Fix test creating diagnostic locally

Check if Xcode version is unsupported
Add function to determine Xcode version based on symlink
2026-10-15 20:05:33 +03:00 · 2026-10-14 10:35:35 +01:00 · 2026-10-14 10:35:35 +01:00 · 2026-10-14 10:35:35 +01:00 · 2026-10-14 10:35:34 +01:00 · 2026-10-14 10:35:34 +01:00
58 changed files with 3768 additions and 2747 deletions
@@ -0,0 +1,119 @@
+# Warning: This file is generated automatically, and should not be modified.
+# Instead, please modify the template in the pr-checks directory and run:
+#     pr-checks/sync.sh
+# to regenerate this file.
+
+name: PR Check - Diagnostic export without database
+env:
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  GO111MODULE: auto
+on:
+  push:
+    branches:
+      - main
+      - releases/v*
+  pull_request: {}
+  merge_group:
+    types:
+      - checks_requested
+  schedule:
+    - cron: '0 5 * * *'
+  workflow_dispatch:
+    inputs: {}
+  workflow_call:
+    inputs: {}
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
+  group: diagnostics-without-db-${{github.ref}}
+jobs:
+  diagnostics-without-db:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: linked
+    name: Diagnostic export without database
+    if: github.triggering_actor != 'dependabot[bot]'
+    permissions:
+      contents: read
+      security-events: read
+    timeout-minutes: 45
+    runs-on: ${{ matrix.os }}
+    steps:
+      # We deliberately need to make this step fail before the database is initialised, but after
+      # some diagnostic has been produced. The simplest way to do that right now is to force the
+      # use of a nightly release and then fail because we are attempting to analyse Swift on
+      # a non-macOS runner.
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 20.x
+          cache: npm
+      - name: Install newer npm
+        run: npm install -g npm@11.19.1
+      - name: Install dependencies
+        run: npm ci
+      - name: Prepare test
+        id: prepare-test
+        uses: ./.github/actions/prepare-test
+        with:
+          version: ${{ matrix.version }}
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
+      - name: Initialise failing analysis
+        id: init
+        uses: ./../action/init
+        continue-on-error: true
+        env:
+          CODEQL_ACTION_FORCE_NIGHTLY: true
+        with:
+          languages: swift
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
+
+      - name: Check diagnostics appear on disk
+        env:
+          SARIF_PATH: '${{ runner.temp }}/codeql-action-temp-diagnostics/'
+        run: |
+          cd ../action
+          npx tsx ./pr-checks/diagnostics-without-db.ts
+    env:
+      CODEQL_ACTION_TEST_MODE: false
+      CODEQL_ACTION_SKIP_SARIF_UPLOAD: true
+      CODEQL_ACTION_TESTING_ENVIRONMENT: codeql-action-pr-checks
+  diagnostics-without-db-validation:
+    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - diagnostics-without-db
+    permissions:
+      contents: read
+      security-events: read
+    timeout-minutes: 5
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 20.x
+          cache: npm
+      - name: Install newer npm
+        run: npm install -g npm@11.19.1
+      - name: Install dependencies
+        run: npm ci
+      - name: Download workflow artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          pattern: test-mode-sarif
+          path: sarif
+
+      - name: List artifact contents
+        run: ls -laR ./sarif
+    env:
+      CODEQL_ACTION_TEST_MODE: true
@@ -14,7 +14,7 @@
      "dependencies": {
        "@actions/artifact": "^5.0.3",
        "@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2",
-        "@actions/cache": "^5.3.0",
+        "@actions/cache": "^5.2.0",
        "@actions/core": "^2.0.3",
        "@actions/exec": "^2.0.0",
        "@actions/github": "^8.0.1",
@@ -23,14 +23,15 @@
        "@actions/io": "^2.0.0",
        "@actions/tool-cache": "^3.0.1",
        "@octokit/core": "^7.0.8",
-        "@octokit/plugin-paginate-rest": "^16.0.0",
+        "@octokit/plugin-paginate-rest": "^15.0.0",
        "@octokit/plugin-rest-endpoint-methods": "^18.0.0",
        "@octokit/plugin-retry": "^8.1.1",
        "archiver": "^8.0.0",
-        "follow-redirects": "^1.16.1",
+        "fast-deep-equal": "^3.1.3",
+        "follow-redirects": "^1.16.0",
        "get-folder-size": "^5.0.0",
        "https-proxy-agent": "^7.0.6",
-        "js-yaml": "^5.4.3",
+        "js-yaml": "^5.4.2",
        "jsonschema": "1.5.0",
        "long": "^5.3.2",
        "node-forge": "^1.4.0",
@@ -57,14 +58,14 @@
        "eslint-import-resolver-typescript": "^4.4.5",
        "eslint-plugin-github": "^6.1.2",
        "eslint-plugin-import-x": "^4.17.1",
-        "eslint-plugin-jsdoc": "^65.2.0",
+        "eslint-plugin-jsdoc": "^65.0.1",
        "eslint-plugin-no-async-foreach": "^0.1.1",
        "glob": "^13.0.6",
-        "globals": "^17.13.0",
+        "globals": "^17.12.0",
        "nock": "^14.0.17",
        "sinon": "^22.1.0",
        "typescript": "^6.0.3",
-        "typescript-eslint": "^8.71.1"
+        "typescript-eslint": "^8.70.1"
      }
    },
    "node_modules/@aashutoshrathi/word-wrap": {
@@ -458,19 +459,19 @@
      }
    },
    "node_modules/@actions/cache": {
-      "version": "5.3.0",
-      "resolved": "https://registry.npmjs.org/@actions/cache/-/cache-5.3.0.tgz",
-      "integrity": "sha512-VqJBlQFt1lpp7op7o/Z0syWywX9cN8TxjFCPjHyGHmXCiczU5NII5ZdEpGpTelUnOGFG2bO7viUx9q3q7WR/Gg==",
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/@actions/cache/-/cache-5.2.0.tgz",
+      "integrity": "sha512-1R1Oc8cuDNCygsIP7gLiKLGCymOw/k5FkGQkXZFcLz6/RWyMImkfP0dZX6kjA9SRAmANcKNocI2XrsIaZ1it8w==",
      "license": "MIT",
      "dependencies": {
-        "@actions/core": "^2.0.3",
+        "@actions/core": "^2.0.0",
        "@actions/exec": "^2.0.0",
        "@actions/glob": "^0.5.1",
        "@actions/http-client": "^3.0.2",
        "@actions/io": "^2.0.0",
        "@azure/abort-controller": "^1.1.0",
-        "@azure/core-rest-pipeline": "^1.25.0",
-        "@azure/storage-blob": "^12.34.0",
+        "@azure/core-rest-pipeline": "^1.22.0",
+        "@azure/storage-blob": "^12.29.1",
        "@protobuf-ts/runtime-rpc": "^2.11.1",
        "semver": "^6.3.1"
      }
@@ -2204,12 +2205,12 @@
      "license": "MIT"
    },
    "node_modules/@octokit/plugin-paginate-rest": {
-      "version": "16.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-16.0.0.tgz",
-      "integrity": "sha512-7RtUeGZypAK4EA4LrjTCnsLALNOoUcYh5vOnCNXpdIQVTQCPh4OFu7324iPqAls3KGgVnZktKUnNKZCOKyHrlA==",
+      "version": "15.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-15.0.0.tgz",
+      "integrity": "sha512-lw9A9YL5s4VPj+VEx8uMxaxQm2YTgrPDkrLEuZuu18R8TK3oPcXF4K6t52nx6xn1RcogZC9i188sAr/4XYJaQQ==",
      "license": "MIT",
      "dependencies": {
-        "@octokit/types": "^18.0.0"
+        "@octokit/types": "^17.0.0"
      },
      "engines": {
        "node": ">= 20"
@@ -2218,6 +2219,21 @@
        "@octokit/core": ">=6"
      }
    },
+    "node_modules/@octokit/plugin-paginate-rest/node_modules/@octokit/openapi-types": {
+      "version": "28.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-28.0.0.tgz",
+      "integrity": "sha512-0rFyLuyHvIj6uuZWuDslxkowFYdPXoNIkeAv4b27dzm2Tf4vGWXnPsMcxs7d65kLdMERgP3wc1AEPlqMz8e1cQ==",
+      "license": "MIT"
+    },
+    "node_modules/@octokit/plugin-paginate-rest/node_modules/@octokit/types": {
+      "version": "17.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-17.0.0.tgz",
+      "integrity": "sha512-ByP1v7YL5SMveFPP7+sj0/ZuWCOOg/Chs4NafOMpq6WNIM/hdGY0S7C0TCGDBWu1aGmOxmUIhMx3cO+IdwYZ1Q==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/openapi-types": "^28.0.0"
+      }
+    },
    "node_modules/@octokit/plugin-request-log": {
      "version": "1.0.4",
      "resolved": "https://registry.npmjs.org/@octokit/plugin-request-log/-/plugin-request-log-1.0.4.tgz",
@@ -2702,17 +2718,17 @@
      "license": "MIT"
    },
    "node_modules/@typescript-eslint/eslint-plugin": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.71.1.tgz",
-      "integrity": "sha512-nNlBf6HuotqMgZvSkWD5hNdemiBIxQ2NmrlgfcUIeZRs+BbakjscCQRq/Hb74EFVnFiSWWdL12JruqwBy3ERDw==",
+      "version": "8.70.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.70.1.tgz",
+      "integrity": "sha512-nDNrUQ/4ruSNYbu749TRY7cfrzPtoLHEXSNBI8aaNY32LlZCajixqRf3FqcKC4p5Cam4VOHYx/t+i5+nKXvrqA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
        "@eslint-community/regexpp": "^4.12.2",
-        "@typescript-eslint/scope-manager": "8.71.1",
-        "@typescript-eslint/type-utils": "8.71.1",
-        "@typescript-eslint/utils": "8.71.1",
-        "@typescript-eslint/visitor-keys": "8.71.1",
+        "@typescript-eslint/scope-manager": "8.70.1",
+        "@typescript-eslint/type-utils": "8.70.1",
+        "@typescript-eslint/utils": "8.70.1",
+        "@typescript-eslint/visitor-keys": "8.70.1",
        "ignore": "^7.0.5",
        "natural-compare": "^1.4.0",
        "ts-api-utils": "^2.5.0"
@@ -2725,7 +2741,7 @@
        "url": "https://opencollective.com/typescript-eslint"
      },
      "peerDependencies": {
-        "@typescript-eslint/parser": "^8.71.1",
+        "@typescript-eslint/parser": "^8.70.1",
        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
        "typescript": ">=4.8.4 <6.1.0"
      }
@@ -2741,16 +2757,16 @@
      }
    },
    "node_modules/@typescript-eslint/parser": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.71.1.tgz",
-      "integrity": "sha512-oM/5sAqz/l1v/zYK1qTOPrn2+JIrBGC1V6uNYucRO5gh6eT9vWJ/RhPbGE59byvZEUQ4VP6XkLBaS5Jti5jpvw==",
+      "version": "8.70.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.70.1.tgz",
+      "integrity": "sha512-nO974WLllwhSFWQXnMLj6nDGa8f0khKEz1JzpPJ1u7Vm/4X1X6ZHajpoknU4bb41vJyMB0HHVyS2GqdhWfIXZw==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/scope-manager": "8.71.1",
-        "@typescript-eslint/types": "8.71.1",
-        "@typescript-eslint/typescript-estree": "8.71.1",
-        "@typescript-eslint/visitor-keys": "8.71.1",
+        "@typescript-eslint/scope-manager": "8.70.1",
+        "@typescript-eslint/types": "8.70.1",
+        "@typescript-eslint/typescript-estree": "8.70.1",
+        "@typescript-eslint/visitor-keys": "8.70.1",
        "debug": "^4.4.3"
      },
      "engines": {
@@ -2784,14 +2800,14 @@
      }
    },
    "node_modules/@typescript-eslint/project-service": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.71.1.tgz",
-      "integrity": "sha512-Oijc9RUsohHjncg6iGi7gCtjnEjYt9FWv9u6ygK8uKcHK5eLjLAkqERQ9BaytbpceOFdk6kifPCS/zAZE+A99g==",
+      "version": "8.70.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.70.1.tgz",
+      "integrity": "sha512-62xOgboPfwc3/IgPSX/W6oQR3ZbF04194FPGUGH8HL8iLFHbt/456/8Ph1wLNUgVF+s94FlHoipBsz+v7+LMnA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/tsconfig-utils": "^8.71.1",
-        "@typescript-eslint/types": "^8.71.1",
+        "@typescript-eslint/tsconfig-utils": "^8.70.1",
+        "@typescript-eslint/types": "^8.70.1",
        "debug": "^4.4.3"
      },
      "engines": {
@@ -2824,14 +2840,14 @@
      }
    },
    "node_modules/@typescript-eslint/scope-manager": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.71.1.tgz",
-      "integrity": "sha512-1YUDZXdTnXLlob03SFHBipdyMBsDVm7zoSz0ytTJ39dk5J1TgsTK03VlR/dLXG/RLLUrPcYbD4rp23BmHxHP0w==",
+      "version": "8.70.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.70.1.tgz",
+      "integrity": "sha512-Pa0EeSeAusQc1WbjQMac+YfenewYTBu0KjgYvkUKwhXaHUKbFog23Dm/rp0DX/6tyYOQ3Xl1a+3EcFNZynGHCw==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/types": "8.71.1",
-        "@typescript-eslint/visitor-keys": "8.71.1"
+        "@typescript-eslint/types": "8.70.1",
+        "@typescript-eslint/visitor-keys": "8.70.1"
      },
      "engines": {
        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -2842,9 +2858,9 @@
      }
    },
    "node_modules/@typescript-eslint/tsconfig-utils": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.71.1.tgz",
-      "integrity": "sha512-oTvkml5SxXhgg+WWKhod5qWQICDXtOB+/Hi9VdPKFAANJ2b7YOgMffgvzXuqog7R6A/JtrzRf128dsxummyWhg==",
+      "version": "8.70.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.70.1.tgz",
+      "integrity": "sha512-jumze1fPI+sDOaM2TWGQdn39PDxTr7TZGeuyLkAbNyx2vtMT3uRnVKChN0hfht5V2TugphJzF6bYXvBcE09qqg==",
      "dev": true,
      "license": "MIT",
      "engines": {
@@ -2859,15 +2875,15 @@
      }
    },
    "node_modules/@typescript-eslint/type-utils": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.71.1.tgz",
-      "integrity": "sha512-kH3t3jZCYv2PZSBEWPKTariLrCaoF1CLoPitYFBJOhAGEwWnSRAtGEifrfrpBa4K9JlwWNZotgA5w3/wLSk/FQ==",
+      "version": "8.70.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.70.1.tgz",
+      "integrity": "sha512-7zKTnyvaVWqzLZHPFQtX1hVHqgkMC+WebPWakNCSyrQVbIP1AM0L0TlBZtACldIRb6PptI8Odk+jyZ5kP3B1VA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/types": "8.71.1",
-        "@typescript-eslint/typescript-estree": "8.71.1",
-        "@typescript-eslint/utils": "8.71.1",
+        "@typescript-eslint/types": "8.70.1",
+        "@typescript-eslint/typescript-estree": "8.70.1",
+        "@typescript-eslint/utils": "8.70.1",
        "debug": "^4.4.3",
        "ts-api-utils": "^2.5.0"
      },
@@ -2902,9 +2918,9 @@
      }
    },
    "node_modules/@typescript-eslint/types": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.71.1.tgz",
-      "integrity": "sha512-ybYnPTUwg3VQQOFEiBPLs8Jxl1ry2vXdn1kVKguomBbvxpetdu3MKTNDqFNUrlG8ylP9MpZosmXMFYlGQHk1oQ==",
+      "version": "8.70.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.70.1.tgz",
+      "integrity": "sha512-Dm1ypdhhrGCTyyehxElhgJ6kgk8MVCv5qXdoOVqPr1uqk42jX8KjrZqhROvdShczA8qrDoYiOWn1ykWlx2k81Q==",
      "dev": true,
      "license": "MIT",
      "engines": {
@@ -2916,16 +2932,16 @@
      }
    },
    "node_modules/@typescript-eslint/typescript-estree": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.71.1.tgz",
-      "integrity": "sha512-pSKSEK1JJpHs6KiKVtABCE4iJK5d7FLFzDXQNBQ2oRY7LEd3UwOt3TZemTgu9syTIf56dJWlTn/pdmrO9oKUXQ==",
+      "version": "8.70.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.70.1.tgz",
+      "integrity": "sha512-TU8PwyGN0PQJUcE96mw8eCQ44SmxGdQlJmlWakHaHQ15eIuuvye5yNtmh/i6oS88jzXVQB71xdNkbkB/fMwL0g==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/project-service": "8.71.1",
-        "@typescript-eslint/tsconfig-utils": "8.71.1",
-        "@typescript-eslint/types": "8.71.1",
-        "@typescript-eslint/visitor-keys": "8.71.1",
+        "@typescript-eslint/project-service": "8.70.1",
+        "@typescript-eslint/tsconfig-utils": "8.70.1",
+        "@typescript-eslint/types": "8.70.1",
+        "@typescript-eslint/visitor-keys": "8.70.1",
        "debug": "^4.4.3",
        "minimatch": "^10.2.2",
        "semver": "^7.7.3",
@@ -3001,16 +3017,16 @@
      }
    },
    "node_modules/@typescript-eslint/utils": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.71.1.tgz",
-      "integrity": "sha512-CBjT6gfAz3DW2j9Q4moFnqt208Aq+506sVGXfpRcyAeqn0EpayL0mjdWoCO2t3RC7GewNrFxdeehuEaPg6DMzQ==",
+      "version": "8.70.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.70.1.tgz",
+      "integrity": "sha512-Esgul8MsnKnRLdYU2Eb2cRV9bS5HJYtKj1ByJnOzzG2M58DGdSUQ1jUuILxipqcpB2h9WLrbD5GijIWUjX/Tqw==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
        "@eslint-community/eslint-utils": "^4.9.1",
-        "@typescript-eslint/scope-manager": "8.71.1",
-        "@typescript-eslint/types": "8.71.1",
-        "@typescript-eslint/typescript-estree": "8.71.1"
+        "@typescript-eslint/scope-manager": "8.70.1",
+        "@typescript-eslint/types": "8.70.1",
+        "@typescript-eslint/typescript-estree": "8.70.1"
      },
      "engines": {
        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -3025,13 +3041,13 @@
      }
    },
    "node_modules/@typescript-eslint/visitor-keys": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.71.1.tgz",
-      "integrity": "sha512-0GxiUGqMU0qXJt58cBsiG3DP8lUmBaFo2vChtUX+CT7PnR3v/VGLLrzVP4K9r1lNiZXjHYefMBbPunplr09v6w==",
+      "version": "8.70.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.70.1.tgz",
+      "integrity": "sha512-Vwj9lUIW5Xq3wQ9w6gv3R86g1hMK8f2zNOdGTAgeXUMMXFK78G9ruCjjqutHMNJc0+CH7LYRnHeUB9IT8wFmcw==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/types": "8.71.1",
+        "@typescript-eslint/types": "8.70.1",
        "eslint-visitor-keys": "^5.0.0"
      },
      "engines": {
@@ -5365,9 +5381,9 @@
      }
    },
    "node_modules/eslint-plugin-jsdoc": {
-      "version": "65.2.0",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-jsdoc/-/eslint-plugin-jsdoc-65.2.0.tgz",
-      "integrity": "sha512-IMZaNwdDa5otUQYGWN1pzywZLsGKswitvFFNhcO8IOsBfaWpWIDXYuZh2sYhe9MNyKN9hz0YryOFaKdpbTP5Bw==",
+      "version": "65.0.1",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-jsdoc/-/eslint-plugin-jsdoc-65.0.1.tgz",
+      "integrity": "sha512-7IvB+ZS71WCw5tGKh6f6D5k55qtXKdrGTnIpQTBKWdpyZ5IfhGHfh0i6ArWlCJ4JEtz22YRk5Bqu1MvbOlpMKQ==",
      "dev": true,
      "license": "BSD-3-Clause",
      "dependencies": {
@@ -5801,7 +5817,6 @@
    },
    "node_modules/fast-deep-equal": {
      "version": "3.1.3",
-      "dev": true,
      "license": "MIT"
    },
    "node_modules/fast-diff": {
@@ -5992,9 +6007,9 @@
      "license": "ISC"
    },
    "node_modules/follow-redirects": {
-      "version": "1.16.1",
-      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.1.tgz",
-      "integrity": "sha512-FNvFGzoMLWmE6Yj9spb/zjd7yiNCHiAW9/Tg9CXrQ8wuu32HtlJOwWO11OJafl5FfY3DxTdQ0vj42zU1kvv5jg==",
+      "version": "1.16.0",
+      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.0.tgz",
+      "integrity": "sha512-y5rN/uOsadFT/JfYwhxRS5R7Qce+g3zG97+JrtFZlC9klX/W5hD7iiLzScI4nZqUS7DNUdhPgw4xI8W2LuXlUw==",
      "funding": [
        {
          "type": "individual",
@@ -6278,9 +6293,9 @@
      }
    },
    "node_modules/globals": {
-      "version": "17.13.0",
-      "resolved": "https://registry.npmjs.org/globals/-/globals-17.13.0.tgz",
-      "integrity": "sha512-RwMTC61u7hrG3ZJMkZQOK4JLJrKS8QtoTii63EmWvFXHqycY9FObBJQCbsLxSO8kjKhWE5kV1GC+Vb1g3RI0Zg==",
+      "version": "17.12.0",
+      "resolved": "https://registry.npmjs.org/globals/-/globals-17.12.0.tgz",
+      "integrity": "sha512-cezEd/DTyyht9cvSSURyygXPfy04GtWO/5e6ZPvH7fCtjKz9PYOmuawphw1Ctd1f6C+5JypXfGD7ahNMXvevBA==",
      "dev": true,
      "license": "MIT",
      "engines": {
@@ -7121,9 +7136,9 @@
      }
    },
    "node_modules/js-yaml": {
-      "version": "5.4.3",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.4.3.tgz",
-      "integrity": "sha512-yzzNtgczwgoVHNigCyKTXcQJU4Y8t/ikU4UxXW0BvrLfHTGWZhsNcOT2s/a7vn81/4KqVnNmHjaUEPlvWnNwVw==",
+      "version": "5.4.2",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.4.2.tgz",
+      "integrity": "sha512-m+aqu+LwO1O6sIopafj8HUVl5aawITwZQe/yHpMCKjaWBaA/d07B/QdMb3529REftiU+RMMHL3Vlsw3hON7vWg==",
      "funding": [
        {
          "type": "github",
@@ -7479,9 +7494,9 @@
      }
    },
    "node_modules/mdast-util-from-markdown": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/mdast-util-from-markdown/-/mdast-util-from-markdown-2.1.0.tgz",
-      "integrity": "sha512-KRLgmPaP2H1ul2bpoJkOS+9pAcDAAj9Nu1mqLnh8NLeJG5tlvj42TH80PIGBpROWlRXLk0lDrWNuZCFy/tsB4A==",
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/mdast-util-from-markdown/-/mdast-util-from-markdown-2.0.3.tgz",
+      "integrity": "sha512-W4mAWTvSlKvf8L6J+VN9yLSqQ9AOAAvHuoDAmPkz4dHf553m5gVj2ejadHJhoJmcmxEnOv6Pa8XJhpxE93kb8Q==",
      "license": "MIT",
      "dependencies": {
        "@types/mdast": "^4.0.0",
@@ -9981,16 +9996,16 @@
      }
    },
    "node_modules/typescript-eslint": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.71.1.tgz",
-      "integrity": "sha512-oiNVPC3/NbV1FpaHU07l8O6ynqG9v4PAiW2WvTrAmZdR0f2HI/gE668ElMLCK7Xbsu5k2fK5C4fXNiq05j7/nQ==",
+      "version": "8.70.1",
+      "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.70.1.tgz",
+      "integrity": "sha512-AcWG7KDjZ2THNXsgwttMaGmzVi0VFRlFYfqFHYQRbDpF3owuYbuiL8c7UUrd2k8s3PoSfIQrWfrGXfcElrWLYA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/eslint-plugin": "8.71.1",
-        "@typescript-eslint/parser": "8.71.1",
-        "@typescript-eslint/typescript-estree": "8.71.1",
-        "@typescript-eslint/utils": "8.71.1"
+        "@typescript-eslint/eslint-plugin": "8.70.1",
+        "@typescript-eslint/parser": "8.70.1",
+        "@typescript-eslint/typescript-estree": "8.70.1",
+        "@typescript-eslint/utils": "8.70.1"
      },
      "engines": {
        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -10485,10 +10500,10 @@
        "@actions/core": "^2.0.3",
        "@actions/github": "^8.0.1",
        "@octokit/core": "^7.0.8",
-        "@octokit/plugin-paginate-rest": ">=16.0.0",
+        "@octokit/plugin-paginate-rest": ">=15.0.0",
        "@octokit/plugin-rest-endpoint-methods": "^18.0.0",
        "lite-matter": "^0.1.2",
-        "mdast-util-from-markdown": "^2.1.0",
+        "mdast-util-from-markdown": "^2.0.3",
        "semver": "^7.8.5",
        "yaml": "^2.9.1"
      },
@@ -22,7 +22,7 @@
  "dependencies": {
    "@actions/artifact": "^5.0.3",
    "@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2",
-    "@actions/cache": "^5.3.0",
+    "@actions/cache": "^5.2.0",
    "@actions/core": "^2.0.3",
    "@actions/exec": "^2.0.0",
    "@actions/github": "^8.0.1",
@@ -31,14 +31,15 @@
    "@actions/io": "^2.0.0",
    "@actions/tool-cache": "^3.0.1",
    "@octokit/core": "^7.0.8",
-    "@octokit/plugin-paginate-rest": "^16.0.0",
+    "@octokit/plugin-paginate-rest": "^15.0.0",
    "@octokit/plugin-rest-endpoint-methods": "^18.0.0",
    "@octokit/plugin-retry": "^8.1.1",
    "archiver": "^8.0.0",
-    "follow-redirects": "^1.16.1",
+    "fast-deep-equal": "^3.1.3",
+    "follow-redirects": "^1.16.0",
    "get-folder-size": "^5.0.0",
    "https-proxy-agent": "^7.0.6",
-    "js-yaml": "^5.4.3",
+    "js-yaml": "^5.4.2",
    "jsonschema": "1.5.0",
    "long": "^5.3.2",
    "node-forge": "^1.4.0",
@@ -65,14 +66,14 @@
    "eslint-import-resolver-typescript": "^4.4.5",
    "eslint-plugin-github": "^6.1.2",
    "eslint-plugin-import-x": "^4.17.1",
-    "eslint-plugin-jsdoc": "^65.2.0",
+    "eslint-plugin-jsdoc": "^65.0.1",
    "eslint-plugin-no-async-foreach": "^0.1.1",
    "glob": "^13.0.6",
-    "globals": "^17.13.0",
+    "globals": "^17.12.0",
    "nock": "^14.0.17",
    "sinon": "^22.1.0",
    "typescript": "^6.0.3",
-    "typescript-eslint": "^8.71.1"
+    "typescript-eslint": "^8.70.1"
  },
  "overrides": {
    "@actions/tool-cache": {
@@ -0,0 +1,49 @@
+name: "Diagnostic export without database"
+description: "Tests that temporary diagnostics are correctly included in the failed SARIF."
+versions:
+  # Overridden by the FF below.
+  - linked
+installNode: true
+
+env:
+  # Allow the failed SARIF file to be generated.
+  CODEQL_ACTION_TEST_MODE: false
+  # But don't actually upload it.
+  CODEQL_ACTION_SKIP_SARIF_UPLOAD: true
+  # Mark telemetry for this workflow so it can be treated separately.
+  CODEQL_ACTION_TESTING_ENVIRONMENT: codeql-action-pr-checks
+
+steps:
+  # We deliberately need to make this step fail before the database is initialised, but after
+  # some diagnostic has been produced. The simplest way to do that right now is to force the
+  # use of a nightly release and then fail because we are attempting to analyse Swift on
+  # a non-macOS runner.
+  - name: Initialise failing analysis
+    id: init
+    uses: ./../action/init
+    continue-on-error: true
+    env:
+      CODEQL_ACTION_FORCE_NIGHTLY: true
+    with:
+      languages: swift
+      tools: ${{ steps.prepare-test.outputs.tools-url }}
+
+  - name: Check diagnostics appear on disk
+    env:
+      SARIF_PATH: "${{ runner.temp }}/codeql-action-temp-diagnostics/"
+    run: |
+      cd ../action
+      npx tsx ./pr-checks/diagnostics-without-db.ts
+validationJobs:
+  diagnostics-without-db-validation:
+    checkout: true
+    installNode: true
+    steps:
+      - name: Download workflow artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          pattern: test-mode-sarif
+          path: sarif
+
+      - name: List artifact contents
+        run: ls -laR ./sarif
@@ -0,0 +1,48 @@
+import * as fs from "fs";
+import * as path from "path";
+
+import * as core from "@actions/core";
+
+import type * as diagnostics from "../src/diagnostics";
+
+const DIAGNOSTIC_ID = "codeql-action/forced-nightly-cli";
+const sarifDirectory = process.env["SARIF_PATH"];
+
+if (sarifDirectory === undefined) {
+  throw new Error("SARIF_PATH is undefined.");
+}
+
+const paths = fs
+  .readdirSync(sarifDirectory, {
+    recursive: true,
+    encoding: "utf-8",
+  })
+  .filter((p) => p.endsWith(".json"));
+
+core.info(`Found ${paths.length} paths in '${sarifDirectory}'.`);
+core.info(`Searching for a diagnostic with id '${DIAGNOSTIC_ID}'...`);
+
+let found = false;
+for (const diagnosticPath of paths) {
+  if (path.extname(diagnosticPath) !== ".json") {
+    core.info(`Skipping ${diagnosticPath}.`);
+    continue;
+  }
+  core.info(`Found ${diagnosticPath}.`);
+
+  const contents = JSON.parse(
+    fs.readFileSync(path.resolve(sarifDirectory, diagnosticPath), "utf-8"),
+  ) as diagnostics.DiagnosticMessage;
+
+  if (contents.source.id === DIAGNOSTIC_ID) {
+    core.info(
+      `Found '${DIAGNOSTIC_ID}' in '${diagnosticPath}'. Skipping remaining files.`,
+    );
+    found = true;
+    break;
+  }
+}
+
+if (!found) {
+  throw new Error(`Didn't find '${DIAGNOSTIC_ID}' diagnostic.`);
+}
@@ -6,10 +6,10 @@
    "@actions/core": "^2.0.3",
    "@actions/github": "^8.0.1",
    "@octokit/core": "^7.0.8",
-    "@octokit/plugin-paginate-rest": ">=16.0.0",
+    "@octokit/plugin-paginate-rest": ">=15.0.0",
    "@octokit/plugin-rest-endpoint-methods": "^18.0.0",
    "lite-matter": "^0.1.2",
-    "mdast-util-from-markdown": "^2.1.0",
+    "mdast-util-from-markdown": "^2.0.3",
    "semver": "^7.8.5",
    "yaml": "^2.9.1"
  },
@@ -90,7 +90,7 @@ interface Specification extends JobSpecification {
  services?: any;

  /** Additional jobs to run after the main PR check job. */
-  validationJobs?: Record<string, JobSpecification>;
+  validationJobs?: Record<string, ValidationJobSpecification>;

  /** If set, this check is part of a named collection that gets its own caller workflow. */
  collection?: string;
@@ -122,6 +122,10 @@ interface JobSpecification {
  installYq?: boolean;
 }

+type ValidationJobSpecification = JobSpecification & {
+  checkout?: boolean;
+};
+
 /** Describes language/framework-specific steps and inputs. */
 interface LanguageSetup {
  specProperty: keyof JobSpecification;
@@ -462,6 +466,20 @@ function generateJobMatrix(
  return matrix;
 }

+/**
+ * Gets the `actions/checkout` step.
+ */
+function getCheckoutStep(): Step {
+  return {
+    name: "Check out repository",
+    uses: pinnedUses(
+      "actions/checkout",
+      "3d3c42e5aac5ba805825da76410c181273ba90b1",
+      "v7.0.1",
+    ),
+  };
+}
+
 /**
 * Retrieves setup steps and additional input definitions based on specific languages or frameworks
 * that are requested by the `checkSpecification`.
@@ -531,14 +549,7 @@ function generateJob(

  // Construct the workflow steps needed for this check.
  const steps: Step[] = [
-    {
-      name: "Check out repository",
-      uses: pinnedUses(
-        "actions/checkout",
-        "3d3c42e5aac5ba805825da76410c181273ba90b1",
-        "v7.0.1",
-      ),
-    },
+    getCheckoutStep(),
    ...setupInfo.steps,
    {
      name: "Prepare test",
@@ -609,13 +620,16 @@ function generateJob(
 /** Generates a validation job. */
 function generateValidationJob(
  specDocument: yaml.Document,
-  jobSpecification: JobSpecification,
+  jobSpecification: ValidationJobSpecification,
  checkName: string,
  name: string,
 ) {
  // Determine which languages or frameworks have to be installed.
  const { inputs, steps } = getSetupSteps(jobSpecification);

+  // Construct a checkout step if requested.
+  const checkoutStep = jobSpecification.checkout ? [getCheckoutStep()] : [];
+
  // Extract the sequence of steps from the YAML document to persist as much formatting as possible.
  const specSteps = specDocument.getIn([
    "validationJobs",
@@ -624,7 +638,7 @@ function generateValidationJob(
  ]) as yaml.YAMLSeq;

  // Add the generated steps in front of the ones from the specification.
-  specSteps.items.unshift(...steps);
+  specSteps.items.unshift(...checkoutStep, ...steps);

  const validationJob: Record<string, any> = {
    name: jobSpecification.name,
@@ -635,7 +649,7 @@ function generateValidationJob(
      "security-events": "read",
    },
    "timeout-minutes": 5,
-    "runs-on": "ubuntu-slim",
+    "runs-on": "ubuntu-latest",
    steps: specSteps,
  };

@@ -1,3 +1,5 @@
+import * as os from "os";
+
 import * as core from "@actions/core";

 import { ActionsEnv, getActionsEnv } from "./actions-util";
@@ -13,6 +15,8 @@ import {
 } from "./status-report";
 import { getEnv, getErrorMessage, wrapError } from "./util";

+export type { Logger } from "./logging";
+
 /** Base state that is available to an Action on startup. */
 export interface BaseState {
  /** The name of the Action. */
@@ -23,6 +27,8 @@ export interface BaseState {
  platform: NodeJS.Platform;
  /** The architecture of the host. */
  arch: NodeJS.Architecture;
+  /** The version of the operating system. */
+  osRelease: string;
 }

 /** Describes different state features that an Action may have. */
@@ -173,6 +179,7 @@ export async function runInActions(action: Action) {
      startedAt,
      platform: process.platform,
      arch: process.arch,
+      osRelease: os.release(),
      logger,
      env,
      actions: actionsEnv,
@@ -72,7 +72,7 @@ export const getOptionalInput = function (name: string): string | undefined {
 * directory that has been set in `CODEQL_ACTION_TEMP` by e.g. a previous step, or the
 * value of `RUNNER_TEMP` otherwise.
 */
-export function getTemporaryDirectory(env: Env = getEnv()): string {
+export function getTemporaryDirectory(env: ReadOnlyEnv = getEnv()): string {
  return (
    env.getOptional(EnvVar.TEMP) ?? env.getRequired(ActionsEnvVars.RUNNER_TEMP)
  );
@@ -93,7 +93,7 @@ export function getActionVersion(): string {
 *
 * This will be "dynamic" for default setup workflow runs.
 */
-export function getWorkflowEventName(env: ReadOnlyEnv = getEnv()) {
+export function getWorkflowEventName(env: Env = getEnv()) {
  return env.getRequired(ActionsEnvVars.GITHUB_EVENT_NAME);
 }

@@ -101,7 +101,7 @@ export function getWorkflowEventName(env: ReadOnlyEnv = getEnv()) {
 * Returns whether the current workflow is executing a local copy of the Action, e.g. we're running
 * a workflow on the codeql-action repo itself.
 */
-export function isRunningLocalAction(env: ReadOnlyEnv = getEnv()): boolean {
+export function isRunningLocalAction(env: Env = getEnv()): boolean {
  const relativeScriptPath = getRelativeScriptPath(env);
  return (
    relativeScriptPath.startsWith("..") || path.isAbsolute(relativeScriptPath)
@@ -113,14 +113,14 @@ export function isRunningLocalAction(env: ReadOnlyEnv = getEnv()): boolean {
 *
 * This can be used to get the Action's name or tell if we're running a local Action.
 */
-function getRelativeScriptPath(env: ReadOnlyEnv): string {
+function getRelativeScriptPath(env: Env): string {
  const runnerTemp = env.getRequired(ActionsEnvVars.RUNNER_TEMP);
  const actionsDirectory = path.join(path.dirname(runnerTemp), "_actions");
  return path.relative(actionsDirectory, __filename);
 }

 /** Returns the contents of `GITHUB_EVENT_PATH` as a JSON object. */
-export function getWorkflowEvent(env: ReadOnlyEnv = getEnv()): any {
+export function getWorkflowEvent(env: Env = getEnv()): any {
  const eventJsonFile = env.getRequired(ActionsEnvVars.GITHUB_EVENT_PATH);
  try {
    return JSON.parse(fs.readFileSync(eventJsonFile, "utf-8"));
@@ -45,7 +45,6 @@ test.serial(
      requiredInputStub.withArgs("token").returns("fake-token");
      requiredInputStub.withArgs("upload-database").returns("false");
      requiredInputStub.withArgs("output").returns("out");
-      requiredInputStub.withArgs("checkout_path").returns("");
      const optionalInputStub = sinon.stub(actionsUtil, "getOptionalInput");
      optionalInputStub.withArgs("expect-error").returns("false");
      sinon.stub(api, "getGitHubVersion").resolves(gitHubVersion);
@@ -105,7 +104,6 @@ test.serial(
      requiredInputStub.withArgs("token").returns("fake-token");
      requiredInputStub.withArgs("upload-database").returns("false");
      requiredInputStub.withArgs("output").returns("out");
-      requiredInputStub.withArgs("checkout_path").returns("");
      const optionalInputStub = sinon.stub(actionsUtil, "getOptionalInput");
      optionalInputStub.withArgs("expect-error").returns("false");
      sinon.stub(api, "getGitHubVersion").resolves(gitHubVersion);
@@ -4,18 +4,12 @@ import { performance } from "perf_hooks";

 import * as core from "@actions/core";

-import {
-  Action,
-  ActionState,
-  extendActionState,
-  runInActions,
-} from "./action-common";
+import { Action, ActionState, runInActions } from "./action-common";
 import * as actionsUtil from "./actions-util";
 import * as analyses from "./analyses";
 import {
  CodeQLAnalysisError,
  dbIsFinalized,
-  determineCheckoutPath,
  QueriesStatusReport,
  runFinalize,
  runQueries,
@@ -218,11 +212,14 @@ async function runAutobuildIfLegacyGoWorkflow(config: Config, logger: Logger) {
  await runAutobuild(config, BuiltInLanguage.go, logger);
 }

-async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) {
+async function run({
+  startedAt,
+  env,
+  logger,
+  actions,
+}: ActionState<["Base", "Env", "Logger", "Actions"]>) {
  // To capture errors appropriately, keep as much code within the try-catch as
  // possible, and only use safe functions outside.
-  const startedAt = action.startedAt;
-  const logger = action.logger;

  let uploadResults:
    | Partial<Record<analyses.AnalysisKind, UploadResult>>
@@ -280,7 +277,7 @@ async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) {

    const apiDetails = getApiDetails();
    const outputDir = actionsUtil.getRequiredInput("output");
-    action.env.export(EnvVar.SARIF_RESULTS_OUTPUT_DIR, outputDir);
+    env.export(EnvVar.SARIF_RESULTS_OUTPUT_DIR, outputDir);
    const threads = util.getThreadsFlag(
      actionsUtil.getOptionalInput("threads") || process.env["CODEQL_THREADS"],
      logger,
@@ -304,7 +301,7 @@ async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) {
      logger,
    );

-    const checkoutPath = await determineCheckoutPath(action, config);
+    const checkoutPath = actions.getRequiredInput("checkout_path");

    // Setup diff informed analysis if needed (based on whether init created the file)
    const diffRangePackDir = await setupDiffInformedQueryRun(
@@ -396,13 +393,11 @@ async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) {
      checkoutPath,
    );

-    const actionWithFeatures = extendActionState(action, { features });
-
    // Possibly upload the database bundles for remote queries.
    // Note: Take care with the ordering of this call since databases may be cleaned up
    // at the `overlay` or `clear` level.
    databaseUploadResults = await cleanupAndUploadDatabases(
-      actionWithFeatures,
+      { logger, features },
      repositoryNwo,
      codeql,
      config,
@@ -451,7 +446,7 @@ async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) {
        `expect-error input was set to true but no error was thrown.`,
      );
    }
-    action.env.export(EnvVar.ANALYZE_DID_COMPLETE_SUCCESSFULLY, "true");
+    env.export(EnvVar.ANALYZE_DID_COMPLETE_SUCCESSFULLY, "true");
  } catch (unwrappedError) {
    const error = util.wrapError(unwrappedError);
    if (
@@ -10,12 +10,10 @@ import {
  resolveQuerySuiteAlias,
  addSarifExtension,
  diffRangeExtensionPackContents,
-  determineCheckoutPath,
 } from "./analyze";
 import { createStubCodeQL } from "./codeql";
 import { defaultSuites } from "./config/db-config";
 import { Feature } from "./feature-flags";
-import * as gitUtils from "./git-utils";
 import { BuiltInLanguage } from "./languages";
 import { getRunnerLogger } from "./logging";
 import {
@@ -23,98 +21,12 @@ import {
  setupActionsVars,
  createFeatures,
  createTestConfig,
-  callee,
 } from "./testing-utils";
 import * as uploadLib from "./upload-lib";
 import * as util from "./util";

 setupTests(test);

-test.serial(
-  "determineCheckoutPath - logs when checkout_path is not in a work tree",
-  async (t) => {
-    const expectedPath = path.resolve("/checkout/path");
-    const target = callee(determineCheckoutPath)
-      .withActions((actions) => {
-        sinon
-          .stub(actions, "getRequiredInput")
-          .withArgs("checkout_path")
-          .returns(expectedPath);
-      })
-      .withArgs(createTestConfig({}));
-    sinon.stub(gitUtils, "getGitRoot").resolves(undefined);
-
-    await target
-      .logs(t, "is not in the work tree of a git repository")
-      .passes(t.is, expectedPath);
-  },
-);
-
-test.serial(
-  "determineCheckoutPath - logs when checkout_path is not a repo root",
-  async (t) => {
-    const expectedPath = path.resolve("/checkout/path");
-    const target = callee(determineCheckoutPath)
-      .withActions((actions) => {
-        sinon
-          .stub(actions, "getRequiredInput")
-          .withArgs("checkout_path")
-          .returns(expectedPath);
-      })
-      .withArgs(createTestConfig({}));
-    sinon.stub(gitUtils, "getGitRoot").resolves("/checkout");
-
-    await target
-      .logs(t, "is not the root of the repository")
-      .passes(t.is, expectedPath);
-  },
-);
-
-test.serial(
-  "determineCheckoutPath - logs when checkout_path is not the same as repo root in config",
-  async (t) => {
-    const expectedPath = path.resolve("/checkout/path");
-    const target = callee(determineCheckoutPath)
-      .withActions((actions) => {
-        sinon
-          .stub(actions, "getRequiredInput")
-          .withArgs("checkout_path")
-          .returns(expectedPath);
-      })
-      .withArgs(createTestConfig({ repositoryRoot: "/some/other/path" }));
-    sinon.stub(gitUtils, "getGitRoot").resolves(expectedPath);
-
-    await target
-      .logs(t, "does not match that found by the 'codeql-action/init' step")
-      .passes(t.is, expectedPath);
-  },
-);
-
-test.serial(
-  "determineCheckoutPath - doesn't log any of the messages when all is as expected",
-  async (t) => {
-    const expectedPath = path.resolve("/checkout/path");
-    const target = callee(determineCheckoutPath)
-      .withActions((actions) => {
-        sinon
-          .stub(actions, "getRequiredInput")
-          .withArgs("checkout_path")
-          .returns(expectedPath);
-      })
-      .withArgs(createTestConfig({ repositoryRoot: expectedPath }));
-    sinon.stub(gitUtils, "getGitRoot").resolves(expectedPath);
-
-    await target
-      .notLogs(
-        t,
-        "is not in the work tree of a git repository",
-        "is not the root of the repository",
-        "does not match that found by the 'codeql-action/init' step",
-      )
-      .passes(t.is, expectedPath);
-  },
-);
-
 /**
 * Checks the status report produced by the analyze Action.
 *
@@ -5,7 +5,6 @@ import { performance } from "perf_hooks";
 import * as io from "@actions/io";
 import * as yaml from "js-yaml";

-import type { ActionState } from "./action-common";
 import { getTemporaryDirectory } from "./actions-util";
 import * as analyses from "./analyses";
 import { setupCppAutobuild } from "./autobuild";
@@ -24,7 +23,6 @@ import {
 } from "./diff-informed-analysis-utils";
 import { EnvVar } from "./environment";
 import { FeatureEnablement, Feature } from "./feature-flags";
-import { getGitRoot } from "./git-utils";
 import { BuiltInLanguage, Language } from "./languages";
 import { Logger, withGroupAsync } from "./logging";
 import { OverlayDatabaseMode } from "./overlay/overlay-database-mode";
@@ -89,58 +87,6 @@ export interface QueriesStatusReport
  event_reports?: EventReport[];
 }

-/**
- * Determines the path at which the repository being analysed is checked out at.
- * Returns the value of the required `checkout_path` input and validates that it
- * refers to the root of a repository.
- *
- * @param action The action state.
- * @param config The CodeQL Action configuration state.
- */
-export async function determineCheckoutPath(
-  action: ActionState<["Logger", "Actions"]>,
-  config: configUtils.Config,
-) {
-  const checkoutPathInput = action.actions.getRequiredInput("checkout_path");
-
-  // Try to obtain the root path of the repository and validate that it matches the input.
-  const absCheckoutPathInput = path.resolve(checkoutPathInput);
-  const repositoryRoot = await getGitRoot(absCheckoutPathInput);
-
-  if (repositoryRoot === undefined) {
-    action.logger.warning(
-      [
-        `The directory at '${absCheckoutPathInput}' is not in the work tree of a git repository.`,
-        "If the repository being analyzed is checked out elsewhere,",
-        "you must explicitly set the 'checkout_path' input for the 'codeql-action/analyze' step to",
-        "the checkout path.",
-      ].join(" "),
-    );
-  } else if (repositoryRoot !== absCheckoutPathInput) {
-    action.logger.warning(
-      [
-        `The directory at '${absCheckoutPathInput}' is not the root of the repository ('${repositoryRoot}').`,
-        "Set the 'checkout_path' input for the 'codeql-action/analyze' step to the root path of the checkout.",
-      ].join(" "),
-    );
-  } else if (
-    config.repositoryRoot !== undefined &&
-    repositoryRoot !== config.repositoryRoot
-  ) {
-    // The repository root that was persisted by the `init` step doesn't match the one we have found here.
-    action.logger.warning(
-      [
-        `The repository path at '${repositoryRoot}' does not match that found by the 'codeql-action/init' step: '${config.repositoryRoot}'.`,
-        "Ensure that the 'checkout_path' input for the 'codeql-action/analyze' step is set to the path of the same repository that",
-        "the 'codeql-action/init' step determined. This is either the GitHub Actions workspace or the repository root corresponding to",
-        "the 'source-root' input if that was provided.",
-      ].join(" "),
-    );
-  }
-
-  return absCheckoutPathInput;
-}
-
 async function setupPythonExtractor(logger: Logger) {
  const codeqlPython = process.env["CODEQL_PYTHON"];
  if (codeqlPython === undefined || codeqlPython.length === 0) {
@@ -2,7 +2,7 @@ import * as fs from "fs";
 import path from "path";

 import { getTemporaryDirectory } from "../actions-util";
-import { Env } from "../environment";
+import { ReadOnlyEnv } from "../environment";
 import * as json from "../json";
 import { Logger } from "../logging";

@@ -51,7 +51,7 @@ export function resetCachedCodeQlVersion(): void {
 * Returns the path to the temporary file that backs the
 * on-disk cache of CLI responses between workflow steps.
 */
-export function getCommandCacheFilePath(env: Env): string {
+export function getCommandCacheFilePath(env: ReadOnlyEnv): string {
  return path.join(getTemporaryDirectory(env), COMMAND_CACHE_FILENAME);
 }

@@ -18,7 +18,7 @@ import { CliError, wrapCliConfigurationError } from "./cli-errors";
 import type { ActionConfig } from "./config/action-config";
 import { appendExtraQueryExclusions, type Config } from "./config-utils";
 import { DocUrl } from "./doc-url";
-import { EnvVar, getEnv, exportEnvVar } from "./environment";
+import { EnvVar, getEnv, exportEnvVar, Env, ReadOnlyEnv } from "./environment";
 import {
  CodeQLDefaultVersionInfo,
  Feature,
@@ -199,6 +199,7 @@ export interface CodeQL {
    sarifFile: string,
    automationDetailsId: string | undefined,
    config: ActionConfig<"tempDir">,
+    diagnosticDir: string | undefined,
  ): Promise<void>;
  /** Get the location of an extractor for the specified language. */
  resolveExtractor(language: Language): Promise<string>;
@@ -494,8 +495,9 @@ export function createStubCodeQL(partialCodeql: Partial<CodeQL>): CodeQL {
 export async function getCodeQLForTesting(
  cmd = "codeql-for-testing",
  logger: Logger = getRunnerLogger(true),
+  env: Env = getEnv(),
 ): Promise<CodeQL> {
-  return getCodeQLForCmd(logger, cmd, false);
+  return getCodeQLForCmd(logger, cmd, false, env);
 }

 /**
@@ -510,13 +512,14 @@ async function getCodeQLForCmd(
  logger: Logger,
  cmd: string,
  checkVersion: boolean,
+  env: Env = getEnv(),
 ): Promise<CodeQL> {
  const codeql: CodeQL = {
    getPath() {
      return cmd;
    },
    async getVersion() {
-      const cacheFilePath = outputCache.getCommandCacheFilePath(getEnv());
+      const cacheFilePath = outputCache.getCommandCacheFilePath(env);
      let result = outputCache.getCachedCodeQlVersion(
        logger,
        cacheFilePath,
@@ -642,7 +645,7 @@ async function getCodeQLForCmd(
      }
    },
    async runAutobuild(config: Config, language: Language) {
-      applyAutobuildAzurePipelinesTimeoutFix();
+      applyAutobuildAzurePipelinesTimeoutFix(env);

      const autobuildCmd = path.join(
        await this.resolveExtractor(language),
@@ -652,8 +655,11 @@ async function getCodeQLForCmd(

      // Bump the verbosity of the autobuild command if we're in debug mode
      if (config.debugMode) {
-        process.env[EnvVar.CLI_VERBOSITY] =
-          process.env[EnvVar.CLI_VERBOSITY] || EXTRACTION_DEBUG_MODE_VERBOSITY;
+        env.set(
+          EnvVar.CLI_VERBOSITY,
+          env.getOptional(EnvVar.CLI_VERBOSITY) ??
+            EXTRACTION_DEBUG_MODE_VERBOSITY,
+        );
      }

      // On macOS, System Integrity Protection (SIP) typically interferes with
@@ -685,7 +691,7 @@ async function getCodeQLForCmd(
    },
    async extractUsingBuildMode(config: Config, language: Language) {
      if (config.buildMode === BuildMode.Autobuild) {
-        applyAutobuildAzurePipelinesTimeoutFix();
+        applyAutobuildAzurePipelinesTimeoutFix(env);
      }
      try {
        await runCli(cmd, [
@@ -817,7 +823,7 @@ async function getCodeQLForCmd(
        "--sarif-group-rules-by-pack",
        "--sarif-include-query-help=always",
        "--sublanguage-file-coverage",
-        ...(await getJobRunUuidSarifOptions()),
+        ...(await getJobRunUuidSarifOptions(env)),
        ...getExtraOptionsFromEnv(["database", "interpret-results"]),
      ];
      if (sarifRunPropertyFlag !== undefined) {
@@ -915,6 +921,7 @@ async function getCodeQLForCmd(
      sarifFile: string,
      automationDetailsId: string | undefined,
      config: ActionConfig<"tempDir">,
+      diagnosticDir: string | undefined,
    ): Promise<void> {
      const args = [
        "diagnostics",
@@ -924,6 +931,9 @@ async function getCodeQLForCmd(
        `--sarif-codescanning-config=${getGeneratedCodeScanningConfigPath(
          config,
        )}`,
+        ...(diagnosticDir !== undefined
+          ? [`--diagnostic-dir=${diagnosticDir}`]
+          : []),
        ...getExtraOptionsFromEnv(["diagnostics", "export"]),
      ];
      if (automationDetailsId !== undefined) {
@@ -1037,7 +1047,7 @@ async function getCodeQLForCmd(
    );
  } else if (
    checkVersion &&
-    process.env[EnvVar.SUPPRESS_DEPRECATED_SOON_WARNING] !== "true" &&
+    env.getOptional(EnvVar.SUPPRESS_DEPRECATED_SOON_WARNING) !== "true" &&
    !(await util.codeQlVersionAtLeast(codeql, CODEQL_NEXT_MINIMUM_VERSION))
  ) {
    const result = await codeql.getVersion();
@@ -1225,7 +1235,7 @@ export async function getTrapCachingExtractorConfigArgsForLang(
 ): Promise<string[]> {
  const cacheDir = config.trapCaches[language];
  if (cacheDir === undefined) return [];
-  const write = await isAnalyzingDefaultBranch(getEnv(), config.repositoryRoot);
+  const write = await isAnalyzingDefaultBranch();
  return [
    `-O=${language}.trap.cache.dir=${cacheDir}`,
    `-O=${language}.trap.cache.bound=${TRAP_CACHE_SIZE_MB}`,
@@ -1259,17 +1269,20 @@ function getExtractionVerbosityArguments(
 * Without the fix, long build processes will timeout when pulling down Java packages
 * https://developercommunity.visualstudio.com/content/problem/292284/maven-hosted-agent-connection-timeout.html
 */
-function applyAutobuildAzurePipelinesTimeoutFix() {
-  const javaToolOptions = process.env["JAVA_TOOL_OPTIONS"] || "";
-  process.env["JAVA_TOOL_OPTIONS"] = [
-    ...javaToolOptions.split(/\s+/),
-    "-Dhttp.keepAlive=false",
-    "-Dmaven.wagon.http.pool=false",
-  ].join(" ");
+function applyAutobuildAzurePipelinesTimeoutFix(env: Env) {
+  const javaToolOptions = env.getOptional("JAVA_TOOL_OPTIONS") ?? "";
+  env.set(
+    "JAVA_TOOL_OPTIONS",
+    [
+      ...javaToolOptions.split(/\s+/),
+      "-Dhttp.keepAlive=false",
+      "-Dmaven.wagon.http.pool=false",
+    ].join(" "),
+  );
 }

-async function getJobRunUuidSarifOptions() {
-  const jobRunUuid = process.env[EnvVar.JOB_RUN_UUID];
+async function getJobRunUuidSarifOptions(env: ReadOnlyEnv) {
+  const jobRunUuid = env.getOptional(EnvVar.JOB_RUN_UUID);

  return jobRunUuid ? [`--sarif-run-property=jobRunUuid=${jobRunUuid}`] : [];
 }
@@ -172,7 +172,6 @@ test.serial("load empty config", async (t) => {
      createTestInitConfigInputs({
        languagesInput: languages,
        repository: { owner: "github", repo: "example" },
-        sourceRoot: tempDir,
        tempDir,
        codeql,
        logger,
@@ -187,7 +186,6 @@ test.serial("load empty config", async (t) => {
        logger,
      }),
      {},
-      undefined,
    );

    t.deepEqual(config, expectedConfig);
@@ -218,7 +216,6 @@ test.serial("load code quality config", async (t) => {
        analysisKinds: [AnalysisKind.CodeQuality],
        languagesInput: languages,
        repository: { owner: "github", repo: "example" },
-        sourceRoot: tempDir,
        tempDir,
        codeql,
        logger,
@@ -299,7 +296,6 @@ test.serial(
            analysisKinds: [AnalysisKind.CodeQuality],
            languagesInput: languages,
            repository: { owner: "github", repo: "example" },
-            sourceRoot: tempDir,
            tempDir,
            codeql,
            repositoryProperties,
@@ -522,7 +518,6 @@ test.serial("load non-empty input", async (t) => {
    // And the config we expect it to parse to
    const expectedConfig = createTestConfig({
      languages: [BuiltInLanguage.javascript],
-      repositoryRoot: undefined,
      buildMode: BuildMode.None,
      originalUserInput: userConfig,
      computedConfig: userConfig,
@@ -543,7 +538,6 @@ test.serial("load non-empty input", async (t) => {
      state,
      createTestInitConfigInputs({
        languagesInput,
-        sourceRoot: tempDir,
        buildModeInput: "none",
        configFile: configFilePath,
        debugArtifactName: "my-artifact",
@@ -1111,6 +1105,11 @@ const checkOverlayEnablementMacro = makeMacro({
            return lang === BuiltInLanguage.java;
          });

+        // Mock git root detection
+        if (setup.gitRoot !== undefined) {
+          sinon.stub(gitUtils, "getGitRoot").resolves(setup.gitRoot);
+        }
+
        // Mock submodule detection
        sinon.stub(gitUtils, "hasSubmodules").returns(setup.hasSubmodules);

@@ -1123,7 +1122,6 @@ const checkOverlayEnablementMacro = makeMacro({
          codeql,
          features,
          setup.languages,
-          setup.gitRoot, // repositoryRoot
          tempDir, // sourceRoot
          setup.buildMode,
          undefined,
@@ -49,7 +49,7 @@ import {
  makeTelemetryDiagnostic,
 } from "./diagnostics";
 import { prepareDiffInformedAnalysis } from "./diff-informed-analysis-utils";
-import { EnvVar, exportEnvVar, getEnv } from "./environment";
+import { EnvVar, exportEnvVar } from "./environment";
 import * as errorMessages from "./error-messages";
 import { Feature, FeatureEnablement, FeatureWithoutCLI } from "./feature-flags";
 import {
@@ -390,7 +390,6 @@ export async function initActionState(
    enableFileCoverageInformation,
  }: InitConfigInputs,
  userConfig: UserConfig,
-  repositoryRoot: string | undefined,
 ): Promise<Config> {
  const languages = await getLanguages(
    codeql,
@@ -442,7 +441,6 @@ export async function initActionState(

  return {
    version: getActionVersion(),
-    repositoryRoot,
    analysisKinds,
    languages,
    buildMode,
@@ -472,18 +470,12 @@ async function downloadCacheWithTime(
  codeQL: CodeQL,
  languages: Language[],
  logger: Logger,
-  repositoryRoot: string | undefined,
 ): Promise<{
  trapCaches: { [language: string]: string };
  trapCacheDownloadTime: number;
 }> {
  const start = performance.now();
-  const trapCaches = await downloadTrapCaches(
-    codeQL,
-    languages,
-    logger,
-    repositoryRoot,
-  );
+  const trapCaches = await downloadTrapCaches(codeQL, languages, logger);
  const trapCacheDownloadTime = performance.now() - start;
  return { trapCaches, trapCacheDownloadTime };
 }
@@ -731,7 +723,6 @@ export async function checkOverlayEnablement(
  codeql: CodeQL,
  features: FeatureEnablement,
  languages: Language[],
-  repositoryRoot: string | undefined,
  sourceRoot: string,
  buildMode: BuildMode | undefined,
  ramInput: string | undefined,
@@ -761,7 +752,6 @@ export async function checkOverlayEnablement(
      true,
      codeql,
      languages,
-      repositoryRoot,
      sourceRoot,
      buildMode,
      gitVersion,
@@ -835,7 +825,7 @@ export async function checkOverlayEnablement(
      `Setting overlay database mode to ${overlayDatabaseMode} ` +
        "with caching because we are analyzing a pull request.",
    );
-  } else if (await isAnalyzingDefaultBranch(getEnv(), repositoryRoot)) {
+  } else if (await isAnalyzingDefaultBranch()) {
    overlayDatabaseMode = OverlayDatabaseMode.OverlayBase;
    logger.info(
      `Setting overlay database mode to ${overlayDatabaseMode} ` +
@@ -851,7 +841,6 @@ export async function checkOverlayEnablement(
    false,
    codeql,
    languages,
-    repositoryRoot,
    sourceRoot,
    buildMode,
    gitVersion,
@@ -871,7 +860,6 @@ async function validateOverlayDatabaseMode(
  overlayModeSetExplicitly: boolean,
  codeql: CodeQL,
  languages: Language[],
-  repositoryRoot: string | undefined,
  sourceRoot: string,
  buildMode: BuildMode | undefined,
  gitVersion: GitVersionInfo | undefined,
@@ -907,7 +895,8 @@ async function validateOverlayDatabaseMode(
    );
    return new Failure(OverlayDisabledReason.IncompatibleCodeQl);
  }
-  if (repositoryRoot === undefined) {
+  const gitRoot = await getGitRoot(sourceRoot);
+  if (gitRoot === undefined) {
    logger.warning(
      `Cannot build an ${overlayDatabaseMode} database because ` +
        `the source root "${sourceRoot}" is not inside a git repository. ` +
@@ -915,7 +904,7 @@ async function validateOverlayDatabaseMode(
    );
    return new Failure(OverlayDisabledReason.NoGitRoot);
  }
-  if (hasSubmodules(repositoryRoot)) {
+  if (hasSubmodules(gitRoot)) {
    if (gitVersion === undefined) {
      logger.warning(
        `Cannot build an ${overlayDatabaseMode} database because ` +
@@ -1167,11 +1156,9 @@ export async function initConfig(
  const { logger, features } = actionState;
  const { tempDir } = inputs;

-  const repositoryRoot = await getGitRoot(inputs.sourceRoot);
-
  const userConfig = await determineUserConfig(actionState, tempDir, inputs);

-  const config = await initActionState(inputs, userConfig, repositoryRoot);
+  const config = await initActionState(inputs, userConfig);

  // If Code Quality analysis is the only enabled analysis kind, then we will initialise
  // the database for Code Quality. That entails disabling the default queries and only
@@ -1253,7 +1240,6 @@ export async function initConfig(
    inputs.codeql,
    inputs.features,
    config.languages,
-    repositoryRoot,
    inputs.sourceRoot,
    config.buildMode,
    inputs.ramInput,
@@ -1307,7 +1293,6 @@ export async function initConfig(
      inputs.codeql,
      config.languages,
      logger,
-      repositoryRoot,
    );
    config.trapCaches = trapCaches;
    config.trapCacheDownloadTime = trapCacheDownloadTime;
@@ -16,11 +16,6 @@ export interface Config {
   * The version of the CodeQL Action that the configuration is for.
   */
  version: string;
-  /**
-   * The path at which the repository being analysed is checked out at, if available.
-   * Persisted in the CodeQL Action configuration state, so that we can consult it in later workflow steps.
-   */
-  repositoryRoot: string | undefined;
  /**
   * Set of analysis kinds that are enabled.
   */
@@ -9,8 +9,9 @@ import {
  LoggedMessage,
  makeMacro,
  RecordingLogger,
+  setupActionsVars,
 } from "../testing-utils";
-import { ConfigurationError, prettyPrintPack } from "../util";
+import { ConfigurationError, prettyPrintPack, withTmpDir } from "../util";

 import * as dbConfig from "./db-config";

@@ -562,69 +563,84 @@ test("mergeDefaultSetupAndUserConfigs - keeps other properties from user-supplie
  t.deepEqual(result, configFile);
 });

-test("mergeDefaultSetupAndUserConfigs - ignores, but warns about, unknown keys from Default Setup", async (t) => {
-  const logger = new RecordingLogger();
-  const configFile: dbConfig.UserConfig = {
-    "query-filters": [{ exclude: { a: "b" } }],
-    "paths-ignore": ["path"],
-  };
+test.serial(
+  "mergeDefaultSetupAndUserConfigs - ignores, but warns about, unknown keys from Default Setup",
+  async (t) => {
+    const logger = new RecordingLogger();
+    const configFile: dbConfig.UserConfig = {
+      "query-filters": [{ exclude: { a: "b" } }],
+      "paths-ignore": ["path"],
+    };

-  const result = dbConfig.mergeDefaultSetupAndUserConfigs(
-    logger,
-    {
-      "default-setup": {
-        borg: [],
-        org: {
-          unknown: "foo",
-          "model-packs": [],
+    await withTmpDir(async (tmpDir) => {
+      setupActionsVars(tmpDir, tmpDir);
+      const result = dbConfig.mergeDefaultSetupAndUserConfigs(
+        logger,
+        {
+          "default-setup": {
+            borg: [],
+            org: {
+              unknown: "foo",
+              "model-packs": [],
+            },
+          } as unknown as dbConfig.DefaultSetupConfig,
+          "paths-ignore": ["other-path"],
        },
-      } as unknown as dbConfig.DefaultSetupConfig,
-      "paths-ignore": ["other-path"],
-    },
-    configFile,
-  );
+        configFile,
+      );

-  t.deepEqual(result, {
-    ...configFile,
-    "default-setup": { org: { "model-packs": [] } },
-  });
+      t.deepEqual(result, {
+        ...configFile,
+        "default-setup": { org: { "model-packs": [] } },
+      });

-  const expectedUnrecognisedKeys = [
-    ".default-setup.org.unknown",
-    ".default-setup.borg",
-    ".paths-ignore",
-  ].join(", ");
-  checkExpectedLogMessages(t, logger.messages, [
-    `Unrecognised keys in Default Setup configuration: ${expectedUnrecognisedKeys}`,
-  ]);
-});
+      const expectedUnrecognisedKeys = [
+        ".default-setup.org.unknown",
+        ".default-setup.borg",
+        ".paths-ignore",
+      ].join(", ");
+      checkExpectedLogMessages(t, logger.messages, [
+        `Unrecognised keys in Default Setup configuration: ${expectedUnrecognisedKeys}`,
+      ]);
+    });
+  },
+);

-test("mergeDefaultSetupAndUserConfigs - warns about invalid keys from Default Setup", async (t) => {
-  const logger = new RecordingLogger();
-  const configFile: dbConfig.UserConfig = {};
+test.serial(
+  "mergeDefaultSetupAndUserConfigs - warns about invalid keys from Default Setup",
+  async (t) => {
+    const logger = new RecordingLogger();
+    const configFile: dbConfig.UserConfig = {};

-  const result = dbConfig.mergeDefaultSetupAndUserConfigs(
-    logger,
-    {
-      "default-setup": {
-        org: {
-          "model-packs": [123],
+    await withTmpDir(async (tmpDir) => {
+      setupActionsVars(tmpDir, tmpDir);
+
+      const result = dbConfig.mergeDefaultSetupAndUserConfigs(
+        logger,
+        {
+          "default-setup": {
+            org: {
+              "model-packs": [123],
+            },
+          } as unknown as dbConfig.DefaultSetupConfig,
        },
-      } as unknown as dbConfig.DefaultSetupConfig,
-    },
-    configFile,
-  );
+        configFile,
+      );

-  t.deepEqual(result, {
-    ...configFile,
-    "default-setup": { org: { "model-packs": [123] } },
-  });
+      t.deepEqual(result, {
+        ...configFile,
+        "default-setup": { org: { "model-packs": [123] } },
+      });

-  const expectedInvalidKeys = [".default-setup.org.model-packs[0]"].join(", ");
-  checkExpectedLogMessages(t, logger.messages, [
-    `Invalid keys in Default Setup configuration: ${expectedInvalidKeys}`,
-  ]);
-});
+      const expectedInvalidKeys = [".default-setup.org.model-packs[0]"].join(
+        ", ",
+      );
+      checkExpectedLogMessages(t, logger.messages, [
+        `Invalid keys in Default Setup configuration: ${expectedInvalidKeys}`,
+      ]);
+    });
+  },
+);

 /** Parses `contents` as a configuration without validating it. */
 function parseUnvalidatedConfig(contents: string): dbConfig.UserConfig {
@@ -46,7 +46,7 @@ export interface DatabaseUploadResult {
 }

 export async function cleanupAndUploadDatabases(
-  action: ActionState<["ReadOnlyEnv", "Logger", "FeatureFlags"]>,
+  action: ActionState<["Logger", "FeatureFlags"]>,
  repositoryNwo: RepositoryNwo,
  codeql: CodeQL,
  config: Config,
@@ -81,7 +81,7 @@ export async function cleanupAndUploadDatabases(
    return [];
  }

-  if (!(await gitUtils.isAnalyzingDefaultBranch(action.env, checkoutPath))) {
+  if (!(await gitUtils.isAnalyzingDefaultBranch())) {
    // We only want to upload a database if we are analyzing the default branch.
    logger.debug("Not analyzing default branch. Skipping upload.");
    return [];
@@ -113,7 +113,7 @@ export async function cleanupAndUploadDatabases(
        includeDiagnostics: false,
      });
      bundledDbSize = fs.statSync(bundledDb).size;
-      const commitOid = await gitUtils.getCommitOid(action.env, checkoutPath);
+      const commitOid = await gitUtils.getCommitOid(checkoutPath);
      // Upload with manual retry logic. We disable Octokit's built-in retries
      // because the request body is a ReadStream, which can only be consumed
      // once.
@@ -313,7 +313,6 @@ export async function downloadDependencyCaches(

    const primaryKey = await cacheKey(codeql, features, language, patterns);
    const restoreKeys: string[] = [
-      primaryKey,
      await cachePrefix(codeql, features, language),
    ];

@@ -0,0 +1,111 @@
+import * as fs from "fs";
+import path from "path";
+
+import test, { type ExecutionContext } from "ava";
+
+import * as diagnostics from "./diagnostics";
+import { BuiltInLanguage } from "./languages";
+import {
+  checkExpectedLogMessages,
+  createTestConfig,
+  initAllState,
+  RecordingLogger,
+  setupTests,
+} from "./testing-utils";
+import { withTmpDir } from "./util";
+
+setupTests(test);
+
+const id = "codeql-action/test-diagnostic";
+const name = "Test title";
+
+test("makeDiagnostic - adds expected properties", (t) => {
+  const diagnostic = diagnostics.makeDiagnostic(id, name, {});
+
+  t.truthy(diagnostic.timestamp);
+  t.is(diagnostic.source.id, id);
+  t.is(diagnostic.source.name, name);
+});
+
+/**
+ * Diagnostic files that are written to disk don't have deterministic names.
+ * This function recursively finds all `.json` files at {@link rootPath},
+ * asserts that there is exactly one, and that it matches {@link expected}.
+ *
+ * @param rootPath The path to start searching from.
+ */
+function assertSingleDiagnosticIn(
+  t: ExecutionContext<unknown>,
+  rootPath: string,
+  expected: diagnostics.DiagnosticMessage,
+) {
+  // Find all `.json` files in `rootPath` and check that there is exactly one.
+  const filePaths = fs
+    .readdirSync(rootPath, {
+      recursive: true,
+      encoding: "utf-8",
+    })
+    .filter((p) => p.endsWith(".json"));
+
+  t.is(filePaths.length, 1);
+
+  // Check that the written diagnostic matches the one we added.
+  const contents = fs.readFileSync(
+    path.resolve(rootPath, filePaths[0]),
+    "utf-8",
+  );
+
+  const readDiagnostic = JSON.parse(contents) as diagnostics.DiagnosticMessage;
+  t.deepEqual(readDiagnostic, expected);
+}
+
+test("addDiagnostic writes temporary diagnostics and flushDiagnostics moves them to the database", async (t) =>
+  withTmpDir(async (tmpDir) => {
+    const logger = new RecordingLogger();
+
+    const tempDiagDir = path.resolve(tmpDir, "temp");
+    const testDbDir = path.resolve(tmpDir, "test", "database");
+    const diagnostic = diagnostics.makeDiagnostic(id, name, {});
+
+    // Write the diagnostic. The path provided for `dbLocation` doesn't exist,
+    // so the diagnostic will be written to a temporary location.
+    t.notThrows(() => {
+      diagnostics.addDiagnostic(
+        createTestConfig({ tempDir: tempDiagDir, dbLocation: testDbDir }),
+        BuiltInLanguage.actions,
+        diagnostic,
+        logger,
+      );
+    });
+
+    // Check that `tempDiagDir` was created.
+    t.true(fs.existsSync(tempDiagDir));
+
+    // Check that the diagnostic exists under `tempDiagDir`.
+    assertSingleDiagnosticIn(t, tempDiagDir, diagnostic);
+
+    // Flush the diagnostics. This will cause the diagnostic we wrote previously to
+    // be moved to a location under `dbLocation`.
+    t.notThrows(() => {
+      diagnostics.flushDiagnostics(
+        initAllState({ logger }),
+        createTestConfig({
+          tempDir: tempDiagDir,
+          dbLocation: testDbDir,
+        }),
+      );
+    });
+
+    // Check that `testDbDir` was created.
+    t.true(fs.existsSync(testDbDir));
+
+    // Check that the diagnostic exists under `testDbDir`.
+    assertSingleDiagnosticIn(t, testDbDir, diagnostic);
+
+    // Check that we logged that the database directory doesn't exist yet
+    // and that we moved one diagnostic.
+    checkExpectedLogMessages(t, logger.messages, [
+      `but the database at ${path.join(testDbDir, "actions")} does not exist yet`,
+      "Moving 1 diagnostic(s) to their respective databases.",
+    ]);
+  }));
@@ -1,10 +1,16 @@
-import { existsSync, mkdirSync, writeFileSync } from "fs";
+import * as fs from "fs";
 import path from "path";

+import type { ActionState } from "./action-common";
+import { getTemporaryDirectory } from "./actions-util";
 import type { Config } from "./config-utils";
 import { Language } from "./languages";
-import { getActionsLogger } from "./logging";
-import { getCodeQLDatabasePath } from "./util";
+import { getActionsLogger, type Logger } from "./logging";
+import {
+  getCodeQLDatabasePath,
+  getErrorMessage,
+  isErrnoException,
+} from "./util";

 /**
 * Known tags for diagnostics. There is currently only "internal-error",
@@ -84,22 +90,16 @@ export type DiagnosticMessage = DiagnosticMessageOptions & {
  source: DiagnosticSource;
 };

-/** Represents a diagnostic message that has not yet been written to the database. */
-interface UnwrittenDiagnostic {
-  /** The diagnostic message that has not yet been written. */
-  diagnostic: DiagnosticMessage;
-  /** The language the diagnostic is for. */
-  language: Language;
+/** Represents a diagnostic message that has not yet been saved to the database. */
+interface TemporaryDiagnostic {
+  /** The path to which the diagnostic has temporarily been written to. */
+  path: string;
+  /** The language the diagnostic is for, if any. */
+  language?: Language;
 }

-/** A list of diagnostics which have not yet been written to disk. */
-let unwrittenDiagnostics: UnwrittenDiagnostic[] = [];
-
-/**
- * A list of diagnostics which have not yet been written to disk,
- * and where the language does not matter.
- */
-let unwrittenDefaultLanguageDiagnostics: DiagnosticMessage[] = [];
+/** A list of diagnostics which have not yet been saved to the database. */
+let temporaryDiagnostics: TemporaryDiagnostic[] = [];

 /**
 * Counter used to generate a unique suffix for each diagnostic filename, so that
@@ -128,6 +128,29 @@ export function makeDiagnostic(
  };
 }

+/**
+ * Gets a path relative to {@link tmpDir} where diagnostics for {@link language}
+ * can temporarily be stored at before the database is initialised. If {@link language}
+ * is `undefined`, then the common base path for all languages relative to {@link tmpDir}
+ * is returned.
+ */
+export function getTempDiagnosticPath(tmpDir: string, language?: Language) {
+  const root = path.join(tmpDir, "codeql-action-temp-diagnostics");
+  return getDiagnosticsPath(root, language);
+}
+
+/**
+ * Gets a path relative to {@link basePath} where diagnostics for {@link language}
+ * should be stored at. If {@link language} is `undefined`, then {@link basePath}
+ * is returned instead.
+ */
+export function getDiagnosticsPath(basePath: string, language?: Language) {
+  if (language !== undefined) {
+    return path.resolve(basePath, language, "diagnostic", "codeql-action");
+  }
+  return basePath;
+}
+
 /**
 * Adds the given diagnostic to the database. If the database does not yet exist,
 * the diagnostic will be written to it once it has been created.
@@ -140,22 +163,23 @@ export function addDiagnostic(
  config: Config,
  language: Language,
  diagnostic: DiagnosticMessage,
+  logger: Logger = getActionsLogger(),
 ) {
-  const logger = getActionsLogger();
  const databasePath = language
    ? getCodeQLDatabasePath(config, language)
    : config.dbLocation;

  // Check that the database exists before writing to it. If the database does not yet exist,
  // store the diagnostic in memory and write it later.
-  if (existsSync(databasePath)) {
-    writeDiagnostic(config, language, diagnostic);
+  if (fs.existsSync(databasePath)) {
+    writeDiagnostic({ logger }, config, language, diagnostic);
  } else {
    logger.debug(
      `Writing a diagnostic for ${language}, but the database at ${databasePath} does not exist yet.`,
    );

-    unwrittenDiagnostics.push({ diagnostic, language });
+    // Write the diagnostic to a temporary location.
+    writeTemporaryDiagnosticFile(logger, config.tempDir, language, diagnostic);
  }
 }

@@ -163,6 +187,7 @@ export function addDiagnostic(
 export function addNoLanguageDiagnostic(
  config: Config | undefined,
  diagnostic: DiagnosticMessage,
+  logger: Logger = getActionsLogger(),
 ) {
  if (config !== undefined) {
    addDiagnostic(
@@ -173,10 +198,82 @@ export function addNoLanguageDiagnostic(
      diagnostic,
    );
  } else {
-    unwrittenDefaultLanguageDiagnostics.push(diagnostic);
+    logger.debug(
+      `Writing a diagnostic not associated with any language, but we have no configuration to tell us where the database is yet.`,
+    );
+
+    // Write the diagnostic to a temporary location.
+    writeTemporaryDiagnosticFile(
+      logger,
+      getTemporaryDirectory(),
+      undefined,
+      diagnostic,
+    );
  }
 }

+/**
+ * Writes {@link diagnostic} for an optional {@link language} to a subdirectory of {@link tempDir}
+ * and tracks it as a diagnostic that was written to a temporary location.
+ */
+function writeTemporaryDiagnosticFile(
+  logger: Logger,
+  tempDir: string,
+  language: Language | undefined,
+  diagnostic: DiagnosticMessage,
+) {
+  const tempDiagnosticsPath = getTempDiagnosticPath(tempDir, language);
+
+  try {
+    // Write the diagnostic to a temporary location.
+    const diagnosticPath = writeDiagnosticFile(tempDiagnosticsPath, diagnostic);
+
+    // Track the temporary file.
+    temporaryDiagnostics.push({ path: diagnosticPath, language });
+  } catch (err) {
+    logger.warning(
+      `Unable to write temporary diagnostic to '${tempDiagnosticsPath}': ${getErrorMessage(err)}\n\n${JSON.stringify(diagnostic)}`,
+    );
+  }
+}
+
+/**
+ * Writes {@link diagnostic} to a file in {@link diagnosticsPath}.
+ */
+function writeDiagnosticFile(
+  diagnosticsPath: string,
+  diagnostic: DiagnosticMessage,
+): string {
+  // Create the directory if it doesn't exist yet.
+  fs.mkdirSync(diagnosticsPath, { recursive: true });
+
+  // Include a monotonically increasing suffix to avoid filename collisions
+  // between diagnostics produced within the same millisecond.
+  const uniqueSuffix = (diagnosticCounter++).toString();
+  // We should only need to remove colons, but to be defensive, only allow a restricted set of
+  // characters.
+  const sanitizedTimestamp = diagnostic.timestamp.replace(
+    /[^a-zA-Z0-9.-]/g,
+    "",
+  );
+  const jsonPath = path.resolve(
+    diagnosticsPath,
+    `codeql-action-${sanitizedTimestamp}-${uniqueSuffix}.json`,
+  );
+
+  fs.writeFileSync(jsonPath, JSON.stringify(diagnostic));
+
+  return jsonPath;
+}
+
+/** Gets the path where diagnostics for {@link language} should be stored in the database. */
+export function getDatabaseDiagnosticsPath(
+  config: Config,
+  language: Language | undefined,
+) {
+  return getDiagnosticsPath(config.dbLocation, language);
+}
+
 /**
 * Writes the given diagnostic to the database.
 *
@@ -185,78 +282,85 @@ export function addNoLanguageDiagnostic(
 * @param diagnostic The diagnostic message to add to the database.
 */
 function writeDiagnostic(
+  action: ActionState<["Logger"]>,
  config: Config,
  language: Language | undefined,
  diagnostic: DiagnosticMessage,
 ) {
-  const logger = getActionsLogger();
-  const databasePath = language
-    ? getCodeQLDatabasePath(config, language)
-    : config.dbLocation;
-  const diagnosticsPath = path.resolve(
-    databasePath,
-    "diagnostic",
-    "codeql-action",
-  );
+  const diagnosticsPath = getDatabaseDiagnosticsPath(config, language);

  try {
-    // Create the directory if it doesn't exist yet.
-    mkdirSync(diagnosticsPath, { recursive: true });
-
-    // Include a monotonically increasing suffix to avoid filename collisions
-    // between diagnostics produced within the same millisecond.
-    const uniqueSuffix = (diagnosticCounter++).toString();
-    // We should only need to remove colons, but to be defensive, only allow a restricted set of
-    // characters.
-    const sanitizedTimestamp = diagnostic.timestamp.replace(
-      /[^a-zA-Z0-9.-]/g,
-      "",
-    );
-    const jsonPath = path.resolve(
-      diagnosticsPath,
-      `codeql-action-${sanitizedTimestamp}-${uniqueSuffix}.json`,
-    );
-
-    writeFileSync(jsonPath, JSON.stringify(diagnostic));
+    writeDiagnosticFile(diagnosticsPath, diagnostic);
  } catch (err) {
-    logger.warning(`Unable to write diagnostic message to database: ${err}`);
-    logger.debug(JSON.stringify(diagnostic));
+    action.logger.warning(
+      `Unable to write diagnostic message to database: ${err}`,
+    );
+    action.logger.debug(JSON.stringify(diagnostic));
  }
 }

-/** Report if there are unwritten diagnostics and write them to the log. */
-export function logUnwrittenDiagnostics() {
-  const logger = getActionsLogger();
-  const num = unwrittenDiagnostics.length;
+/** Report if there are temporary diagnostics and write them to the log. */
+export function logTemporaryDiagnostics(action: ActionState<["Logger"]>) {
+  const num = temporaryDiagnostics.length;
+
  if (num > 0) {
-    logger.warning(
+    action.logger.warning(
      `${num} diagnostic(s) could not be written to the database and will not appear on the Tool Status Page.`,
    );

-    for (const unwritten of unwrittenDiagnostics) {
-      logger.debug(JSON.stringify(unwritten.diagnostic));
+    for (const temporary of temporaryDiagnostics) {
+      action.logger.debug(fs.readFileSync(temporary.path, "utf-8"));
    }
  }
 }

-/** Writes all unwritten diagnostics to disk. */
-export function flushDiagnostics(config: Config) {
-  const logger = getActionsLogger();
+/** Relocates all temporary diagnostics to the respective databases. */
+export function flushDiagnostics(
+  action: ActionState<["Logger"]>,
+  config: Config,
+) {
+  const diagnosticsCount = temporaryDiagnostics.length;
+  action.logger.debug(
+    `Moving ${diagnosticsCount} diagnostic(s) to their respective databases.`,
+  );

-  const diagnosticsCount =
-    unwrittenDiagnostics.length + unwrittenDefaultLanguageDiagnostics.length;
-  logger.debug(`Writing ${diagnosticsCount} diagnostic(s) to database.`);
+  const failedFlushDiagnostics: TemporaryDiagnostic[] = [];
+  for (const temporary of temporaryDiagnostics) {
+    // If `temporary.language` is `undefined`, then we didn't have a `config` at the time that
+    // `addNoLanguageDiagnostic` was called. In that case, we arbitrarily choose the first
+    // configured language here like we would have done in `addNoLanguageDiagnostic`.
+    const directory = getDatabaseDiagnosticsPath(
+      config,
+      temporary.language ?? config.languages[0],
+    );
+    const filename = path.basename(temporary.path);
+    const destination = path.join(directory, filename);

-  for (const unwritten of unwrittenDiagnostics) {
-    writeDiagnostic(config, unwritten.language, unwritten.diagnostic);
-  }
-  for (const unwritten of unwrittenDefaultLanguageDiagnostics) {
-    addNoLanguageDiagnostic(config, unwritten);
+    try {
+      fs.mkdirSync(directory, { recursive: true });
+      try {
+        fs.renameSync(temporary.path, destination);
+      } catch (renameErr: unknown) {
+        // Rethrow the error if it isn't an EXDEV one.
+        if (!isErrnoException(renameErr) || renameErr.code !== "EXDEV") {
+          throw renameErr;
+        }
+
+        // The error was an EXDEV one: try to copy the file and delete the temporary one.
+        fs.copyFileSync(temporary.path, destination);
+        fs.unlinkSync(temporary.path);
+      }
+    } catch (err) {
+      action.logger.warning(
+        `Failed to relocate '${temporary.path}' to '${destination}': ${getErrorMessage(err)}`,
+      );
+
+      failedFlushDiagnostics.push(temporary);
+    }
  }

-  // Reset the unwritten diagnostics arrays.
-  unwrittenDiagnostics = [];
-  unwrittenDefaultLanguageDiagnostics = [];
+  // Reset the temporary diagnostics arrays.
+  temporaryDiagnostics = failedFlushDiagnostics;
 }

 /**
@@ -346,13 +346,6 @@ export class Env<
    this.changed = true;
  }

-  /** Sets all environment variables given by `vars`. */
-  public setAll(vars: Record<string, T>): void {
-    for (const [key, val] of Object.entries(vars)) {
-      this.set(key, val);
-    }
-  }
-
  /**
   * Wrapper around `core.exportVariable` which does not call `core.exportVariable`
   * when running unit tests. This is important, because otherwise `core.exportVariable`
@@ -170,6 +170,8 @@ export enum Feature {
   */
  PerLanguageBundles = "per_language_bundles_v2",
  QaTelemetryEnabled = "qa_telemetry_enabled",
+  /** Whether we should fail early if we detect that traced Swift analysis is unsupported. */
+  SwiftSkipUnsupportedTracedAnalysis = "swift_skip_unsupported_traced_analysis",
  /** Routes (some) API requests through the registry proxy. */
  ProxyApiRequests = "proxy_api_requests",
  /** Note that this currently only disables baseline file coverage information. */
@@ -466,6 +468,11 @@ export const featureConfig = {
    envVar: "CODEQL_ACTION_START_PROXY_USE_FEATURES_RELEASE",
    minimumVersion: undefined,
  },
+  [Feature.SwiftSkipUnsupportedTracedAnalysis]: {
+    defaultValue: false,
+    envVar: "CODEQL_ACTION_SWIFT_SKIP_UNSUPPORTED_TRACED_ANALYSIS",
+    minimumVersion: undefined,
+  },
  [Feature.ToolsRepositoryProperty]: {
    defaultValue: false,
    envVar: "CODEQL_ACTION_TOOLS_REPOSITORY_PROPERTY",
@@ -7,42 +7,35 @@ import test from "ava";
 import * as sinon from "sinon";

 import * as actionsUtil from "./actions-util";
-import { ActionsEnvVars, EnvVar } from "./environment";
 import * as gitUtils from "./git-utils";
-import { getTestEnv, setupActionsVars, setupTests } from "./testing-utils";
+import { setupActionsVars, setupTests } from "./testing-utils";
 import { withTmpDir } from "./util";

 setupTests(test);

-test("getRef() throws on the empty string", async (t) => {
-  const env = getTestEnv({ [ActionsEnvVars.GITHUB_REF]: "" });
-  await t.throwsAsync(() => gitUtils.getRef(env, ""));
+test.serial("getRef() throws on the empty string", async (t) => {
+  process.env["GITHUB_REF"] = "";
+  await t.throwsAsync(gitUtils.getRef);
 });

 test.serial(
  "getRef() returns merge PR ref if GITHUB_SHA still checked out",
  async (t) => {
    await withTmpDir(async (tmpDir: string) => {
+      setupActionsVars(tmpDir, tmpDir);
      const expectedRef = "refs/pull/1/merge";
      const currentSha = "a".repeat(40);
-
-      const env = getTestEnv();
-      setupActionsVars(tmpDir, tmpDir, {}, env);
-      env.setAll({
-        [ActionsEnvVars.GITHUB_REF]: expectedRef,
-        [ActionsEnvVars.GITHUB_SHA]: currentSha,
-      });
+      process.env["GITHUB_REF"] = expectedRef;
+      process.env["GITHUB_SHA"] = currentSha;

      const callback = sinon.stub(gitUtils, "getCommitOid");
-      callback
-        .withArgs(sinon.match.any, sinon.match.string, "HEAD")
-        .resolves(currentSha);
+      callback.withArgs(sinon.match.string, "HEAD").resolves(currentSha);

-      const actualRef = await gitUtils.getRef(env, tmpDir);
+      const actualRef = await gitUtils.getRef();
      t.deepEqual(actualRef, expectedRef);

      t.is(callback.callCount, 1);
-      t.true(callback.calledOnceWith(env, tmpDir, "HEAD"));
+      t.true(callback.calledOnceWith(tmpDir, "HEAD"));
    });
  },
 );
@@ -51,33 +44,24 @@ test.serial(
  "getRef() returns merge PR ref if GITHUB_REF still checked out but sha has changed (actions checkout@v1)",
  async (t) => {
    await withTmpDir(async (tmpDir: string) => {
+      setupActionsVars(tmpDir, tmpDir);
      const expectedRef = "refs/pull/1/merge";
-      const env = getTestEnv();
-      setupActionsVars(tmpDir, tmpDir, {}, env);
-      env.setAll({
-        [ActionsEnvVars.GITHUB_REF]: expectedRef,
-        [ActionsEnvVars.GITHUB_SHA]: "b".repeat(40),
-      });
+      process.env["GITHUB_REF"] = expectedRef;
+      process.env["GITHUB_SHA"] = "b".repeat(40);
      const sha = "a".repeat(40);

      const callback = sinon.stub(gitUtils, "getCommitOid");
      callback
-        .withArgs(
-          sinon.match.any,
-          sinon.match.string,
-          "refs/remotes/pull/1/merge",
-        )
-        .resolves(sha);
-      callback
-        .withArgs(sinon.match.any, sinon.match.string, "HEAD")
+        .withArgs(sinon.match.string, "refs/remotes/pull/1/merge")
        .resolves(sha);
+      callback.withArgs(sinon.match.any, "HEAD").resolves(sha);

-      const actualRef = await gitUtils.getRef(env, tmpDir);
+      const actualRef = await gitUtils.getRef();
      t.deepEqual(actualRef, expectedRef);

      t.is(callback.callCount, 2);
-      t.true(callback.calledWith(env, tmpDir, "HEAD"));
-      t.true(callback.calledWith(env, tmpDir, "refs/remotes/pull/1/merge"));
+      t.true(callback.calledWith(tmpDir, "HEAD"));
+      t.true(callback.calledWith(tmpDir, "refs/remotes/pull/1/merge"));
    });
  },
 );
@@ -86,28 +70,23 @@ test.serial(
  "getRef() returns head PR ref if GITHUB_REF no longer checked out",
  async (t) => {
    await withTmpDir(async (tmpDir: string) => {
-      const env = getTestEnv();
-      setupActionsVars(tmpDir, tmpDir, {}, env);
-      env.setAll({
-        [ActionsEnvVars.GITHUB_REF]: "refs/pull/1/merge",
-        [ActionsEnvVars.GITHUB_SHA]: "a".repeat(40),
-      });
+      setupActionsVars(tmpDir, tmpDir);
+      process.env["GITHUB_REF"] = "refs/pull/1/merge";
+      process.env["GITHUB_SHA"] = "a".repeat(40);

      const callback = sinon.stub(gitUtils, "getCommitOid");
      callback
-        .withArgs(sinon.match.any, tmpDir, "refs/remotes/pull/1/merge")
+        .withArgs(tmpDir, "refs/remotes/pull/1/merge")
        .resolves("a".repeat(40));
-      callback
-        .withArgs(sinon.match.any, tmpDir, "HEAD")
-        .resolves("b".repeat(40));
+      callback.withArgs(tmpDir, "HEAD").resolves("b".repeat(40));
      callback.throws(new Error("Unexpected getCommitOid call in test."));

-      const actualRef = await gitUtils.getRef(env, tmpDir);
+      const actualRef = await gitUtils.getRef();
      t.deepEqual(actualRef, "refs/pull/1/head");

      t.is(callback.callCount, 2);
-      t.true(callback.calledWith(env, tmpDir, "refs/remotes/pull/1/merge"));
-      t.true(callback.calledWith(env, tmpDir, "HEAD"));
+      t.true(callback.calledWith(tmpDir, "refs/remotes/pull/1/merge"));
+      t.true(callback.calledWith(tmpDir, "HEAD"));
    });
  },
 );
@@ -116,6 +95,7 @@ test.serial(
  "getRef() returns ref provided as an input and ignores current HEAD",
  async (t) => {
    await withTmpDir(async (tmpDir: string) => {
+      setupActionsVars(tmpDir, tmpDir);
      const getAdditionalInputStub = sinon.stub(
        actionsUtil,
        "getOptionalInput",
@@ -124,22 +104,14 @@ test.serial(
      getAdditionalInputStub.withArgs("sha").resolves("b".repeat(40));

      // These values are be ignored
-      const env = getTestEnv();
-      setupActionsVars(tmpDir, tmpDir, {}, env);
-      env.setAll({
-        [ActionsEnvVars.GITHUB_REF]: "refs/pull/1/merge",
-        [ActionsEnvVars.GITHUB_SHA]: "a".repeat(40),
-      });
+      process.env["GITHUB_REF"] = "refs/pull/1/merge";
+      process.env["GITHUB_SHA"] = "a".repeat(40);

      const callback = sinon.stub(gitUtils, "getCommitOid");
-      callback
-        .withArgs(sinon.match.any, tmpDir, "refs/pull/1/merge")
-        .resolves("b".repeat(40));
-      callback
-        .withArgs(sinon.match.any, sinon.match.string, "HEAD")
-        .resolves("b".repeat(40));
+      callback.withArgs(tmpDir, "refs/pull/1/merge").resolves("b".repeat(40));
+      callback.withArgs(sinon.match.any, "HEAD").resolves("b".repeat(40));

-      const actualRef = await gitUtils.getRef(env, tmpDir);
+      const actualRef = await gitUtils.getRef();
      t.deepEqual(actualRef, "refs/pull/2/merge");

      // getCommitOid shouldn't be called, because the ref should be taken from the input
@@ -152,17 +124,14 @@ test.serial(
  "getRef() returns CODE_SCANNING_REF as a fallback for GITHUB_REF",
  async (t) => {
    await withTmpDir(async (tmpDir: string) => {
+      setupActionsVars(tmpDir, tmpDir);
      const expectedRef = "refs/pull/1/HEAD";
      const currentSha = "a".repeat(40);
-      const env = getTestEnv();
-      setupActionsVars(tmpDir, tmpDir, {}, env);
-      env.setAll({
-        [EnvVar.CODE_SCANNING_REF]: expectedRef,
-        [ActionsEnvVars.GITHUB_REF]: "",
-        [ActionsEnvVars.GITHUB_SHA]: currentSha,
-      });
+      process.env["CODE_SCANNING_REF"] = expectedRef;
+      process.env["GITHUB_REF"] = "";
+      process.env["GITHUB_SHA"] = currentSha;

-      const actualRef = await gitUtils.getRef(env, tmpDir);
+      const actualRef = await gitUtils.getRef();
      t.deepEqual(actualRef, expectedRef);
    });
  },
@@ -172,17 +141,14 @@ test.serial(
  "getRef() returns GITHUB_REF over CODE_SCANNING_REF if both are provided",
  async (t) => {
    await withTmpDir(async (tmpDir: string) => {
+      setupActionsVars(tmpDir, tmpDir);
      const expectedRef = "refs/pull/1/merge";
      const currentSha = "a".repeat(40);
-      const env = getTestEnv();
-      setupActionsVars(tmpDir, tmpDir, {}, env);
-      env.setAll({
-        [EnvVar.CODE_SCANNING_REF]: "refs/pull/1/HEAD",
-        [ActionsEnvVars.GITHUB_REF]: expectedRef,
-        [ActionsEnvVars.GITHUB_SHA]: currentSha,
-      });
+      process.env["CODE_SCANNING_REF"] = "refs/pull/1/HEAD";
+      process.env["GITHUB_REF"] = expectedRef;
+      process.env["GITHUB_SHA"] = currentSha;

-      const actualRef = await gitUtils.getRef(env, tmpDir);
+      const actualRef = await gitUtils.getRef();
      t.deepEqual(actualRef, expectedRef);
    });
  },
@@ -192,9 +158,7 @@ test.serial(
  "getRef() throws an error if only `ref` is provided as an input",
  async (t) => {
    await withTmpDir(async (tmpDir: string) => {
-      const env = getTestEnv();
-      setupActionsVars(tmpDir, tmpDir, {}, env);
-
+      setupActionsVars(tmpDir, tmpDir);
      const getAdditionalInputStub = sinon.stub(
        actionsUtil,
        "getOptionalInput",
@@ -203,7 +167,7 @@ test.serial(

      await t.throwsAsync(
        async () => {
-          await gitUtils.getRef(env, tmpDir);
+          await gitUtils.getRef();
        },
        {
          instanceOf: Error,
@@ -219,12 +183,8 @@ test.serial(
  "getRef() throws an error if only `sha` is provided as an input",
  async (t) => {
    await withTmpDir(async (tmpDir: string) => {
-      const env = getTestEnv();
-      setupActionsVars(tmpDir, tmpDir, {}, env);
-      env.setAll({
-        [ActionsEnvVars.GITHUB_WORKSPACE]: "/tmp",
-      });
-
+      setupActionsVars(tmpDir, tmpDir);
+      process.env["GITHUB_WORKSPACE"] = "/tmp";
      const getAdditionalInputStub = sinon.stub(
        actionsUtil,
        "getOptionalInput",
@@ -233,7 +193,7 @@ test.serial(

      await t.throwsAsync(
        async () => {
-          await gitUtils.getRef(env, tmpDir);
+          await gitUtils.getRef();
        },
        {
          instanceOf: Error,
@@ -246,16 +206,13 @@ test.serial(
 );

 test.serial("isAnalyzingDefaultBranch()", async (t) => {
-  const env = getTestEnv({
-    [ActionsEnvVars.GITHUB_EVENT_NAME]: "push",
-    CODE_SCANNING_IS_ANALYZING_DEFAULT_BRANCH: "true",
-  });
-  t.deepEqual(await gitUtils.isAnalyzingDefaultBranch(env, ""), true);
-
-  env.set("CODE_SCANNING_IS_ANALYZING_DEFAULT_BRANCH", "false");
+  process.env["GITHUB_EVENT_NAME"] = "push";
+  process.env["CODE_SCANNING_IS_ANALYZING_DEFAULT_BRANCH"] = "true";
+  t.deepEqual(await gitUtils.isAnalyzingDefaultBranch(), true);
+  process.env["CODE_SCANNING_IS_ANALYZING_DEFAULT_BRANCH"] = "false";

  await withTmpDir(async (tmpDir) => {
-    setupActionsVars(tmpDir, tmpDir, {}, env);
+    setupActionsVars(tmpDir, tmpDir);
    const envFile = path.join(tmpDir, "event.json");
    fs.writeFileSync(
      envFile,
@@ -265,17 +222,17 @@ test.serial("isAnalyzingDefaultBranch()", async (t) => {
        },
      }),
    );
-    env.set(ActionsEnvVars.GITHUB_EVENT_PATH, envFile);
+    process.env["GITHUB_EVENT_PATH"] = envFile;

-    env.set(ActionsEnvVars.GITHUB_REF, "main");
-    env.set(ActionsEnvVars.GITHUB_SHA, "1234");
-    t.deepEqual(await gitUtils.isAnalyzingDefaultBranch(env, tmpDir), true);
+    process.env["GITHUB_REF"] = "main";
+    process.env["GITHUB_SHA"] = "1234";
+    t.deepEqual(await gitUtils.isAnalyzingDefaultBranch(), true);

-    env.set(ActionsEnvVars.GITHUB_REF, "refs/heads/main");
-    t.deepEqual(await gitUtils.isAnalyzingDefaultBranch(env, tmpDir), true);
+    process.env["GITHUB_REF"] = "refs/heads/main";
+    t.deepEqual(await gitUtils.isAnalyzingDefaultBranch(), true);

-    env.set(ActionsEnvVars.GITHUB_REF, "feature");
-    t.deepEqual(await gitUtils.isAnalyzingDefaultBranch(env, tmpDir), false);
+    process.env["GITHUB_REF"] = "feature";
+    t.deepEqual(await gitUtils.isAnalyzingDefaultBranch(), false);

    fs.writeFileSync(
      envFile,
@@ -283,9 +240,9 @@ test.serial("isAnalyzingDefaultBranch()", async (t) => {
        schedule: "0 0 * * *",
      }),
    );
-    env.set(ActionsEnvVars.GITHUB_EVENT_NAME, "schedule");
-    env.set(ActionsEnvVars.GITHUB_REF, "refs/heads/main");
-    t.deepEqual(await gitUtils.isAnalyzingDefaultBranch(env, tmpDir), true);
+    process.env["GITHUB_EVENT_NAME"] = "schedule";
+    process.env["GITHUB_REF"] = "refs/heads/main";
+    t.deepEqual(await gitUtils.isAnalyzingDefaultBranch(), true);

    const getAdditionalInputStub = sinon.stub(actionsUtil, "getOptionalInput");
    getAdditionalInputStub
@@ -294,9 +251,9 @@ test.serial("isAnalyzingDefaultBranch()", async (t) => {
    getAdditionalInputStub
      .withArgs("sha")
      .resolves("0000000000000000000000000000000000000000");
-    env.set(ActionsEnvVars.GITHUB_EVENT_NAME, "schedule");
-    env.set(ActionsEnvVars.GITHUB_REF, "refs/heads/main");
-    t.deepEqual(await gitUtils.isAnalyzingDefaultBranch(env, tmpDir), false);
+    process.env["GITHUB_EVENT_NAME"] = "schedule";
+    process.env["GITHUB_REF"] = "refs/heads/main";
+    t.deepEqual(await gitUtils.isAnalyzingDefaultBranch(), false);
  });
 });

@@ -13,7 +13,6 @@ import {
  getWorkflowEvent,
  getWorkflowEventName,
 } from "./actions-util";
-import { ActionsEnvVars, EnvVar, type ReadOnlyEnv } from "./environment";
 import { ConfigurationError, getRequiredEnvParam } from "./util";

 /**
@@ -102,7 +101,6 @@ export const runGitCommand = async function (
 * Gets the SHA of the commit that is currently checked out.
 */
 export const getCommitOid = async function (
-  env: ReadOnlyEnv,
  checkoutPath: string,
  ref = "HEAD",
 ): Promise<string> {
@@ -121,9 +119,7 @@ export const getCommitOid = async function (
    );
    return stdout.trim();
  } catch {
-    return (
-      getOptionalInput("sha") || env.getRequired(ActionsEnvVars.GITHUB_SHA)
-    );
+    return getOptionalInput("sha") || getRequiredEnvParam("GITHUB_SHA");
  }
 };

@@ -245,7 +241,7 @@ export const getGitRoot = async function (
      ["rev-parse", "--show-toplevel"],
      `Cannot find Git repository root from the source root ${sourceRoot}.`,
    );
-    return path.resolve(stdout.trim());
+    return stdout.trim();
  } catch {
    // Errors are already logged by runGitCommand()
    return undefined;
@@ -318,18 +314,18 @@ export const getFileOidsUnderPath = async function (
  return fileOidMap;
 };

-function getRefFromEnv(env: ReadOnlyEnv): string {
+function getRefFromEnv(): string {
  // To workaround a limitation of Actions dynamic workflows not setting
  // the GITHUB_REF in some cases, we accept also the ref within the
  // CODE_SCANNING_REF variable. When possible, however, we prefer to use
  // the GITHUB_REF as that is a protected variable and cannot be overwritten.
  let refEnv: string;
  try {
-    refEnv = env.getRequired(ActionsEnvVars.GITHUB_REF);
+    refEnv = getRequiredEnvParam("GITHUB_REF");
  } catch (e) {
    // If the GITHUB_REF is not set, we try to rescue by getting the
    // CODE_SCANNING_REF.
-    const maybeRef = env.getOptional(EnvVar.CODE_SCANNING_REF);
+    const maybeRef = process.env["CODE_SCANNING_REF"];
    if (maybeRef === undefined || maybeRef.length === 0) {
      throw e;
    }
@@ -341,16 +337,15 @@ function getRefFromEnv(env: ReadOnlyEnv): string {
 /**
 * Get the ref currently being analyzed.
 */
-export async function getRef(
-  env: ReadOnlyEnv,
-  checkoutPath: string | undefined,
-): Promise<string> {
+export async function getRef(): Promise<string> {
  // Will be in the form "refs/heads/master" on a push event
  // or in the form "refs/pull/N/merge" on a pull_request event
  const refInput = getOptionalInput("ref");
  const shaInput = getOptionalInput("sha");
-  checkoutPath =
-    checkoutPath ?? env.getRequired(ActionsEnvVars.GITHUB_WORKSPACE);
+  const checkoutPath =
+    getOptionalInput("checkout_path") ||
+    getOptionalInput("source-root") ||
+    getRequiredEnvParam("GITHUB_WORKSPACE");

  const hasRefInput = !!refInput;
  const hasShaInput = !!shaInput;
@@ -361,8 +356,8 @@ export async function getRef(
    );
  }

-  const ref = refInput || getRefFromEnv(env);
-  const sha = shaInput || env.getRequired(ActionsEnvVars.GITHUB_SHA);
+  const ref = refInput || getRefFromEnv();
+  const sha = shaInput || getRequiredEnvParam("GITHUB_SHA");

  // If the ref is a user-provided input, we have to skip logic
  // and assume that it is really where they want to upload the results.
@@ -379,7 +374,7 @@ export async function getRef(
    return ref;
  }

-  const head = await getCommitOid(env, checkoutPath, "HEAD");
+  const head = await getCommitOid(checkoutPath, "HEAD");

  // in actions/checkout@v2+ we can check if git rev-parse HEAD == GITHUB_SHA
  // in actions/checkout@v1 this may not be true as it checks out the repository
@@ -389,7 +384,6 @@ export async function getRef(
  const hasChangedRef =
    sha !== head &&
    (await getCommitOid(
-      env,
      checkoutPath,
      ref.replace(/^refs\/pull\//, "refs/remotes/pull/"),
    )) !== head;
@@ -416,23 +410,20 @@ function removeRefsHeadsPrefix(ref: string): string {
 * environment variable can be set in cases where repository information might not be available, for
 * example dynamic workflows.
 */
-export async function isAnalyzingDefaultBranch(
-  env: ReadOnlyEnv,
-  checkoutPath: string | undefined,
-): Promise<boolean> {
-  if (env.getOptional("CODE_SCANNING_IS_ANALYZING_DEFAULT_BRANCH") === "true") {
+export async function isAnalyzingDefaultBranch(): Promise<boolean> {
+  if (process.env.CODE_SCANNING_IS_ANALYZING_DEFAULT_BRANCH === "true") {
    return true;
  }

  // Get the current ref and trim and refs/heads/ prefix
-  let currentRef = await getRef(env, checkoutPath);
+  let currentRef = await getRef();
  currentRef = removeRefsHeadsPrefix(currentRef);

-  const event = getWorkflowEvent(env);
+  const event = getWorkflowEvent();
  let defaultBranch = event?.repository?.default_branch;

-  if (getWorkflowEventName(env) === "schedule") {
-    defaultBranch = removeRefsHeadsPrefix(getRefFromEnv(env));
+  if (getWorkflowEventName() === "schedule") {
+    defaultBranch = removeRefsHeadsPrefix(getRefFromEnv());
  }

  return currentRef === defaultBranch;
@@ -1,3 +1,6 @@
+import * as fs from "fs";
+import * as path from "path";
+
 import * as core from "@actions/core";
 import test, { ExecutionContext } from "ava";
 import * as sinon from "sinon";
@@ -8,6 +11,7 @@ import * as apiClient from "./api-client";
 import * as codeql from "./codeql";
 import * as configUtils from "./config-utils";
 import * as debugArtifacts from "./debug-artifacts";
+import { getTempDiagnosticPath } from "./diagnostics";
 import { EnvVar } from "./environment";
 import { Feature } from "./feature-flags";
 import * as initActionPostHelper from "./init-action-post-helper";
@@ -35,6 +39,47 @@ const NUM_BYTES_PER_GIB = 1024 * 1024 * 1024;

 setupTests(test);

+test.serial("generateFailedSarif picks up unwritten diagnostics", async (t) =>
+  util.withTmpDir(async (tmpDir) => {
+    const logger = new RecordingLogger();
+
+    const tempDiagDir = getTempDiagnosticPath(tmpDir);
+    fs.mkdirSync(tempDiagDir);
+
+    const codeqlObject = await codeql.getCodeQLForTesting();
+    const diagnosticsExport = sinon
+      .stub(codeqlObject, "diagnosticsExport")
+      .resolves();
+
+    sinon.stub(codeql, "getCodeQL").resolves(codeqlObject);
+
+    const sarifFile = path.join(tmpDir, "failed.sarif");
+    const result = await initActionPostHelper.generateFailedSarif(
+      logger,
+      createFeatures([]),
+      createTestConfig({
+        tempDir: tmpDir,
+        // Explicitly undefined to ensure we get the "no database" path.
+        dbLocation: undefined,
+      }),
+      "category",
+      "",
+      sarifFile,
+    );
+
+    t.truthy(result);
+    t.is(diagnosticsExport.callCount, 1);
+    t.true(
+      diagnosticsExport.calledOnceWith(
+        sarifFile,
+        "category",
+        sinon.match.any,
+        tempDiagDir,
+      ),
+    );
+  }),
+);
+
 test.serial("init-post action with debug mode off", async (t) => {
  return await util.withTmpDir(async (tmpDir) => {
    setupActionsVars(tmpDir, tmpDir);
@@ -24,7 +24,8 @@ import {
  type UploadDebugArtifactsConfig,
 } from "./debug-artifacts";
 import * as dependencyCaching from "./dependency-caching";
-import { EnvVar, ReadOnlyEnv } from "./environment";
+import { getTempDiagnosticPath } from "./diagnostics";
+import { EnvVar, isInTestMode, ReadOnlyEnv } from "./environment";
 import { Feature, FeatureEnablement } from "./feature-flags";
 import { Logger } from "./logging";
 import { OverlayDatabaseMode } from "./overlay/overlay-database-mode";
@@ -50,7 +51,7 @@ import {
 } from "./util";
 import {
  getCategoryInputOrThrow,
-  getRepositoryRootOrThrow,
+  getCheckoutPathInputOrThrow,
  getUploadInputOrThrow,
  getWorkflow,
 } from "./workflow";
@@ -155,15 +156,7 @@ async function prepareFailedSarif(
      });
    }
    const category = getCategoryInputOrThrow(workflow, jobName, matrix);
-
-    // Try to determine the path at which the repository that we failed to analyse is checked out at.
-    // We need this to relativise the paths in the SARIF.
-    const checkoutPath = getRepositoryRootOrThrow(
-      workflow,
-      jobName,
-      matrix,
-      config,
-    );
+    const checkoutPath = getCheckoutPathInputOrThrow(workflow, jobName, matrix);

    const result = await generateFailedSarif(
      logger,
@@ -176,7 +169,16 @@ async function prepareFailedSarif(
  }
 }

-async function generateFailedSarif(
+/**
+ * Generates a SARIF file for a failed run, i.e. an analysis where no SARIF was produced as a result of the analysis.
+ *
+ * Not intended to be called directly, other than by `prepareFailedSarif`.
+ *
+ * @param category The analysis category to include in the SARIF.
+ * @param checkoutPath The path where the repository was checked out at.
+ * @param sarifFile The SARIF file to produce.
+ */
+export async function generateFailedSarif(
  logger: Logger,
  features: FeatureEnablement,
  config: ActionConfig<"codeQLCmd" | "tempDir">,
@@ -197,7 +199,19 @@ async function generateFailedSarif(
    databasePath === undefined ||
    !(await features.getValue(Feature.ExportDiagnosticsEnabled, codeql))
  ) {
-    await codeql.diagnosticsExport(sarifFile, category, config);
+    // If we don't have a database path, then we may have diagnostics that were written to a
+    // temporary location. Get the path that they would have been written to and check whether
+    // it exists. If so, pass it on to the CLI. The CLI will not complain if we give it a
+    // path that doesn't exist, so we are just being extra defensive here.
+    let diagnosticDir: string | undefined = getTempDiagnosticPath(
+      config.tempDir,
+    );
+
+    if (!fs.existsSync(diagnosticDir)) {
+      diagnosticDir = undefined;
+    }
+
+    await codeql.diagnosticsExport(sarifFile, category, config, diagnosticDir);
  } else {
    // We call 'database export-diagnostics' to find any per-database diagnostics.
    await codeql.databaseExportDiagnostics(databasePath, sarifFile, category);
@@ -239,6 +253,19 @@ async function maybeUploadFailedSarif(
    logger,
    { isUnsuccessfulExecution: true },
  );
+
+  // If we are in test mode, `uploadFiles` will not have uploaded the failed SARIF file
+  // and instead will have written it to disk. Upload it as a workflow artifact so that
+  // we can inspect it in validation jobs.
+  if (uploadResult.sarifID && isInTestMode()) {
+    await uploadSarifArtifact(logger, "test-mode-sarif", {
+      // We defaulted to CodeScanning in the `uploadFiles` call above.
+      sarifFile: uploadLib.getSavedPayloadPath(CodeScanning.kind),
+      category: failedSarif.category,
+      checkoutPath: failedSarif.checkoutPath,
+    });
+  }
+
  return uploadResult
    ? { ...uploadResult.statusReport, sarifID: uploadResult.sarifID }
    : {};
@@ -257,7 +284,15 @@ async function maybeUploadFailedSarifArtifact(
  }

  const failedSarif = failedSarifResult.value;
+  return uploadSarifArtifact(logger, "sarif-artifact", failedSarif);
+}

+/** Uploads a failed SARIF file as workflow artifact. */
+async function uploadSarifArtifact(
+  logger: Logger,
+  prefix: string,
+  failedSarif: FailedSarifInfo,
+): Promise<UploadFailedSarifResult> {
  logger.info(
    `Uploading failed SARIF file ${failedSarif.sarifFile} as artifact`,
  );
@@ -266,7 +301,7 @@ async function maybeUploadFailedSarifArtifact(
  const client = await getArtifactUploaderClient(logger, gitHubVersion.type);

  const suffix = getArtifactSuffix(actionsUtil.getOptionalInput("matrix"));
-  const name = sanitizeArtifactName(`sarif-artifact-${suffix}`);
+  const name = sanitizeArtifactName(`${prefix}-${suffix}`);
  await client.uploadArtifact(
    name,
    [path.normalize(failedSarif.sarifFile)],
@@ -76,6 +76,9 @@ async function run(action: ActionState<["Base", "Logger", "Env"]>) {
    // Try to load the "failed" configuration file instead which may have been written by the `init` step
    // with a minimal configuration for this post-action.
    if (config === undefined) {
+      logger.debug(
+        "Will try to load the configuration file from an aborted 'init' step, since there is no regular one.",
+      );
      config = getAbortedInitConfig(action, tmpDir);
    }

@@ -114,10 +117,7 @@ async function run(action: ActionState<["Base", "Logger", "Env"]>) {
      // do this under these circumstances to avoid slowing down analyses for PRs
      // and where caching may not be enabled.
      if (
-        (await gitUtils.isAnalyzingDefaultBranch(
-          action.env,
-          config.repositoryRoot,
-        )) &&
+        (await gitUtils.isAnalyzingDefaultBranch()) &&
        hasConfigKey(config, "dependencyCachingEnabled") &&
        config.dependencyCachingEnabled !== CachingKind.None
      ) {
@@ -40,7 +40,7 @@ import {
  addDiagnostic,
  addNoLanguageDiagnostic,
  flushDiagnostics,
-  logUnwrittenDiagnostics,
+  logTemporaryDiagnostics,
  makeDiagnostic,
  makeTelemetryDiagnostic,
 } from "./diagnostics";
@@ -61,6 +61,7 @@ import {
  runDatabaseInitCluster,
 } from "./init";
 import { JavaEnvVars, BuiltInLanguage } from "./languages";
+import { isSwiftCompatible } from "./languages/swift";
 import { Logger, withGroupAsync } from "./logging";
 import {
  downloadOverlayBaseDatabaseFromCache,
@@ -418,14 +419,7 @@ async function run(
      logger,
    });

-    if (
-      config.languages.includes(BuiltInLanguage.swift) &&
-      process.platform !== "darwin"
-    ) {
-      throw new ConfigurationError(
-        `Swift analysis is only supported on macOS runner images. Please migrate to a macOS runner.`,
-      );
-    }
+    await isSwiftCompatible(actionStateWithFeatures, config, codeql);

    if (repositoryPropertiesResult.isFailure()) {
      addNoLanguageDiagnostic(
@@ -484,6 +478,7 @@ async function run(
    if (statusReportBase !== undefined) {
      await sendStatusReport(statusReportBase);
    }
+    logTemporaryDiagnostics(actionState);
    return;
  }

@@ -766,9 +761,9 @@ async function run(
      );
    }

-    // Write diagnostics to the database that we previously stored in memory because the database
-    // did not exist until now.
-    flushDiagnostics(config);
+    // Move diagnostics to the database that we previously kept in a temporary location
+    // because the database did not exist until now
+    flushDiagnostics(actionState, config);

    // We save the config here instead of at the end of `initConfig` because we
    // may have updated the config returned from `initConfig`, e.g. to revert to
@@ -797,7 +792,7 @@ async function run(
    );
    return;
  } finally {
-    logUnwrittenDiagnostics();
+    logTemporaryDiagnostics(actionState);
  }
  await sendCompletedStatusReport(
    startedAt,
@@ -0,0 +1,578 @@
+import fs from "fs";
+
+import test from "ava";
+import * as sinon from "sinon";
+
+import { getCodeQLForTesting } from "../codeql";
+import * as diagnostics from "../diagnostics";
+import { ActionsEnvVars } from "../environment";
+import { Feature } from "../feature-flags";
+import {
+  checkExpectedLogMessages,
+  checkUnexpectedLogMessages,
+  createFeatures,
+  createTestConfig,
+  getTestEnv,
+  initAllState,
+  makeVersionInfo,
+  RecordingLogger,
+  setupTests,
+} from "../testing-utils";
+import { ToolsFeature } from "../tools-features";
+import { withTmpDir } from "../util";
+
+import {
+  isSwiftCompatible,
+  XCODE_SELECT_LINK_PATH,
+  xcodeVersion,
+} from "./swift";
+
+import { BuiltInLanguage } from ".";
+
+setupTests(test);
+
+test.serial("xcodeVersion returns undefined if symlink doesn't exist", (t) => {
+  const logger = new RecordingLogger();
+
+  const statSync = sinon.stub(fs, "statSync").throws(new Error("ENOENT"));
+
+  t.is(xcodeVersion(logger), undefined);
+  t.is(statSync.callCount, 1);
+  t.deepEqual(statSync.args[0], [XCODE_SELECT_LINK_PATH]);
+
+  checkExpectedLogMessages(t, logger.messages, [
+    "Unable to determine Xcode version: ENOENT",
+  ]);
+});
+
+test.serial("xcodeVersion returns undefined if file is not a symlink", (t) => {
+  const logger = new RecordingLogger();
+
+  const statSync = sinon
+    .stub(fs, "statSync")
+    .returns({ isSymbolicLink: () => false } as fs.Stats);
+
+  t.is(xcodeVersion(logger), undefined);
+  t.is(statSync.callCount, 1);
+  t.deepEqual(statSync.args[0], [XCODE_SELECT_LINK_PATH]);
+
+  checkExpectedLogMessages(t, logger.messages, [
+    "exists, but is not a symbolic link",
+  ]);
+});
+
+test.serial(
+  "xcodeVersion returns undefined if resolving the symlink returns nothing",
+  (t) => {
+    const logger = new RecordingLogger();
+
+    const statSync = sinon
+      .stub(fs, "statSync")
+      .returns({ isSymbolicLink: () => true } as fs.Stats);
+    const readlinkSync = sinon.stub(fs, "readlinkSync").returns("");
+
+    t.is(xcodeVersion(logger), undefined);
+    t.is(statSync.callCount, 1);
+    t.deepEqual(statSync.args[0], [XCODE_SELECT_LINK_PATH]);
+    t.is(readlinkSync.callCount, 1);
+    t.deepEqual(readlinkSync.args[0], [XCODE_SELECT_LINK_PATH]);
+
+    checkExpectedLogMessages(t, logger.messages, [
+      "unexpectedly returned nothing",
+    ]);
+  },
+);
+
+test.serial(
+  "xcodeVersion returns undefined if resolved path doesn't include pattern",
+  (t) => {
+    const logger = new RecordingLogger();
+
+    const statSync = sinon
+      .stub(fs, "statSync")
+      .returns({ isSymbolicLink: () => true } as fs.Stats);
+    const readlinkSync = sinon
+      .stub(fs, "readlinkSync")
+      .returns("/Applications/Xcode.app/Contents/Developer");
+
+    t.is(xcodeVersion(logger), undefined);
+    t.is(statSync.callCount, 1);
+    t.deepEqual(statSync.args[0], [XCODE_SELECT_LINK_PATH]);
+    t.is(readlinkSync.callCount, 1);
+    t.deepEqual(readlinkSync.args[0], [XCODE_SELECT_LINK_PATH]);
+
+    checkExpectedLogMessages(t, logger.messages, [
+      "does not contain expected pattern",
+    ]);
+  },
+);
+
+test.serial("xcodeVersion returns undefined if match can't be parsed", (t) => {
+  const logger = new RecordingLogger();
+
+  const statSync = sinon
+    .stub(fs, "statSync")
+    .returns({ isSymbolicLink: () => true } as fs.Stats);
+  const readlinkSync = sinon
+    .stub(fs, "readlinkSync")
+    .returns("/Applications/Xcode_00.0.app/Contents/Developer");
+
+  t.is(xcodeVersion(logger), undefined);
+  t.is(statSync.callCount, 1);
+  t.deepEqual(statSync.args[0], [XCODE_SELECT_LINK_PATH]);
+  t.is(readlinkSync.callCount, 1);
+  t.deepEqual(readlinkSync.args[0], [XCODE_SELECT_LINK_PATH]);
+
+  checkExpectedLogMessages(t, logger.messages, [
+    "Couldn't parse '00.0' as a semantic version.",
+  ]);
+});
+
+test.serial("xcodeVersion returns version from resolved path", (t) => {
+  const logger = new RecordingLogger();
+
+  const statSync = sinon
+    .stub(fs, "statSync")
+    .returns({ isSymbolicLink: () => true } as fs.Stats);
+  const readlinkSync = sinon
+    .stub(fs, "readlinkSync")
+    .returns("/Applications/Xcode_16.4.app/Contents/Developer");
+
+  const result = xcodeVersion(logger);
+
+  if (t.truthy(result)) {
+    t.is(result.major, 16);
+    t.is(result.minor, 4);
+  }
+
+  t.is(statSync.callCount, 1);
+  t.deepEqual(statSync.args[0], [XCODE_SELECT_LINK_PATH]);
+  t.is(readlinkSync.callCount, 1);
+  t.deepEqual(readlinkSync.args[0], [XCODE_SELECT_LINK_PATH]);
+});
+
+test("isSwiftCompatible doesn't throw for non-Swift languages", async (t) => {
+  for (const language of Object.values(BuiltInLanguage)) {
+    if (language === BuiltInLanguage.swift) {
+      continue;
+    }
+
+    const codeql = await getCodeQLForTesting();
+    await t.notThrowsAsync(
+      isSwiftCompatible(
+        initAllState(),
+        createTestConfig({ languages: [language] }),
+        codeql,
+      ),
+    );
+  }
+});
+
+test("isSwiftCompatible doesn't throw for Swift if CLI supports swiftSupportsAllPlatforms", async (t) =>
+  withTmpDir(async (tmpDir) => {
+    const logger = new RecordingLogger();
+    const env = getTestEnv();
+    env.set(ActionsEnvVars.RUNNER_TEMP, tmpDir);
+
+    const codeql = await getCodeQLForTesting("codeql-for-testing", logger, env);
+    const supportsFeature = sinon
+      .stub(codeql, "supportsFeature")
+      .withArgs(ToolsFeature.SwiftSupportsAllPlatforms)
+      .resolves(true);
+
+    await t.notThrowsAsync(
+      isSwiftCompatible(
+        initAllState({ platform: "darwin", env, logger }),
+        createTestConfig({ languages: [BuiltInLanguage.swift] }),
+        codeql,
+      ),
+    );
+
+    t.is(supportsFeature.callCount, 1);
+    t.deepEqual(supportsFeature.args[0], [
+      ToolsFeature.SwiftSupportsAllPlatforms,
+    ]);
+  }));
+
+test("isSwiftCompatible doesn't throw for Swift on darwin", async (t) =>
+  withTmpDir(async (tmpDir) => {
+    const logger = new RecordingLogger();
+    const env = getTestEnv();
+    env.set(ActionsEnvVars.RUNNER_TEMP, tmpDir);
+
+    const codeql = await getCodeQLForTesting("codeql-for-testing", logger, env);
+    sinon.stub(codeql, "getVersion").resolves(makeVersionInfo("2.27.0"));
+
+    await t.notThrowsAsync(
+      isSwiftCompatible(
+        initAllState({ platform: "darwin", env, logger }),
+        createTestConfig({
+          tempDir: tmpDir,
+          languages: [BuiltInLanguage.swift],
+        }),
+        codeql,
+      ),
+    );
+  }));
+
+const nonDarwinPlatforms: NodeJS.Platform[] = ["linux", "win32"];
+for (const nonDarwinPlatform of nonDarwinPlatforms) {
+  test(`isSwiftCompatible throws for Swift on ${nonDarwinPlatform}`, async (t) =>
+    withTmpDir(async (tmpDir) => {
+      const logger = new RecordingLogger();
+      const env = getTestEnv();
+      env.set(ActionsEnvVars.RUNNER_TEMP, tmpDir);
+
+      const codeql = await getCodeQLForTesting(
+        "codeql-for-testing",
+        logger,
+        env,
+      );
+      sinon.stub(codeql, "getVersion").resolves(makeVersionInfo("2.27.0"));
+
+      await t.throwsAsync(
+        isSwiftCompatible(
+          initAllState({ platform: nonDarwinPlatform, env, logger }),
+          createTestConfig({ languages: [BuiltInLanguage.swift] }),
+          codeql,
+        ),
+      );
+    }));
+}
+
+test("isSwiftCompatible warns if version string is not a semver", async (t) =>
+  withTmpDir(async (tmpDir) => {
+    const logger = new RecordingLogger();
+    const env = getTestEnv();
+    env.set(ActionsEnvVars.RUNNER_TEMP, tmpDir);
+
+    const codeql = await getCodeQLForTesting("codeql-for-testing", logger, env);
+    sinon.stub(codeql, "getVersion").resolves(makeVersionInfo("2.27.0"));
+
+    await isSwiftCompatible(
+      initAllState({
+        logger,
+        platform: "darwin",
+        osRelease: "unexpected",
+        env,
+      }),
+      createTestConfig({ languages: [BuiltInLanguage.swift] }),
+      codeql,
+    );
+
+    checkExpectedLogMessages(t, logger.messages, [
+      "Unable to determine version of macOS, got: unexpected",
+    ]);
+  }));
+
+// `addDiagnostic` changes global state and we must stub it, so this test must be serial.
+test.serial(
+  "isSwiftCompatible logs and adds diagnostic if macOS version is unsupported",
+  async (t) =>
+    withTmpDir(async (tmpDir) => {
+      const logger = new RecordingLogger();
+      const env = getTestEnv();
+      env.set(ActionsEnvVars.RUNNER_TEMP, tmpDir);
+
+      const codeql = await getCodeQLForTesting(
+        "codeql-for-testing",
+        logger,
+        env,
+      );
+      sinon.stub(codeql, "getVersion").resolves(makeVersionInfo("2.27.0"));
+
+      const addDiagnostic = sinon.stub(diagnostics, "addDiagnostic");
+
+      const config = createTestConfig({ languages: [BuiltInLanguage.swift] });
+      await isSwiftCompatible(
+        initAllState({
+          logger,
+          platform: "darwin",
+          osRelease: "27.0.0",
+          env,
+        }),
+        config,
+        codeql,
+      );
+
+      checkExpectedLogMessages(t, logger.messages, [
+        "Traced Swift analysis is not supported on macOS 27",
+      ]);
+
+      t.is(addDiagnostic.callCount, 1);
+      t.like(addDiagnostic.args[0], [
+        config,
+        BuiltInLanguage.swift,
+        {
+          attributes: {
+            languages: [BuiltInLanguage.swift],
+            macOSVersion: "27.0.0",
+          },
+          severity: "warning",
+          source: {
+            id: "codeql-action/unsupported-traced-swift-analysis-macos",
+            name: "Traced Swift analysis is not supported on this version of macOS",
+          },
+          visibility: {
+            cliSummaryTable: true,
+            statusPage: true,
+            telemetry: true,
+          },
+        } satisfies Partial<diagnostics.DiagnosticMessage>,
+      ]);
+    }),
+);
+
+// `addDiagnostic` changes global state and we must stub it, so this test must be serial.
+test.serial(
+  "isSwiftCompatible throws if macOS version is unsupported and FF is enabled",
+  async (t) =>
+    withTmpDir(async (tmpDir) => {
+      const logger = new RecordingLogger();
+      const env = getTestEnv();
+      env.set(ActionsEnvVars.RUNNER_TEMP, tmpDir);
+
+      const features = createFeatures([
+        Feature.SwiftSkipUnsupportedTracedAnalysis,
+      ]);
+
+      const codeql = await getCodeQLForTesting(
+        "codeql-for-testing",
+        logger,
+        env,
+      );
+      sinon.stub(codeql, "getVersion").resolves(makeVersionInfo("2.27.0"));
+
+      const addDiagnostic = sinon.stub(diagnostics, "addDiagnostic");
+
+      const config = createTestConfig({ languages: [BuiltInLanguage.swift] });
+      await t.throwsAsync(
+        isSwiftCompatible(
+          initAllState({
+            logger,
+            platform: "darwin",
+            osRelease: "27.0.0",
+            env,
+            features,
+          }),
+          config,
+          codeql,
+        ),
+      );
+
+      t.is(addDiagnostic.callCount, 1);
+      t.like(addDiagnostic.args[0], [
+        config,
+        BuiltInLanguage.swift,
+        {
+          attributes: {
+            languages: [BuiltInLanguage.swift],
+            macOSVersion: "27.0.0",
+          },
+          severity: "error",
+          source: {
+            id: "codeql-action/unsupported-traced-swift-analysis-macos",
+            name: "Traced Swift analysis is not supported on this version of macOS",
+          },
+          visibility: {
+            cliSummaryTable: true,
+            statusPage: true,
+            telemetry: true,
+          },
+        } satisfies Partial<diagnostics.DiagnosticMessage>,
+      ]);
+    }),
+);
+
+// `addDiagnostic` changes global state and we must stub it, so this test must be serial.
+test.serial(
+  "isSwiftCompatible doesn't add a diagnostic if Xcode version is supported",
+  async (t) =>
+    withTmpDir(async (tmpDir) => {
+      const logger = new RecordingLogger();
+      const env = getTestEnv();
+      env.set(ActionsEnvVars.RUNNER_TEMP, tmpDir);
+
+      const statSync = sinon
+        .stub(fs, "statSync")
+        .returns({ isSymbolicLink: () => true } as fs.Stats);
+      const readlinkSync = sinon
+        .stub(fs, "readlinkSync")
+        .returns("/Applications/Xcode_26.0.app/Contents/Developer");
+
+      const codeql = await getCodeQLForTesting(
+        "codeql-for-testing",
+        logger,
+        env,
+      );
+      sinon.stub(codeql, "getVersion").resolves(makeVersionInfo("2.27.0"));
+
+      const addDiagnostic = sinon.stub(diagnostics, "addDiagnostic");
+
+      const config = createTestConfig({ languages: [BuiltInLanguage.swift] });
+      await isSwiftCompatible(
+        initAllState({
+          logger,
+          platform: "darwin",
+          osRelease: "26.0.0",
+          env,
+        }),
+        config,
+        codeql,
+      );
+
+      t.is(statSync.callCount, 1);
+      t.deepEqual(statSync.args[0], [XCODE_SELECT_LINK_PATH]);
+      t.is(readlinkSync.callCount, 1);
+      t.deepEqual(readlinkSync.args[0], [XCODE_SELECT_LINK_PATH]);
+
+      checkUnexpectedLogMessages(t, logger.messages, [
+        "Traced Swift analysis is not supported on Xcode 27",
+      ]);
+
+      t.is(addDiagnostic.callCount, 0);
+    }),
+);
+
+// `addDiagnostic` changes global state and we must stub it, so this test must be serial.
+test.serial(
+  "isSwiftCompatible logs and adds diagnostic if Xcode version is unsupported",
+  async (t) =>
+    withTmpDir(async (tmpDir) => {
+      const logger = new RecordingLogger();
+      const env = getTestEnv();
+      env.set(ActionsEnvVars.RUNNER_TEMP, tmpDir);
+
+      const statSync = sinon
+        .stub(fs, "statSync")
+        .returns({ isSymbolicLink: () => true } as fs.Stats);
+      const readlinkSync = sinon
+        .stub(fs, "readlinkSync")
+        .returns("/Applications/Xcode_27.0.app/Contents/Developer");
+
+      const codeql = await getCodeQLForTesting(
+        "codeql-for-testing",
+        logger,
+        env,
+      );
+      sinon.stub(codeql, "getVersion").resolves(makeVersionInfo("2.27.0"));
+
+      const addDiagnostic = sinon.stub(diagnostics, "addDiagnostic");
+
+      const config = createTestConfig({ languages: [BuiltInLanguage.swift] });
+      await isSwiftCompatible(
+        initAllState({
+          logger,
+          platform: "darwin",
+          osRelease: "26.0.0",
+          env,
+        }),
+        config,
+        codeql,
+      );
+
+      t.is(statSync.callCount, 1);
+      t.deepEqual(statSync.args[0], [XCODE_SELECT_LINK_PATH]);
+      t.is(readlinkSync.callCount, 1);
+      t.deepEqual(readlinkSync.args[0], [XCODE_SELECT_LINK_PATH]);
+
+      checkExpectedLogMessages(t, logger.messages, [
+        "Traced Swift analysis is not supported on Xcode 27",
+      ]);
+
+      t.is(addDiagnostic.callCount, 1);
+      t.like(addDiagnostic.args[0], [
+        config,
+        BuiltInLanguage.swift,
+        {
+          attributes: {
+            languages: [BuiltInLanguage.swift],
+            xcodeVersion: "27.0.0",
+          },
+          severity: "warning",
+          source: {
+            id: "codeql-action/unsupported-traced-swift-analysis-xcode",
+            name: "Traced Swift analysis is not supported on this version of Xcode",
+          },
+          visibility: {
+            cliSummaryTable: true,
+            statusPage: true,
+            telemetry: true,
+          },
+        } satisfies Partial<diagnostics.DiagnosticMessage>,
+      ]);
+    }),
+);
+
+// `addDiagnostic` changes global state and we must stub it, so this test must be serial.
+test.serial(
+  "isSwiftCompatible throws if Xcode version is unsupported and FF is enabled",
+  async (t) =>
+    withTmpDir(async (tmpDir) => {
+      const logger = new RecordingLogger();
+      const env = getTestEnv();
+      env.set(ActionsEnvVars.RUNNER_TEMP, tmpDir);
+
+      const statSync = sinon
+        .stub(fs, "statSync")
+        .returns({ isSymbolicLink: () => true } as fs.Stats);
+      const readlinkSync = sinon
+        .stub(fs, "readlinkSync")
+        .returns("/Applications/Xcode_27.0.app/Contents/Developer");
+
+      const features = createFeatures([
+        Feature.SwiftSkipUnsupportedTracedAnalysis,
+      ]);
+
+      const codeql = await getCodeQLForTesting(
+        "codeql-for-testing",
+        logger,
+        env,
+      );
+      sinon.stub(codeql, "getVersion").resolves(makeVersionInfo("2.27.0"));
+
+      const addDiagnostic = sinon.stub(diagnostics, "addDiagnostic");
+
+      const config = createTestConfig({ languages: [BuiltInLanguage.swift] });
+      await t.throwsAsync(
+        isSwiftCompatible(
+          initAllState({
+            logger,
+            platform: "darwin",
+            osRelease: "26.0.0",
+            env,
+            features,
+          }),
+          config,
+          codeql,
+        ),
+      );
+
+      t.is(statSync.callCount, 1);
+      t.deepEqual(statSync.args[0], [XCODE_SELECT_LINK_PATH]);
+      t.is(readlinkSync.callCount, 1);
+      t.deepEqual(readlinkSync.args[0], [XCODE_SELECT_LINK_PATH]);
+
+      t.is(addDiagnostic.callCount, 1);
+      t.like(addDiagnostic.args[0], [
+        config,
+        BuiltInLanguage.swift,
+        {
+          attributes: {
+            languages: [BuiltInLanguage.swift],
+            xcodeVersion: "27.0.0",
+          },
+          severity: "error",
+          source: {
+            id: "codeql-action/unsupported-traced-swift-analysis-xcode",
+            name: "Traced Swift analysis is not supported on this version of Xcode",
+          },
+          visibility: {
+            cliSummaryTable: true,
+            statusPage: true,
+            telemetry: true,
+          },
+        } satisfies Partial<diagnostics.DiagnosticMessage>,
+      ]);
+    }),
+);
@@ -0,0 +1,216 @@
+import * as fs from "fs";
+
+import * as semver from "semver";
+
+import { ActionState, Logger } from "../action-common";
+import { CodeQL } from "../codeql";
+import { Config } from "../config-utils";
+import { addDiagnostic, makeDiagnostic } from "../diagnostics";
+import { Feature } from "../feature-flags";
+import { macOSVersion } from "../platform";
+import { ToolsFeature } from "../tools-features";
+import { ConfigurationError, getErrorMessage } from "../util";
+
+import { BuiltInLanguage } from ".";
+
+/** The static path we check for a symbolic link to the (dynamic) Xcode location. */
+export const XCODE_SELECT_LINK_PATH = "/private/var/db/xcode_select_link";
+
+/** The pattern we expect to find in the Xcode path. */
+export const XCODE_APP_FILENAME_PATTERN = new RegExp(
+  /(?<filename>Xcode_(?<majorMinor>\d+.\d+).app)/,
+);
+
+/** macOS 27 and above do not support traced extraction for Swift. */
+export const SWIFT_TRACED_UNSUPPORTED_MACOS = 27;
+
+/** Xcode 27 and above do not support traced extraction for Swift. */
+export const SWIFT_TRACED_UNSUPPORTED_XCODE = 27;
+
+/**
+ * Tries to determine the version of Xcode that is installed.
+ *
+ * @param logger The logger to use.
+ * @returns The Xcode version or `undefined` if it couldn't be determined.
+ */
+export function xcodeVersion(logger: Logger): semver.SemVer | undefined {
+  try {
+    // Stat the expected symbolic link to check that it exists and is a symbolic link.
+    // The `readlinkSync` call below returns an empty string in either case and so
+    // this check allows us to distinguish between the two cases.
+    const stats = fs.statSync(XCODE_SELECT_LINK_PATH);
+
+    if (!stats.isSymbolicLink()) {
+      logger.warning(
+        `${XCODE_SELECT_LINK_PATH} exists, but is not a symbolic link.`,
+      );
+      return undefined;
+    }
+
+    // Read what the symbolic link points to.
+    const xcodePath = fs.readlinkSync(XCODE_SELECT_LINK_PATH);
+
+    if (xcodePath === "") {
+      logger.warning(
+        `Resolving ${XCODE_SELECT_LINK_PATH} unexpectedly returned nothing.`,
+      );
+      return undefined;
+    }
+
+    // Try to extract the version from the path.
+    const matchResult = xcodePath.match(XCODE_APP_FILENAME_PATTERN);
+
+    if (matchResult?.groups === undefined) {
+      logger.warning(
+        `Xcode path '${xcodePath}' does not contain expected pattern.`,
+      );
+      return undefined;
+    }
+
+    const majorMinor = matchResult.groups["majorMinor"];
+    const version = semver.coerce(majorMinor);
+
+    if (version === null) {
+      logger.warning(`Couldn't parse '${majorMinor}' as a semantic version.`);
+      return undefined;
+    }
+    return version;
+  } catch (err) {
+    logger.warning(
+      `Unable to determine Xcode version: ${getErrorMessage(err)}`,
+    );
+    return undefined;
+  }
+}
+
+/**
+ * Creates a diagnostic indicating that `version` of `product` is unsupported for traced Swift analysis.
+ * Depending on `skipUnsupportedTracedAnalysis`, this function then either throws a {@link ConfigurationError}
+ * or logs the problem as a warning.
+ *
+ * @param logger The logger to use.
+ * @param config The CodeQL Action configuration.
+ * @param skipUnsupportedTracedAnalysis Whether this is a fatal error.
+ * @param product The product that the version is unsupported of.
+ * @param version The unsupported version.
+ */
+function handleUnsupportedVersion(
+  logger: Logger,
+  config: Config,
+  skipUnsupportedTracedAnalysis: boolean,
+  product: "macOS" | "Xcode",
+  version: semver.SemVer,
+) {
+  const baseMessage = [
+    `Traced Swift analysis is not supported on ${product} ${SWIFT_TRACED_UNSUPPORTED_MACOS} or above.`,
+    `Configure your analysis to run on macOS ${SWIFT_TRACED_UNSUPPORTED_MACOS - 1} or below`,
+    `and XCode ${SWIFT_TRACED_UNSUPPORTED_XCODE - 1} or below.`,
+  ].join(" ");
+
+  const attributeName = product === "macOS" ? "macOSVersion" : "xcodeVersion";
+
+  // Create a diagnostic that will show up on the TSP.
+  addDiagnostic(
+    config,
+    BuiltInLanguage.swift,
+    makeDiagnostic(
+      `codeql-action/unsupported-traced-swift-analysis-${product.toLowerCase()}`,
+      `Traced Swift analysis is not supported on this version of ${product}`,
+      {
+        attributes: {
+          languages: config.languages,
+          [attributeName]: version.toString(),
+        },
+        markdownMessage: baseMessage,
+        severity: skipUnsupportedTracedAnalysis ? "error" : "warning",
+        visibility: {
+          cliSummaryTable: true,
+          statusPage: true,
+          telemetry: true,
+        },
+      },
+    ),
+  );
+
+  // Throw an error to abort the analysis if the FF is enabled or log the message.
+  if (skipUnsupportedTracedAnalysis) {
+    // ConfigurationErrors are converted to the "aborted" status by the exception handler
+    // in `init-action.ts` that guards the call to `isSwiftCompatible`.
+    throw new ConfigurationError(baseMessage);
+  } else {
+    // This will also show up as a workflow annotation.
+    logger.warning(baseMessage);
+  }
+}
+
+/**
+ * Determines whether we can run a Swift analysis on the current runner.
+ *
+ * @param action The Action state.
+ * @param config The Action configuration.
+ *
+ * @throws {ConfigurationError} If Swift analysis is not possible on the current runner.
+ * @returns True if we can run a Swift analysis.
+ */
+export async function isSwiftCompatible(
+  action: ActionState<["Base", "Logger", "FeatureFlags"]>,
+  config: Config,
+  codeql: CodeQL,
+) {
+  // The checks are not relevant if we are not trying to analyse Swift.
+  if (!config.languages.includes(BuiltInLanguage.swift)) {
+    return;
+  }
+
+  // Skip the checks if the `swiftSupportsAllPlatforms` feature is supported by the CLI.
+  // This is a forward-looking measure that allows a future CLI update to disable these
+  // platform checks in the Action when they shouldn't be enforced anymore.
+  if (await codeql.supportsFeature(ToolsFeature.SwiftSupportsAllPlatforms)) {
+    return;
+  }
+
+  // Try to get the macOS version.
+  const version = macOSVersion(action);
+
+  // If `version` is undefined, then we are not on macOS.
+  if (version === undefined) {
+    throw new ConfigurationError(
+      `Swift analysis is only supported on macOS runner images. Please migrate to a macOS runner.`,
+    );
+  }
+
+  const skipUnsupportedTracedAnalysis = await action.features.getValue(
+    Feature.SwiftSkipUnsupportedTracedAnalysis,
+  );
+  if (typeof version === "string") {
+    // If we got a string, we are on macOS but couldn't parse the version string.
+    action.logger.warning(
+      `Unable to determine version of macOS, got: ${version}`,
+    );
+  } else if (version.major >= SWIFT_TRACED_UNSUPPORTED_MACOS) {
+    handleUnsupportedVersion(
+      action.logger,
+      config,
+      skipUnsupportedTracedAnalysis,
+      "macOS",
+      version,
+    );
+  }
+
+  // Determining whether the Xcode version is supported only makes sense on macOS, so we only do it
+  // after determining that we are running on macOS.
+  const xcodeVer = xcodeVersion(action.logger);
+
+  if (
+    xcodeVer !== undefined &&
+    xcodeVer.major >= SWIFT_TRACED_UNSUPPORTED_XCODE
+  ) {
+    handleUnsupportedVersion(
+      action.logger,
+      config,
+      skipUnsupportedTracedAnalysis,
+      "Xcode",
+      xcodeVer,
+    );
+  }
+}
@@ -15,7 +15,6 @@ import {
  CleanupLevel,
  getBaseDatabaseOidsFilePath,
  getCodeQLDatabasePath,
-  getEnv,
  getErrorMessage,
  isInTestMode,
  tryGetFolderBytes,
@@ -291,7 +290,7 @@ export async function downloadOverlayBaseDatabaseFromCache(
      actionsCache.restoreCache(
        [dbLocation],
        cacheRestoreKeyPrefix,
-        [cacheRestoreKeyPrefix],
+        undefined,
        {
          // Azure SDK download (which is the default) uses 128MB segments; see
          // https://github.com/actions/toolkit/blob/main/packages/cache/README.md.
@@ -378,7 +377,7 @@ export async function getCacheSaveKey(
      `Failed to get workflow run ID or attempt ID. Reason: ${getErrorMessage(e)}`,
    );
  }
-  const sha = await getCommitOid(getEnv(), checkoutPath);
+  const sha = await getCommitOid(checkoutPath);
  const restoreKeyPrefix = await getCacheRestoreKeyPrefix(
    config,
    codeQlVersion,
@@ -130,7 +130,7 @@ export async function getOverlayStatus(
    await fs.promises.mkdir(path.dirname(statusFile), { recursive: true });
    const foundKey = await waitForResultWithTimeLimit(
      MAX_CACHE_OPERATION_MS,
-      actionsCache.restoreCache([statusFile], cacheKey, [cacheKey]),
+      actionsCache.restoreCache([statusFile], cacheKey),
      () => {
        logger.warning("Timed out restoring overlay status from cache.");
      },
@@ -1,6 +1,7 @@
 import test from "ava";

-import { BundlePlatform, getBundlePlatform } from "./platform";
+import { BundlePlatform, getBundlePlatform, macOSVersion } from "./platform";
+import { initAllState } from "./testing-utils";

 for (const [platform, arch, expected] of [
  ["linux", "x64", BundlePlatform.Linux64],
@@ -16,3 +17,40 @@ for (const [platform, arch, expected] of [
    t.is(getBundlePlatform(platform, arch), expected);
  });
 }
+
+const platforms: NodeJS.Platform[] = ["linux", "win32", "freebsd"];
+for (const platform of platforms) {
+  test(`macOSVersion returns undefined on ${platform}`, (t) => {
+    t.is(macOSVersion(initAllState({ platform })), undefined);
+  });
+}
+
+test("macOSVersion returns raw string if semver parsing fails", (t) => {
+  const invalidSemVer = "sealOS-2026";
+  t.is(
+    macOSVersion(
+      initAllState({ platform: "darwin", osRelease: invalidSemVer }),
+    ),
+    invalidSemVer,
+  );
+});
+
+test("macOSVersion returns semver if parsing succeeds", (t) => {
+  const validSemVer = "27.0.1";
+
+  const version = macOSVersion(
+    initAllState({ platform: "darwin", osRelease: validSemVer }),
+  );
+
+  // Check that `version` is not undefined and narrow the type; throws if undefined.
+  if (t.truthy(version)) {
+    // Check that it's also not just a string.
+    t.not(typeof version, "string");
+
+    // Should be an object with the expected properties.
+    t.is(typeof version, "object");
+    t.is(version["major"], 27);
+    t.is(version["minor"], 0);
+    t.is(version["patch"], 1);
+  }
+});
@@ -1,3 +1,7 @@
+import * as semver from "semver";
+
+import type { ActionState } from "./action-common";
+
 /** Platform identifiers used in CodeQL bundle asset names. */
 export enum BundlePlatform {
  Linux64 = "linux64",
@@ -24,3 +28,28 @@ export function getBundlePlatform(
      return undefined;
  }
 }
+
+/**
+ * Tries to determine the version of macOS.
+ *
+ * @returns
+ *  The version as either a semantic version object, the raw version string
+ *  if it is not a semantic version, or `undefined` if we are not on macOS.
+ */
+export function macOSVersion(
+  action: ActionState<["Base"]>,
+): semver.SemVer | string | undefined {
+  // Skip if we are not running on macOS.
+  if (action.platform !== "darwin") {
+    return undefined;
+  }
+
+  // Try to parse the OS version string.
+  const version = semver.parse(action.osRelease);
+
+  if (version === null) {
+    return action.osRelease;
+  }
+
+  return version;
+}
@@ -6,14 +6,6 @@ export interface RepositoryNwo {
  repo: string;
 }

-/** An approximation of what a repository NWO string looks like. */
-export type RepositoryNwoStr = `${string}/${string}`;
-
-/** A basic check that `val` looks like a `RepositoryNwoStr`. */
-export function isRepositoryNwoStr(val: string): val is RepositoryNwoStr {
-  return val.includes("/");
-}
-
 /**
 * Get the repository name with owner from the environment variable
 * `GITHUB_REPOSITORY`.
@@ -126,6 +126,24 @@ test.serial("convert to semver", (t) => {
  }
 });

+test.serial("getCodeQLActionRepository", (t) => {
+  const logger = getRunnerLogger(true);
+
+  initializeEnvironment("1.2.3");
+
+  // isRunningLocalAction() === true
+  delete process.env["GITHUB_ACTION_REPOSITORY"];
+  process.env["RUNNER_TEMP"] = path.dirname(__dirname);
+  const repoLocalRunner = setupCodeql.getCodeQLActionRepository(logger);
+  t.deepEqual(repoLocalRunner, "github/codeql-action");
+
+  // isRunningLocalAction() === false
+  sinon.stub(actionsUtil, "isRunningLocalAction").returns(false);
+  process.env["GITHUB_ACTION_REPOSITORY"] = "xxx/yyy";
+  const repoEnv = setupCodeql.getCodeQLActionRepository(logger);
+  t.deepEqual(repoEnv, "xxx/yyy");
+});
+
 test.serial(
  "getCodeQLSource sets CLI version for a semver tagged bundle",
  async (t) => {
@@ -1629,16 +1647,20 @@ test.serial(
      },
    ]);

-    const result = await setupCodeql.getEnabledVersionsWithOverlayBaseDatabases(
-      overlayMatchEnabledVersions,
-      ["javascript"],
-      createFeatures([Feature.OverlayAnalysisMatchCodeqlVersion]),
-      getRunnerLogger(true),
-    );
-    t.deepEqual(result, [
-      { cliVersion: "2.20.1", tagName: "codeql-bundle-v2.20.1" },
-      { cliVersion: "2.20.0", tagName: "codeql-bundle-v2.20.0" },
-    ]);
+    await withTmpDir(async (tmpDir) => {
+      setupActionsVars(tmpDir, tmpDir);
+      const result =
+        await setupCodeql.getEnabledVersionsWithOverlayBaseDatabases(
+          overlayMatchEnabledVersions,
+          ["javascript"],
+          createFeatures([Feature.OverlayAnalysisMatchCodeqlVersion]),
+          getRunnerLogger(true),
+        );
+      t.deepEqual(result, [
+        { cliVersion: "2.20.1", tagName: "codeql-bundle-v2.20.1" },
+        { cliVersion: "2.20.0", tagName: "codeql-bundle-v2.20.0" },
+      ]);
+    });
  },
 );

@@ -1755,21 +1777,25 @@ test.serial(
      },
    ]);

-    const result = await setupCodeql.getEnabledVersionsWithOverlayBaseDatabases(
-      overlayMatchEnabledVersions,
-      ["javascript"],
-      createFeatures([Feature.OverlayAnalysisMatchCodeqlVersionDryRun]),
-      getRunnerLogger(true),
-    );
-    t.deepEqual(
-      result,
-      [],
-      "Dry-run should return an empty list so the caller falls back.",
-    );
-    t.assert(
-      listStub.calledOnce,
-      "Dry-run should still list Actions caches to populate the diagnostic.",
-    );
+    await withTmpDir(async (tmpDir) => {
+      setupActionsVars(tmpDir, tmpDir);
+      const result =
+        await setupCodeql.getEnabledVersionsWithOverlayBaseDatabases(
+          overlayMatchEnabledVersions,
+          ["javascript"],
+          createFeatures([Feature.OverlayAnalysisMatchCodeqlVersionDryRun]),
+          getRunnerLogger(true),
+        );
+      t.deepEqual(
+        result,
+        [],
+        "Dry-run should return an empty list so the caller falls back.",
+      );
+      t.assert(
+        listStub.calledOnce,
+        "Dry-run should still list Actions caches to populate the diagnostic.",
+      );
+    });
  },
 );

@@ -1783,18 +1809,22 @@ test.serial(
      },
    ]);

-    const result = await setupCodeql.getEnabledVersionsWithOverlayBaseDatabases(
-      overlayMatchEnabledVersions,
-      ["javascript"],
-      createFeatures([
-        Feature.OverlayAnalysisMatchCodeqlVersion,
-        Feature.OverlayAnalysisMatchCodeqlVersionDryRun,
-      ]),
-      getRunnerLogger(true),
-    );
-    t.deepEqual(result, [
-      { cliVersion: "2.20.1", tagName: "codeql-bundle-v2.20.1" },
-    ]);
+    await withTmpDir(async (tmpDir) => {
+      setupActionsVars(tmpDir, tmpDir);
+      const result =
+        await setupCodeql.getEnabledVersionsWithOverlayBaseDatabases(
+          overlayMatchEnabledVersions,
+          ["javascript"],
+          createFeatures([
+            Feature.OverlayAnalysisMatchCodeqlVersion,
+            Feature.OverlayAnalysisMatchCodeqlVersionDryRun,
+          ]),
+          getRunnerLogger(true),
+        );
+      t.deepEqual(result, [
+        { cliVersion: "2.20.1", tagName: "codeql-bundle-v2.20.1" },
+      ]);
+    });
  },
 );

@@ -4,6 +4,7 @@ import * as path from "path";
 import { performance } from "perf_hooks";

 import * as toolcache from "@actions/tool-cache";
+import { default as deepEqual } from "fast-deep-equal";
 import * as semver from "semver";
 import { v4 as uuidV4 } from "uuid";

@@ -12,6 +13,7 @@ import {
  isAnalyzingPullRequest,
  isDynamicWorkflow,
  isGitHubHostedRunner,
+  isRunningLocalAction,
 } from "./actions-util";
 import * as api from "./api-client";
 import {
@@ -42,7 +44,6 @@ import {
  logPerLanguageBundleFallback,
 } from "./per-language-bundles";
 import { getBundlePlatform } from "./platform";
-import { getCodeQLAssetDownloadURL } from "./setup/repository";
 import * as tar from "./tar";
 import {
  deleteToolcacheBundles,
@@ -64,6 +65,7 @@ export enum ToolsSource {
  Download = "DOWNLOAD",
 }

+const CODEQL_DEFAULT_ACTION_REPOSITORY = "github/codeql-action";
 const CODEQL_NIGHTLIES_REPOSITORY_OWNER = "dsp-testing";
 const CODEQL_NIGHTLIES_REPOSITORY_NAME = "codeql-cli-nightlies";

@@ -71,6 +73,75 @@ const CODEQL_BUNDLE_VERSION_ALIAS: string[] = ["linked", "latest"];
 const CODEQL_NIGHTLY_TOOLS_INPUTS = ["nightly", "nightly-latest"];
 const CODEQL_TOOLCACHE_INPUT = "toolcache";

+export function getCodeQLActionRepository(logger: Logger): string {
+  if (isRunningLocalAction()) {
+    // This handles the case where the Action does not come from an Action repository,
+    // e.g. our integration tests which use the Action code from the current checkout.
+    // In these cases, the GITHUB_ACTION_REPOSITORY environment variable is not set.
+    logger.info(
+      "The CodeQL Action is checked out locally. Using the default CodeQL Action repository.",
+    );
+    return CODEQL_DEFAULT_ACTION_REPOSITORY;
+  }
+
+  return util.getRequiredEnvParam("GITHUB_ACTION_REPOSITORY");
+}
+
+async function getCodeQLBundleDownloadURL(
+  tagName: string,
+  apiDetails: api.GitHubApiDetails,
+  codeQLBundleName: string,
+  logger: Logger,
+): Promise<string> {
+  const codeQLActionRepository = getCodeQLActionRepository(logger);
+  const potentialDownloadSources = [
+    // This GitHub instance, and this Action.
+    [apiDetails.url, codeQLActionRepository],
+    // This GitHub instance, and the canonical Action.
+    [apiDetails.url, CODEQL_DEFAULT_ACTION_REPOSITORY],
+    // GitHub.com, and the canonical Action.
+    [util.GITHUB_DOTCOM_URL, CODEQL_DEFAULT_ACTION_REPOSITORY],
+  ];
+  // We now filter out any duplicates.
+  // Duplicates will happen either because the GitHub instance is GitHub.com, or because the Action is not a fork.
+  const uniqueDownloadSources = potentialDownloadSources.filter(
+    (source, index, self) => {
+      return !self.slice(0, index).some((other) => deepEqual(source, other));
+    },
+  );
+  for (const downloadSource of uniqueDownloadSources) {
+    const [apiURL, repository] = downloadSource;
+    // If we've reached the final case, short-circuit the API check since we know the bundle exists and is public.
+    if (
+      apiURL === util.GITHUB_DOTCOM_URL &&
+      repository === CODEQL_DEFAULT_ACTION_REPOSITORY
+    ) {
+      break;
+    }
+    const [repositoryOwner, repositoryName] = repository.split("/");
+    try {
+      const release = await api.getApiClient().rest.repos.getReleaseByTag({
+        owner: repositoryOwner,
+        repo: repositoryName,
+        tag: tagName,
+      });
+      for (const asset of release.data.assets) {
+        if (asset.name === codeQLBundleName) {
+          logger.info(
+            `Found CodeQL bundle ${codeQLBundleName} in ${repository} on ${apiURL} with URL ${asset.url}.`,
+          );
+          return asset.url;
+        }
+      }
+    } catch (e) {
+      logger.info(
+        `Looked for CodeQL bundle ${codeQLBundleName} in ${repository} on ${apiURL} but got error ${e}.`,
+      );
+    }
+  }
+  return `https://github.com/${CODEQL_DEFAULT_ACTION_REPOSITORY}/releases/download/${tagName}/${codeQLBundleName}`;
+}
+
 function tryGetBundleVersionFromTagName(
  tagName: string,
  logger: Logger,
@@ -649,10 +720,9 @@ export async function getCodeQLSource(
        ? "zstd"
        : "gzip";

-    const action = { env: getEnv(), logger };
    const platform = getBundlePlatform();
    const perLanguageBundleLanguage = await getPerLanguageBundleLanguage(
-      { ...action, features },
+      { env: getEnv(), features, logger },
      {
        rawLanguages,
        otherLanguagePacksReason,
@@ -665,11 +735,11 @@ export async function getCodeQLSource(

    // Resolves the combined or per-language bundle URL for the requested release.
    const resolveBundleURL = (language?: BuiltInLanguage) =>
-      getCodeQLAssetDownloadURL(
-        action,
-        apiDetails,
+      getCodeQLBundleDownloadURL(
        bundleTagName,
+        apiDetails,
        getCodeQLBundleName(compressionMethod, platform, language),
+        logger,
      );

    const combinedBundleURL = await resolveBundleURL();
@@ -1,35 +0,0 @@
-import * as path from "path";
-
-import test from "ava";
-import * as sinon from "sinon";
-
-import * as actionsUtil from "../actions-util";
-import { ActionsEnvVars } from "../environment";
-import { callee, getTestEnv, setupTests } from "../testing-utils";
-import { initializeEnvironment } from "../util";
-
-import { getCodeQLActionRepository } from "./repository";
-
-setupTests(test);
-
-test.serial("getCodeQLActionRepository", async (t) => {
-  const initialEnv = getTestEnv({
-    [ActionsEnvVars.RUNNER_TEMP]: path.dirname(__dirname),
-  });
-  initializeEnvironment("1.2.3", initialEnv);
-
-  const target = callee(getCodeQLActionRepository)
-    .withArgs()
-    .withEnv(initialEnv);
-
-  // isRunningLocalAction() === true
-  await target.passes(t.deepEqual, "github/codeql-action");
-
-  // isRunningLocalAction() === false
-  sinon.stub(actionsUtil, "isRunningLocalAction").returns(false);
-  await target
-    .withEnv((env) => {
-      env.set(ActionsEnvVars.GITHUB_ACTION_REPOSITORY, "xxx/yyy");
-    })
-    .passes(t.deepEqual, "xxx/yyy");
-});
@@ -1,158 +0,0 @@
-import { ActionState } from "../action-common";
-import { isRunningLocalAction } from "../actions-util";
-import * as api from "../api-client";
-import { ActionsEnvVars } from "../environment";
-import {
-  isRepositoryNwoStr,
-  parseRepositoryNwo,
-  type RepositoryNwoStr,
-} from "../repository";
-import { GITHUB_DOTCOM_URL, type InstanceURL } from "../util";
-
-/** The NWO of the standard CodeQL Action repository. */
-export const CODEQL_DEFAULT_ACTION_REPOSITORY = "github/codeql-action";
-
-/**
- * Retrieves the NWO of the repository that the CodeQL Action is loaded from.
- * Typically, this will be `github/codeql-action`, but it may be something else for
- * forks of the Action or in environments other than GitHub.com.
- *
- * If this function detects that we are running the Action locally (e.g. in tests),
- * then we default to `CODEQL_DEFAULT_ACTION_REPOSITORY`.
- */
-export function getCodeQLActionRepository(
-  action: ActionState<["ReadOnlyEnv", "Logger"]>,
-): RepositoryNwoStr {
-  if (isRunningLocalAction(action.env)) {
-    // This handles the case where the Action does not come from an Action repository,
-    // e.g. our integration tests which use the Action code from the current checkout.
-    // In these cases, the GITHUB_ACTION_REPOSITORY environment variable is not set.
-    action.logger.info(
-      "The CodeQL Action is checked out locally. Using the default CodeQL Action repository.",
-    );
-    return CODEQL_DEFAULT_ACTION_REPOSITORY;
-  }
-
-  const actionRepository = action.env.getRequired(
-    ActionsEnvVars.GITHUB_ACTION_REPOSITORY,
-  );
-
-  if (isRepositoryNwoStr(actionRepository)) {
-    return actionRepository;
-  }
-
-  throw new Error(
-    `The value of '${ActionsEnvVars.GITHUB_ACTION_REPOSITORY}' is '${actionRepository}', which does not match the expected 'owner/repo' format.`,
-  );
-}
-
-/**A download source is a pair of strings. */
-export type DownloadSource = [InstanceURL, RepositoryNwoStr];
-
-/** GitHub.com, and the canonical Action. */
-export const DEFAULT_DOWNLOAD_SOURCE: DownloadSource = [
-  GITHUB_DOTCOM_URL,
-  CODEQL_DEFAULT_ACTION_REPOSITORY,
-];
-
-/** Decides if the two provided download sources are the same. */
-const isSameDownloadSource = (
-  [srcUrl, srcRepo]: DownloadSource,
-  [otherUrl, otherRepo]: DownloadSource,
-) => {
-  return srcUrl === otherUrl && srcRepo === otherRepo;
-};
-
-/** A download URL is represented as a string. */
-export type DownloadURL = string;
-
-/** Gets the default GitHub.com download URL for `assetName` in a release tagged `tagName`. */
-export function getDefaultDotcomDownloadURL(
-  tagName: string,
-  assetName: string,
-): DownloadURL {
-  return `${GITHUB_DOTCOM_URL}/${CODEQL_DEFAULT_ACTION_REPOSITORY}/releases/download/${tagName}/${assetName}`;
-}
-
-/** Enumerates log-friendly descriptions of different kinds of assets we might look for in releases. */
-export type ReleaseAssetKind = "CodeQL bundle" | "private registry proxy";
-
-/**
- * Tries to find a download URL for `assetName` in a release tagged with `tagName`.
- *
- * Depending on where and how the CodeQL Action is running, we may be using different `apiDetails` and there may be
- * different options for where to source CodeQL releases from.
- *
- * This function either returns the download URL for the asset for the first release we find, or
- * defaults to the assumed download URL for the asset on the default CodeQL Action repository on GitHub.com.
- * In the latter case, this function does not guarantee that the asset actually exists.
- *
- * @param action The Action state.
- * @param apiDetails The details of the GitHub API in use.
- * @param tagName The name of the release tag we want to obtain the asset from.
- * @param assetName The name of the asset we should look for in the release.
- * @param [assetKind="CodeQL bundle"] The kind of asset we are looking for to show in log messages.
- * @returns A URL that we can use to download the asset.
- */
-export async function getCodeQLAssetDownloadURL(
-  action: ActionState<["ReadOnlyEnv", "Logger"]>,
-  apiDetails: api.GitHubApiDetails,
-  tagName: string,
-  assetName: string,
-  assetKind: ReleaseAssetKind = "CodeQL bundle",
-): Promise<DownloadURL> {
-  const codeQLActionRepository = getCodeQLActionRepository(action);
-
-  const potentialDownloadSources: DownloadSource[] = [
-    // This GitHub instance, and this Action.
-    [apiDetails.url, codeQLActionRepository],
-    // This GitHub instance, and the canonical Action.
-    [apiDetails.url, CODEQL_DEFAULT_ACTION_REPOSITORY],
-    // GitHub.com, and the canonical Action.
-    DEFAULT_DOWNLOAD_SOURCE,
-  ];
-
-  // We now filter out any duplicates.
-  // Duplicates will happen either because the GitHub instance is GitHub.com, or because the Action is not a fork.
-  const uniqueDownloadSources = potentialDownloadSources.filter(
-    (source, index, self) => {
-      return !self
-        .slice(0, index)
-        .some((other) => isSameDownloadSource(source, other));
-    },
-  );
-
-  for (const [instanceURL, repository] of uniqueDownloadSources) {
-    // If we've reached the final case, short-circuit the API check since we know the asset exists and is public.
-    if (
-      isSameDownloadSource(DEFAULT_DOWNLOAD_SOURCE, [instanceURL, repository])
-    ) {
-      break;
-    }
-
-    const { owner: repositoryOwner, repo: repositoryName } =
-      parseRepositoryNwo(repository);
-    try {
-      const release = await api.getApiClient().rest.repos.getReleaseByTag({
-        owner: repositoryOwner,
-        repo: repositoryName,
-        tag: tagName,
-      });
-
-      for (const asset of release.data.assets) {
-        if (asset.name === assetName) {
-          action.logger.info(
-            `Found ${assetKind} ${assetName} in ${repository} on ${instanceURL} with URL ${asset.url}.`,
-          );
-          return asset.url;
-        }
-      }
-    } catch (e) {
-      action.logger.info(
-        `Looked for ${assetKind} ${assetName} in ${repository} on ${instanceURL} but got error ${e}.`,
-      );
-    }
-  }
-
-  return getDefaultDotcomDownloadURL(tagName, assetName);
-}
@@ -10,7 +10,7 @@ import {
  runInActions,
 } from "./action-common";
 import * as actionsUtil from "./actions-util";
-import { getApiDetails, getGitHubVersion } from "./api-client";
+import { getGitHubVersion } from "./api-client";
 import { FeatureEnablement, initFeatures } from "./feature-flags";
 import { BuiltInLanguage, parseBuiltInLanguage } from "./languages";
 import { Logger } from "./logging";
@@ -104,10 +104,7 @@ async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) {

    // Start the Proxy
    const actionWithFeatures = extendActionState(action, { features });
-    const proxyBin = await getProxyBinaryPath(
-      actionWithFeatures,
-      getApiDetails(action.env),
-    );
+    const proxyBin = await getProxyBinaryPath(actionWithFeatures);
    const proxyInfo = await startProxy(
      proxyBin,
      proxyConfig,
@@ -6,21 +6,17 @@ import test, { ExecutionContext } from "ava";
 import sinon from "sinon";

 import { ActionState } from "./action-common";
-import * as actionsUtil from "./actions-util";
 import * as apiClient from "./api-client";
 import * as defaults from "./defaults.json";
-import { ActionsEnvVars } from "./environment";
 import { setUpFeatureFlagTests } from "./feature-flags/testing-util";
 import { UnvalidatedObject, validateSchema } from "./json";
 import { makeFromSchema } from "./json/testing-util";
 import { BuiltInLanguage } from "./languages";
 import { getRunnerLogger, Logger } from "./logging";
 import { BundlePlatform, getBundlePlatform } from "./platform";
-import * as repository from "./setup/repository";
 import * as startProxyExports from "./start-proxy";
 import * as statusReport from "./status-report";
 import {
-  addSinonAssertions,
  assertNotLogged,
  checkExpectedLogMessages,
  createFeatures,
@@ -28,7 +24,6 @@ import {
  makeMacro,
  makeTestToken,
  RecordingLogger,
-  SAMPLE_DOTCOM_API_DETAILS,
  setupTests,
  withRecordingLoggerAsync,
 } from "./testing-utils";
@@ -710,29 +705,18 @@ function mockGetApiClient(endpoints: any) {

 type ReleaseAssets = Array<{ name: string; url?: string }>;

-function mockGetReleaseByTag(expectedTag?: string, assets?: ReleaseAssets) {
+function mockGetReleaseByTag(assets?: ReleaseAssets) {
  const getReleaseByTag =
    assets === undefined
      ? sinon.stub().rejects()
-      : sinon.stub().callsFake(({ tag }) => {
-          if (tag === expectedTag) {
-            return {
-              status: 200,
-              data: { assets },
-              headers: {},
-              url: "GET /repos/:owner/:repo/releases/tags/:tag",
-            };
-          } else {
-            return {
-              status: 404,
-            };
-          }
+      : sinon.stub().resolves({
+          status: 200,
+          data: { assets },
+          headers: {},
+          url: "GET /repos/:owner/:repo/releases/tags/:tag",
        });

-  return {
-    getReleaseByTag,
-    getApiClient: mockGetApiClient({ repos: { getReleaseByTag } }),
-  };
+  return mockGetApiClient({ repos: { getReleaseByTag } });
 }

 function mockOfflineFeatures(tempDir: string, logger: Logger) {
@@ -767,33 +751,25 @@ test.serial(
        logger,
        features,
      });
+      const info = await startProxyExports.getDownloadUrl(state);

-      // Stub this to always return `true` so we get the default repo for the tests.
-      sinon.stub(actionsUtil, "isRunningLocalAction").returns(true);
-
-      const info = await startProxyExports.getDownloadUrl(
-        state,
-        SAMPLE_DOTCOM_API_DETAILS,
+      t.is(info.version, startProxyExports.UPDATEJOB_PROXY_VERSION);
+      t.is(
+        info.url,
+        startProxyExports.getFallbackUrl(
+          startProxyExports.getProxyPackage(BundlePlatform.Linux64),
+        ),
      );

      t.true(
        logger.hasMessage(`Unsupported platform android on architecture ppc`),
      );
-
-      t.is(info.version, defaults.cliVersion);
-      t.is(
-        info.url,
-        repository.getDefaultDotcomDownloadURL(
-          defaults.bundleVersion,
-          startProxyExports.getProxyPackage(BundlePlatform.Linux64),
-        ),
-      );
    });
  },
 );

 test.serial(
-  "getDownloadUrl returns default bundle URL for linked version",
+  "getDownloadUrl returns fallback when `getReleaseByVersion` rejects",
  async (t) => {
    const logger = new RecordingLogger();
    mockGetReleaseByTag();
@@ -801,20 +777,12 @@ test.serial(
    await withTmpDir(async (tempDir) => {
      const features = mockOfflineFeatures(tempDir, logger);
      const state = initAllState({ logger, features });
+      const info = await startProxyExports.getDownloadUrl(state);

-      // Stub this to always return `true` so we get the default repo for the tests.
-      sinon.stub(actionsUtil, "isRunningLocalAction").returns(true);
-
-      const info = await startProxyExports.getDownloadUrl(
-        state,
-        SAMPLE_DOTCOM_API_DETAILS,
-      );
-
-      t.is(info.version, defaults.cliVersion);
+      t.is(info.version, startProxyExports.UPDATEJOB_PROXY_VERSION);
      t.is(
        info.url,
-        repository.getDefaultDotcomDownloadURL(
-          defaults.bundleVersion,
+        startProxyExports.getFallbackUrl(
          startProxyExports.getProxyPackage(getTestPlatform(state)),
        ),
      );
@@ -823,7 +791,7 @@ test.serial(
 );

 test.serial(
-  "getDownloadUrl doesn't check that the default asset exists",
+  "getDownloadUrl returns fallback when there's no matching release asset",
  async (t) => {
    const logger = new RecordingLogger();
    const testAssets = [[], [{ name: "foo" }]];
@@ -832,28 +800,19 @@ test.serial(
      const features = mockOfflineFeatures(tempDir, logger);
      const state = initAllState({ logger, features });

-      // Stub this to always return `true` so we get the default repo for the tests.
-      sinon.stub(actionsUtil, "isRunningLocalAction").returns(true);
-
      for (const assets of testAssets) {
-        const stubs = mockGetReleaseByTag(defaults.bundleVersion, assets);
-        const info = await startProxyExports.getDownloadUrl(
-          state,
-          SAMPLE_DOTCOM_API_DETAILS,
-        );
+        const stub = mockGetReleaseByTag(assets);
+        const info = await startProxyExports.getDownloadUrl(state);

-        t.is(info.version, defaults.cliVersion);
+        t.is(info.version, startProxyExports.UPDATEJOB_PROXY_VERSION);
        t.is(
          info.url,
-          repository.getDefaultDotcomDownloadURL(
-            defaults.bundleVersion,
+          startProxyExports.getFallbackUrl(
            startProxyExports.getProxyPackage(getTestPlatform(state)),
          ),
        );

-        // mockGetReleaseByTag stubs the global getApiClient; since we are calling
-        // that in a loop, we need to manually restore it here
-        stubs.getApiClient.restore();
+        stub.restore();
      }
    });
  },
@@ -869,22 +828,11 @@ test.serial("getDownloadUrl returns matching release asset", async (t) => {
      url: "url-we-want",
    },
  ];
-  const stubs = mockGetReleaseByTag(defaults.bundleVersion, assets);
+  mockGetReleaseByTag(assets);

  await withTmpDir(async (tempDir) => {
-    state.env.set(ActionsEnvVars.RUNNER_TEMP, tempDir);
    const features = mockOfflineFeatures(tempDir, logger);
-
-    // Stub this to always return `false` so we force `getCodeQLAssetDownloadURL` to use the (mocked) API.
-    sinon.stub(actionsUtil, "isRunningLocalAction").returns(false);
-    state.env.set(ActionsEnvVars.GITHUB_ACTION_REPOSITORY, "test/repo");
-
-    const info = await startProxyExports.getDownloadUrl(
-      { ...state, features },
-      SAMPLE_DOTCOM_API_DETAILS,
-    );
-
-    t.is(stubs.getReleaseByTag.callCount, 1);
+    const info = await startProxyExports.getDownloadUrl({ ...state, features });

    t.is(info.version, defaults.cliVersion);
    t.is(info.url, "url-we-want");
@@ -1017,13 +965,9 @@ test.serial(
      const toolcachePath = "/path/to/proxy/dir";
      sinon.stub(toolcache, "find").returns(toolcachePath);

-      // Stub this to always return `true` so we get the default repo for the tests.
-      sinon.stub(actionsUtil, "isRunningLocalAction").returns(true);
-
      const features = mockOfflineFeatures(tempDir, logger);
      const path = await startProxyExports.getProxyBinaryPath(
        initAllState({ logger, features }),
-        SAMPLE_DOTCOM_API_DETAILS,
      );

      t.assert(path);
@@ -1041,7 +985,7 @@ test.serial(
    const logger = new RecordingLogger();
    const state = initAllState({ logger });
    const downloadUrl = "url-we-want";
-    const stubs = mockGetReleaseByTag(defaults.bundleVersion, [
+    mockGetReleaseByTag([
      {
        name: startProxyExports.getProxyPackage(getTestPlatform(state)),
        url: downloadUrl,
@@ -1050,6 +994,11 @@ test.serial(

    const toolcachePath = "/path/to/proxy/dir";
    const find = sinon.stub(toolcache, "find").returns("");
+    const getApiDetails = sinon.stub(apiClient, "getApiDetails").returns({
+      auth: "",
+      url: "",
+      apiURL: "",
+    });
    const getAuthorizationHeaderFor = sinon
      .stub(apiClient, "getAuthorizationHeaderFor")
      .returns(undefined);
@@ -1063,27 +1012,17 @@ test.serial(
      .resolves(extractedPath);
    const cacheDir = sinon.stub(toolcache, "cacheDir").resolves(toolcachePath);

-    // Stub this to always return `false` so we force `getCodeQLAssetDownloadURL` to use the (mocked) API.
-    sinon.stub(actionsUtil, "isRunningLocalAction").returns(false);
-    state.env.set(ActionsEnvVars.GITHUB_ACTION_REPOSITORY, "test/repo");
+    const path = await startProxyExports.getProxyBinaryPath({
+      ...state,
+      features: createFeatures([]),
+    });

-    const path = await startProxyExports.getProxyBinaryPath(
-      {
-        ...state,
-        features: createFeatures([]),
-      },
-      SAMPLE_DOTCOM_API_DETAILS,
-    );
-
-    t.is(stubs.getReleaseByTag.callCount, 1);
    t.assert(find.calledOnce);
+    t.assert(getApiDetails.calledOnce);
    t.assert(getAuthorizationHeaderFor.calledOnce);
-
-    const st = addSinonAssertions(t);
-    st.onceWith(downloadTool, downloadUrl);
-    st.onceWith(extractTar, archivePath);
-    st.onceWith(cacheDir, extractedPath);
-
+    t.assert(downloadTool.calledOnceWith(downloadUrl));
+    t.assert(extractTar.calledOnceWith(archivePath));
+    t.assert(cacheDir.calledOnceWith(extractedPath));
    t.assert(path);
    t.is(
      path,
@@ -1091,7 +1030,7 @@ test.serial(
    );

    checkExpectedLogMessages(t, logger.messages, [
-      `Found private registry proxy ${startProxyExports.getProxyPackage(getTestPlatform(state))} in test/repo on https://github.com with URL ${downloadUrl}`,
+      `Found '${startProxyExports.getProxyPackage(getTestPlatform(state))}' in release '${defaults.bundleVersion}' at '${downloadUrl}'`,
    ]);
  },
 );
@@ -1103,8 +1042,8 @@ test.serial(
    const state = initAllState({ logger });
    const expectedTag = "codeql-bundle-v2.20.1";
    const expectedParams = {
-      owner: "test",
-      repo: "repo",
+      owner: "github",
+      repo: "codeql-action",
      tag: expectedTag,
    };
    const downloadUrl = "url-we-want";
@@ -1127,6 +1066,11 @@ test.serial(
    await withTmpDir(async (tempDir) => {
      const toolcachePath = "/path/to/proxy/dir";
      const find = sinon.stub(toolcache, "find").returns("");
+      const getApiDetails = sinon.stub(apiClient, "getApiDetails").returns({
+        auth: "",
+        url: "",
+        apiURL: "",
+      });
      const getAuthorizationHeaderFor = sinon
        .stub(apiClient, "getAuthorizationHeaderFor")
        .returns(undefined);
@@ -1156,28 +1100,22 @@ test.serial(
        .resolves({
          enabledVersions: [{ cliVersion: "2.20.1", tagName: expectedTag }],
        });
-
-      // Stub this to always return `false` so we force `getCodeQLAssetDownloadURL` to use the (mocked) API.
-      sinon.stub(actionsUtil, "isRunningLocalAction").returns(false);
-      state.env.set(ActionsEnvVars.GITHUB_ACTION_REPOSITORY, "test/repo");
-
-      const path = await startProxyExports.getProxyBinaryPath(
-        {
-          ...state,
-          features,
-        },
-        SAMPLE_DOTCOM_API_DETAILS,
-      );
+      const path = await startProxyExports.getProxyBinaryPath({
+        ...state,
+        features,
+      });

      t.assert(getDefaultCliVersion.calledOnce);
-
-      const st = addSinonAssertions(t);
-      st.onceWith(getReleaseByTag, expectedParams);
+      sinon.assert.calledOnceWithMatch(
+        getReleaseByTag,
+        sinon.match(expectedParams),
+      );
      t.assert(find.calledOnce);
+      t.assert(getApiDetails.calledOnce);
      t.assert(getAuthorizationHeaderFor.calledOnce);
-      st.onceWith(downloadTool, downloadUrl);
-      st.onceWith(extractTar, archivePath);
-      st.onceWith(cacheDir, extractedPath);
+      t.assert(downloadTool.calledOnceWith(downloadUrl));
+      t.assert(extractTar.calledOnceWith(archivePath));
+      t.assert(cacheDir.calledOnceWith(extractedPath));

      t.assert(path);
      t.is(
@@ -1187,7 +1125,7 @@ test.serial(
    });

    checkExpectedLogMessages(t, logger.messages, [
-      `Found private registry proxy ${startProxyExports.getProxyPackage(getTestPlatform(state))} in test/repo on https://github.com with URL url-we-want.`,
+      `Found '${startProxyExports.getProxyPackage(getTestPlatform(state))}' in release '${expectedTag}' at '${downloadUrl}'`,
    ]);
  },
 );
@@ -5,9 +5,10 @@ import * as toolcache from "@actions/tool-cache";

 import { ActionState } from "./action-common";
 import {
+  getApiClient,
+  getApiDetails,
  getAuthorizationHeaderFor,
  getGitHubVersion,
-  GitHubApiDetails,
 } from "./api-client";
 import * as artifactScanner from "./artifact-scanner";
 import { Config } from "./config-utils";
@@ -21,7 +22,6 @@ import * as json from "./json";
 import { BuiltInLanguage } from "./languages";
 import { Logger } from "./logging";
 import { BundlePlatform, getBundlePlatform } from "./platform";
-import { getCodeQLAssetDownloadURL } from "./setup/repository";
 import {
  Address,
  Registry,
@@ -171,8 +171,10 @@ export async function sendFailedStatusReport(
  }
 }

-/** The basename of the proxy artifacts. */
 export const UPDATEJOB_PROXY = "update-job-proxy";
+export const UPDATEJOB_PROXY_VERSION = "v2.0.20250624110901";
+const UPDATEJOB_PROXY_URL_PREFIX =
+  "https://github.com/github/codeql-action/releases/download/codeql-bundle-v2.22.0/";

 function isPAT(value: string) {
  return artifactScanner.isAuthToken(value, [
@@ -377,6 +379,30 @@ export function getProxyPackage(platform: BundlePlatform): string {
  return `${UPDATEJOB_PROXY}-${platform}.tar.gz`;
 }

+/**
+ * Gets the fallback URL for downloading the proxy release asset.
+ *
+ * @param proxyPackage The asset name.
+ * @returns The full URL to download the specified asset from the fallback release.
+ */
+export function getFallbackUrl(proxyPackage: string): string {
+  return `${UPDATEJOB_PROXY_URL_PREFIX}${proxyPackage}`;
+}
+
+/**
+ * Uses the GitHub API to obtain information about the CodeQL CLI bundle release
+ * that is tagged by `version`.
+ *
+ * @returns The response from the GitHub API.
+ */
+async function getReleaseByVersion(version: string) {
+  return getApiClient().rest.repos.getReleaseByTag({
+    owner: "github",
+    repo: "codeql-action",
+    tag: version,
+  });
+}
+
 /** Uses `features` to determine the default CLI version. */
 async function getCliVersionFromFeatures(
  features: FeatureEnablement,
@@ -393,8 +419,7 @@ async function getCliVersionFromFeatures(
 * @returns Returns the download URL and version of the proxy package we plan to use.
 */
 export async function getDownloadUrl(
-  action: ActionState<["Base", "ReadOnlyEnv", "Logger", "FeatureFlags"]>,
-  apiDetails: GitHubApiDetails,
+  action: ActionState<["Base", "Logger", "FeatureFlags"]>,
 ): Promise<{ url: string; version: string }> {
  // Default to linux64 if we don't recognise the platform+arch pair.
  // This maintains the behaviour we had before switching to `getBundlePlatform` here.
@@ -423,26 +448,37 @@ export async function getDownloadUrl(
        };

    // Try to retrieve information about the CLI bundle release identified by `versionInfo`.
-    const proxyAssetUrl = await getCodeQLAssetDownloadURL(
-      action,
-      apiDetails,
-      versionInfo.tagName,
-      proxyPackage,
-      "private registry proxy",
-    );
+    const cliRelease = await getReleaseByVersion(versionInfo.tagName);

-    return {
-      url: proxyAssetUrl,
-      // The `update-job-proxy` doesn't have a version as such. Since we now bundle it
-      // with CodeQL CLI bundle releases, we use the corresponding CLI version to
-      // differentiate between (potentially) different versions of `update-job-proxy`.
-      version: versionInfo.cliVersion,
-    };
+    // Search the release's assets to find the one we are looking for.
+    for (const asset of cliRelease.data.assets) {
+      if (asset.name === proxyPackage) {
+        action.logger.info(
+          `Found '${proxyPackage}' in release '${versionInfo.tagName}' at '${asset.url}'`,
+        );
+        return {
+          url: asset.url,
+          // The `update-job-proxy` doesn't have a version as such. Since we now bundle it
+          // with CodeQL CLI bundle releases, we use the corresponding CLI version to
+          // differentiate between (potentially) different versions of `update-job-proxy`.
+          version: versionInfo.cliVersion,
+        };
+      }
+    }
  } catch (ex) {
-    throw new Error(
+    action.logger.warning(
      `Failed to retrieve information about the linked release: ${getErrorMessage(ex)}`,
    );
  }
+
+  // Fallback to the hard-coded URL.
+  action.logger.info(
+    `Did not find '${proxyPackage}' in the linked release, falling back to hard-coded version.`,
+  );
+  return {
+    url: getFallbackUrl(proxyPackage),
+    version: UPDATEJOB_PROXY_VERSION,
+  };
 }

 /**
@@ -461,14 +497,9 @@ export async function downloadProxy(
  try {
    // Download the proxy archive from `url`. We let `downloadTool` choose where
    // to store it. The path to the downloaded file will be returned if successful.
-    return await toolcache.downloadTool(
-      url,
-      /* dest: */ undefined,
-      authorization,
-      {
-        accept: "application/octet-stream",
-      },
-    );
+    return toolcache.downloadTool(url, /* dest: */ undefined, authorization, {
+      accept: "application/octet-stream",
+    });
  } catch (error) {
    logger.error(
      `Failed to download proxy archive from ${url}: ${getErrorMessage(error)}`,
@@ -538,48 +569,28 @@ export function getProxyFilename() {
 * @returns The path to the proxy binary.
 */
 export async function getProxyBinaryPath(
-  action: ActionState<["Base", "ReadOnlyEnv", "Logger", "FeatureFlags"]>,
-  apiDetails: GitHubApiDetails,
+  action: ActionState<["Base", "Logger", "FeatureFlags"]>,
 ): Promise<string> {
  const logger = action.logger;
-  logger.startGroup("Setting up authentication proxy");
+  const proxyFileName = getProxyFilename();
+  const proxyInfo = await getDownloadUrl(action);

-  try {
-    const proxyFileName = getProxyFilename();
-    const proxyInfo = await getDownloadUrl(action, apiDetails);
-
-    logger.info(
-      `Using authentication proxy from CodeQL release ${proxyInfo.version}.`,
+  let proxyBin = toolcache.find(proxyFileName, proxyInfo.version);
+  if (!proxyBin) {
+    const apiDetails = getApiDetails();
+    const authorization = getAuthorizationHeaderFor(
+      logger,
+      apiDetails,
+      proxyInfo.url,
+    );
+    const temp = await downloadProxy(logger, proxyInfo.url, authorization);
+    const extracted = await extractProxy(logger, temp);
+    proxyBin = await cacheProxy(
+      logger,
+      extracted,
+      proxyFileName,
+      proxyInfo.version,
    );
-
-    let proxyDir = toolcache.find(proxyFileName, proxyInfo.version);
-
-    if (!proxyDir) {
-      logger.info(
-        `Authentication proxy is not in the toolcache. Will try to download it from '${proxyInfo.url}'.`,
-      );
-
-      const authorization = getAuthorizationHeaderFor(
-        logger,
-        apiDetails,
-        proxyInfo.url,
-      );
-      const temp = await downloadProxy(logger, proxyInfo.url, authorization);
-
-      logger.info(`Downloaded the authentication proxy asset to '${temp}'.`);
-
-      const extracted = await extractProxy(logger, temp);
-      proxyDir = await cacheProxy(
-        logger,
-        extracted,
-        proxyFileName,
-        proxyInfo.version,
-      );
-
-      logger.info(`Extracted the authentication proxy to '${proxyDir}'.`);
-    }
-    return path.join(proxyDir, proxyFileName);
-  } finally {
-    logger.endGroup();
  }
+  return path.join(proxyBin, proxyFileName);
 }
@@ -378,7 +378,7 @@ export async function createStatusReportBase(
  try {
    const commitOid =
      getOptionalInput("sha") || process.env["GITHUB_SHA"] || "";
-    const ref = await getRef(getEnv(), config?.repositoryRoot);
+    const ref = await getRef();
    const jobRunUUID = process.env[EnvVar.JOB_RUN_UUID] || "";
    const workflowRunID = getWorkflowRunID();
    const workflowRunAttempt = getWorkflowRunAttempt();
@@ -1,4 +1,5 @@
 import { TextDecoder } from "node:util";
+import * as os from "os";
 import path from "path";

 import * as github from "@actions/github";
@@ -34,6 +35,7 @@ import { Logger } from "./logging";
 import { OverlayDatabaseMode } from "./overlay/overlay-database-mode";
 import { getBundlePlatform } from "./platform";
 import { ActionName } from "./status-report";
+import { ToolsFeature } from "./tools-features";
 import {
  DEFAULT_DEBUG_ARTIFACT_NAME,
  DEFAULT_DEBUG_DATABASE_NAME,
@@ -163,46 +165,6 @@ export function setupTests(testFn: TestFn<any>) {
  });
 }

-export interface AvaSinonAssertions {
-  /**
-   * Asserts that `stub` must have been called once with at least the `expected` arguments.
-   */
-  onceWith: <TArgs extends readonly any[]>(
-    stub: sinon.SinonStub<TArgs>,
-    ...expected: sinon.MatchPartialArguments<TArgs>
-  ) => boolean;
-}
-
-/** Adds additional assertions for use with `sinon` to `t`. */
-export function addSinonAssertions(
-  t: ExecutionContext<unknown>,
-): ExecutionContext<unknown> & AvaSinonAssertions {
-  return {
-    ...t,
-    onceWith: <TArgs extends readonly any[]>(
-      stub: sinon.SinonStub<TArgs>,
-      ...expected: sinon.MatchPartialArguments<TArgs>
-    ) => {
-      // Fail if the stub hasn't been called at all so that we can safely compare
-      // the arguments of the first call in the else branch.
-      if (stub.callCount === 0) {
-        t.fail("The stub wasn't called.");
-      } else {
-        // Reduce the arguments of each to the same number that was provided,
-        // so that extra arguments don't lead to a failure.
-        const actual = stub.args.map<sinon.MatchPartialArguments<TArgs>>(
-          (args: TArgs) =>
-            args.slice(
-              0,
-              expected.length,
-            ) as sinon.MatchPartialArguments<TArgs>,
-        );
-        return t.deepEqual(actual, [expected]);
-      }
-    },
-  };
-}
-
 /**
 * Declare a reusable test implementation, with better type safety than `test.macro`.
 */
@@ -272,6 +234,7 @@ export function initAllState(
    startedAt: new Date(),
    platform: process.platform,
    arch: process.arch,
+    osRelease: os.release(),
    logger: new RecordingLogger(),
    env,
    actions: getTestActionsEnv(env),
@@ -910,7 +873,7 @@ export function mockLanguagesInRepo(languages: string[]) {
 */
 export const makeVersionInfo = (
  version: string,
-  features?: { [name: string]: boolean },
+  features?: { [key in ToolsFeature]?: boolean },
  overlayVersion?: number,
 ): VersionInfo => ({
  version,
@@ -1006,7 +969,6 @@ export function createTestConfig(overrides: Partial<Config>): Config {
    {},
    {
      version: getActionVersion(),
-      repositoryRoot: undefined,
      analysisKinds: [AnalysisKind.CodeScanning],
      languages: [],
      buildMode: undefined,
@@ -6,6 +6,7 @@ export enum ToolsFeature {
  BundleSupportsOverlay = "bundleSupportsOverlay",
  IndirectTracingSupportsStaticBinaries = "indirectTracingSupportsStaticBinaries",
  SuppressesMissingFileBaselineWarning = "suppressesMissingFileBaselineWarning",
+  SwiftSupportsAllPlatforms = "swiftSupportsAllPlatforms",
 }

 /**
@@ -182,7 +182,6 @@ test.serial(
        stubCodeql,
        [BuiltInLanguage.javascript, BuiltInLanguage.cpp],
        logger,
-        undefined,
      );
      t.assert(
        stubRestore.calledOnceWith(
@@ -14,7 +14,6 @@ import { Language } from "./languages";
 import { Logger } from "./logging";
 import {
  asHTTPError,
-  getEnv,
  getErrorMessage,
  tryGetFolderBytes,
  waitForResultWithTimeLimit,
@@ -44,7 +43,6 @@ const MAX_CACHE_OPERATION_MS = 120_000; // Two minutes
 * @param codeql The CodeQL instance to use.
 * @param languages The languages being analyzed.
 * @param logger A logger to record some informational messages to.
- * @param repositoryRoot The path at which the repository is checked out at.
 * @returns A partial map from languages to TRAP cache paths on disk, with
 * languages for which we shouldn't use TRAP caching omitted.
 */
@@ -52,7 +50,6 @@ export async function downloadTrapCaches(
  codeql: CodeQL,
  languages: Language[],
  logger: Logger,
-  repositoryRoot: string | undefined,
 ): Promise<{ [language: string]: string }> {
  const result: { [language: string]: string } = {};
  const languagesSupportingCaching = await getLanguagesSupportingCaching(
@@ -75,7 +72,7 @@ export async function downloadTrapCaches(
    result[language] = cacheDir;
  }

-  if (await gitUtils.isAnalyzingDefaultBranch(getEnv(), repositoryRoot)) {
+  if (await gitUtils.isAnalyzingDefaultBranch()) {
    logger.info(
      "Analyzing default branch. Skipping downloading of TRAP caches.",
    );
@@ -102,7 +99,6 @@ export async function downloadTrapCaches(
    const found = await waitForResultWithTimeLimit(
      MAX_CACHE_OPERATION_MS,
      actionsCache.restoreCache([cacheDir], preferredKey, [
-        preferredKey,
        // Fall back to any cache with the right key prefix
        await cachePrefix(codeql, language),
      ]),
@@ -136,12 +132,7 @@ export async function uploadTrapCaches(
  config: Config,
  logger: Logger,
 ): Promise<boolean> {
-  // Only upload caches from the default branch
-  if (
-    !(await gitUtils.isAnalyzingDefaultBranch(getEnv(), config.repositoryRoot))
-  ) {
-    return false;
-  }
+  if (!(await gitUtils.isAnalyzingDefaultBranch())) return false; // Only upload caches from the default branch

  for (const language of config.languages) {
    const cacheDir = config.trapCaches[language];
@@ -189,8 +180,6 @@ export async function cleanupTrapCaches(
  features: FeatureEnablement,
  logger: Logger,
 ): Promise<TrapCacheCleanupStatusReport> {
-  const env = getEnv();
-
  if (!(await features.getValue(Feature.CleanupTrapCaches))) {
    return {
      trap_cache_cleanup_skipped_because: "feature disabled",
@@ -200,7 +189,7 @@ export async function cleanupTrapCaches(
    "TRAP cache cleanup is deprecated and will be removed in May 2026. " +
      "We recommend instead disabling TRAP caching by passing the `trap-caching: false` input to the `init` Action.",
  );
-  if (!(await gitUtils.isAnalyzingDefaultBranch(env, config.repositoryRoot))) {
+  if (!(await gitUtils.isAnalyzingDefaultBranch())) {
    return {
      trap_cache_cleanup_skipped_because: "not analyzing default branch",
    };
@@ -211,7 +200,7 @@ export async function cleanupTrapCaches(

    const allCaches = await apiClient.listActionsCaches(
      CODEQL_TRAP_CACHE_PREFIX,
-      await gitUtils.getRef(env, config.repositoryRoot),
+      await gitUtils.getRef(),
    );

    for (const language of config.languages) {
@@ -14,7 +14,7 @@ import { getGitHubVersion, wrapApiConfigurationError } from "./api-client";
 import { CodeQL, getCodeQL } from "./codeql";
 import { getConfig } from "./config-utils";
 import { readDiffRangesJsonFile } from "./diff-informed-analysis-utils";
-import { ActionsEnvVars, EnvVar, exportEnvVar } from "./environment";
+import { EnvVar, exportEnvVar } from "./environment";
 import { FeatureEnablement } from "./feature-flags";
 import * as fingerprints from "./fingerprints";
 import * as gitUtils from "./git-utils";
@@ -227,6 +227,14 @@ function getAutomationID(
  return api.computeAutomationID(analysis_key, environment);
 }

+/** Gets the path to a saved payload file for {@link analysisKind}. */
+export function getSavedPayloadPath(analysisKind: analyses.AnalysisKind) {
+  return path.join(
+    actionsUtil.getTemporaryDirectory(),
+    `payload-${analysisKind}.json`,
+  );
+}
+
 /**
 * Upload the given payload.
 * If the request fails then this will retry a small number of times.
@@ -241,10 +249,7 @@ export async function uploadPayload(
  logger.info("Uploading results");

  if (util.shouldSkipSarifUpload()) {
-    const payloadSaveFile = path.join(
-      actionsUtil.getTemporaryDirectory(),
-      `payload-${analysis.kind}.json`,
-    );
+    const payloadSaveFile = getSavedPayloadPath(analysis.kind);
    logger.info(
      `SARIF upload disabled by an environment variable. Saving to ${payloadSaveFile}`,
    );
@@ -762,13 +767,12 @@ export async function uploadPostProcessedFiles(
  const zippedSarif = zlib.gzipSync(sarifPayload).toString("base64");
  const checkoutURI = url.pathToFileURL(checkoutPath).href;

-  const env = util.getEnv();
  const payload = uploadTarget.transformPayload(
    buildPayload(
-      await gitUtils.getCommitOid(env, checkoutPath),
-      await gitUtils.getRef(env, checkoutPath),
+      await gitUtils.getCommitOid(checkoutPath),
+      await gitUtils.getRef(),
      postProcessingResults.analysisKey,
-      env.getRequired(ActionsEnvVars.GITHUB_WORKFLOW),
+      util.getRequiredEnvParam("GITHUB_WORKFLOW"),
      zippedSarif,
      actionsUtil.getWorkflowRunID(),
      actionsUtil.getWorkflowRunAttempt(),
@@ -20,8 +20,6 @@ import {
  getRequiredEnvParam,
  isInTestMode,
  exportEnvVar,
-  getEnv,
-  type Env,
 } from "./environment";
 import * as json from "./json";
 import { Language } from "./languages";
@@ -47,13 +45,10 @@ const BASE_DATABASE_OIDS_FILE_NAME = "base-database-oids.json";
 */
 const BROKEN_VERSIONS = ["0.0.0-20211207"];

-/** A string representing a GitHub instance. */
-export type InstanceURL = string;
-
 /**
 * The URL for github.com.
 */
-export const GITHUB_DOTCOM_URL: InstanceURL = "https://github.com";
+export const GITHUB_DOTCOM_URL = "https://github.com";

 /**
 * Default name of the debugging artifact.
@@ -604,12 +599,12 @@ export function assertNever(value: never): never {
 * Set some initial environment variables that we can set even without
 * knowing what version of CodeQL we're running.
 */
-export function initializeEnvironment(version: string, env: Env = getEnv()) {
-  env.export(EnvVar.FEATURE_MULTI_LANGUAGE, "false");
-  env.export(EnvVar.FEATURE_SANDWICH, "false");
-  env.export(EnvVar.FEATURE_SARIF_COMBINE, "true");
-  env.export(EnvVar.FEATURE_WILL_UPLOAD, "true");
-  env.export(EnvVar.VERSION, version);
+export function initializeEnvironment(version: string) {
+  exportEnvVar(EnvVar.FEATURE_MULTI_LANGUAGE, "false");
+  exportEnvVar(EnvVar.FEATURE_SANDWICH, "false");
+  exportEnvVar(EnvVar.FEATURE_SARIF_COMBINE, "true");
+  exportEnvVar(EnvVar.FEATURE_WILL_UPLOAD, "true");
+  exportEnvVar(EnvVar.VERSION, version);
 }

 export class HTTPError extends Error {
@@ -929,6 +924,21 @@ export function getErrorMessage(error: unknown): string {
  return error instanceof Error ? error.message : String(error);
 }

+/**
+ * Approximates whether {@link error} is like a {@link NodeJS.ErrnoException}.
+ * We only typically care about the `code` property, so that's what we check for here.
+ */
+export function isErrnoException(
+  error: unknown,
+): error is NodeJS.ErrnoException {
+  return (
+    typeof error === "object" &&
+    error !== null &&
+    "code" in error &&
+    typeof error.code === "string"
+  );
+}
+
 export function prettyPrintPack(pack: Pack) {
  return `${pack.name}${pack.version ? `@${pack.version}` : ""}${
    pack.path ? `:${pack.path}` : ""
@@ -4,12 +4,10 @@ import * as sinon from "sinon";

 import * as actionsUtil from "./actions-util";
 import { createStubCodeQL, getCodeQLForTesting } from "./codeql";
-import { ActionsEnvVars, EnvVar } from "./environment";
+import { EnvVar } from "./environment";
 import {
  checkExpectedLogMessages,
-  createTestConfig,
  getRecordingLogger,
-  getTestEnv,
  LoggedMessage,
  setupTests,
 } from "./testing-utils";
@@ -1004,124 +1002,3 @@ test.serial(
    t.is(messages.length, 0);
  },
 );
-
-test("getRepositoryRootOrThrow - gets root from config", async (t) => {
-  const expectedRoot = "/path/to/root";
-  const repositoryRoot = workflow.getRepositoryRootOrThrow(
-    {},
-    "testJob",
-    {},
-    createTestConfig({ repositoryRoot: expectedRoot }),
-    getTestEnv(),
-  );
-
-  t.is(repositoryRoot, expectedRoot);
-});
-
-test("getRepositoryRootOrThrow - gets root from workflow", async (t) => {
-  const expectedRoot = "/path/to/root";
-  const repositoryRoot = workflow.getRepositoryRootOrThrow(
-    {
-      jobs: {
-        testJob: {
-          steps: [
-            {
-              uses: "github/codeql-action/analyze",
-              with: { checkout_path: expectedRoot },
-            },
-          ],
-        },
-      },
-    },
-    "testJob",
-    {},
-    createTestConfig({}),
-    getTestEnv(),
-  );
-
-  t.is(repositoryRoot, expectedRoot);
-});
-
-test("getRepositoryRootOrThrow - gets root from environment", async (t) => {
-  const expectedRoot = "/path/to/root";
-  const repositoryRoot = workflow.getRepositoryRootOrThrow(
-    {
-      jobs: { testJob: { steps: [{ uses: "github/codeql-action/analyze" }] } },
-    },
-    "testJob",
-    {},
-    createTestConfig({}),
-    getTestEnv({ [ActionsEnvVars.GITHUB_WORKSPACE]: expectedRoot }),
-  );
-
-  t.is(repositoryRoot, expectedRoot);
-});
-
-test("getRepositoryRootOrThrow - throws if there's no matching job", async (t) => {
-  t.throws(
-    () =>
-      workflow.getRepositoryRootOrThrow(
-        {
-          jobs: {
-            otherJob: {
-              steps: [
-                {
-                  uses: "github/codeql-action/analyze",
-                  with: { checkout_path: "/some/path" },
-                },
-              ],
-            },
-          },
-        },
-        "testJob",
-        {},
-        createTestConfig({}),
-        getTestEnv(),
-      ),
-    { message: /since the workflow has no job named testJob./ },
-  );
-});
-
-test("getRepositoryRootOrThrow - throws if there's no analyze step", async (t) => {
-  t.throws(
-    () =>
-      workflow.getRepositoryRootOrThrow(
-        {
-          jobs: {
-            testJob: { steps: [] },
-          },
-        },
-        "testJob",
-        {},
-        createTestConfig({}),
-        getTestEnv(),
-      ),
-    { message: /since the testJob job does not call/ },
-  );
-});
-
-test("getRepositoryRootOrThrow - throws if the env var is not set", async (t) => {
-  t.throws(
-    () =>
-      workflow.getRepositoryRootOrThrow(
-        {
-          jobs: {
-            testJob: {
-              steps: [
-                {
-                  uses: "github/codeql-action/analyze",
-                },
-              ],
-            },
-          },
-        },
-        "testJob",
-        {},
-        createTestConfig({}),
-        getTestEnv(),
-      ),
-    {
-      message: `${ActionsEnvVars.GITHUB_WORKSPACE} environment variable must be set`,
-    },
-  );
-});
@@ -8,8 +8,7 @@ import * as yaml from "js-yaml";
 import { isDynamicWorkflow } from "./actions-util";
 import * as api from "./api-client";
 import { CodeQL } from "./codeql";
-import type { Config } from "./config-utils";
-import { ActionsEnvVars, EnvVar, getEnv, ReadOnlyEnv } from "./environment";
+import { EnvVar } from "./environment";
 import { Logger } from "./logging";
 import {
  getRequiredEnvParam,
@@ -442,45 +441,27 @@ export function getUploadInputOrThrow(
 }

 /**
- * Makes a best effort attempt to determine the root path of the repository that the analysis
- * relates to. We need that to make paths in SARIF files relative.
- *
- * - If available, we take the `repositoryRoot` from the `config`.
- * - If it isn't, we fall back to trying to extract a `checkout_path` input from the `workflow`.
- * - Finally, we fall back to the value of `GITHUB_WORKSPACE`.
+ * Makes a best effort attempt to retrieve the checkout_path input for the
+ * particular job, given a set of matrix variables.
 *
 * Typically you'll want to wrap this function in a try/catch block and handle the error.
 *
- * @param workflow The workflow specification of the currently running workflow.
- * @param jobName The name of the job that is currently running.
- * @param matrixVars The matrix variables, if any.
- * @param config The CodeQL Action configuration state.
- * @param env The environment variables.
- *
- * @returns The repository root path, or its best approximation.
- * @throws `Error` if the repository root could not be determined.
+ * @returns the checkout_path input
+ * @throws an error if the checkout_path input could not be determined
 */
-export function getRepositoryRootOrThrow(
+export function getCheckoutPathInputOrThrow(
  workflow: Workflow,
  jobName: string,
  matrixVars: { [key: string]: string } | undefined,
-  config: Partial<Config>,
-  env: ReadOnlyEnv = getEnv(),
 ): string {
  return (
-    // If the CodeQL Action already has a persisted repository root, then we can just use that.
-    config.repositoryRoot ??
-    // Otherwise, try to retrieve it from a `checkout_path` input in the workflow specification.
    getInputOrThrow(
      workflow,
      jobName,
      getAnalyzeActionName(),
      "checkout_path",
      matrixVars,
-    ) ??
-    // Finally, if all of the above fail, just use the value of `GITHUB_WORKSPACE` since that
-    // is what is used by default.
-    env.getRequired(ActionsEnvVars.GITHUB_WORKSPACE)
+    ) || getRequiredEnvParam("GITHUB_WORKSPACE") // if unspecified, checkout_path defaults to ${{ github.workspace }}
  );
 }

@@ -1 +0,0 @@
- The `codeql-action/analyze` step now validates that a correct argument for the `checkout_path` input has been provided. The `checkout_path` input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by `codeql-action/init`, then the CodeQL Action now produces a warning. [#4148](https://github.com/github/codeql-action/pull/4148)
@@ -1 +0,0 @@
- Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. [#4206](https://github.com/github/codeql-action/pull/4206)
@@ -1 +0,0 @@
- The `codeql-action/start-proxy` step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as `codeql-action/init`. This primarily benefits customers who are using GitHub instances other than `github.com` where the `codeql-action/start-proxy` step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. [#4198](https://github.com/github/codeql-action/pull/4198)
Author	SHA1	Message	Date
Michael B. Gale	0171ce39a4	Fix test creating diagnostic locally	2026-10-14 10:35:35 +01:00
Michael B. Gale	df0bdf35e5	Check if Xcode version is unsupported	2026-10-14 10:35:35 +01:00
Michael B. Gale	abe66b06ae	Add function to determine Xcode version based on symlink	2026-10-14 10:35:35 +01:00
Michael B. Gale	43a3059f81	Add FF to fail if macOS version is unsupported	2026-10-14 10:35:34 +01:00
Michael B. Gale	a198c3e411	Check if macOS version is unsupported	2026-10-14 10:35:34 +01:00
Michael B. Gale	50f07e1ba6	Skip Swift checks if tools feature is enabled	2026-10-14 10:35:34 +01:00
Michael B. Gale	1f5e5a0e52	Add `swiftSupportsAllPlatforms` to `ToolsFeature`	2026-10-14 10:35:34 +01:00
Michael B. Gale	60ec21d7c9	Use `macOSVersion` in `isSwiftCompatible`	2026-10-14 10:35:33 +01:00
Michael B. Gale	93c04eb8f5	Refactor swift check out of `init-action.ts`	2026-10-14 10:35:33 +01:00
Michael B. Gale	3f8193218a	Add `macOSVersion` helper	2026-10-14 10:35:33 +01:00
Michael B. Gale	803240ed20	Make `getCodeQLForCmd` use `Env`	2026-10-14 10:35:33 +01:00
Michael B. Gale	1373d0be15	Add `osRelease` to `BaseState`	2026-10-14 10:35:32 +01:00
Michael B. Gale	4061d4ea89	Scaffold validation job	2026-10-14 10:35:31 +01:00
Michael B. Gale	d0bbbf819a	Log when we didn't get a normal configuration file	2026-10-14 10:35:31 +01:00
Michael B. Gale	0570c2f5e9	Upload failed SARIF as workflow artifact in test mode	2026-10-14 10:35:30 +01:00
Michael B. Gale	a033fca529	Add test for new `generateFailedSarif` behaviour	2026-10-14 10:35:30 +01:00
Michael B. Gale	6964da9adb	Address EXDEV issue	2026-10-14 10:35:30 +01:00
Michael B. Gale	33049e1967	Handle failures in `writeTemporaryDiagnosticFile`	2026-10-14 10:35:30 +01:00
Michael B. Gale	7e304e9cf7	Refactor `writeTemporaryDiagnosticFile` out of `add[NoLanguage]Diagnostic`	2026-10-14 10:35:29 +01:00
Michael B. Gale	555b654c2c	Fix typos	2026-10-14 10:35:29 +01:00
Michael B. Gale	1b0a4317e7	Fix hardcoded path separator	2026-10-14 10:35:29 +01:00
Michael B. Gale	89b1f61746	Add e2e test	2026-10-14 10:35:29 +01:00
Michael B. Gale	3d2a6f22f2	Use temporary diagnostic dir in `generateFailedSarif`	2026-10-14 10:35:28 +01:00
Michael B. Gale	f61e1c4fea	Make diagnostics less dependent on global state Add limited test coverage	2026-10-14 10:35:28 +01:00
Michael B. Gale	ed5bb3c5a3	Write diagnostics to temporary location when database isn't ready	2026-10-14 10:35:28 +01:00
Michael B. Gale	bf28f43414	Refactor `writeDiagnosticFile` out of `writeDiagnostic`	2026-10-14 10:35:28 +01:00
				`@@ -1 +0,0 @@`
				- The `codeql-action/analyze` step now validates that a correct argument for the `checkout_path` input has been provided. The `checkout_path` input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by `codeql-action/init`, then the CodeQL Action now produces a warning. [#4148](https://github.com/github/codeql-action/pull/4148)
				`@@ -1 +0,0 @@`
				`- Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. [#4206](https://github.com/github/codeql-action/pull/4206)`
				`@@ -1 +0,0 @@`
				- The `codeql-action/start-proxy` step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as `codeql-action/init`. This primarily benefits customers who are using GitHub instances other than `github.com` where the `codeql-action/start-proxy` step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. [#4198](https://github.com/github/codeql-action/pull/4198)