Merge pull request #4260 from github/dependabot/npm_and_yarn/npm-minor-74c39c9262

Bump the npm-minor group across 1 directory with 3 updates
Merge pull request #4261 from github/dependabot/github_actions/dot-github/workflows/actions-minor-4a8da92e94
2026-10-22 15:15:35 +03:00 · 2026-10-22 10:39:44 +00:00 · 2026-10-22 10:34:34 +00:00 · 2026-10-22 10:17:39 +01:00 · 2026-10-22 10:17:07 +01:00 · 2026-10-21 17:58:09 +00:00
44 changed files with 983 additions and 3386 deletions
@@ -63,7 +63,7 @@ jobs:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Install Java
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
        with:
          java-version: ${{ inputs.java-version || '17' }}
          distribution: temurin
@@ -63,7 +63,7 @@ jobs:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Install Java
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
        with:
          java-version: ${{ inputs.java-version || '17' }}
          distribution: temurin
@@ -1,143 +0,0 @@
-# Warning: This file is generated automatically, and should not be modified.
-# Instead, please modify the template in the pr-checks directory and run:
-#     pr-checks/sync.sh
-# to regenerate this file.
-
-name: PR Check - Diagnostic export without database
-env:
-  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-  GO111MODULE: auto
-on:
-  push:
-    branches:
-      - main
-      - releases/v*
-  pull_request: {}
-  merge_group:
-    types:
-      - checks_requested
-  schedule:
-    - cron: '0 5 * * *'
-  workflow_dispatch:
-    inputs: {}
-  workflow_call:
-    inputs: {}
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: diagnostics-without-db-${{github.ref}}
-jobs:
-  diagnostics-without-db:
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - os: ubuntu-latest
-            version: linked
-    name: Diagnostic export without database
-    if: github.triggering_actor != 'dependabot[bot]'
-    permissions:
-      contents: read
-      security-events: read
-    timeout-minutes: 45
-    runs-on: ${{ matrix.os }}
-    steps:
-      # We deliberately need to make this step fail before the database is initialised, but after
-      # some diagnostic has been produced. The simplest way to do that right now is to:
-      #
-      # - Produce a diagnostic before the db is initialised by forcing the use of a nightly release
-      #   with the `CODEQL_ACTION_FORCE_NIGHTLY` feature flag.
-      # - Cause `init` to abort because we are attempting to analyse Swift on a non-macOS runner.
-      #
-      - name: Check out repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Install Node.js
-        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
-        with:
-          node-version: 20.x
-          cache: npm
-      - name: Install newer npm
-        run: npm install -g npm@11.19.1
-      - name: Install dependencies
-        run: npm ci
-      - name: Prepare test
-        id: prepare-test
-        uses: ./.github/actions/prepare-test
-        with:
-          version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
-      - name: Initialise failing analysis
-        id: init
-        uses: ./../action/init
-        continue-on-error: true
-        env:
-          CODEQL_ACTION_FORCE_NIGHTLY: true
-        with:
-          languages: swift
-          tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-      - name: Analyze
-        uses: ./analyze
-        # In a real workflow, this step wouldn't run. Since we used `continue-on-error`
-        # above, we manually disable it with an `if` condition. Having this step is required
-        # for the init post-action because it checks the workflow definition for e.g. the
-        # `category` input. Without this step, that part of the init post-action would fail.
-        if: false
-        with:
-          category: '/test-codeql-version:${{ matrix.version }}'
-
-      - name: Check diagnostics appear on disk
-        env:
-          DIAGNOSTICS_DIR: '${{ runner.temp }}/codeql-action-temp-diagnostics/'
-        run: |
-          cd ../action
-          npx tsx ./pr-checks/diagnostics-without-db.ts
-    env:
-      CODEQL_ACTION_SKIP_GENERATE_FAILED_SARIF: false
-      CODEQL_ACTION_SKIP_SARIF_UPLOAD: true
-      CODEQL_ACTION_TESTING_ENVIRONMENT: codeql-action-pr-checks
-      CODEQL_ACTION_TEST_MODE: true
-  diagnostics-without-db-validation:
-    if: github.triggering_actor != 'dependabot[bot]'
-    needs:
-      - diagnostics-without-db
-    permissions:
-      contents: read
-      security-events: read
-    timeout-minutes: 5
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Install Node.js
-        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
-        with:
-          node-version: 20.x
-          cache: npm
-      - name: Install newer npm
-        run: npm install -g npm@11.19.1
-      - name: Install dependencies
-        run: npm ci
-      - name: Download workflow artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          pattern: test-mode-sarif-*
-          path: sarif
-
-      - name: List artifact contents
-        run: ls -laR ./sarif
-
-      - name: Check diagnostics appear in SARIF
-        env:
-          SARIF_PATH: "./sarif/codeql-failed-run.sarif"
-          DIAGNOSTIC_ID: "codeql-action/forced-nightly-cli"
-          DIAGNOSTIC_NAME: "A nightly release of CodeQL was used"
-          EXPECTED_LOCATIONS: "0"
-          EXPECTED_MESSAGE: |
-            GitHub configured this analysis to use a nightly release of CodeQL to allow you to preview changes from an upcoming release.
-        run: npx tsx ./pr-checks/check-diagnostics.ts
-    env:
-      CODEQL_ACTION_TEST_MODE: true
@@ -54,7 +54,7 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Set up Ruby
-        uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1.327.0
+        uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
        with:
          ruby-version: 2.6
      - name: Install Code Scanning integration
@@ -71,9 +71,7 @@ jobs:
        run: exit 1
      - uses: ./analyze
        # In a real workflow, this step wouldn't run. Since we used `continue-on-error`
-        # above, we manually disable it with an `if` condition. Having this step is required
-        # for the init post-action because it checks the workflow definition for e.g. the
-        # `category` input. Without this step, that part of the init post-action would fail.
+        # above, we manually disable it with an `if` condition.
        if: false
        with:
          category: '/test-codeql-version:${{ matrix.version }}'
@@ -1,131 +0,0 @@
-# Warning: This file is generated automatically, and should not be modified.
-# Instead, please modify the template in the pr-checks directory and run:
-#     pr-checks/sync.sh
-# to regenerate this file.
-
-name: PR Check - Unsupported macOS
-env:
-  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-  GO111MODULE: auto
-on:
-  push:
-    branches:
-      - main
-      - releases/v*
-  pull_request: {}
-  merge_group:
-    types:
-      - checks_requested
-  schedule:
-    - cron: '0 5 * * *'
-  workflow_dispatch:
-    inputs: {}
-  workflow_call:
-    inputs: {}
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: unsupported-macos-${{github.ref}}
-jobs:
-  unsupported-macos:
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - os: xcode-27
-            version: linked
-          - os: xcode-27
-            version: nightly-latest
-    name: Unsupported macOS
-    if: github.triggering_actor != 'dependabot[bot]'
-    permissions:
-      contents: read
-      security-events: read
-    timeout-minutes: 45
-    runs-on: ${{ matrix.os }}
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Install Node.js
-        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
-        with:
-          node-version: 20.x
-          cache: npm
-      - name: Install newer npm
-        run: npm install -g npm@11.19.1
-      - name: Install dependencies
-        run: npm ci
-      - name: Prepare test
-        id: prepare-test
-        uses: ./.github/actions/prepare-test
-        with:
-          version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
-      - name: Check xcode_select_link
-        run: |
-          readlink /private/var/db/xcode_select_link
-          file -h /private/var/db/xcode_select_link
-
-      - uses: ./../action/init
-        id: init
-        with:
-          languages: swift
-          tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-      - name: Analyze
-        # We could run `analyze` here from `./../analyze`, but `getAnalyzeActionName` in `workflow.ts`
-        # can't cope with that unless we introduce a different testing environment. Since this step
-        # would just fail on `xcode-27` anyway, we just skip it instead.
-        if: false
-        uses: ./analyze
-        with:
-          category: '/test-codeql-version:${{ matrix.version }}'
-    env:
-      CODEQL_ACTION_SKIP_GENERATE_FAILED_SARIF: false
-      CODEQL_ACTION_SKIP_SARIF_UPLOAD: true
-      CODEQL_ACTION_TESTING_ENVIRONMENT: codeql-action-pr-checks
-      CODEQL_ACTION_TEST_MODE: true
-  unsupported-macos-sarif-checks:
-    if: github.triggering_actor != 'dependabot[bot]'
-    needs:
-      - unsupported-macos
-    permissions:
-      contents: read
-      security-events: read
-    timeout-minutes: 5
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Install Node.js
-        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
-        with:
-          node-version: 20.x
-          cache: npm
-      - name: Install newer npm
-        run: npm install -g npm@11.19.1
-      - name: Install dependencies
-        run: npm ci
-      - name: Download workflow artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          pattern: test-mode-sarif-*
-          path: sarif
-
-      - name: List artifact contents
-        run: ls -laR ./sarif
-
-      - name: Check diagnostics appear in SARIF
-        env:
-          SARIF_PATH: "./sarif/"
-          DIAGNOSTIC_ID: "codeql-action/unsupported-traced-analysis-macos"
-          DIAGNOSTIC_NAME: "Traced analysis is not supported on this version of macOS"
-          EXPECTED_LOCATIONS: "0"
-          EXPECTED_MESSAGE: |
-            Traced analysis is not supported on macOS 27 or above.
-        run: npx tsx ./pr-checks/check-diagnostics.ts
-    env:
-      CODEQL_ACTION_TEST_MODE: true
@@ -134,7 +134,7 @@ jobs:
          echo "::endgroup::"

      - name: Generate token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
        id: app-token
        with:
          app-id: ${{ vars.AUTOMATION_APP_ID }}
@@ -139,7 +139,7 @@ jobs:

      - name: Generate token
        if: github.event_name == 'workflow_dispatch'
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
        id: app-token
        with:
          app-id: ${{ vars.AUTOMATION_APP_ID }}
@@ -95,7 +95,7 @@ jobs:
      pull-requests: write # needed to create pull request
    steps:
    - name: Generate token
-      uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
      id: app-token
      with:
        app-id: ${{ vars.AUTOMATION_APP_ID }}
@@ -36,7 +36,7 @@
        "node-forge": "^1.4.0",
        "semver": "^7.8.5",
        "undici": "^6.28.0",
-        "uuid": "^14.0.2"
+        "uuid": "^14.0.3"
      },
      "devDependencies": {
        "@ava/typescript": "6.0.0",
@@ -57,14 +57,14 @@
        "eslint-import-resolver-typescript": "^4.4.5",
        "eslint-plugin-github": "^6.1.2",
        "eslint-plugin-import-x": "^4.17.1",
-        "eslint-plugin-jsdoc": "^65.2.0",
+        "eslint-plugin-jsdoc": "^65.3.4",
        "eslint-plugin-no-async-foreach": "^0.1.1",
        "glob": "^13.0.6",
        "globals": "^17.13.0",
        "nock": "^14.0.17",
        "sinon": "^22.1.0",
        "typescript": "^6.0.3",
-        "typescript-eslint": "^8.71.1"
+        "typescript-eslint": "^8.71.2"
      }
    },
    "node_modules/@aashutoshrathi/word-wrap": {
@@ -2702,17 +2702,17 @@
      "license": "MIT"
    },
    "node_modules/@typescript-eslint/eslint-plugin": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.71.1.tgz",
-      "integrity": "sha512-nNlBf6HuotqMgZvSkWD5hNdemiBIxQ2NmrlgfcUIeZRs+BbakjscCQRq/Hb74EFVnFiSWWdL12JruqwBy3ERDw==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.71.2.tgz",
+      "integrity": "sha512-K72/pvT7qpm8q3k8G5u93NCSN1RcLxX5h7Gw0bQpbMXviBHeY6Nx1WEwmk9wP+eKTSQ8ecxvcgt/ZX/rB938xQ==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
        "@eslint-community/regexpp": "^4.12.2",
-        "@typescript-eslint/scope-manager": "8.71.1",
-        "@typescript-eslint/type-utils": "8.71.1",
-        "@typescript-eslint/utils": "8.71.1",
-        "@typescript-eslint/visitor-keys": "8.71.1",
+        "@typescript-eslint/scope-manager": "8.71.2",
+        "@typescript-eslint/type-utils": "8.71.2",
+        "@typescript-eslint/utils": "8.71.2",
+        "@typescript-eslint/visitor-keys": "8.71.2",
        "ignore": "^7.0.5",
        "natural-compare": "^1.4.0",
        "ts-api-utils": "^2.5.0"
@@ -2725,7 +2725,7 @@
        "url": "https://opencollective.com/typescript-eslint"
      },
      "peerDependencies": {
-        "@typescript-eslint/parser": "^8.71.1",
+        "@typescript-eslint/parser": "^8.71.2",
        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
        "typescript": ">=4.8.4 <6.1.0"
      }
@@ -2741,16 +2741,16 @@
      }
    },
    "node_modules/@typescript-eslint/parser": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.71.1.tgz",
-      "integrity": "sha512-oM/5sAqz/l1v/zYK1qTOPrn2+JIrBGC1V6uNYucRO5gh6eT9vWJ/RhPbGE59byvZEUQ4VP6XkLBaS5Jti5jpvw==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.71.2.tgz",
+      "integrity": "sha512-aTtmZjp/x3gsGHkDs04/1I8kNogBJkpQaeGaN0PfiG43NzDEmW2n+OP5im9wfsvyX0yP1UZWBrAGtDBfH9jEVw==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/scope-manager": "8.71.1",
-        "@typescript-eslint/types": "8.71.1",
-        "@typescript-eslint/typescript-estree": "8.71.1",
-        "@typescript-eslint/visitor-keys": "8.71.1",
+        "@typescript-eslint/scope-manager": "8.71.2",
+        "@typescript-eslint/types": "8.71.2",
+        "@typescript-eslint/typescript-estree": "8.71.2",
+        "@typescript-eslint/visitor-keys": "8.71.2",
        "debug": "^4.4.3"
      },
      "engines": {
@@ -2784,14 +2784,14 @@
      }
    },
    "node_modules/@typescript-eslint/project-service": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.71.1.tgz",
-      "integrity": "sha512-Oijc9RUsohHjncg6iGi7gCtjnEjYt9FWv9u6ygK8uKcHK5eLjLAkqERQ9BaytbpceOFdk6kifPCS/zAZE+A99g==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.71.2.tgz",
+      "integrity": "sha512-Pd68GsLVh5ZXlcEccFPdhSOvtHZ/2WU0XsA8zmXOS3F158lVlcTLhfQ6qvtL1RzbMie0Kp8xtbVwAg4nejKPHw==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/tsconfig-utils": "^8.71.1",
-        "@typescript-eslint/types": "^8.71.1",
+        "@typescript-eslint/tsconfig-utils": "^8.71.2",
+        "@typescript-eslint/types": "^8.71.2",
        "debug": "^4.4.3"
      },
      "engines": {
@@ -2824,14 +2824,14 @@
      }
    },
    "node_modules/@typescript-eslint/scope-manager": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.71.1.tgz",
-      "integrity": "sha512-1YUDZXdTnXLlob03SFHBipdyMBsDVm7zoSz0ytTJ39dk5J1TgsTK03VlR/dLXG/RLLUrPcYbD4rp23BmHxHP0w==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.71.2.tgz",
+      "integrity": "sha512-YF4wgg5iUX5Obywoac27B56FhozMNFhdJSbh11H5GBAwmBtfyRhmgTQqW9tRNNmHDvsZ2CX6UGzoz+YfYn2Leg==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/types": "8.71.1",
-        "@typescript-eslint/visitor-keys": "8.71.1"
+        "@typescript-eslint/types": "8.71.2",
+        "@typescript-eslint/visitor-keys": "8.71.2"
      },
      "engines": {
        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -2842,9 +2842,9 @@
      }
    },
    "node_modules/@typescript-eslint/tsconfig-utils": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.71.1.tgz",
-      "integrity": "sha512-oTvkml5SxXhgg+WWKhod5qWQICDXtOB+/Hi9VdPKFAANJ2b7YOgMffgvzXuqog7R6A/JtrzRf128dsxummyWhg==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.71.2.tgz",
+      "integrity": "sha512-jz49TAWokm/7yWD9/o837nYax9DyALxIPOImdImvVzo6canBCZYzin8zJyqNR5k1j9K1DE0bVvr0XYB+99uAdg==",
      "dev": true,
      "license": "MIT",
      "engines": {
@@ -2859,15 +2859,15 @@
      }
    },
    "node_modules/@typescript-eslint/type-utils": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.71.1.tgz",
-      "integrity": "sha512-kH3t3jZCYv2PZSBEWPKTariLrCaoF1CLoPitYFBJOhAGEwWnSRAtGEifrfrpBa4K9JlwWNZotgA5w3/wLSk/FQ==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.71.2.tgz",
+      "integrity": "sha512-cC8UaalCViJkb3rH/xLIvidEwoFRtMZMUqDjjJMGEKaTFwYRHYBcoczlEGHuvkHEO8svRDrgZ0yQgOArFmwang==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/types": "8.71.1",
-        "@typescript-eslint/typescript-estree": "8.71.1",
-        "@typescript-eslint/utils": "8.71.1",
+        "@typescript-eslint/types": "8.71.2",
+        "@typescript-eslint/typescript-estree": "8.71.2",
+        "@typescript-eslint/utils": "8.71.2",
        "debug": "^4.4.3",
        "ts-api-utils": "^2.5.0"
      },
@@ -2902,9 +2902,9 @@
      }
    },
    "node_modules/@typescript-eslint/types": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.71.1.tgz",
-      "integrity": "sha512-ybYnPTUwg3VQQOFEiBPLs8Jxl1ry2vXdn1kVKguomBbvxpetdu3MKTNDqFNUrlG8ylP9MpZosmXMFYlGQHk1oQ==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.71.2.tgz",
+      "integrity": "sha512-y5Ukl3oVp7e/VGxqIoEXoeb/Roj71PAJ4WG/N/RGj+eeDvKRLM15kGr9MijLbN0i03S52zxu31Z98E5gWChJKw==",
      "dev": true,
      "license": "MIT",
      "engines": {
@@ -2916,16 +2916,16 @@
      }
    },
    "node_modules/@typescript-eslint/typescript-estree": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.71.1.tgz",
-      "integrity": "sha512-pSKSEK1JJpHs6KiKVtABCE4iJK5d7FLFzDXQNBQ2oRY7LEd3UwOt3TZemTgu9syTIf56dJWlTn/pdmrO9oKUXQ==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.71.2.tgz",
+      "integrity": "sha512-DgNOEsl4pdYzwSL+N/Cl33tX1Hlw3FvId73LnKXfq7jnrF2viOEn7X+P7RBkkSWCVm92gnWd28GIC5vJuLREeA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/project-service": "8.71.1",
-        "@typescript-eslint/tsconfig-utils": "8.71.1",
-        "@typescript-eslint/types": "8.71.1",
-        "@typescript-eslint/visitor-keys": "8.71.1",
+        "@typescript-eslint/project-service": "8.71.2",
+        "@typescript-eslint/tsconfig-utils": "8.71.2",
+        "@typescript-eslint/types": "8.71.2",
+        "@typescript-eslint/visitor-keys": "8.71.2",
        "debug": "^4.4.3",
        "minimatch": "^10.2.2",
        "semver": "^7.7.3",
@@ -3001,16 +3001,16 @@
      }
    },
    "node_modules/@typescript-eslint/utils": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.71.1.tgz",
-      "integrity": "sha512-CBjT6gfAz3DW2j9Q4moFnqt208Aq+506sVGXfpRcyAeqn0EpayL0mjdWoCO2t3RC7GewNrFxdeehuEaPg6DMzQ==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.71.2.tgz",
+      "integrity": "sha512-RyKa1G1M9rKHDhrk+HJtiF1MvLD5Ux2JW3TSkzw+02pRALdpJb+QzG1Y5em+LvCgzGwgg8H7mBRFKljNz7ImPw==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
        "@eslint-community/eslint-utils": "^4.9.1",
-        "@typescript-eslint/scope-manager": "8.71.1",
-        "@typescript-eslint/types": "8.71.1",
-        "@typescript-eslint/typescript-estree": "8.71.1"
+        "@typescript-eslint/scope-manager": "8.71.2",
+        "@typescript-eslint/types": "8.71.2",
+        "@typescript-eslint/typescript-estree": "8.71.2"
      },
      "engines": {
        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -3025,13 +3025,13 @@
      }
    },
    "node_modules/@typescript-eslint/visitor-keys": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.71.1.tgz",
-      "integrity": "sha512-0GxiUGqMU0qXJt58cBsiG3DP8lUmBaFo2vChtUX+CT7PnR3v/VGLLrzVP4K9r1lNiZXjHYefMBbPunplr09v6w==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.71.2.tgz",
+      "integrity": "sha512-zozlN0UA32bSG2zkKAgQyRYSbEISVoyU6vvkKYo2aSny74D8Jh4e+POkJ6Lk0dlezZi5x7TtD+88Xb06IB8nhg==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/types": "8.71.1",
+        "@typescript-eslint/types": "8.71.2",
        "eslint-visitor-keys": "^5.0.0"
      },
      "engines": {
@@ -5365,9 +5365,9 @@
      }
    },
    "node_modules/eslint-plugin-jsdoc": {
-      "version": "65.2.0",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-jsdoc/-/eslint-plugin-jsdoc-65.2.0.tgz",
-      "integrity": "sha512-IMZaNwdDa5otUQYGWN1pzywZLsGKswitvFFNhcO8IOsBfaWpWIDXYuZh2sYhe9MNyKN9hz0YryOFaKdpbTP5Bw==",
+      "version": "65.3.4",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-jsdoc/-/eslint-plugin-jsdoc-65.3.4.tgz",
+      "integrity": "sha512-Z3/ro8sZPqnXKhyAzCNa3F7KCZ3js5xVx/q9BEvTjUGzN6OIQfdb+q3Sc9lJ3zCfyPnN0tI524ulZjYRxAwnAw==",
      "dev": true,
      "license": "BSD-3-Clause",
      "dependencies": {
@@ -9981,16 +9981,16 @@
      }
    },
    "node_modules/typescript-eslint": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.71.1.tgz",
-      "integrity": "sha512-oiNVPC3/NbV1FpaHU07l8O6ynqG9v4PAiW2WvTrAmZdR0f2HI/gE668ElMLCK7Xbsu5k2fK5C4fXNiq05j7/nQ==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.71.2.tgz",
+      "integrity": "sha512-Rz4effbMy2g9wnvOJZG6SbVavX313Lap1vNEbk1RUochzickvzP8P4HB+bkNg5e50eVz1hQGjh9K1omI1xB4Bw==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/eslint-plugin": "8.71.1",
-        "@typescript-eslint/parser": "8.71.1",
-        "@typescript-eslint/typescript-estree": "8.71.1",
-        "@typescript-eslint/utils": "8.71.1"
+        "@typescript-eslint/eslint-plugin": "8.71.2",
+        "@typescript-eslint/parser": "8.71.2",
+        "@typescript-eslint/typescript-estree": "8.71.2",
+        "@typescript-eslint/utils": "8.71.2"
      },
      "engines": {
        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -10167,9 +10167,9 @@
      "license": "MIT"
    },
    "node_modules/uuid": {
-      "version": "14.0.2",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-14.0.2.tgz",
-      "integrity": "sha512-xZe/16rV4aa+HGSOCiY2YeLT1OybRLrrkL/Rqaq7p7GMVXjFh+6wN4oMYgjFmnSnhY8t6Xpdl2l9qmnHYuMHwQ==",
+      "version": "14.0.3",
+      "resolved": "https://registry.npmjs.org/uuid/-/uuid-14.0.3.tgz",
+      "integrity": "sha512-Sc5u1VVln93y1Xnz4R+CunOZc7R9LUcTmhj7Rc7Eg3HVcf7rVn2FOoa812fe0W8p3jD7xeoGSYbfqCGGH2B6xw==",
      "funding": [
        "https://github.com/sponsors/broofa",
        "https://github.com/sponsors/ctavan"
@@ -10488,7 +10488,6 @@
        "@octokit/core": "^7.0.8",
        "@octokit/plugin-paginate-rest": ">=16.0.0",
        "@octokit/plugin-rest-endpoint-methods": "^18.0.0",
-        "glob": "^13.0.6",
        "lite-matter": "^0.1.2",
        "mdast-util-from-markdown": "^2.1.0",
        "semver": "^7.8.5",
@@ -44,7 +44,7 @@
    "node-forge": "^1.4.0",
    "semver": "^7.8.5",
    "undici": "^6.28.0",
-    "uuid": "^14.0.2"
+    "uuid": "^14.0.3"
  },
  "devDependencies": {
    "@ava/typescript": "6.0.0",
@@ -65,14 +65,14 @@
    "eslint-import-resolver-typescript": "^4.4.5",
    "eslint-plugin-github": "^6.1.2",
    "eslint-plugin-import-x": "^4.17.1",
-    "eslint-plugin-jsdoc": "^65.2.0",
+    "eslint-plugin-jsdoc": "^65.3.4",
    "eslint-plugin-no-async-foreach": "^0.1.1",
    "glob": "^13.0.6",
    "globals": "^17.13.0",
    "nock": "^14.0.17",
    "sinon": "^22.1.0",
    "typescript": "^6.0.3",
-    "typescript-eslint": "^8.71.1"
+    "typescript-eslint": "^8.71.2"
  },
  "overrides": {
    "@actions/tool-cache": {
@@ -1,91 +1,19 @@
 import fs from "fs";
-import path from "path";

 import * as core from "@actions/core";
-import { globSync } from "glob";

 import * as sarif from "../src/sarif";

-const DIAGNOSTIC_ID =
-  process.env["DIAGNOSTIC_ID"] ?? "lang/diagnostics/example";
-const DIAGNOSTIC_NAME = process.env["DIAGNOSTIC_NAME"] ?? "Diagnostic name";
-const EXPECTED_MESSAGE = process.env["EXPECTED_MESSAGE"] ?? "Plaintext message";
-const EXPECTED_LOCATIONS = Number.parseInt(
-  process.env["EXPECTED_LOCATIONS"] ?? "1",
-);
-
-function checkStatusPageNotification(n: sarif.Notification) {
-  const expectedMessage = EXPECTED_MESSAGE.trim();
-  if (!n.message.text?.includes(expectedMessage)) {
-    if (n.message.text !== undefined) {
-      core.setFailed(
-        `Expected the status page diagnostic to contain the message '${expectedMessage}', but found '${n.message.text.replaceAll("\n", "\\n")}'.`,
-      );
-    } else {
-      core.setFailed(
-        `Expected the status page diagnostic to contain the message '${expectedMessage}', but found nothing.`,
-      );
-    }
-  }
-
-  const locationCount = n.locations?.length ?? 0;
-  if (locationCount !== EXPECTED_LOCATIONS) {
+function checkStatusPageNotification(n) {
+  const expectedMessage = "Plaintext message";
+  if (n.message.text !== expectedMessage) {
    core.setFailed(
-      `Expected the status page diagnostic to have exactly ${EXPECTED_LOCATIONS} location(s), but found ${locationCount}.`,
+      `Expected the status page diagnostic to have the message '${expectedMessage}', but found '${n.message.text}'.`,
    );
  }
-}
-
-function checkSarif(sarifFile: string) {
-  core.info(`Checking SARIF file at '${sarifFile}'`);
-
-  const log = JSON.parse(fs.readFileSync(sarifFile, "utf8")) as sarif.Log;
-  const run = log.runs[0];
-
-  if (run.invocations === undefined) {
-    throw new Error("run.invocations is undefined");
-  }
-
-  const toolExecutionNotifications =
-    run.invocations[0].toolExecutionNotifications;
-
-  if (toolExecutionNotifications === undefined) {
-    throw new Error("toolExecutionNotifications is undefined");
-  }
-
-  const statusPageNotifications = toolExecutionNotifications.filter(
-    (n) =>
-      n.descriptor?.id === DIAGNOSTIC_ID &&
-      n.properties?.visibility?.statusPage,
-  );
-  if (statusPageNotifications.length !== 1) {
+  if (n.locations.length !== 1) {
    core.setFailed(
-      "Expected exactly one status page reporting descriptor for this diagnostic in the " +
-        `'runs[].invocations[].toolExecutionNotifications[]' SARIF property, but found ` +
-        `${statusPageNotifications.length}. All notification reporting descriptors: ` +
-        `${JSON.stringify(toolExecutionNotifications)}.`,
-    );
-  }
-  checkStatusPageNotification(statusPageNotifications[0]);
-
-  const notifications = run.tool.driver.notifications;
-
-  if (notifications === undefined) {
-    throw new Error("notifications is undefined");
-  }
-
-  const diagnosticNotification = notifications.filter(
-    (n) =>
-      n.id === DIAGNOSTIC_ID &&
-      n.name === DIAGNOSTIC_ID &&
-      n.fullDescription?.text === DIAGNOSTIC_NAME,
-  );
-  if (diagnosticNotification.length !== 1) {
-    core.setFailed(
-      "Expected exactly one notification for this diagnostic in the " +
-        `'runs[].tool.driver.notifications[]' SARIF property, but found ` +
-        `${diagnosticNotification.length}. All notifications: ` +
-        `${JSON.stringify(notifications)}.`,
+      `Expected the status page diagnostic to have exactly 1 location, but found ${n.locations.length}.`,
    );
  }
 }
@@ -93,23 +21,57 @@ function checkSarif(sarifFile: string) {
 const sarifPath = process.env["SARIF_PATH"];

 if (sarifPath === undefined) {
-  throw new Error(
-    "The path to a SARIF file or directory must be set in 'SARIF_PATH'.",
+  throw new Error("The path to a SARIF file must be set in 'SARIF_PATH'.");
+}
+
+const log = JSON.parse(fs.readFileSync(sarifPath, "utf8")) as sarif.Log;
+const run = log.runs[0];
+
+if (run.invocations === undefined) {
+  throw new Error("run.invocations is undefined");
+}
+
+const toolExecutionNotifications =
+  run.invocations[0].toolExecutionNotifications;
+
+if (toolExecutionNotifications === undefined) {
+  throw new Error("toolExecutionNotifications is undefined");
+}
+
+const statusPageNotifications = toolExecutionNotifications.filter(
+  (n) =>
+    n.descriptor?.id === "lang/diagnostics/example" &&
+    n.properties?.visibility?.statusPage,
+);
+if (statusPageNotifications.length !== 1) {
+  core.setFailed(
+    "Expected exactly one status page reporting descriptor for this diagnostic in the " +
+      `'runs[].invocations[].toolExecutionNotifications[]' SARIF property, but found ` +
+      `${statusPageNotifications.length}. All notification reporting descriptors: ` +
+      `${JSON.stringify(toolExecutionNotifications)}.`,
+  );
+}
+checkStatusPageNotification(statusPageNotifications[0]);
+
+const notifications = run.tool.driver.notifications;
+
+if (notifications === undefined) {
+  throw new Error("notifications is undefined");
+}
+
+const diagnosticNotification = notifications.filter(
+  (n) =>
+    n.id === "lang/diagnostics/example" &&
+    n.name === "lang/diagnostics/example" &&
+    n.fullDescription?.text === "Diagnostic name",
+);
+if (diagnosticNotification.length !== 1) {
+  core.setFailed(
+    "Expected exactly one notification for this diagnostic in the " +
+      `'runs[].tool.driver.notifications[]' SARIF property, but found ` +
+      `${diagnosticNotification.length}. All notifications: ` +
+      `${JSON.stringify(notifications)}.`,
  );
 }

-if (fs.statSync(sarifPath).isDirectory()) {
-  const sarifFiles = globSync(path.join(sarifPath, "**", "*.sarif"));
-
-  if (sarifFiles.length < 1) {
-    throw new Error(`Unable to find any .sarif files in '${sarifPath}'.`);
-  }
-
-  for (const sarifFile of sarifFiles) {
-    checkSarif(sarifFile);
-  }
-} else {
-  checkSarif(sarifPath);
-}
-
 core.info("Finished diagnostic export test");
@@ -1,72 +0,0 @@
-name: "Diagnostic export without database"
-description: "Tests that temporary diagnostics are correctly included in the failed SARIF."
-versions:
-  # Overridden by the FF in the `init` step below.
-  - linked
-installNode: true
-
-env:
-  # Allow the failed SARIF file to be generated.
-  CODEQL_ACTION_SKIP_GENERATE_FAILED_SARIF: false
-  # But don't actually upload it.
-  CODEQL_ACTION_SKIP_SARIF_UPLOAD: true
-  # Mark telemetry for this workflow so it can be treated separately.
-  CODEQL_ACTION_TESTING_ENVIRONMENT: codeql-action-pr-checks
-
-steps:
-  # We deliberately need to make this step fail before the database is initialised, but after
-  # some diagnostic has been produced. The simplest way to do that right now is to:
-  #
-  # - Produce a diagnostic before the db is initialised by forcing the use of a nightly release
-  #   with the `CODEQL_ACTION_FORCE_NIGHTLY` feature flag.
-  # - Cause `init` to abort because we are attempting to analyse Swift on a non-macOS runner.
-  #
-  - name: Initialise failing analysis
-    id: init
-    uses: ./../action/init
-    continue-on-error: true
-    env:
-      CODEQL_ACTION_FORCE_NIGHTLY: true
-    with:
-      languages: swift
-      tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-  - name: Analyze
-    uses: ./analyze
-    # In a real workflow, this step wouldn't run. Since we used `continue-on-error`
-    # above, we manually disable it with an `if` condition. Having this step is required
-    # for the init post-action because it checks the workflow definition for e.g. the
-    # `category` input. Without this step, that part of the init post-action would fail.
-    if: false
-    with:
-      category: "/test-codeql-version:${{ matrix.version }}"
-
-  - name: Check diagnostics appear on disk
-    env:
-      DIAGNOSTICS_DIR: "${{ runner.temp }}/codeql-action-temp-diagnostics/"
-    run: |
-      cd ../action
-      npx tsx ./pr-checks/diagnostics-without-db.ts
-validationJobs:
-  diagnostics-without-db-validation:
-    checkout: true
-    installNode: true
-    steps:
-      - name: Download workflow artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          pattern: test-mode-sarif-*
-          path: sarif
-
-      - name: List artifact contents
-        run: ls -laR ./sarif
-
-      - name: Check diagnostics appear in SARIF
-        env:
-          SARIF_PATH: "./sarif/codeql-failed-run.sarif"
-          DIAGNOSTIC_ID: "codeql-action/forced-nightly-cli"
-          DIAGNOSTIC_NAME: "A nightly release of CodeQL was used"
-          EXPECTED_LOCATIONS: "0"
-          EXPECTED_MESSAGE: |
-            GitHub configured this analysis to use a nightly release of CodeQL to allow you to preview changes from an upcoming release.
-        run: npx tsx ./pr-checks/check-diagnostics.ts
@@ -5,7 +5,7 @@ versions:
  - default
 steps:
  - name: Set up Ruby
-    uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1.327.0
+    uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
    with:
      ruby-version: 2.6
  - name: Install Code Scanning integration
@@ -35,9 +35,7 @@ steps:
    run: exit 1
  - uses: ./analyze
    # In a real workflow, this step wouldn't run. Since we used `continue-on-error`
-    # above, we manually disable it with an `if` condition. Having this step is required
-    # for the init post-action because it checks the workflow definition for e.g. the
-    # `category` input. Without this step, that part of the init post-action would fail.
+    # above, we manually disable it with an `if` condition.
    if: false
    with:
      category: "/test-codeql-version:${{ matrix.version }}"
@@ -1,63 +0,0 @@
-name: "Unsupported macOS"
-description: "Tests that unsupported macOS versions are detected and result in appropriate diagnostics."
-versions:
-  - linked
-  - nightly-latest
-installNode: true
-
-operatingSystems:
-  - os: macos
-    runner-image: xcode-27
-
-env:
-  # Allow the failed SARIF file to be generated.
-  CODEQL_ACTION_SKIP_GENERATE_FAILED_SARIF: false
-  # But don't actually upload it.
-  CODEQL_ACTION_SKIP_SARIF_UPLOAD: true
-  # Mark telemetry for this workflow so it can be treated separately.
-  CODEQL_ACTION_TESTING_ENVIRONMENT: codeql-action-pr-checks
-
-steps:
-  - name: Check xcode_select_link
-    run: |
-      readlink /private/var/db/xcode_select_link
-      file -h /private/var/db/xcode_select_link
-
-  - uses: ./../action/init
-    id: init
-    with:
-      languages: swift
-      tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-  - name: Analyze
-    # We could run `analyze` here from `./../analyze`, but `getAnalyzeActionName` in `workflow.ts`
-    # can't cope with that unless we introduce a different testing environment. Since this step
-    # would just fail on `xcode-27` anyway, we just skip it instead.
-    if: false
-    uses: ./analyze
-    with:
-      category: "/test-codeql-version:${{ matrix.version }}"
-
-validationJobs:
-  unsupported-macos-sarif-checks:
-    checkout: true
-    installNode: true
-    steps:
-      - name: Download workflow artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          pattern: test-mode-sarif-*
-          path: sarif
-
-      - name: List artifact contents
-        run: ls -laR ./sarif
-
-      - name: Check diagnostics appear in SARIF
-        env:
-          SARIF_PATH: "./sarif/"
-          DIAGNOSTIC_ID: "codeql-action/unsupported-traced-analysis-macos"
-          DIAGNOSTIC_NAME: "Traced analysis is not supported on this version of macOS"
-          EXPECTED_LOCATIONS: "0"
-          EXPECTED_MESSAGE: |
-            Traced analysis is not supported on macOS 27 or above.
-        run: npx tsx ./pr-checks/check-diagnostics.ts
@@ -1,48 +0,0 @@
-import * as fs from "fs";
-import * as path from "path";
-
-import * as core from "@actions/core";
-
-import type * as diagnostics from "../src/diagnostics";
-
-const DIAGNOSTIC_ID = "codeql-action/forced-nightly-cli";
-const diagnosticDirectory = process.env["DIAGNOSTICS_DIR"];
-
-if (diagnosticDirectory === undefined) {
-  throw new Error("DIAGNOSTICS_DIR is undefined.");
-}
-
-const paths = fs
-  .readdirSync(diagnosticDirectory, {
-    recursive: true,
-    encoding: "utf-8",
-  })
-  .filter((p) => p.endsWith(".json"));
-
-core.info(`Found ${paths.length} paths in '${diagnosticDirectory}'.`);
-core.info(`Searching for a diagnostic with id '${DIAGNOSTIC_ID}'...`);
-
-let found = false;
-for (const diagnosticPath of paths) {
-  if (path.extname(diagnosticPath) !== ".json") {
-    core.info(`Skipping ${diagnosticPath}.`);
-    continue;
-  }
-  core.info(`Found ${diagnosticPath}.`);
-
-  const contents = JSON.parse(
-    fs.readFileSync(path.resolve(diagnosticDirectory, diagnosticPath), "utf-8"),
-  ) as diagnostics.DiagnosticMessage;
-
-  if (contents.source.id === DIAGNOSTIC_ID) {
-    core.info(
-      `Found '${DIAGNOSTIC_ID}' in '${diagnosticPath}'. Skipping remaining files.`,
-    );
-    found = true;
-    break;
-  }
-}
-
-if (!found) {
-  throw new Error(`Didn't find '${DIAGNOSTIC_ID}' diagnostic.`);
-}
@@ -9,7 +9,6 @@
    "@octokit/core": "^7.0.8",
    "@octokit/plugin-paginate-rest": ">=16.0.0",
    "@octokit/plugin-rest-endpoint-methods": "^18.0.0",
-    "glob": "^13.0.6",
    "lite-matter": "^0.1.2",
    "mdast-util-from-markdown": "^2.1.0",
    "semver": "^7.8.5",
@@ -90,7 +90,7 @@ interface Specification extends JobSpecification {
  services?: any;

  /** Additional jobs to run after the main PR check job. */
-  validationJobs?: Record<string, ValidationJobSpecification>;
+  validationJobs?: Record<string, JobSpecification>;

  /** If set, this check is part of a named collection that gets its own caller workflow. */
  collection?: string;
@@ -122,12 +122,6 @@ interface JobSpecification {
  installYq?: boolean;
 }

-type ValidationJobSpecification = JobSpecification & {
-  checkout?: boolean;
-  /** Optional condition for the validation job. */
-  if?: string;
-};
-
 /** Describes language/framework-specific steps and inputs. */
 interface LanguageSetup {
  specProperty: keyof JobSpecification;
@@ -269,8 +263,8 @@ const languageSetups: LanguageSetups = {
        name: "Install Java",
        uses: pinnedUses(
          "actions/setup-java",
-          "de7274f081f381c8f8158605e0321c36c376e2e6",
-          "v6.0.1",
+          "b843ebf9b913146b38da2eaa7aeddf76074ae1ad",
+          "v6.1.0",
        ),
        with: {
          "java-version": `\${{ inputs.java-version || '${defaultLanguageVersions.java}' }}`,
@@ -468,20 +462,6 @@ function generateJobMatrix(
  return matrix;
 }

-/**
- * Gets the `actions/checkout` step.
- */
-function getCheckoutStep(): Step {
-  return {
-    name: "Check out repository",
-    uses: pinnedUses(
-      "actions/checkout",
-      "3d3c42e5aac5ba805825da76410c181273ba90b1",
-      "v7.0.1",
-    ),
-  };
-}
-
 /**
 * Retrieves setup steps and additional input definitions based on specific languages or frameworks
 * that are requested by the `checkSpecification`.
@@ -551,7 +531,14 @@ function generateJob(

  // Construct the workflow steps needed for this check.
  const steps: Step[] = [
-    getCheckoutStep(),
+    {
+      name: "Check out repository",
+      uses: pinnedUses(
+        "actions/checkout",
+        "3d3c42e5aac5ba805825da76410c181273ba90b1",
+        "v7.0.1",
+      ),
+    },
    ...setupInfo.steps,
    {
      name: "Prepare test",
@@ -622,16 +609,13 @@ function generateJob(
 /** Generates a validation job. */
 function generateValidationJob(
  specDocument: yaml.Document,
-  jobSpecification: ValidationJobSpecification,
+  jobSpecification: JobSpecification,
  checkName: string,
  name: string,
 ) {
  // Determine which languages or frameworks have to be installed.
  const { inputs, steps } = getSetupSteps(jobSpecification);

-  // Construct a checkout step if requested.
-  const checkoutStep = jobSpecification.checkout ? [getCheckoutStep()] : [];
-
  // Extract the sequence of steps from the YAML document to persist as much formatting as possible.
  const specSteps = specDocument.getIn([
    "validationJobs",
@@ -640,23 +624,18 @@ function generateValidationJob(
  ]) as yaml.YAMLSeq;

  // Add the generated steps in front of the ones from the specification.
-  specSteps.items.unshift(...checkoutStep, ...steps);
-
-  const baseCondition = "github.triggering_actor != 'dependabot[bot]'";
+  specSteps.items.unshift(...steps);

  const validationJob: Record<string, any> = {
    name: jobSpecification.name,
-    if:
-      jobSpecification.if !== undefined
-        ? `${baseCondition} && ${jobSpecification.if}`
-        : baseCondition,
+    if: "github.triggering_actor != 'dependabot[bot]'",
    needs: [checkName],
    permissions: {
      contents: "read",
      "security-events": "read",
    },
    "timeout-minutes": 5,
-    "runs-on": "ubuntu-latest",
+    "runs-on": "ubuntu-slim",
    steps: specSteps,
  };

@@ -1,5 +1,3 @@
-import * as os from "os";
-
 import * as core from "@actions/core";

 import { ActionsEnv, getActionsEnv } from "./actions-util";
@@ -15,8 +13,6 @@ import {
 } from "./status-report";
 import { getEnv, getErrorMessage, wrapError } from "./util";

-export type { Logger } from "./logging";
-
 /** Base state that is available to an Action on startup. */
 export interface BaseState {
  /** The name of the Action. */
@@ -27,8 +23,6 @@ export interface BaseState {
  platform: NodeJS.Platform;
  /** The architecture of the host. */
  arch: NodeJS.Architecture;
-  /** The version of the operating system. */
-  osRelease: string;
 }

 /** Describes different state features that an Action may have. */
@@ -179,7 +173,6 @@ export async function runInActions(action: Action) {
      startedAt,
      platform: process.platform,
      arch: process.arch,
-      osRelease: os.release(),
      logger,
      env,
      actions: actionsEnv,
@@ -72,7 +72,7 @@ export const getOptionalInput = function (name: string): string | undefined {
 * directory that has been set in `CODEQL_ACTION_TEMP` by e.g. a previous step, or the
 * value of `RUNNER_TEMP` otherwise.
 */
-export function getTemporaryDirectory(env: ReadOnlyEnv = getEnv()): string {
+export function getTemporaryDirectory(env: Env = getEnv()): string {
  return (
    env.getOptional(EnvVar.TEMP) ?? env.getRequired(ActionsEnvVars.RUNNER_TEMP)
  );
@@ -2,7 +2,7 @@ import * as fs from "fs";
 import path from "path";

 import { getTemporaryDirectory } from "../actions-util";
-import { ReadOnlyEnv } from "../environment";
+import { Env } from "../environment";
 import * as json from "../json";
 import { Logger } from "../logging";

@@ -51,7 +51,7 @@ export function resetCachedCodeQlVersion(): void {
 * Returns the path to the temporary file that backs the
 * on-disk cache of CLI responses between workflow steps.
 */
-export function getCommandCacheFilePath(env: ReadOnlyEnv): string {
+export function getCommandCacheFilePath(env: Env): string {
  return path.join(getTemporaryDirectory(env), COMMAND_CACHE_FILENAME);
 }

@@ -18,7 +18,7 @@ import { CliError, wrapCliConfigurationError } from "./cli-errors";
 import type { ActionConfig } from "./config/action-config";
 import { appendExtraQueryExclusions, type Config } from "./config-utils";
 import { DocUrl } from "./doc-url";
-import { EnvVar, getEnv, exportEnvVar, Env, ReadOnlyEnv } from "./environment";
+import { EnvVar, getEnv, exportEnvVar } from "./environment";
 import {
  CodeQLDefaultVersionInfo,
  Feature,
@@ -199,7 +199,6 @@ export interface CodeQL {
    sarifFile: string,
    automationDetailsId: string | undefined,
    config: ActionConfig<"tempDir">,
-    diagnosticDir: string | undefined,
  ): Promise<void>;
  /** Get the location of an extractor for the specified language. */
  resolveExtractor(language: Language): Promise<string>;
@@ -499,14 +498,13 @@ export async function getCodeQLForCmd(
  logger: Logger,
  cmd: string,
  checkVersion: boolean,
-  env: Env = getEnv(),
 ): Promise<CodeQL> {
  const codeql: CodeQL = {
    getPath() {
      return cmd;
    },
    async getVersion() {
-      const cacheFilePath = outputCache.getCommandCacheFilePath(env);
+      const cacheFilePath = outputCache.getCommandCacheFilePath(getEnv());
      let result = outputCache.getCachedCodeQlVersion(
        logger,
        cacheFilePath,
@@ -632,7 +630,7 @@ export async function getCodeQLForCmd(
      }
    },
    async runAutobuild(config: Config, language: Language) {
-      applyAutobuildAzurePipelinesTimeoutFix(env);
+      applyAutobuildAzurePipelinesTimeoutFix();

      const autobuildCmd = path.join(
        await this.resolveExtractor(language),
@@ -642,11 +640,8 @@ export async function getCodeQLForCmd(

      // Bump the verbosity of the autobuild command if we're in debug mode
      if (config.debugMode) {
-        env.set(
-          EnvVar.CLI_VERBOSITY,
-          env.getOptional(EnvVar.CLI_VERBOSITY) ??
-            EXTRACTION_DEBUG_MODE_VERBOSITY,
-        );
+        process.env[EnvVar.CLI_VERBOSITY] =
+          process.env[EnvVar.CLI_VERBOSITY] || EXTRACTION_DEBUG_MODE_VERBOSITY;
      }

      // On macOS, System Integrity Protection (SIP) typically interferes with
@@ -678,7 +673,7 @@ export async function getCodeQLForCmd(
    },
    async extractUsingBuildMode(config: Config, language: Language) {
      if (config.buildMode === BuildMode.Autobuild) {
-        applyAutobuildAzurePipelinesTimeoutFix(env);
+        applyAutobuildAzurePipelinesTimeoutFix();
      }
      try {
        await runCli(cmd, [
@@ -810,7 +805,7 @@ export async function getCodeQLForCmd(
        "--sarif-group-rules-by-pack",
        "--sarif-include-query-help=always",
        "--sublanguage-file-coverage",
-        ...(await getJobRunUuidSarifOptions(env)),
+        ...(await getJobRunUuidSarifOptions()),
        ...getExtraOptionsFromEnv(["database", "interpret-results"]),
      ];
      if (sarifRunPropertyFlag !== undefined) {
@@ -908,43 +903,15 @@ export async function getCodeQLForCmd(
      sarifFile: string,
      automationDetailsId: string | undefined,
      config: ActionConfig<"tempDir">,
-      diagnosticDir: string | undefined,
    ): Promise<void> {
-      // We may be exporting diagnostics for a failed SARIF, in which case the configuration
-      // file may not have been written to disk and there may not be a database. The CLI
-      // will produce a SARIF for diagnostics from `diagnosticDir` without it. Therefore,
-      // if `diagnosticDir` is set, we check whether `configPath` exists and only provide
-      // it to the CLI if it does. Although not needed, the CLI will produce an error if it
-      // is provided with an argument to `--sarif-codescanning-config` that does not exist.
-      let configPath: string | undefined =
-        getGeneratedCodeScanningConfigPath(config);
-
-      if (!fs.existsSync(configPath)) {
-        // Warn if there is no configuration file, even though `config` claims that `init`
-        // was successful. This shouldn't be happening.
-        if (config.successfullyInitialised) {
-          logger.warning(
-            [
-              `Expected a configuration file at '${configPath}', which does not exist.`,
-              "Continuing with diagnostics export anyway, without a configuration file.",
-            ].join(" "),
-          );
-        }
-
-        configPath = undefined;
-      }
-
      const args = [
        "diagnostics",
        "export",
        "--format=sarif-latest",
        `--output=${sarifFile}`,
-        ...(configPath !== undefined
-          ? [`--sarif-codescanning-config=${configPath}`]
-          : []),
-        ...(diagnosticDir !== undefined
-          ? [`--diagnostic-dir=${diagnosticDir}`]
-          : []),
+        `--sarif-codescanning-config=${getGeneratedCodeScanningConfigPath(
+          config,
+        )}`,
        ...getExtraOptionsFromEnv(["diagnostics", "export"]),
      ];
      if (automationDetailsId !== undefined) {
@@ -1058,7 +1025,7 @@ export async function getCodeQLForCmd(
    );
  } else if (
    checkVersion &&
-    env.getOptional(EnvVar.SUPPRESS_DEPRECATED_SOON_WARNING) !== "true" &&
+    process.env[EnvVar.SUPPRESS_DEPRECATED_SOON_WARNING] !== "true" &&
    !(await util.codeQlVersionAtLeast(codeql, CODEQL_NEXT_MINIMUM_VERSION))
  ) {
    const result = await codeql.getVersion();
@@ -1280,20 +1247,17 @@ function getExtractionVerbosityArguments(
 * Without the fix, long build processes will timeout when pulling down Java packages
 * https://developercommunity.visualstudio.com/content/problem/292284/maven-hosted-agent-connection-timeout.html
 */
-function applyAutobuildAzurePipelinesTimeoutFix(env: Env) {
-  const javaToolOptions = env.getOptional("JAVA_TOOL_OPTIONS") ?? "";
-  env.set(
-    "JAVA_TOOL_OPTIONS",
-    [
-      ...javaToolOptions.split(/\s+/),
-      "-Dhttp.keepAlive=false",
-      "-Dmaven.wagon.http.pool=false",
-    ].join(" "),
-  );
+function applyAutobuildAzurePipelinesTimeoutFix() {
+  const javaToolOptions = process.env["JAVA_TOOL_OPTIONS"] || "";
+  process.env["JAVA_TOOL_OPTIONS"] = [
+    ...javaToolOptions.split(/\s+/),
+    "-Dhttp.keepAlive=false",
+    "-Dmaven.wagon.http.pool=false",
+  ].join(" ");
 }

-async function getJobRunUuidSarifOptions(env: ReadOnlyEnv) {
-  const jobRunUuid = env.getOptional(EnvVar.JOB_RUN_UUID);
+async function getJobRunUuidSarifOptions() {
+  const jobRunUuid = process.env[EnvVar.JOB_RUN_UUID];

  return jobRunUuid ? [`--sarif-run-property=jobRunUuid=${jobRunUuid}`] : [];
 }
@@ -465,8 +465,6 @@ export async function initActionState(
    overlayModeSetExplicitly: false,
    repositoryProperties,
    enableFileCoverageInformation,
-    // We don't set this to `true` until `init` is successful.
-    successfullyInitialised: false,
  };
 }

@@ -130,9 +130,6 @@ export interface Config {
   * Whether to enable file coverage information.
   */
  enableFileCoverageInformation: boolean;
-
-  /** Whether the analysis was successfully initialised using the configuration. */
-  successfullyInitialised: boolean;
 }

 /** Properties available in `Config`. */
@@ -8,9 +8,8 @@ import {
  LoggedMessage,
  makeMacro,
  RecordingLogger,
-  setupActionsVars,
 } from "../testing-utils";
-import { ConfigurationError, prettyPrintPack, withTmpDir } from "../util";
+import { ConfigurationError, prettyPrintPack } from "../util";

 import * as dbConfig from "./db-config";

@@ -562,84 +561,69 @@ test("mergeDefaultSetupAndUserConfigs - keeps other properties from user-supplie
  t.deepEqual(result, configFile);
 });

-test.serial(
-  "mergeDefaultSetupAndUserConfigs - ignores, but warns about, unknown keys from Default Setup",
-  async (t) => {
-    const logger = new RecordingLogger();
-    const configFile: dbConfig.UserConfig = {
-      "query-filters": [{ exclude: { a: "b" } }],
-      "paths-ignore": ["path"],
-    };
+test("mergeDefaultSetupAndUserConfigs - ignores, but warns about, unknown keys from Default Setup", async (t) => {
+  const logger = new RecordingLogger();
+  const configFile: dbConfig.UserConfig = {
+    "query-filters": [{ exclude: { a: "b" } }],
+    "paths-ignore": ["path"],
+  };

-    await withTmpDir(async (tmpDir) => {
-      setupActionsVars(tmpDir, tmpDir);
-      const result = dbConfig.mergeDefaultSetupAndUserConfigs(
-        logger,
-        {
-          "default-setup": {
-            borg: [],
-            org: {
-              unknown: "foo",
-              "model-packs": [],
-            },
-          } as unknown as dbConfig.DefaultSetupConfig,
-          "paths-ignore": ["other-path"],
+  const result = dbConfig.mergeDefaultSetupAndUserConfigs(
+    logger,
+    {
+      "default-setup": {
+        borg: [],
+        org: {
+          unknown: "foo",
+          "model-packs": [],
        },
-        configFile,
-      );
+      } as unknown as dbConfig.DefaultSetupConfig,
+      "paths-ignore": ["other-path"],
+    },
+    configFile,
+  );

-      t.deepEqual(result, {
-        ...configFile,
-        "default-setup": { org: { "model-packs": [] } },
-      });
+  t.deepEqual(result, {
+    ...configFile,
+    "default-setup": { org: { "model-packs": [] } },
+  });

-      const expectedUnrecognisedKeys = [
-        ".default-setup.org.unknown",
-        ".default-setup.borg",
-        ".paths-ignore",
-      ].join(", ");
-      checkExpectedLogMessages(t, logger.messages, [
-        `Unrecognised keys in Default Setup configuration: ${expectedUnrecognisedKeys}`,
-      ]);
-    });
-  },
-);
+  const expectedUnrecognisedKeys = [
+    ".default-setup.org.unknown",
+    ".default-setup.borg",
+    ".paths-ignore",
+  ].join(", ");
+  checkExpectedLogMessages(t, logger.messages, [
+    `Unrecognised keys in Default Setup configuration: ${expectedUnrecognisedKeys}`,
+  ]);
+});

-test.serial(
-  "mergeDefaultSetupAndUserConfigs - warns about invalid keys from Default Setup",
-  async (t) => {
-    const logger = new RecordingLogger();
-    const configFile: dbConfig.UserConfig = {};
+test("mergeDefaultSetupAndUserConfigs - warns about invalid keys from Default Setup", async (t) => {
+  const logger = new RecordingLogger();
+  const configFile: dbConfig.UserConfig = {};

-    await withTmpDir(async (tmpDir) => {
-      setupActionsVars(tmpDir, tmpDir);
-
-      const result = dbConfig.mergeDefaultSetupAndUserConfigs(
-        logger,
-        {
-          "default-setup": {
-            org: {
-              "model-packs": [123],
-            },
-          } as unknown as dbConfig.DefaultSetupConfig,
+  const result = dbConfig.mergeDefaultSetupAndUserConfigs(
+    logger,
+    {
+      "default-setup": {
+        org: {
+          "model-packs": [123],
        },
-        configFile,
-      );
+      } as unknown as dbConfig.DefaultSetupConfig,
+    },
+    configFile,
+  );

-      t.deepEqual(result, {
-        ...configFile,
-        "default-setup": { org: { "model-packs": [123] } },
-      });
+  t.deepEqual(result, {
+    ...configFile,
+    "default-setup": { org: { "model-packs": [123] } },
+  });

-      const expectedInvalidKeys = [".default-setup.org.model-packs[0]"].join(
-        ", ",
-      );
-      checkExpectedLogMessages(t, logger.messages, [
-        `Invalid keys in Default Setup configuration: ${expectedInvalidKeys}`,
-      ]);
-    });
-  },
-);
+  const expectedInvalidKeys = [".default-setup.org.model-packs[0]"].join(", ");
+  checkExpectedLogMessages(t, logger.messages, [
+    `Invalid keys in Default Setup configuration: ${expectedInvalidKeys}`,
+  ]);
+});

 /** Parses `contents` as a configuration without validating it. */
 function parseUnvalidatedConfig(contents: string): dbConfig.UserConfig {
@@ -1,165 +0,0 @@
-import * as fs from "fs";
-import path from "path";
-
-import test, { type ExecutionContext } from "ava";
-
-import * as diagnostics from "./diagnostics";
-import { BuiltInLanguage } from "./languages";
-import {
-  checkExpectedLogMessages,
-  createTestConfig,
-  initAllState,
-  RecordingLogger,
-  setupTests,
-} from "./testing-utils";
-import { withTmpDir } from "./util";
-
-setupTests(test);
-
-const id = "codeql-action/test-diagnostic";
-const name = "Test title";
-
-test("makeDiagnostic - adds expected properties", (t) => {
-  const diagnostic = diagnostics.makeDiagnostic(id, name, {});
-
-  t.truthy(diagnostic.timestamp);
-  t.is(diagnostic.source.id, id);
-  t.is(diagnostic.source.name, name);
-});
-
-test("getLanguageDiagnosticsPath gets language-specific path", async (t) =>
-  withTmpDir(async (tmpDir) => {
-    for (const language of Object.values(BuiltInLanguage)) {
-      t.is(
-        diagnostics.getLanguageDiagnosticsPath(tmpDir, language),
-        path.resolve(
-          tmpDir,
-          language,
-          ...diagnostics.CODEQL_ACTION_DIAGNOSTIC_SUBDIR_PARTS,
-        ),
-      );
-    }
-  }));
-
-test("getTempLanguageDiagnosticsPath returns path without language", async (t) =>
-  withTmpDir(async (tmpDir) => {
-    t.is(
-      diagnostics.getTempLanguageDiagnosticsPath(tmpDir),
-      path.resolve(
-        tmpDir,
-        diagnostics.TEMP_DIAGNOSTIC_DIR_NAME,
-        ...diagnostics.CODEQL_ACTION_DIAGNOSTIC_SUBDIR_PARTS,
-      ),
-    );
-  }));
-
-test("getTempLanguageDiagnosticsPath returns language-specific path if a language is provided", async (t) =>
-  withTmpDir(async (tmpDir) => {
-    t.is(
-      diagnostics.getTempLanguageDiagnosticsPath(tmpDir, BuiltInLanguage.swift),
-      path.resolve(
-        tmpDir,
-        diagnostics.TEMP_DIAGNOSTIC_DIR_NAME,
-        BuiltInLanguage.swift,
-        ...diagnostics.CODEQL_ACTION_DIAGNOSTIC_SUBDIR_PARTS,
-      ),
-    );
-  }));
-
-test("getDatabaseDiagnosticsPath returns language-specific path if a language is provided", async (t) =>
-  withTmpDir(async (tmpDir) => {
-    t.is(
-      diagnostics.getDatabaseDiagnosticsPath(
-        createTestConfig({ dbLocation: tmpDir }),
-        BuiltInLanguage.swift,
-      ),
-      path.resolve(
-        tmpDir,
-        BuiltInLanguage.swift,
-        ...diagnostics.CODEQL_ACTION_DIAGNOSTIC_SUBDIR_PARTS,
-      ),
-    );
-  }));
-
-/**
- * Diagnostic files that are written to disk don't have deterministic names.
- * This function recursively finds all `.json` files at {@link rootPath},
- * asserts that there is exactly one, and that it matches {@link expected}.
- *
- * @param rootPath The path to start searching from.
- */
-function assertSingleDiagnosticIn(
-  t: ExecutionContext<unknown>,
-  rootPath: string,
-  expected: diagnostics.DiagnosticMessage,
-) {
-  // Find all `.json` files in `rootPath` and check that there is exactly one.
-  const filePaths = fs
-    .readdirSync(rootPath, {
-      recursive: true,
-      encoding: "utf-8",
-    })
-    .filter((p) => p.endsWith(".json"));
-
-  t.is(filePaths.length, 1);
-
-  // Check that the written diagnostic matches the one we added.
-  const contents = fs.readFileSync(
-    path.resolve(rootPath, filePaths[0]),
-    "utf-8",
-  );
-
-  const readDiagnostic = JSON.parse(contents) as diagnostics.DiagnosticMessage;
-  t.deepEqual(readDiagnostic, expected);
-}
-
-test("addDiagnostic writes temporary diagnostics and flushDiagnostics moves them to the database", async (t) =>
-  withTmpDir(async (tmpDir) => {
-    const logger = new RecordingLogger();
-
-    const tempDiagDir = path.resolve(tmpDir, "temp");
-    const testDbDir = path.resolve(tmpDir, "test", "database");
-    const diagnostic = diagnostics.makeDiagnostic(id, name, {});
-
-    // Write the diagnostic. The path provided for `dbLocation` doesn't exist,
-    // so the diagnostic will be written to a temporary location.
-    t.notThrows(() => {
-      diagnostics.addDiagnostic(
-        createTestConfig({ tempDir: tempDiagDir, dbLocation: testDbDir }),
-        BuiltInLanguage.actions,
-        diagnostic,
-        logger,
-      );
-    });
-
-    // Check that `tempDiagDir` was created.
-    t.true(fs.existsSync(tempDiagDir));
-
-    // Check that the diagnostic exists under `tempDiagDir`.
-    assertSingleDiagnosticIn(t, tempDiagDir, diagnostic);
-
-    // Flush the diagnostics. This will cause the diagnostic we wrote previously to
-    // be moved to a location under `dbLocation`.
-    t.notThrows(() => {
-      diagnostics.flushDiagnostics(
-        initAllState({ logger }),
-        createTestConfig({
-          tempDir: tempDiagDir,
-          dbLocation: testDbDir,
-        }),
-      );
-    });
-
-    // Check that `testDbDir` was created.
-    t.true(fs.existsSync(testDbDir));
-
-    // Check that the diagnostic exists under `testDbDir`.
-    assertSingleDiagnosticIn(t, testDbDir, diagnostic);
-
-    // Check that we logged that the database directory doesn't exist yet
-    // and that we moved one diagnostic.
-    checkExpectedLogMessages(t, logger.messages, [
-      `but the database at ${path.join(testDbDir, "actions")} does not exist yet`,
-      "Moving 1 diagnostic(s) to their respective databases.",
-    ]);
-  }));
@@ -1,24 +1,10 @@
-import * as fs from "fs";
+import { existsSync, mkdirSync, writeFileSync } from "fs";
 import path from "path";

-import type { ActionState } from "./action-common";
-import { getTemporaryDirectory } from "./actions-util";
-import type { ActionConfig } from "./config/action-config";
+import type { Config } from "./config-utils";
 import { Language } from "./languages";
-import { getActionsLogger, type Logger } from "./logging";
-import {
-  getCodeQLDatabasePath,
-  getErrorMessage,
-  isErrnoException,
-} from "./util";
-
-/** The name of the directory we use to temporarily store diagnostics. */
-export const TEMP_DIAGNOSTIC_DIR_NAME = "codeql-action-temp-diagnostics";
-
-export const CODEQL_ACTION_DIAGNOSTIC_SUBDIR_PARTS = [
-  "diagnostic",
-  "codeql-action",
-];
+import { getActionsLogger } from "./logging";
+import { getCodeQLDatabasePath } from "./util";

 /**
 * Known tags for diagnostics. There is currently only "internal-error",
@@ -98,16 +84,22 @@ export type DiagnosticMessage = DiagnosticMessageOptions & {
  source: DiagnosticSource;
 };

-/** Represents a diagnostic message that has not yet been saved to the database. */
-interface TemporaryDiagnostic {
-  /** The path to which the diagnostic has temporarily been written to. */
-  path: string;
-  /** The language the diagnostic is for, if any. */
-  language?: Language;
+/** Represents a diagnostic message that has not yet been written to the database. */
+interface UnwrittenDiagnostic {
+  /** The diagnostic message that has not yet been written. */
+  diagnostic: DiagnosticMessage;
+  /** The language the diagnostic is for. */
+  language: Language;
 }

-/** A list of diagnostics which have not yet been saved to the database. */
-let temporaryDiagnostics: TemporaryDiagnostic[] = [];
+/** A list of diagnostics which have not yet been written to disk. */
+let unwrittenDiagnostics: UnwrittenDiagnostic[] = [];
+
+/**
+ * A list of diagnostics which have not yet been written to disk,
+ * and where the language does not matter.
+ */
+let unwrittenDefaultLanguageDiagnostics: DiagnosticMessage[] = [];

 /**
 * Counter used to generate a unique suffix for each diagnostic filename, so that
@@ -136,54 +128,6 @@ export function makeDiagnostic(
  };
 }

-/**
- * Gets a path relative to {@link basePath} where diagnostics for to {@link language} should be stored at.
- */
-export function getLanguageDiagnosticsPath(
-  basePath: string,
-  language: Language,
-) {
-  return path.resolve(
-    basePath,
-    language,
-    ...CODEQL_ACTION_DIAGNOSTIC_SUBDIR_PARTS,
-  );
-}
-
-/**
- * Gets a path relative to {@link tmpDir} where diagnostics should temporarily be stored
- * until they can be moved to the database.
- */
-export function getTempDiagnosticsRoot(tmpDir: string): string {
-  return path.resolve(tmpDir, TEMP_DIAGNOSTIC_DIR_NAME);
-}
-
-/**
- * Gets a path relative to {@link tmpDir} where diagnostics for {@link language}
- * can temporarily be stored at before the database is initialised. If {@link language}
- * is `undefined`, then a non-language-specific path is returned.
- */
-export function getTempLanguageDiagnosticsPath(
-  tmpDir: string,
-  language?: Language,
-) {
-  const root = getTempDiagnosticsRoot(tmpDir);
-
-  if (language !== undefined) {
-    return getLanguageDiagnosticsPath(root, language);
-  }
-
-  return path.resolve(root, ...CODEQL_ACTION_DIAGNOSTIC_SUBDIR_PARTS);
-}
-
-/** Gets the path where diagnostics for {@link language} should be stored in the database. */
-export function getDatabaseDiagnosticsPath(
-  config: ActionConfig<"dbLocation">,
-  language: Language,
-) {
-  return getLanguageDiagnosticsPath(config.dbLocation, language);
-}
-
 /**
 * Adds the given diagnostic to the database. If the database does not yet exist,
 * the diagnostic will be written to it once it has been created.
@@ -193,34 +137,32 @@ export function getDatabaseDiagnosticsPath(
 * @param diagnostic The diagnostic message to add to the database.
 */
 export function addDiagnostic(
-  config: ActionConfig<"dbLocation" | "tempDir">,
+  config: Config,
  language: Language,
  diagnostic: DiagnosticMessage,
-  logger: Logger = getActionsLogger(),
 ) {
+  const logger = getActionsLogger();
  const databasePath = language
    ? getCodeQLDatabasePath(config, language)
    : config.dbLocation;

  // Check that the database exists before writing to it. If the database does not yet exist,
  // store the diagnostic in memory and write it later.
-  if (fs.existsSync(databasePath)) {
-    writeDiagnostic({ logger }, config, language, diagnostic);
+  if (existsSync(databasePath)) {
+    writeDiagnostic(config, language, diagnostic);
  } else {
    logger.debug(
      `Writing a diagnostic for ${language}, but the database at ${databasePath} does not exist yet.`,
    );

-    // Write the diagnostic to a temporary location.
-    writeTemporaryDiagnosticFile(logger, config.tempDir, language, diagnostic);
+    unwrittenDiagnostics.push({ diagnostic, language });
  }
 }

 /** Adds a diagnostic that is not specific to any language. */
 export function addNoLanguageDiagnostic(
-  config: ActionConfig<"languages" | "dbLocation" | "tempDir"> | undefined,
+  config: Config | undefined,
  diagnostic: DiagnosticMessage,
-  logger: Logger = getActionsLogger(),
 ) {
  if (config !== undefined) {
    addDiagnostic(
@@ -231,74 +173,10 @@ export function addNoLanguageDiagnostic(
      diagnostic,
    );
  } else {
-    logger.debug(
-      `Writing a diagnostic not associated with any language, but we have no configuration to tell us where the database is yet.`,
-    );
-
-    // Write the diagnostic to a temporary location.
-    writeTemporaryDiagnosticFile(
-      logger,
-      getTemporaryDirectory(),
-      undefined,
-      diagnostic,
-    );
+    unwrittenDefaultLanguageDiagnostics.push(diagnostic);
  }
 }

-/**
- * Writes {@link diagnostic} for an optional {@link language} to a subdirectory of {@link tempDir}
- * and tracks it as a diagnostic that was written to a temporary location.
- */
-function writeTemporaryDiagnosticFile(
-  logger: Logger,
-  tempDir: string,
-  language: Language | undefined,
-  diagnostic: DiagnosticMessage,
-) {
-  const tempDiagnosticsPath = getTempLanguageDiagnosticsPath(tempDir, language);
-
-  try {
-    // Write the diagnostic to a temporary location.
-    const diagnosticPath = writeDiagnosticFile(tempDiagnosticsPath, diagnostic);
-
-    // Track the temporary file.
-    temporaryDiagnostics.push({ path: diagnosticPath, language });
-  } catch (err) {
-    logger.warning(
-      `Unable to write temporary diagnostic to '${tempDiagnosticsPath}': ${getErrorMessage(err)}\n\n${JSON.stringify(diagnostic)}`,
-    );
-  }
-}
-
-/**
- * Writes {@link diagnostic} to a file in {@link diagnosticsPath}.
- */
-function writeDiagnosticFile(
-  diagnosticsPath: string,
-  diagnostic: DiagnosticMessage,
-): string {
-  // Create the directory if it doesn't exist yet.
-  fs.mkdirSync(diagnosticsPath, { recursive: true });
-
-  // Include a monotonically increasing suffix to avoid filename collisions
-  // between diagnostics produced within the same millisecond.
-  const uniqueSuffix = (diagnosticCounter++).toString();
-  // We should only need to remove colons, but to be defensive, only allow a restricted set of
-  // characters.
-  const sanitizedTimestamp = diagnostic.timestamp.replace(
-    /[^a-zA-Z0-9.-]/g,
-    "",
-  );
-  const jsonPath = path.resolve(
-    diagnosticsPath,
-    `codeql-action-${sanitizedTimestamp}-${uniqueSuffix}.json`,
-  );
-
-  fs.writeFileSync(jsonPath, JSON.stringify(diagnostic));
-
-  return jsonPath;
-}
-
 /**
 * Writes the given diagnostic to the database.
 *
@@ -307,94 +185,78 @@ function writeDiagnosticFile(
 * @param diagnostic The diagnostic message to add to the database.
 */
 function writeDiagnostic(
-  action: ActionState<["Logger"]>,
-  config: ActionConfig<"dbLocation">,
-  language: Language,
+  config: Config,
+  language: Language | undefined,
  diagnostic: DiagnosticMessage,
 ) {
-  const diagnosticsPath = getDatabaseDiagnosticsPath(config, language);
-
-  try {
-    writeDiagnosticFile(diagnosticsPath, diagnostic);
-  } catch (err) {
-    action.logger.warning(
-      `Unable to write diagnostic message to database: ${err}`,
-    );
-    action.logger.debug(JSON.stringify(diagnostic));
-  }
-}
-
-/** Report if there are temporary diagnostics and write them to the log. */
-export function logTemporaryDiagnostics(action: ActionState<["Logger"]>) {
-  const num = temporaryDiagnostics.length;
-
-  if (num > 0 && action.logger.isDebug()) {
-    action.logger.startGroup("Diagnostics in temporary location");
-    action.logger.debug(
-      `${num} diagnostic(s) were not moved to the database and remain in the temporary directory.`,
-    );
-
-    for (const temporary of temporaryDiagnostics) {
-      try {
-        action.logger.debug(fs.readFileSync(temporary.path, "utf-8"));
-      } catch (err) {
-        action.logger.debug(
-          `Failed to read diagnostics from temporary location at '${temporary.path}': ${getErrorMessage(err)}`,
-        );
-      }
-    }
-
-    action.logger.endGroup();
-  }
-}
-
-/** Relocates all temporary diagnostics to the respective databases. */
-export function flushDiagnostics(
-  action: ActionState<["Logger"]>,
-  config: ActionConfig<"dbLocation" | "languages">,
-) {
-  const diagnosticsCount = temporaryDiagnostics.length;
-  action.logger.debug(
-    `Moving ${diagnosticsCount} diagnostic(s) to their respective databases.`,
+  const logger = getActionsLogger();
+  const databasePath = language
+    ? getCodeQLDatabasePath(config, language)
+    : config.dbLocation;
+  const diagnosticsPath = path.resolve(
+    databasePath,
+    "diagnostic",
+    "codeql-action",
  );

-  const failedFlushDiagnostics: TemporaryDiagnostic[] = [];
-  for (const temporary of temporaryDiagnostics) {
-    // If `temporary.language` is `undefined`, then we didn't have a `config` at the time that
-    // `addNoLanguageDiagnostic` was called. In that case, we arbitrarily choose the first
-    // configured language here like we would have done in `addNoLanguageDiagnostic`.
-    const directory = getDatabaseDiagnosticsPath(
-      config,
-      temporary.language ?? config.languages[0],
+  try {
+    // Create the directory if it doesn't exist yet.
+    mkdirSync(diagnosticsPath, { recursive: true });
+
+    // Include a monotonically increasing suffix to avoid filename collisions
+    // between diagnostics produced within the same millisecond.
+    const uniqueSuffix = (diagnosticCounter++).toString();
+    // We should only need to remove colons, but to be defensive, only allow a restricted set of
+    // characters.
+    const sanitizedTimestamp = diagnostic.timestamp.replace(
+      /[^a-zA-Z0-9.-]/g,
+      "",
+    );
+    const jsonPath = path.resolve(
+      diagnosticsPath,
+      `codeql-action-${sanitizedTimestamp}-${uniqueSuffix}.json`,
    );
-    const filename = path.basename(temporary.path);
-    const destination = path.join(directory, filename);

-    try {
-      fs.mkdirSync(directory, { recursive: true });
-      try {
-        fs.renameSync(temporary.path, destination);
-      } catch (renameErr: unknown) {
-        // Rethrow the error if it isn't an EXDEV one.
-        if (!isErrnoException(renameErr) || renameErr.code !== "EXDEV") {
-          throw renameErr;
-        }
+    writeFileSync(jsonPath, JSON.stringify(diagnostic));
+  } catch (err) {
+    logger.warning(`Unable to write diagnostic message to database: ${err}`);
+    logger.debug(JSON.stringify(diagnostic));
+  }
+}

-        // The error was an EXDEV one: try to copy the file and delete the temporary one.
-        fs.copyFileSync(temporary.path, destination);
-        fs.unlinkSync(temporary.path);
-      }
-    } catch (err) {
-      action.logger.warning(
-        `Failed to relocate '${temporary.path}' to '${destination}': ${getErrorMessage(err)}`,
-      );
+/** Report if there are unwritten diagnostics and write them to the log. */
+export function logUnwrittenDiagnostics() {
+  const logger = getActionsLogger();
+  const num = unwrittenDiagnostics.length;
+  if (num > 0) {
+    logger.warning(
+      `${num} diagnostic(s) could not be written to the database and will not appear on the Tool Status Page.`,
+    );

-      failedFlushDiagnostics.push(temporary);
+    for (const unwritten of unwrittenDiagnostics) {
+      logger.debug(JSON.stringify(unwritten.diagnostic));
    }
  }
+}

-  // Reset the temporary diagnostics arrays.
-  temporaryDiagnostics = failedFlushDiagnostics;
+/** Writes all unwritten diagnostics to disk. */
+export function flushDiagnostics(config: Config) {
+  const logger = getActionsLogger();
+
+  const diagnosticsCount =
+    unwrittenDiagnostics.length + unwrittenDefaultLanguageDiagnostics.length;
+  logger.debug(`Writing ${diagnosticsCount} diagnostic(s) to database.`);
+
+  for (const unwritten of unwrittenDiagnostics) {
+    writeDiagnostic(config, unwritten.language, unwritten.diagnostic);
+  }
+  for (const unwritten of unwrittenDefaultLanguageDiagnostics) {
+    addNoLanguageDiagnostic(config, unwritten);
+  }
+
+  // Reset the unwritten diagnostics arrays.
+  unwrittenDiagnostics = [];
+  unwrittenDefaultLanguageDiagnostics = [];
 }

 /**
@@ -12,6 +12,4 @@ export enum DocUrl {
  SPECIFY_BUILD_STEPS_MANUALLY = "https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages#about-specifying-build-steps-manually",
  SYSTEM_REQUIREMENTS = "https://codeql.github.com/docs/codeql-overview/system-requirements/",
  TRACK_CODE_SCANNING_ALERTS_ACROSS_RUNS = "https://docs.github.com/en/code-security/reference/code-scanning/sarif-support-for-code-scanning#data-for-preventing-duplicated-alerts",
-  /** Blog post about traced analysis being unsupported on macOS 27 and with Xcode 27. */
-  UNSUPPORTED_TRACED_ANALYSIS_MACOS27 = "https://github.blog/changelog/2026-10-19-codeql-changes-for-macos-27-xcode-27-and-swift-6-4/",
 }
@@ -162,8 +162,6 @@ export enum Feature {
   */
  PerLanguageBundles = "per_language_bundles_v2",
  QaTelemetryEnabled = "qa_telemetry_enabled",
-  /** Whether we should fail early if we detect that traced analysis is unsupported. */
-  SkipUnsupportedTracedAnalysis = "skip_unsupported_traced_analysis",
  /** Routes (some) API requests through the registry proxy. */
  ProxyApiRequests = "proxy_api_requests",
  /** Note that this currently only disables baseline file coverage information. */
@@ -445,11 +443,6 @@ export const featureConfig = {
    envVar: "CODEQL_ACTION_START_PROXY_USE_FEATURES_RELEASE",
    minimumVersion: undefined,
  },
-  [Feature.SkipUnsupportedTracedAnalysis]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_SKIP_UNSUPPORTED_TRACED_ANALYSIS",
-    minimumVersion: undefined,
-  },
  [Feature.ToolsRepositoryProperty]: {
    defaultValue: false,
    envVar: "CODEQL_ACTION_TOOLS_REPOSITORY_PROPERTY",
@@ -1,6 +1,3 @@
-import * as fs from "fs";
-import * as path from "path";
-
 import * as core from "@actions/core";
 import test, { ExecutionContext } from "ava";
 import * as sinon from "sinon";
@@ -11,7 +8,6 @@ import * as apiClient from "./api-client";
 import * as codeql from "./codeql";
 import * as configUtils from "./config-utils";
 import * as debugArtifacts from "./debug-artifacts";
-import { getTempDiagnosticsRoot } from "./diagnostics";
 import { EnvVar } from "./environment";
 import { Feature } from "./feature-flags";
 import * as initActionPostHelper from "./init-action-post-helper";
@@ -39,47 +35,6 @@ const NUM_BYTES_PER_GIB = 1024 * 1024 * 1024;

 setupTests(test);

-test.serial("generateFailedSarif picks up unwritten diagnostics", async (t) =>
-  util.withTmpDir(async (tmpDir) => {
-    const logger = new RecordingLogger();
-
-    const tempDiagDir = getTempDiagnosticsRoot(tmpDir);
-    fs.mkdirSync(tempDiagDir, { recursive: true });
-
-    const codeqlObject = await getCodeQLForTesting();
-    const diagnosticsExport = sinon
-      .stub(codeqlObject, "diagnosticsExport")
-      .resolves();
-
-    sinon.stub(codeql, "getCodeQL").resolves(codeqlObject);
-
-    const sarifFile = path.join(tmpDir, "failed.sarif");
-    const result = await initActionPostHelper.generateFailedSarif(
-      logger,
-      createFeatures([Feature.ExportDiagnosticsEnabled]),
-      createTestConfig({
-        tempDir: tmpDir,
-        // Explicitly undefined to ensure we get the "no database" path.
-        dbLocation: undefined,
-      }),
-      "category",
-      "",
-      sarifFile,
-    );
-
-    t.truthy(result);
-    t.is(diagnosticsExport.callCount, 1);
-    t.true(
-      diagnosticsExport.calledOnceWith(
-        sarifFile,
-        "category",
-        sinon.match.any,
-        tempDiagDir,
-      ),
-    );
-  }),
-);
-
 test.serial("init-post action with debug mode off", async (t) => {
  return await util.withTmpDir(async (tmpDir) => {
    setupActionsVars(tmpDir, tmpDir);
@@ -24,7 +24,6 @@ import {
  type UploadDebugArtifactsConfig,
 } from "./debug-artifacts";
 import * as dependencyCaching from "./dependency-caching";
-import { getTempDiagnosticsRoot } from "./diagnostics";
 import { EnvVar, ReadOnlyEnv } from "./environment";
 import { Feature, FeatureEnablement } from "./feature-flags";
 import { Logger } from "./logging";
@@ -178,16 +177,7 @@ async function prepareFailedSarif(
  }
 }

-/**
- * Generates a SARIF file for a failed run, i.e. an analysis where no SARIF was produced as a result of the analysis.
- *
- * Not intended to be called directly, other than by `prepareFailedSarif`.
- *
- * @param category The analysis category to include in the SARIF.
- * @param checkoutPath The path where the repository was checked out at.
- * @param sarifFile The SARIF file to produce.
- */
-export async function generateFailedSarif(
+async function generateFailedSarif(
  logger: Logger,
  features: FeatureEnablement,
  config: ActionConfig<"codeQLCmd" | "tempDir">,
@@ -204,26 +194,11 @@ export async function generateFailedSarif(
  }

  // If there is no database or the feature flag is off, we run 'export diagnostics'
-  const exportDiagnosticsEnabled = await features.getValue(
-    Feature.ExportDiagnosticsEnabled,
-    codeql,
-  );
-  if (databasePath === undefined || !exportDiagnosticsEnabled) {
-    // If we don't have a database path, then we may have diagnostics that were written to a
-    // temporary location. Get the path that they would have been written to and check whether
-    // it exists. If so, pass it on to the CLI. The CLI will not complain if we give it a
-    // path that doesn't exist, so we are just being extra defensive here.
-    // We also don't pass the path to the CLI if `exportDiagnosticsEnabled` is not enabled, to preserve
-    // its intended behaviour of controlling whether diagnostics are included in the SARIF or not.
-    let diagnosticDir: string | undefined = getTempDiagnosticsRoot(
-      config.tempDir,
-    );
-
-    if (!exportDiagnosticsEnabled || !fs.existsSync(diagnosticDir)) {
-      diagnosticDir = undefined;
-    }
-
-    await codeql.diagnosticsExport(sarifFile, category, config, diagnosticDir);
+  if (
+    databasePath === undefined ||
+    !(await features.getValue(Feature.ExportDiagnosticsEnabled, codeql))
+  ) {
+    await codeql.diagnosticsExport(sarifFile, category, config);
  } else {
    // We call 'database export-diagnostics' to find any per-database diagnostics.
    await codeql.databaseExportDiagnostics(databasePath, sarifFile, category);
@@ -40,7 +40,7 @@ import {
  addDiagnostic,
  addNoLanguageDiagnostic,
  flushDiagnostics,
-  logTemporaryDiagnostics,
+  logUnwrittenDiagnostics,
  makeDiagnostic,
  makeTelemetryDiagnostic,
 } from "./diagnostics";
@@ -62,7 +62,6 @@ import {
  runDatabaseInitCluster,
 } from "./init";
 import { JavaEnvVars, BuiltInLanguage } from "./languages";
-import { checkRunnerSupportsTracedAnalysis } from "./languages/traced";
 import { Logger, withGroupAsync } from "./logging";
 import {
  downloadOverlayBaseDatabaseFromCache,
@@ -419,11 +418,14 @@ async function run(
      logger,
    });

-    await checkRunnerSupportsTracedAnalysis(
-      actionStateWithFeatures,
-      config,
-      codeql,
-    );
+    if (
+      config.languages.includes(BuiltInLanguage.swift) &&
+      process.platform !== "darwin"
+    ) {
+      throw new ConfigurationError(
+        `Swift analysis is only supported on macOS runner images. Please migrate to a macOS runner.`,
+      );
+    }

    if (repositoryPropertiesResult.isFailure()) {
      addNoLanguageDiagnostic(
@@ -482,7 +484,6 @@ async function run(
    if (statusReportBase !== undefined) {
      await sendStatusReport(statusReportBase);
    }
-    logTemporaryDiagnostics(actionState);
    return;
  }

@@ -765,15 +766,14 @@ async function run(
      );
    }

-    // Move diagnostics to the database that we previously kept in a temporary location
-    // because the database did not exist until now
-    flushDiagnostics(actionState, config);
+    // Write diagnostics to the database that we previously stored in memory because the database
+    // did not exist until now.
+    flushDiagnostics(config);

    // We save the config here instead of at the end of `initConfig` because we
    // may have updated the config returned from `initConfig`, e.g. to revert to
    // `OverlayDatabaseMode.None` if we failed to download an overlay-base
    // database.
-    config.successfullyInitialised = true;
    await configUtils.saveConfig(config, logger);

    core.setOutput("codeql-path", config.codeQLCmd);
@@ -797,7 +797,7 @@ async function run(
    );
    return;
  } finally {
-    logTemporaryDiagnostics(actionState);
+    logUnwrittenDiagnostics();
  }
  await sendCompletedStatusReport(
    startedAt,
@@ -1,89 +0,0 @@
-import test from "ava";
-import * as sinon from "sinon";
-
-import { ActionsEnvVars } from "../environment";
-import {
-  createTestConfig,
-  getCodeQLForTesting,
-  getTestEnv,
-  makeVersionInfo,
-  RecordingLogger,
-  setupTests,
-} from "../testing-utils";
-import { ToolsFeature } from "../tools-features";
-import { withTmpDir } from "../util";
-
-import { isSwiftCompatible } from "./swift";
-
-import { BuiltInLanguage } from ".";
-
-setupTests(test);
-
-test("isSwiftCompatible doesn't throw for non-Swift languages", async (t) => {
-  for (const language of Object.values(BuiltInLanguage)) {
-    if (language === BuiltInLanguage.swift) {
-      continue;
-    }
-
-    const codeql = await getCodeQLForTesting();
-    await t.notThrowsAsync(
-      isSwiftCompatible(
-        createTestConfig({ languages: [language] }),
-        codeql,
-        // A value of `undefined` should make `isSwiftCompatible` throw for Swift by default
-        // since it means we are on a platform other than macOS
-        undefined,
-      ),
-    );
-  }
-});
-
-test("isSwiftCompatible doesn't throw for Swift if CLI supports swiftSupportsAllPlatforms", async (t) =>
-  withTmpDir(async (tmpDir) => {
-    const logger = new RecordingLogger();
-    const env = getTestEnv();
-    env.set(ActionsEnvVars.RUNNER_TEMP, tmpDir);
-
-    const codeql = await getCodeQLForTesting("codeql-for-testing", logger, env);
-    const supportsFeature = sinon
-      .stub(codeql, "supportsFeature")
-      .withArgs(ToolsFeature.SwiftSupportsAllPlatforms)
-      .resolves(true);
-
-    await t.notThrowsAsync(
-      isSwiftCompatible(
-        createTestConfig({ languages: [BuiltInLanguage.swift] }),
-        codeql,
-        // A value of `undefined` should make `isSwiftCompatible` throw for Swift by default
-        // since it means we are on a platform other than macOS
-        undefined,
-      ),
-    );
-
-    t.is(supportsFeature.callCount, 1);
-    t.deepEqual(supportsFeature.args[0], [
-      ToolsFeature.SwiftSupportsAllPlatforms,
-    ]);
-  }));
-
-test("isSwiftCompatible doesn't throw for Swift on darwin", async (t) =>
-  withTmpDir(async (tmpDir) => {
-    const logger = new RecordingLogger();
-    const env = getTestEnv();
-    env.set(ActionsEnvVars.RUNNER_TEMP, tmpDir);
-
-    const codeql = await getCodeQLForTesting("codeql-for-testing", logger, env);
-    sinon.stub(codeql, "getVersion").resolves(makeVersionInfo("2.27.0"));
-
-    await t.notThrowsAsync(
-      isSwiftCompatible(
-        createTestConfig({
-          tempDir: tmpDir,
-          languages: [BuiltInLanguage.swift],
-        }),
-        codeql,
-        // A value other than `undefined` means we are on macOS.
-        "some-macos-version",
-      ),
-    );
-  }));
@@ -1,42 +0,0 @@
-import type { SemVer } from "semver";
-
-import { CodeQL } from "../codeql";
-import type { ActionConfig } from "../config/action-config";
-import { ToolsFeature } from "../tools-features";
-import { ConfigurationError } from "../util";
-
-import { BuiltInLanguage } from ".";
-
-/**
- * Determines whether we can run a Swift analysis on the current runner.
- *
- * @param config The Action configuration.
- * @param codeql The {@link CodeQL} CLI instance.
- * @param macosVersion The version of macOS, if any.
- *
- * @throws {ConfigurationError} If Swift analysis is not possible on the current runner.
- */
-export async function isSwiftCompatible(
-  config: ActionConfig<"languages">,
-  codeql: CodeQL,
-  macosVersion: SemVer | string | undefined,
-) {
-  // The checks are not relevant if we are not trying to analyse Swift.
-  if (!config.languages.includes(BuiltInLanguage.swift)) {
-    return;
-  }
-
-  // Skip the checks if the `swiftSupportsAllPlatforms` feature is supported by the CLI.
-  // This is a forward-looking measure that allows a future CLI update to disable these
-  // platform checks in the Action when they shouldn't be enforced anymore.
-  if (await codeql.supportsFeature(ToolsFeature.SwiftSupportsAllPlatforms)) {
-    return;
-  }
-
-  // If `macosVersion` is undefined, then we are not on macOS and Swift analysis is unsupported.
-  if (macosVersion === undefined) {
-    throw new ConfigurationError(
-      `Swift analysis is only supported on macOS runner images. Please migrate to a macOS runner.`,
-    );
-  }
-}
@@ -1,482 +0,0 @@
-import fs from "fs";
-
-import test from "ava";
-import * as sinon from "sinon";
-
-import { type CodeQL } from "../codeql";
-import * as diagnostics from "../diagnostics";
-import { ActionsEnvVars, type Env } from "../environment";
-import { Feature } from "../feature-flags";
-import type { Logger } from "../logging";
-import { XCODE_SELECT_LINK_PATH } from "../platform";
-import {
-  checkExpectedLogMessages,
-  checkUnexpectedLogMessages,
-  createFeatures,
-  createTestConfig,
-  getCodeQLForTesting,
-  getTestEnv,
-  initAllState,
-  makeVersionInfo,
-  RecordingLogger,
-  setupTests,
-} from "../testing-utils";
-import { BuildMode, withTmpDir } from "../util";
-
-import { checkRunnerSupportsTracedAnalysis } from "./traced";
-
-import { BuiltInLanguage } from ".";
-
-setupTests(test);
-
-const TEST_DEFAULT_TRACED_LANGUAGES = {
-  [BuiltInLanguage.swift]: true,
-  [BuiltInLanguage.go]: true,
-};
-
-async function getCodeQLWithTracedStub(
-  cmd: string,
-  logger: Logger,
-  env: Env,
-  tracedLanguages: Partial<
-    Record<BuiltInLanguage, boolean>
-  > = TEST_DEFAULT_TRACED_LANGUAGES,
-): Promise<CodeQL> {
-  const codeql = await getCodeQLForTesting(cmd, logger, env);
-  sinon.stub(codeql, "isTracedLanguage").callsFake(async (language) => {
-    return tracedLanguages[language] === true;
-  });
-  return codeql;
-}
-
-const nonDarwinPlatforms: NodeJS.Platform[] = ["linux", "win32"];
-for (const nonDarwinPlatform of nonDarwinPlatforms) {
-  test(`checkRunnerSupportsTracedAnalysis throws for Swift on ${nonDarwinPlatform}`, async (t) =>
-    withTmpDir(async (tmpDir) => {
-      const logger = new RecordingLogger();
-      const env = getTestEnv();
-      env.set(ActionsEnvVars.RUNNER_TEMP, tmpDir);
-
-      const codeql = await getCodeQLWithTracedStub(
-        "codeql-for-testing",
-        logger,
-        env,
-      );
-      sinon.stub(codeql, "getVersion").resolves(makeVersionInfo("2.27.0"));
-
-      await t.throwsAsync(
-        checkRunnerSupportsTracedAnalysis(
-          initAllState({ platform: nonDarwinPlatform, env, logger }),
-          createTestConfig({ languages: [BuiltInLanguage.swift] }),
-          codeql,
-        ),
-      );
-    }));
-}
-
-test(`checkRunnerSupportsTracedAnalysis doesn't throw for BMN`, async (t) =>
-  withTmpDir(async (tmpDir) => {
-    const logger = new RecordingLogger();
-    const env = getTestEnv();
-    env.set(ActionsEnvVars.RUNNER_TEMP, tmpDir);
-
-    const codeql = await getCodeQLWithTracedStub(
-      "codeql-for-testing",
-      logger,
-      env,
-    );
-    sinon.stub(codeql, "getVersion").resolves(makeVersionInfo("2.27.0"));
-
-    await t.notThrowsAsync(
-      checkRunnerSupportsTracedAnalysis(
-        initAllState({
-          platform: "darwin",
-          osRelease: "27.0.0",
-          env,
-          logger,
-        }),
-        createTestConfig({ buildMode: BuildMode.None }),
-        codeql,
-      ),
-    );
-  }));
-
-// Some languages not in `TEST_DEFAULT_TRACED_LANGUAGES`.
-const nonTracedLanguages: BuiltInLanguage[] = [
-  BuiltInLanguage.javascript,
-  BuiltInLanguage.actions,
-];
-for (const nonTracedLanguage of nonTracedLanguages) {
-  test(`checkRunnerSupportsTracedAnalysis doesn't throw for ${nonTracedLanguage} on unsupported macOS`, async (t) =>
-    withTmpDir(async (tmpDir) => {
-      const logger = new RecordingLogger();
-      const env = getTestEnv();
-      env.set(ActionsEnvVars.RUNNER_TEMP, tmpDir);
-
-      const codeql = await getCodeQLWithTracedStub(
-        "codeql-for-testing",
-        logger,
-        env,
-      );
-      sinon.stub(codeql, "getVersion").resolves(makeVersionInfo("2.27.0"));
-
-      await t.notThrowsAsync(
-        checkRunnerSupportsTracedAnalysis(
-          initAllState({
-            platform: "darwin",
-            osRelease: "27.0.0",
-            env,
-            logger,
-          }),
-          createTestConfig({ languages: [nonTracedLanguage] }),
-          codeql,
-        ),
-      );
-    }));
-}
-
-test("checkRunnerSupportsTracedAnalysis warns if version string is not a semver", async (t) =>
-  withTmpDir(async (tmpDir) => {
-    const logger = new RecordingLogger();
-    const env = getTestEnv();
-    env.set(ActionsEnvVars.RUNNER_TEMP, tmpDir);
-
-    const codeql = await getCodeQLWithTracedStub(
-      "codeql-for-testing",
-      logger,
-      env,
-    );
-    sinon.stub(codeql, "getVersion").resolves(makeVersionInfo("2.27.0"));
-
-    await checkRunnerSupportsTracedAnalysis(
-      initAllState({
-        logger,
-        platform: "darwin",
-        osRelease: "unexpected",
-        env,
-      }),
-      createTestConfig({ languages: [BuiltInLanguage.go] }),
-      codeql,
-    );
-
-    checkExpectedLogMessages(t, logger.messages, [
-      "Unable to determine version of macOS, got: unexpected",
-    ]);
-  }));
-
-// `addDiagnostic` changes global state and we must stub it, so this test must be serial.
-test.serial(
-  "checkRunnerSupportsTracedAnalysis logs and adds diagnostic if macOS version is unsupported",
-  async (t) =>
-    withTmpDir(async (tmpDir) => {
-      const logger = new RecordingLogger();
-      const env = getTestEnv();
-      env.set(ActionsEnvVars.RUNNER_TEMP, tmpDir);
-
-      const codeql = await getCodeQLWithTracedStub(
-        "codeql-for-testing",
-        logger,
-        env,
-      );
-      sinon.stub(codeql, "getVersion").resolves(makeVersionInfo("2.27.0"));
-
-      const addDiagnostic = sinon.stub(diagnostics, "addDiagnostic");
-
-      const config = createTestConfig({ languages: [BuiltInLanguage.swift] });
-      await checkRunnerSupportsTracedAnalysis(
-        initAllState({
-          logger,
-          platform: "darwin",
-          osRelease: "27.0.0",
-          env,
-        }),
-        config,
-        codeql,
-      );
-
-      checkExpectedLogMessages(t, logger.messages, [
-        "Traced analysis is not supported on macOS 27",
-      ]);
-
-      t.is(addDiagnostic.callCount, 1);
-      t.like(addDiagnostic.args[0], [
-        config,
-        BuiltInLanguage.swift,
-        {
-          attributes: {
-            languages: [BuiltInLanguage.swift],
-            macOSVersion: "27.0.0",
-          },
-          severity: "warning",
-          source: {
-            id: "codeql-action/unsupported-traced-analysis-macos",
-            name: "Traced analysis is not supported on this version of macOS",
-          },
-          visibility: {
-            cliSummaryTable: true,
-            statusPage: true,
-            telemetry: true,
-          },
-        } satisfies Partial<diagnostics.DiagnosticMessage>,
-      ]);
-    }),
-);
-
-// `addDiagnostic` changes global state and we must stub it, so this test must be serial.
-test.serial(
-  "checkRunnerSupportsTracedAnalysis throws if macOS version is unsupported and FF is enabled",
-  async (t) =>
-    withTmpDir(async (tmpDir) => {
-      const logger = new RecordingLogger();
-      const env = getTestEnv();
-      env.set(ActionsEnvVars.RUNNER_TEMP, tmpDir);
-
-      const features = createFeatures([Feature.SkipUnsupportedTracedAnalysis]);
-
-      const codeql = await getCodeQLWithTracedStub(
-        "codeql-for-testing",
-        logger,
-        env,
-      );
-      sinon.stub(codeql, "getVersion").resolves(makeVersionInfo("2.27.0"));
-
-      const addDiagnostic = sinon.stub(diagnostics, "addDiagnostic");
-
-      const config = createTestConfig({ languages: [BuiltInLanguage.swift] });
-      await t.throwsAsync(
-        checkRunnerSupportsTracedAnalysis(
-          initAllState({
-            logger,
-            platform: "darwin",
-            osRelease: "27.0.0",
-            env,
-            features,
-          }),
-          config,
-          codeql,
-        ),
-      );
-
-      t.is(addDiagnostic.callCount, 1);
-      t.like(addDiagnostic.args[0], [
-        config,
-        BuiltInLanguage.swift,
-        {
-          attributes: {
-            languages: [BuiltInLanguage.swift],
-            macOSVersion: "27.0.0",
-          },
-          severity: "error",
-          source: {
-            id: "codeql-action/unsupported-traced-analysis-macos",
-            name: "Traced analysis is not supported on this version of macOS",
-          },
-          visibility: {
-            cliSummaryTable: true,
-            statusPage: true,
-            telemetry: true,
-          },
-        } satisfies Partial<diagnostics.DiagnosticMessage>,
-      ]);
-    }),
-);
-
-// `addDiagnostic` changes global state and we must stub it, so this test must be serial.
-test.serial(
-  "checkRunnerSupportsTracedAnalysis doesn't add a diagnostic if Xcode version is supported",
-  async (t) =>
-    withTmpDir(async (tmpDir) => {
-      const logger = new RecordingLogger();
-      const env = getTestEnv();
-      env.set(ActionsEnvVars.RUNNER_TEMP, tmpDir);
-
-      const lstatSync = sinon
-        .stub(fs, "lstatSync")
-        .returns({ isSymbolicLink: () => true } as fs.Stats);
-      const readlinkSync = sinon
-        .stub(fs, "readlinkSync")
-        .returns("/Applications/Xcode_26.0.app/Contents/Developer");
-
-      const codeql = await getCodeQLWithTracedStub(
-        "codeql-for-testing",
-        logger,
-        env,
-      );
-      sinon.stub(codeql, "getVersion").resolves(makeVersionInfo("2.27.0"));
-
-      const addDiagnostic = sinon.stub(diagnostics, "addDiagnostic");
-
-      const config = createTestConfig({ languages: [BuiltInLanguage.swift] });
-      await checkRunnerSupportsTracedAnalysis(
-        initAllState({
-          logger,
-          platform: "darwin",
-          osRelease: "26.0.0",
-          env,
-        }),
-        config,
-        codeql,
-      );
-
-      t.is(lstatSync.callCount, 1);
-      t.deepEqual(lstatSync.args[0], [
-        XCODE_SELECT_LINK_PATH,
-        { throwIfNoEntry: false },
-      ]);
-      t.is(readlinkSync.callCount, 1);
-      t.deepEqual(readlinkSync.args[0], [XCODE_SELECT_LINK_PATH]);
-
-      checkUnexpectedLogMessages(t, logger.messages, [
-        "Traced analysis is not supported on Xcode 27",
-      ]);
-
-      t.is(addDiagnostic.callCount, 0);
-    }),
-);
-
-// `addDiagnostic` changes global state and we must stub it, so this test must be serial.
-test.serial(
-  "checkRunnerSupportsTracedAnalysis logs and adds diagnostic if Xcode version is unsupported",
-  async (t) =>
-    withTmpDir(async (tmpDir) => {
-      const logger = new RecordingLogger();
-      const env = getTestEnv();
-      env.set(ActionsEnvVars.RUNNER_TEMP, tmpDir);
-
-      const lstatSync = sinon
-        .stub(fs, "lstatSync")
-        .returns({ isSymbolicLink: () => true } as fs.Stats);
-      const readlinkSync = sinon
-        .stub(fs, "readlinkSync")
-        .returns("/Applications/Xcode_27.0.app/Contents/Developer");
-
-      const codeql = await getCodeQLWithTracedStub(
-        "codeql-for-testing",
-        logger,
-        env,
-      );
-      sinon.stub(codeql, "getVersion").resolves(makeVersionInfo("2.27.0"));
-
-      const addDiagnostic = sinon.stub(diagnostics, "addDiagnostic");
-
-      const config = createTestConfig({ languages: [BuiltInLanguage.swift] });
-      await checkRunnerSupportsTracedAnalysis(
-        initAllState({
-          logger,
-          platform: "darwin",
-          osRelease: "26.0.0",
-          env,
-        }),
-        config,
-        codeql,
-      );
-
-      t.is(lstatSync.callCount, 1);
-      t.deepEqual(lstatSync.args[0], [
-        XCODE_SELECT_LINK_PATH,
-        { throwIfNoEntry: false },
-      ]);
-      t.is(readlinkSync.callCount, 1);
-      t.deepEqual(readlinkSync.args[0], [XCODE_SELECT_LINK_PATH]);
-
-      checkExpectedLogMessages(t, logger.messages, [
-        "Traced analysis is not supported on Xcode 27",
-      ]);
-
-      t.is(addDiagnostic.callCount, 1);
-      t.like(addDiagnostic.args[0], [
-        config,
-        BuiltInLanguage.swift,
-        {
-          attributes: {
-            languages: [BuiltInLanguage.swift],
-            xcodeVersion: "27.0.0",
-          },
-          severity: "warning",
-          source: {
-            id: "codeql-action/unsupported-traced-analysis-xcode",
-            name: "Traced analysis is not supported on this version of Xcode",
-          },
-          visibility: {
-            cliSummaryTable: true,
-            statusPage: true,
-            telemetry: true,
-          },
-        } satisfies Partial<diagnostics.DiagnosticMessage>,
-      ]);
-    }),
-);
-
-// `addDiagnostic` changes global state and we must stub it, so this test must be serial.
-test.serial(
-  "checkRunnerSupportsTracedAnalysis throws if Xcode version is unsupported and FF is enabled",
-  async (t) =>
-    withTmpDir(async (tmpDir) => {
-      const logger = new RecordingLogger();
-      const env = getTestEnv();
-      env.set(ActionsEnvVars.RUNNER_TEMP, tmpDir);
-
-      const lstatSync = sinon
-        .stub(fs, "lstatSync")
-        .returns({ isSymbolicLink: () => true } as fs.Stats);
-      const readlinkSync = sinon
-        .stub(fs, "readlinkSync")
-        .returns("/Applications/Xcode_27.0.app/Contents/Developer");
-
-      const features = createFeatures([Feature.SkipUnsupportedTracedAnalysis]);
-
-      const codeql = await getCodeQLWithTracedStub(
-        "codeql-for-testing",
-        logger,
-        env,
-      );
-      sinon.stub(codeql, "getVersion").resolves(makeVersionInfo("2.27.0"));
-
-      const addDiagnostic = sinon.stub(diagnostics, "addDiagnostic");
-
-      const config = createTestConfig({ languages: [BuiltInLanguage.swift] });
-      await t.throwsAsync(
-        checkRunnerSupportsTracedAnalysis(
-          initAllState({
-            logger,
-            platform: "darwin",
-            osRelease: "26.0.0",
-            env,
-            features,
-          }),
-          config,
-          codeql,
-        ),
-      );
-
-      t.is(lstatSync.callCount, 1);
-      t.deepEqual(lstatSync.args[0], [
-        XCODE_SELECT_LINK_PATH,
-        { throwIfNoEntry: false },
-      ]);
-      t.is(readlinkSync.callCount, 1);
-      t.deepEqual(readlinkSync.args[0], [XCODE_SELECT_LINK_PATH]);
-
-      t.is(addDiagnostic.callCount, 1);
-      t.like(addDiagnostic.args[0], [
-        config,
-        BuiltInLanguage.swift,
-        {
-          attributes: {
-            languages: [BuiltInLanguage.swift],
-            xcodeVersion: "27.0.0",
-          },
-          severity: "error",
-          source: {
-            id: "codeql-action/unsupported-traced-analysis-xcode",
-            name: "Traced analysis is not supported on this version of Xcode",
-          },
-          visibility: {
-            cliSummaryTable: true,
-            statusPage: true,
-            telemetry: true,
-          },
-        } satisfies Partial<diagnostics.DiagnosticMessage>,
-      ]);
-    }),
-);
@@ -1,171 +0,0 @@
-import * as semver from "semver";
-
-import type { ActionState, Logger } from "../action-common";
-import type { CodeQL } from "../codeql";
-import type { ActionConfig } from "../config/action-config";
-import { addDiagnostic, makeDiagnostic } from "../diagnostics";
-import { DocUrl } from "../doc-url";
-import { Feature } from "../feature-flags";
-import { macOSVersion, xcodeVersion } from "../platform";
-import { ConfigurationError } from "../util";
-
-import { isSwiftCompatible } from "./swift";
-
-/** macOS 27 and above do not support traced extraction. */
-export const UNSUPPORTED_MACOS_FOR_TRACED = 27;
-
-/** Xcode 27 and above do not support traced extraction. */
-export const UNSUPPORTED_XCODE_FOR_TRACED = 27;
-
-/**
- * Creates a diagnostic indicating that `version` of `product` is unsupported for traced  analysis.
- * Depending on `skipUnsupportedTracedAnalysis`, this function then either throws a {@link ConfigurationError}
- * or logs the problem as a warning.
- *
- * @param logger The logger to use.
- * @param config The CodeQL Action configuration.
- * @param skipUnsupportedTracedAnalysis Whether this is a fatal error.
- * @param product The product that the version is unsupported of.
- * @param version The unsupported version.
- */
-function handleUnsupportedVersion(
-  logger: Logger,
-  config: ActionConfig<"languages" | "dbLocation" | "tempDir">,
-  skipUnsupportedTracedAnalysis: boolean,
-  product: "macOS" | "Xcode",
-  version: semver.SemVer,
-) {
-  const baseMessage = [
-    `Traced analysis is not supported on ${product} ${UNSUPPORTED_MACOS_FOR_TRACED} or above.`,
-    `Configure your analysis to run on macOS ${UNSUPPORTED_MACOS_FOR_TRACED - 1} or below`,
-    `and XCode ${UNSUPPORTED_XCODE_FOR_TRACED - 1} or below.`,
-  ].join(" ");
-
-  const attributeName = product === "macOS" ? "macOSVersion" : "xcodeVersion";
-
-  // Create a diagnostic that will show up on the TSP.
-  for (const language of config.languages) {
-    addDiagnostic(
-      config,
-      language,
-      makeDiagnostic(
-        `codeql-action/unsupported-traced-analysis-${product.toLowerCase()}`,
-        `Traced analysis is not supported on this version of ${product}`,
-        {
-          attributes: {
-            languages: config.languages,
-            [attributeName]: version.toString(),
-          },
-          markdownMessage: [
-            baseMessage,
-            `For more information, see [this announcement](${DocUrl.UNSUPPORTED_TRACED_ANALYSIS_MACOS27}).`,
-          ].join(" "),
-          severity: skipUnsupportedTracedAnalysis ? "error" : "warning",
-          visibility: {
-            cliSummaryTable: true,
-            statusPage: true,
-            telemetry: true,
-          },
-        },
-      ),
-    );
-  }
-
-  // Log messages generally don't render as markdown, so we include the URL verbatim there.
-  const logMessage = [
-    baseMessage,
-    `For more information, see ${DocUrl.UNSUPPORTED_TRACED_ANALYSIS_MACOS27}`,
-  ].join(" ");
-
-  // Throw an error to abort the analysis if the FF is enabled or log the message.
-  if (skipUnsupportedTracedAnalysis) {
-    // ConfigurationErrors are converted to the "aborted" status by the exception handler
-    // in `init-action.ts` that guards the call to `checkRunnerSupportsTracedAnalysis`.
-    throw new ConfigurationError(logMessage);
-  } else {
-    // This will also show up as a workflow annotation.
-    logger.warning(logMessage);
-  }
-}
-
-/**
- * Decides whether {@link config} has any traced languages by looking for tracer
- * configurations in the {@link codeql} CLI installation.
- */
-export async function hasTracedLanguages(
-  config: ActionConfig<"languages">,
-  codeql: CodeQL,
-): Promise<boolean> {
-  for (const language of config.languages) {
-    if (await codeql.isTracedLanguage(language)) {
-      return true;
-    }
-  }
-
-  return false;
-}
-
-/**
- * Determines whether we can run a traced analysis on the current runner.
- *
- * @throws {ConfigurationError} If traced analysis is not possible on the current runner.
- */
-export async function checkRunnerSupportsTracedAnalysis(
-  action: ActionState<["Base", "Logger", "FeatureFlags"]>,
-  config: ActionConfig<"languages" | "dbLocation" | "tempDir">,
-  codeql: CodeQL,
-) {
-  // Try to get the macOS version.
-  const version = macOSVersion(action);
-
-  // Perform some initial, Swift-specific checks.
-  await isSwiftCompatible(config, codeql, version);
-
-  // `build-mode: none` doesn't use the tracer, so it is always supported.
-  if (config.buildMode !== undefined && config.buildMode === "none") {
-    return;
-  }
-
-  // If none of the languages are traced, then we can skip the compatibility checks below as well.
-  if (!(await hasTracedLanguages(config, codeql))) {
-    return;
-  }
-
-  const skipUnsupportedTracedAnalysis = await action.features.getValue(
-    Feature.SkipUnsupportedTracedAnalysis,
-  );
-  if (typeof version === "string") {
-    // If we got a string, we are on macOS but couldn't parse the version string.
-    action.logger.warning(
-      `Unable to determine version of macOS, got: ${version}`,
-    );
-  } else if (
-    version !== undefined &&
-    version.major >= UNSUPPORTED_MACOS_FOR_TRACED
-  ) {
-    handleUnsupportedVersion(
-      action.logger,
-      config,
-      skipUnsupportedTracedAnalysis,
-      "macOS",
-      version,
-    );
-  }
-
-  // Determining whether the Xcode version is supported only makes sense on macOS, so we only do it
-  // after determining that we are running on macOS.
-  const xcodeVer = xcodeVersion(action.logger);
-
-  if (
-    xcodeVer !== undefined &&
-    xcodeVer.major >= UNSUPPORTED_XCODE_FOR_TRACED
-  ) {
-    handleUnsupportedVersion(
-      action.logger,
-      config,
-      skipUnsupportedTracedAnalysis,
-      "Xcode",
-      xcodeVer,
-    );
-  }
-}
@@ -1,23 +1,6 @@
-import fs from "fs";
-
 import test from "ava";
-import * as sinon from "sinon";

-import {
-  BundlePlatform,
-  getBundlePlatform,
-  macOSVersion,
-  XCODE_SELECT_LINK_PATH,
-  xcodeVersion,
-} from "./platform";
-import {
-  checkExpectedLogMessages,
-  initAllState,
-  RecordingLogger,
-  setupTests,
-} from "./testing-utils";
-
-setupTests(test);
+import { BundlePlatform, getBundlePlatform } from "./platform";

 for (const [platform, arch, expected] of [
  ["linux", "x64", BundlePlatform.Linux64],
@@ -33,221 +16,3 @@ for (const [platform, arch, expected] of [
    t.is(getBundlePlatform(platform, arch), expected);
  });
 }
-
-const platforms: NodeJS.Platform[] = ["linux", "win32", "freebsd"];
-for (const platform of platforms) {
-  test(`macOSVersion returns undefined on ${platform}`, (t) => {
-    t.is(macOSVersion(initAllState({ platform })), undefined);
-  });
-}
-
-test("macOSVersion returns raw string if semver parsing fails", (t) => {
-  const invalidSemVer = "sealOS-2026";
-  t.is(
-    macOSVersion(
-      initAllState({ platform: "darwin", osRelease: invalidSemVer }),
-    ),
-    invalidSemVer,
-  );
-});
-
-test("macOSVersion returns semver if parsing succeeds", (t) => {
-  const validSemVer = "27.0.1";
-
-  const version = macOSVersion(
-    initAllState({ platform: "darwin", osRelease: validSemVer }),
-  );
-
-  // Check that `version` is not undefined and narrow the type; throws if undefined.
-  if (t.truthy(version)) {
-    // Check that it's also not just a string.
-    t.not(typeof version, "string");
-
-    // Should be an object with the expected properties.
-    t.is(typeof version, "object");
-    t.is(version["major"], 27);
-    t.is(version["minor"], 0);
-    t.is(version["patch"], 1);
-  }
-});
-
-test.serial("xcodeVersion returns undefined if symlink doesn't exist", (t) => {
-  const logger = new RecordingLogger();
-
-  const lstatSync = sinon.stub(fs, "lstatSync").returns(undefined);
-
-  t.is(xcodeVersion(logger), undefined);
-  t.is(lstatSync.callCount, 1);
-  t.deepEqual(lstatSync.args[0], [
-    XCODE_SELECT_LINK_PATH,
-    { throwIfNoEntry: false },
-  ]);
-
-  checkExpectedLogMessages(t, logger.messages, [
-    "Xcode is probably not installed.",
-  ]);
-});
-
-test.serial("xcodeVersion returns undefined if lstatSync throws", (t) => {
-  const logger = new RecordingLogger();
-
-  const lstatSync = sinon.stub(fs, "lstatSync").throws(new Error("ENOENT"));
-
-  t.is(xcodeVersion(logger), undefined);
-  t.is(lstatSync.callCount, 1);
-  t.deepEqual(lstatSync.args[0], [
-    XCODE_SELECT_LINK_PATH,
-    { throwIfNoEntry: false },
-  ]);
-
-  checkExpectedLogMessages(t, logger.messages, [
-    "Unable to determine Xcode version: ENOENT",
-  ]);
-});
-
-test.serial("xcodeVersion returns undefined if file is not a symlink", (t) => {
-  const logger = new RecordingLogger();
-
-  const lstatSync = sinon
-    .stub(fs, "lstatSync")
-    .returns({ isSymbolicLink: () => false } as fs.Stats);
-
-  t.is(xcodeVersion(logger), undefined);
-  t.is(lstatSync.callCount, 1);
-  t.deepEqual(lstatSync.args[0], [
-    XCODE_SELECT_LINK_PATH,
-    { throwIfNoEntry: false },
-  ]);
-
-  checkExpectedLogMessages(t, logger.messages, [
-    "exists, but is not a symbolic link",
-  ]);
-});
-
-test.serial(
-  "xcodeVersion returns undefined if resolving the symlink returns nothing",
-  (t) => {
-    const logger = new RecordingLogger();
-
-    const lstatSync = sinon
-      .stub(fs, "lstatSync")
-      .returns({ isSymbolicLink: () => true } as fs.Stats);
-    const readlinkSync = sinon.stub(fs, "readlinkSync").returns("");
-
-    t.is(xcodeVersion(logger), undefined);
-    t.is(lstatSync.callCount, 1);
-    t.deepEqual(lstatSync.args[0], [
-      XCODE_SELECT_LINK_PATH,
-      { throwIfNoEntry: false },
-    ]);
-    t.is(readlinkSync.callCount, 1);
-    t.deepEqual(readlinkSync.args[0], [XCODE_SELECT_LINK_PATH]);
-
-    checkExpectedLogMessages(t, logger.messages, [
-      "unexpectedly returned nothing",
-    ]);
-  },
-);
-
-test.serial(
-  "xcodeVersion returns undefined if resolved path doesn't include pattern",
-  (t) => {
-    const logger = new RecordingLogger();
-
-    const lstatSync = sinon
-      .stub(fs, "lstatSync")
-      .returns({ isSymbolicLink: () => true } as fs.Stats);
-    const readlinkSync = sinon
-      .stub(fs, "readlinkSync")
-      .returns("/Applications/Xcode.app/Contents/Developer");
-
-    t.is(xcodeVersion(logger), undefined);
-    t.is(lstatSync.callCount, 1);
-    t.deepEqual(lstatSync.args[0], [
-      XCODE_SELECT_LINK_PATH,
-      { throwIfNoEntry: false },
-    ]);
-    t.is(readlinkSync.callCount, 1);
-    t.deepEqual(readlinkSync.args[0], [XCODE_SELECT_LINK_PATH]);
-
-    checkExpectedLogMessages(t, logger.messages, [
-      "does not contain expected pattern",
-    ]);
-  },
-);
-
-test.serial("xcodeVersion returns undefined if match can't be parsed", (t) => {
-  const logger = new RecordingLogger();
-
-  const lstatSync = sinon
-    .stub(fs, "lstatSync")
-    .returns({ isSymbolicLink: () => true } as fs.Stats);
-  const readlinkSync = sinon
-    .stub(fs, "readlinkSync")
-    .returns("/Applications/Xcode_00.0.app/Contents/Developer");
-
-  t.is(xcodeVersion(logger), undefined);
-  t.is(lstatSync.callCount, 1);
-  t.deepEqual(lstatSync.args[0], [
-    XCODE_SELECT_LINK_PATH,
-    { throwIfNoEntry: false },
-  ]);
-  t.is(readlinkSync.callCount, 1);
-  t.deepEqual(readlinkSync.args[0], [XCODE_SELECT_LINK_PATH]);
-
-  checkExpectedLogMessages(t, logger.messages, [
-    "Couldn't parse '00.0' as a semantic version.",
-  ]);
-});
-
-test.serial("xcodeVersion returns version from resolved path", (t) => {
-  const logger = new RecordingLogger();
-
-  const lstatSync = sinon
-    .stub(fs, "lstatSync")
-    .returns({ isSymbolicLink: () => true } as fs.Stats);
-  const readlinkSync = sinon
-    .stub(fs, "readlinkSync")
-    .returns("/Applications/Xcode_16.4.app/Contents/Developer");
-
-  const result = xcodeVersion(logger);
-
-  if (t.truthy(result)) {
-    t.is(result.major, 16);
-    t.is(result.minor, 4);
-  }
-
-  t.is(lstatSync.callCount, 1);
-  t.deepEqual(lstatSync.args[0], [
-    XCODE_SELECT_LINK_PATH,
-    { throwIfNoEntry: false },
-  ]);
-  t.is(readlinkSync.callCount, 1);
-  t.deepEqual(readlinkSync.args[0], [XCODE_SELECT_LINK_PATH]);
-});
-
-test.serial("xcodeVersion returns major version from resolved path", (t) => {
-  const logger = new RecordingLogger();
-
-  const lstatSync = sinon
-    .stub(fs, "lstatSync")
-    .returns({ isSymbolicLink: () => true } as fs.Stats);
-  const readlinkSync = sinon
-    .stub(fs, "readlinkSync")
-    .returns("/Applications/Xcode_16.app/Contents/Developer");
-
-  const result = xcodeVersion(logger);
-
-  if (t.truthy(result)) {
-    t.is(result.major, 16);
-    t.is(result.minor, 0);
-  }
-
-  t.is(lstatSync.callCount, 1);
-  t.deepEqual(lstatSync.args[0], [
-    XCODE_SELECT_LINK_PATH,
-    { throwIfNoEntry: false },
-  ]);
-  t.is(readlinkSync.callCount, 1);
-  t.deepEqual(readlinkSync.args[0], [XCODE_SELECT_LINK_PATH]);
-});
@@ -1,10 +1,3 @@
-import fs from "fs";
-
-import * as semver from "semver";
-
-import type { ActionState, Logger } from "./action-common";
-import { getErrorMessage } from "./util";
-
 /** Platform identifiers used in CodeQL bundle asset names. */
 export enum BundlePlatform {
  Linux64 = "linux64",
@@ -31,100 +24,3 @@ export function getBundlePlatform(
      return undefined;
  }
 }
-
-/**
- * Tries to determine the version of macOS.
- *
- * @returns
- *  The version as either a semantic version object, the raw version string
- *  if it is not a semantic version, or `undefined` if we are not on macOS.
- */
-export function macOSVersion(
-  action: ActionState<["Base"]>,
-): semver.SemVer | string | undefined {
-  // Skip if we are not running on macOS.
-  if (action.platform !== "darwin") {
-    return undefined;
-  }
-
-  // Try to parse the OS version string.
-  const version = semver.parse(action.osRelease);
-
-  if (version === null) {
-    return action.osRelease;
-  }
-
-  return version;
-}
-
-/** The static path we check for a symbolic link to the (dynamic) Xcode location. */
-export const XCODE_SELECT_LINK_PATH = "/private/var/db/xcode_select_link";
-
-/** The pattern we expect to find in the Xcode path. */
-export const XCODE_APP_FILENAME_PATTERN = new RegExp(
-  /(?<filename>Xcode_(?<majorMinor>\d+(\.\d+)?)\.app)/,
-);
-
-/**
- * Tries to determine the version of Xcode that is installed.
- *
- * @param logger The logger to use.
- * @returns The Xcode version or `undefined` if it couldn't be determined.
- */
-export function xcodeVersion(logger: Logger): semver.SemVer | undefined {
-  try {
-    // Stat the expected symbolic link to check that it exists and is a symbolic link.
-    // The `readlinkSync` call below returns an empty string in either case and so
-    // this check allows us to distinguish between the two cases.
-    const stats = fs.lstatSync(XCODE_SELECT_LINK_PATH, {
-      throwIfNoEntry: false,
-    });
-
-    if (stats === undefined) {
-      logger.debug(
-        `'${XCODE_SELECT_LINK_PATH}' does not exist. Xcode is probably not installed.`,
-      );
-      return undefined;
-    }
-    if (!stats.isSymbolicLink()) {
-      logger.warning(
-        `${XCODE_SELECT_LINK_PATH} exists, but is not a symbolic link.`,
-      );
-      return undefined;
-    }
-
-    // Read what the symbolic link points to.
-    const xcodePath = fs.readlinkSync(XCODE_SELECT_LINK_PATH);
-
-    if (xcodePath === "") {
-      logger.warning(
-        `Resolving ${XCODE_SELECT_LINK_PATH} unexpectedly returned nothing.`,
-      );
-      return undefined;
-    }
-
-    // Try to extract the version from the path.
-    const matchResult = xcodePath.match(XCODE_APP_FILENAME_PATTERN);
-
-    if (matchResult?.groups === undefined) {
-      logger.warning(
-        `Xcode path '${xcodePath}' does not contain expected pattern.`,
-      );
-      return undefined;
-    }
-
-    const majorMinor = matchResult.groups["majorMinor"];
-    const version = semver.coerce(majorMinor);
-
-    if (version === null) {
-      logger.warning(`Couldn't parse '${majorMinor}' as a semantic version.`);
-      return undefined;
-    }
-    return version;
-  } catch (err) {
-    logger.warning(
-      `Unable to determine Xcode version: ${getErrorMessage(err)}`,
-    );
-    return undefined;
-  }
-}
@@ -1626,20 +1626,16 @@ test.serial(
      },
    ]);

-    await withTmpDir(async (tmpDir) => {
-      setupActionsVars(tmpDir, tmpDir);
-      const result =
-        await setupCodeql.getEnabledVersionsWithOverlayBaseDatabases(
-          overlayMatchEnabledVersions,
-          ["javascript"],
-          createFeatures([Feature.OverlayAnalysisMatchCodeqlVersion]),
-          new RecordingLogger(),
-        );
-      t.deepEqual(result, [
-        { cliVersion: "2.20.1", tagName: "codeql-bundle-v2.20.1" },
-        { cliVersion: "2.20.0", tagName: "codeql-bundle-v2.20.0" },
-      ]);
-    });
+    const result = await setupCodeql.getEnabledVersionsWithOverlayBaseDatabases(
+      overlayMatchEnabledVersions,
+      ["javascript"],
+      createFeatures([Feature.OverlayAnalysisMatchCodeqlVersion]),
+      new RecordingLogger(),
+    );
+    t.deepEqual(result, [
+      { cliVersion: "2.20.1", tagName: "codeql-bundle-v2.20.1" },
+      { cliVersion: "2.20.0", tagName: "codeql-bundle-v2.20.0" },
+    ]);
  },
 );

@@ -1756,25 +1752,21 @@ test.serial(
      },
    ]);

-    await withTmpDir(async (tmpDir) => {
-      setupActionsVars(tmpDir, tmpDir);
-      const result =
-        await setupCodeql.getEnabledVersionsWithOverlayBaseDatabases(
-          overlayMatchEnabledVersions,
-          ["javascript"],
-          createFeatures([Feature.OverlayAnalysisMatchCodeqlVersionDryRun]),
-          new RecordingLogger(),
-        );
-      t.deepEqual(
-        result,
-        [],
-        "Dry-run should return an empty list so the caller falls back.",
-      );
-      t.assert(
-        listStub.calledOnce,
-        "Dry-run should still list Actions caches to populate the diagnostic.",
-      );
-    });
+    const result = await setupCodeql.getEnabledVersionsWithOverlayBaseDatabases(
+      overlayMatchEnabledVersions,
+      ["javascript"],
+      createFeatures([Feature.OverlayAnalysisMatchCodeqlVersionDryRun]),
+      new RecordingLogger(),
+    );
+    t.deepEqual(
+      result,
+      [],
+      "Dry-run should return an empty list so the caller falls back.",
+    );
+    t.assert(
+      listStub.calledOnce,
+      "Dry-run should still list Actions caches to populate the diagnostic.",
+    );
  },
 );

@@ -1788,22 +1780,18 @@ test.serial(
      },
    ]);

-    await withTmpDir(async (tmpDir) => {
-      setupActionsVars(tmpDir, tmpDir);
-      const result =
-        await setupCodeql.getEnabledVersionsWithOverlayBaseDatabases(
-          overlayMatchEnabledVersions,
-          ["javascript"],
-          createFeatures([
-            Feature.OverlayAnalysisMatchCodeqlVersion,
-            Feature.OverlayAnalysisMatchCodeqlVersionDryRun,
-          ]),
-          new RecordingLogger(),
-        );
-      t.deepEqual(result, [
-        { cliVersion: "2.20.1", tagName: "codeql-bundle-v2.20.1" },
-      ]);
-    });
+    const result = await setupCodeql.getEnabledVersionsWithOverlayBaseDatabases(
+      overlayMatchEnabledVersions,
+      ["javascript"],
+      createFeatures([
+        Feature.OverlayAnalysisMatchCodeqlVersion,
+        Feature.OverlayAnalysisMatchCodeqlVersionDryRun,
+      ]),
+      new RecordingLogger(),
+    );
+    t.deepEqual(result, [
+      { cliVersion: "2.20.1", tagName: "codeql-bundle-v2.20.1" },
+    ]);
  },
 );

@@ -1,5 +1,4 @@
 import { TextDecoder } from "node:util";
-import * as os from "os";
 import path from "path";

 import * as github from "@actions/github";
@@ -35,7 +34,6 @@ import { joinMessageStrings, Loggable, LoggableError, Logger } from "./logging";
 import { OverlayDatabaseMode } from "./overlay/overlay-database-mode";
 import { getBundlePlatform } from "./platform";
 import { ActionName } from "./status-report";
-import { ToolsFeature } from "./tools-features";
 import {
  DEFAULT_DEBUG_ARTIFACT_NAME,
  DEFAULT_DEBUG_DATABASE_NAME,
@@ -274,7 +272,6 @@ export function initAllState(
    startedAt: new Date(),
    platform: process.platform,
    arch: process.arch,
-    osRelease: os.release(),
    logger: new RecordingLogger(),
    env,
    actions: getTestActionsEnv(env),
@@ -914,7 +911,7 @@ export function mockLanguagesInRepo(languages: string[]) {
 */
 export const makeVersionInfo = (
  version: string,
-  features?: { [key in ToolsFeature]?: boolean },
+  features?: { [name: string]: boolean },
  overlayVersion?: number,
 ): VersionInfo => ({
  version,
@@ -1035,7 +1032,6 @@ export function createTestConfig(overrides: Partial<Config>): Config {
      overlayModeSetExplicitly: false,
      repositoryProperties: {},
      enableFileCoverageInformation: true,
-      successfullyInitialised: false,
    } satisfies Config,
    overrides,
  );
@@ -1055,7 +1051,6 @@ export function makeTestToken(length: number = 36) {
 export async function getCodeQLForTesting(
  cmd = "codeql-for-testing",
  logger: Logger = new RecordingLogger(),
-  env: Env = getEnv(),
 ): Promise<codeql.CodeQL> {
-  return codeql.getCodeQLForCmd(logger, cmd, false, env);
+  return codeql.getCodeQLForCmd(logger, cmd, false);
 }
@@ -6,7 +6,6 @@ export enum ToolsFeature {
  BundleSupportsOverlay = "bundleSupportsOverlay",
  IndirectTracingSupportsStaticBinaries = "indirectTracingSupportsStaticBinaries",
  SuppressesMissingFileBaselineWarning = "suppressesMissingFileBaselineWarning",
-  SwiftSupportsAllPlatforms = "swiftSupportsAllPlatforms",
 }

 /**
@@ -900,21 +900,6 @@ export function getErrorMessage(error: unknown): string {
  return error instanceof Error ? error.message : String(error);
 }

-/**
- * Approximates whether {@link error} is like a {@link NodeJS.ErrnoException}.
- * We only typically care about the `code` property, so that's what we check for here.
- */
-export function isErrnoException(
-  error: unknown,
-): error is NodeJS.ErrnoException {
-  return (
-    typeof error === "object" &&
-    error !== null &&
-    "code" in error &&
-    typeof error.code === "string"
-  );
-}
-
 export function prettyPrintPack(pack: Pack) {
  return `${pack.name}${pack.version ? `@${pack.version}` : ""}${
    pack.path ? `:${pack.path}` : ""
Author	SHA1	Message	Date
Michael B. Gale	b484113f11	Merge pull request #4260 from github/dependabot/npm_and_yarn/npm-minor-74c39c9262 Bump the npm-minor group across 1 directory with 3 updates	2026-10-22 10:39:44 +00:00
Michael B. Gale	e0b72fe71a	Merge pull request #4261 from github/dependabot/github_actions/dot-github/workflows/actions-minor-4a8da92e94 Bump the actions-minor group across 1 directory with 3 updates	2026-10-22 10:34:34 +00:00
Michael B. Gale	347d5ce5d5	Trigger workflows	2026-10-22 10:17:39 +01:00
Michael B. Gale	c758339759	Trigger workflows	2026-10-22 10:17:07 +01:00
github-actions[bot]	fb5d8688b9	Rebuild	2026-10-21 17:58:09 +00:00
dependabot[bot]	ec3f8658b6	Bump the actions-minor group across 1 directory with 3 updates Bumps the actions-minor group with 3 updates in the /.github/workflows directory: [actions/setup-java](https://github.com/actions/setup-java), [ruby/setup-ruby](https://github.com/ruby/setup-ruby) and [actions/create-github-app-token](https://github.com/actions/create-github-app-token). Updates `actions/setup-java` from 6.0.1 to 6.1.0 - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](https://github.com/actions/setup-java/compare/de7274f081f381c8f8158605e0321c36c376e2e6...b843ebf9b913146b38da2eaa7aeddf76074ae1ad) Updates `ruby/setup-ruby` from 1.327.0 to 1.329.0 - [Release notes](https://github.com/ruby/setup-ruby/releases) - [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb) - [Commits](https://github.com/ruby/setup-ruby/compare/14594264cd68ce8a2345dd349bc3d138a4ef85c8...651ff0d62c5c79bed6d53ec518387aae20e72c1a) Updates `actions/create-github-app-token` from 3.2.0 to 3.3.0 - [Release notes](https://github.com/actions/create-github-app-token/releases) - [Changelog](https://github.com/actions/create-github-app-token/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/create-github-app-token/compare/bcd2ba49218906704ab6c1aa796996da409d3eb1...64ab729a6294000f5aa4a4bc0b73d1f32bc45510) --- updated-dependencies: - dependency-name: actions/setup-java dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-minor - dependency-name: ruby/setup-ruby dependency-version: 1.329.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-minor - dependency-name: actions/create-github-app-token dependency-version: 3.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-minor ... Signed-off-by: dependabot[bot] <support@github.com>	2026-10-21 17:56:03 +00:00
dependabot[bot]	d1db36d302	Bump the npm-minor group across 1 directory with 3 updates Bumps the npm-minor group with 3 updates in the / directory: [uuid](https://github.com/uuidjs/uuid), [eslint-plugin-jsdoc](https://github.com/gajus/eslint-plugin-jsdoc) and [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint). Updates `uuid` from 14.0.2 to 14.0.3 - [Release notes](https://github.com/uuidjs/uuid/releases) - [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md) - [Commits](https://github.com/uuidjs/uuid/compare/v14.0.2...v14.0.3) Updates `eslint-plugin-jsdoc` from 65.2.0 to 65.3.4 - [Release notes](https://github.com/gajus/eslint-plugin-jsdoc/releases) - [Commits](https://github.com/gajus/eslint-plugin-jsdoc/compare/v65.2.0...v65.3.4) Updates `typescript-eslint` from 8.71.1 to 8.71.2 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.71.2/packages/typescript-eslint) --- updated-dependencies: - dependency-name: uuid dependency-version: 14.0.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-minor - dependency-name: eslint-plugin-jsdoc dependency-version: 65.3.4 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor - dependency-name: typescript-eslint dependency-version: 8.71.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor ... Signed-off-by: dependabot[bot] <support@github.com>	2026-10-21 17:54:13 +00:00