fix(ci): set up Java before Kotlin in PR checks

Merge pull request #4263 from github/mbg/pr-dequeue-notify
Add workflow to comment on a PR when it was dequeued
2026-10-31 20:01:33 +03:00 · 2026-10-26 11:54:59 +00:00 · 2026-10-23 12:00:00 +00:00 · 2026-10-23 11:30:29 +00:00 · 2026-10-23 12:19:29 +01:00 · 2026-10-22 17:33:56 +01:00
138 changed files with 3797 additions and 2240 deletions
@@ -11,9 +11,12 @@ The CodeQL Action is used in GitHub Actions workflows to run CodeQL scans using

 ## Review instructions

- When wording review comments, be helpful and friendly. Assume that the PR author has written the code with the best of intentions. Word your comments constructively as suggestions for improvements. Do not word suggestions as commands.
+- Prioritise identifying critical issues, such as logic bugs, over comments on documentation or typos.
+- When wording review comments, be helpful and friendly. Assume that the PR author has written the code with the best of intentions. Never word suggestions as commands or using the imperative. Examples of what you should never write: "Preserve that non-fatal behaviour here" or "Please preserve that non-fatal behaviour here".
+- When writing feedback, assume that the PR author is competent and is able to understand whether the point you are making is valid or not, why you are raising it, and how to best address it. While you can suggest how to address a point you are making, don't phrase it as a requirement or assume that it is the only solution.
+- Always word your comments constructively as suggestions for improvements, for example: "It would make sense to ..." or "Could you add ...?" or "Would it make sense to ...?"
 - If you want to comment on a change that you believe will fail a CI check, do not present the CI failure you expect as a fact. Instead, write that you think a change "may" lead to a failure in CI. Suggest that, if such a failure manifests, the changes you are commenting on may be the place responsible for the failure and are worth looking at.
- If a suggestion you make is suitable for a follow-up, such as a refactoring that doesn't change the behaviour or fixing a typo in a comment, mention that it can be addressed in a later PR rather than blocking this one.
+- If a suggestion you make is suitable for a follow-up, such as a refactoring that doesn't change the behaviour or fixing a typo in a comment, mention that it can be addressed in a later PR rather than blocking this one or prefix your comment with "Minor: ".
 - If a change is a net improvement, for example because it improves on an existing limitation of existing code, do not complain about pre-existing problems that remain. You may comment on them, but you should make it clear that the thing you are commenting on is not new by writing e.g. "Not new in this PR, but [..]" followed by your description of the issue and a suggestion that it could be improved at the same time with e.g. "Consider whether this is worth addressing as part of this PR as well."

 ## Generated code
@@ -22,6 +25,16 @@ The main codebase of the CodeQL Action is written in TypeScript and compiled to

 GitHub Actions workflows in the `.github/workflows` directory whose filenames start with two underscores (e.g. `__all-platform-bundle.yml`) are automatically generated using the `pr-checks/sync.sh` script from template files in the `pr-checks/checks` directory. Therefore, you do not need to review files in the `.github/workflows` directory that start with two underscores. However, you should review changes to the `pr-checks` directory as well as workflows in the `.github/workflows` directory that do not start with underscores.

+## Feature flags
+
+Some functionality in the code may be gated behind feature flags, which are controlled server-side. If the functionality that is gated behind them is user-facing, then this should be documented in a change note at the time that the gated functionality is added. See `CHANGELOG.md` for existing notes that mention "experimental" for examples. These typically include information about when users may expect to see the feature rolled out.
+
+When a feature flag that gates some functionality is removed, this does not need to be documented in a change note since the feature is already rolled out and the notes for the release which introduced the feature already describe it. The only exception is functionality which will start having an effect on GHES as a result of the feature flag removal:
+
+- Most functionality gated behind feature flags does not affect GHES.
+- We can make functionality available on GHES by setting `defaultValue` to `true` first and waiting for this to have had an effect on GHES. No change note is needed if a feature flag is removed where `defaultValue` was `true`.
+- When removing a feature flag where `defaultValue` was `false` and the functionality starts to affect GHES, a change note may be appropriate.
+
 ## Release process

 Changes that are merged to the `main` branch are not used in production straight away. Instead, changes from `main` must first be released using the release process, which has to be manually triggered by a staff member. Therefore, it is possible for further changes to be made to the code after some changes have been merged to `main` but before they are released. Once the release process automation is started, a series of PRs are automatically generated:
@@ -30,6 +30,11 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
  workflow_call:
    inputs:
      dotnet-version:
@@ -42,12 +47,17 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: all-platform-bundle-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: all-platform-bundle-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
  all-platform-bundle:
    strategy:
@@ -79,6 +89,11 @@ jobs:
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
@@ -19,15 +19,25 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
  workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: analysis-kinds-${{github.ref}}
+  group: analysis-kinds-${{github.ref}}-${{inputs.java-version}}
 jobs:
  analysis-kinds:
    strategy:
@@ -68,6 +78,11 @@ jobs:
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
@@ -30,6 +30,11 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
  workflow_call:
    inputs:
      dotnet-version:
@@ -42,12 +47,17 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: analyze-ref-input-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: analyze-ref-input-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
  analyze-ref-input:
    strategy:
@@ -75,6 +85,11 @@ jobs:
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
@@ -25,6 +25,11 @@ on:
        description: The version of .NET to install
        required: false
        default: 9.x
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
  workflow_call:
    inputs:
      dotnet-version:
@@ -32,12 +37,17 @@ on:
        description: The version of .NET to install
        required: false
        default: 9.x
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: autobuild-action-${{github.ref}}-${{inputs.dotnet-version}}
+  group: autobuild-action-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.java-version}}
 jobs:
  autobuild-action:
    strategy:
@@ -64,6 +74,11 @@ jobs:
        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
        with:
          dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
@@ -63,7 +63,7 @@ jobs:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Install Java
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
        with:
          java-version: ${{ inputs.java-version || '17' }}
          distribution: temurin
@@ -19,15 +19,25 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
  workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: autobuild-working-dir-${{github.ref}}
+  group: autobuild-working-dir-${{github.ref}}-${{inputs.java-version}}
 jobs:
  autobuild-working-dir:
    strategy:
@@ -46,6 +56,11 @@ jobs:
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
@@ -63,7 +63,7 @@ jobs:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Install Java
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
        with:
          java-version: ${{ inputs.java-version || '17' }}
          distribution: temurin
@@ -30,6 +30,11 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
  workflow_call:
    inputs:
      dotnet-version:
@@ -42,12 +47,17 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: build-mode-manual-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: build-mode-manual-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
  build-mode-manual:
    strategy:
@@ -75,6 +85,11 @@ jobs:
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
@@ -19,15 +19,25 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
  workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: build-mode-none-${{github.ref}}
+  group: build-mode-none-${{github.ref}}-${{inputs.java-version}}
 jobs:
  build-mode-none:
    strategy:
@@ -48,6 +58,11 @@ jobs:
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
@@ -19,15 +19,25 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
  workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: build-mode-rollback-${{github.ref}}
+  group: build-mode-rollback-${{github.ref}}-${{inputs.java-version}}
 jobs:
  build-mode-rollback:
    strategy:
@@ -46,6 +56,11 @@ jobs:
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
@@ -19,15 +19,25 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
  workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: bundle-from-nightly-${{github.ref}}
+  group: bundle-from-nightly-${{github.ref}}-${{inputs.java-version}}
 jobs:
  bundle-from-nightly:
    strategy:
@@ -46,6 +56,11 @@ jobs:
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
@@ -19,15 +19,25 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
  workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: bundle-from-toolcache-${{github.ref}}
+  group: bundle-from-toolcache-${{github.ref}}-${{inputs.java-version}}
 jobs:
  bundle-from-toolcache:
    strategy:
@@ -46,6 +56,20 @@ jobs:
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
+      - name: Install Node.js
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 20.x
+          cache: npm
+      - name: Install newer npm
+        run: npm install -g npm@11.19.1
+      - name: Install dependencies
+        run: npm ci
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
@@ -53,31 +77,20 @@ jobs:
          version: ${{ matrix.version }}
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
-      - name: Install @actions/tool-cache
-        run: npm install @actions/tool-cache@3
      - name: Check toolcache contains CodeQL
        continue-on-error: true
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        with:
-          script: |
-            const toolcache = require('@actions/tool-cache');
-            const allCodeqlVersions = toolcache.findAllVersions('CodeQL');
-            if (allCodeqlVersions.length === 0) {
-              throw new Error(`CodeQL could not be found in the toolcache`);
-            }
+        run: |
+          cd ./../action
+          npx tsx ./pr-checks/toolcache.ts installed
+
      - id: setup-codeql
        uses: ./../action/setup-codeql
        with:
          tools: ${{ steps.prepare-test.outputs.tools-url }}
+
      - name: Check CodeQL is installed within the toolcache
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        with:
-          script: |
-            const toolcache = require('@actions/tool-cache');
-            const allCodeqlVersions = toolcache.findAllVersions('CodeQL');
-            console.log(`Found CodeQL versions: ${allCodeqlVersions}`);
-            if (allCodeqlVersions.length === 0) {
-              throw new Error('CodeQL not found in toolcache');
-            }
+        run: |
+          cd ./../action
+          npx tsx ./pr-checks/toolcache.ts installed
    env:
      CODEQL_ACTION_TEST_MODE: true
@@ -19,15 +19,25 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
  workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: bundle-toolcache-${{github.ref}}
+  group: bundle-toolcache-${{github.ref}}-${{inputs.java-version}}
 jobs:
  bundle-toolcache:
    strategy:
@@ -50,6 +60,20 @@ jobs:
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
+      - name: Install Node.js
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 20.x
+          cache: npm
+      - name: Install newer npm
+        run: npm install -g npm@11.19.1
+      - name: Install dependencies
+        run: npm ci
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
@@ -58,47 +82,30 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Remove CodeQL from toolcache
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        with:
-          script: |
-            const fs = require('fs');
-            const path = require('path');
-            const codeqlPath = path.join(process.env['RUNNER_TOOL_CACHE'], 'CodeQL');
-            fs.rmdirSync(codeqlPath, { recursive: true });
-      - name: Install @actions/tool-cache
-        run: npm install @actions/tool-cache@3
+        run: |
+          cd ./../action
+          npx tsx ./pr-checks/toolcache.ts clear
+
      - name: Check toolcache does not contain CodeQL
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        with:
-          script: |
-            const toolcache = require('@actions/tool-cache');
-            const allCodeqlVersions = toolcache.findAllVersions('CodeQL');
-            if (allCodeqlVersions.length !== 0) {
-              throw new Error(`CodeQL should not be found in the toolcache, but found ${allCodeqlVersions}`);
-            }
-            console.log('No versions of CodeQL found in the toolcache');
+        run: |
+          cd ./../action
+          npx tsx ./pr-checks/toolcache.ts absent
+
      - id: init
        uses: ./../action/init
        with:
          # Request multiple languages so this check uses the combined bundle.
          languages: javascript,python
          tools: ${{ steps.prepare-test.outputs.tools-url }}
+
      - uses: ./../action/analyze
        with:
          output: ${{ runner.temp }}/results
          upload-database: false
+
      - name: Check CodeQL is installed within the toolcache
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        with:
-          script: |
-            const toolcache = require('@actions/tool-cache');
-            const allCodeqlVersions = toolcache.findAllVersions('CodeQL');
-            console.log(`Found CodeQL versions: ${allCodeqlVersions}`);
-            if (allCodeqlVersions.length === 0) {
-              throw new Error('CodeQL not found in toolcache');
-            }
-            if (allCodeqlVersions.length > 1) {
-              throw new Error('Multiple CodeQL versions found in toolcache');
-            }
+        run: |
+          cd ./../action
+          npx tsx ./pr-checks/toolcache.ts installed -n 1
    env:
      CODEQL_ACTION_TEST_MODE: true
@@ -19,15 +19,25 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
  workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: cleanup-db-cluster-dir-${{github.ref}}
+  group: cleanup-db-cluster-dir-${{github.ref}}-${{inputs.java-version}}
 jobs:
  cleanup-db-cluster-dir:
    strategy:
@@ -46,6 +56,11 @@ jobs:
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
@@ -19,15 +19,25 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
  workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: config-export-${{github.ref}}
+  group: config-export-${{github.ref}}-${{inputs.java-version}}
 jobs:
  config-export:
    strategy:
@@ -48,6 +58,11 @@ jobs:
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
@@ -19,15 +19,25 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
  workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: config-input-${{github.ref}}
+  group: config-input-${{github.ref}}-${{inputs.java-version}}
 jobs:
  config-input:
    strategy:
@@ -46,6 +56,11 @@ jobs:
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
      - name: Install Node.js
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
@@ -19,15 +19,25 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
  workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: cpp-deptrace-disabled-${{github.ref}}
+  group: cpp-deptrace-disabled-${{github.ref}}-${{inputs.java-version}}
 jobs:
  cpp-deptrace-disabled:
    strategy:
@@ -50,6 +60,11 @@ jobs:
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
@@ -19,15 +19,25 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
  workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: cpp-deptrace-enabled-on-macos-${{github.ref}}
+  group: cpp-deptrace-enabled-on-macos-${{github.ref}}-${{inputs.java-version}}
 jobs:
  cpp-deptrace-enabled-on-macos:
    strategy:
@@ -48,6 +58,11 @@ jobs:
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
@@ -19,15 +19,25 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
  workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: cpp-deptrace-enabled-${{github.ref}}
+  group: cpp-deptrace-enabled-${{github.ref}}-${{inputs.java-version}}
 jobs:
  cpp-deptrace-enabled:
    strategy:
@@ -50,6 +60,11 @@ jobs:
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
@@ -19,15 +19,25 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
  workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: diagnostics-export-${{github.ref}}
+  group: diagnostics-export-${{github.ref}}-${{inputs.java-version}}
 jobs:
  diagnostics-export:
    strategy:
@@ -48,6 +58,20 @@ jobs:
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
+      - name: Install Node.js
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 20.x
+          cache: npm
+      - name: Install newer npm
+        run: npm install -g npm@11.19.1
+      - name: Install dependencies
+        run: npm ci
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
@@ -81,56 +105,13 @@ jobs:
          name: diagnostics-export-${{ matrix.os }}-${{ matrix.version }}.sarif.json
          path: '${{ runner.temp }}/results/javascript.sarif'
          retention-days: 7
+
      - name: Check diagnostics appear in SARIF
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        env:
          SARIF_PATH: '${{ runner.temp }}/results/javascript.sarif'
-        with:
-          script: |
-            const fs = require('fs');
-
-            function checkStatusPageNotification(n) {
-              const expectedMessage = 'Plaintext message';
-              if (n.message.text !== expectedMessage) {
-                core.setFailed(`Expected the status page diagnostic to have the message '${expectedMessage}', but found '${n.message.text}'.`);
-              }
-              if (n.locations.length !== 1) {
-                core.setFailed(`Expected the status page diagnostic to have exactly 1 location, but found ${n.locations.length}.`);
-              }
-            }
-
-            const sarif = JSON.parse(fs.readFileSync(process.env['SARIF_PATH'], 'utf8'));
-            const run = sarif.runs[0];
-
-            const toolExecutionNotifications = run.invocations[0].toolExecutionNotifications;
-            const statusPageNotifications = toolExecutionNotifications.filter(n =>
-              n.descriptor.id === 'lang/diagnostics/example' && n.properties?.visibility?.statusPage
-            );
-            if (statusPageNotifications.length !== 1) {
-              core.setFailed(
-                'Expected exactly one status page reporting descriptor for this diagnostic in the ' +
-                  `'runs[].invocations[].toolExecutionNotifications[]' SARIF property, but found ` +
-                  `${statusPageNotifications.length}. All notification reporting descriptors: ` +
-                  `${JSON.stringify(toolExecutionNotifications)}.`
-              );
-            }
-            checkStatusPageNotification(statusPageNotifications[0]);
-
-            const notifications = run.tool.driver.notifications;
-            const diagnosticNotification = notifications.filter(n =>
-              n.id === 'lang/diagnostics/example' && n.name === 'lang/diagnostics/example' &&
-                n.fullDescription.text === 'Diagnostic name'
-            );
-            if (diagnosticNotification.length !== 1) {
-              core.setFailed(
-                'Expected exactly one notification for this diagnostic in the ' +
-                  `'runs[].tool.driver.notifications[]' SARIF property, but found ` +
-                  `${diagnosticNotification.length}. All notifications: ` +
-                  `${JSON.stringify(notifications)}.`
-              );
-            }
-
-            core.info('Finished diagnostic export test');
+        run: |
+          cd ../action
+          npx tsx ./pr-checks/check-diagnostics.ts
    env:
      CODEQL_ACTION_EXPORT_DIAGNOSTICS: true
      CODEQL_ACTION_TEST_MODE: true
@@ -0,0 +1,158 @@
+# Warning: This file is generated automatically, and should not be modified.
+# Instead, please modify the template in the pr-checks directory and run:
+#     pr-checks/sync.sh
+# to regenerate this file.
+
+name: PR Check - Diagnostic export without database
+env:
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  GO111MODULE: auto
+on:
+  push:
+    branches:
+      - main
+      - releases/v*
+  pull_request: {}
+  merge_group:
+    types:
+      - checks_requested
+  schedule:
+    - cron: '0 5 * * *'
+  workflow_dispatch:
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
+  workflow_call:
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
+  group: diagnostics-without-db-${{github.ref}}-${{inputs.java-version}}
+jobs:
+  diagnostics-without-db:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: linked
+    name: Diagnostic export without database
+    if: github.triggering_actor != 'dependabot[bot]'
+    permissions:
+      contents: read
+      security-events: read
+    timeout-minutes: 45
+    runs-on: ${{ matrix.os }}
+    steps:
+      # We deliberately need to make this step fail before the database is initialised, but after
+      # some diagnostic has been produced. The simplest way to do that right now is to:
+      #
+      # - Produce a diagnostic before the db is initialised by forcing the use of a nightly release
+      #   with the `CODEQL_ACTION_FORCE_NIGHTLY` feature flag.
+      # - Cause `init` to abort because we are attempting to analyse Swift on a non-macOS runner.
+      #
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
+      - name: Install Node.js
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 20.x
+          cache: npm
+      - name: Install newer npm
+        run: npm install -g npm@11.19.1
+      - name: Install dependencies
+        run: npm ci
+      - name: Prepare test
+        id: prepare-test
+        uses: ./.github/actions/prepare-test
+        with:
+          version: ${{ matrix.version }}
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
+      - name: Initialise failing analysis
+        id: init
+        uses: ./../action/init
+        continue-on-error: true
+        env:
+          CODEQL_ACTION_FORCE_NIGHTLY: true
+        with:
+          languages: swift
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
+
+      - name: Analyze
+        uses: ./analyze
+        # In a real workflow, this step wouldn't run. Since we used `continue-on-error`
+        # above, we manually disable it with an `if` condition. Having this step is required
+        # for the init post-action because it checks the workflow definition for e.g. the
+        # `category` input. Without this step, that part of the init post-action would fail.
+        if: false
+        with:
+          category: '/test-codeql-version:${{ matrix.version }}'
+
+      - name: Check diagnostics appear on disk
+        env:
+          DIAGNOSTICS_DIR: '${{ runner.temp }}/codeql-action-temp-diagnostics/'
+        run: |
+          cd ../action
+          npx tsx ./pr-checks/diagnostics-without-db.ts
+    env:
+      CODEQL_ACTION_SKIP_GENERATE_FAILED_SARIF: false
+      CODEQL_ACTION_SKIP_SARIF_UPLOAD: true
+      CODEQL_ACTION_TESTING_ENVIRONMENT: codeql-action-pr-checks
+      CODEQL_ACTION_TEST_MODE: true
+  diagnostics-without-db-validation:
+    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - diagnostics-without-db
+    permissions:
+      contents: read
+      security-events: read
+    timeout-minutes: 5
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Node.js
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 20.x
+          cache: npm
+      - name: Install newer npm
+        run: npm install -g npm@11.19.1
+      - name: Install dependencies
+        run: npm ci
+      - name: Download workflow artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          pattern: test-mode-sarif-*
+          path: sarif
+
+      - name: List artifact contents
+        run: ls -laR ./sarif
+
+      - name: Check diagnostics appear in SARIF
+        env:
+          SARIF_PATH: "./sarif/codeql-failed-run.sarif"
+          DIAGNOSTIC_ID: "codeql-action/forced-nightly-cli"
+          DIAGNOSTIC_NAME: "A nightly release of CodeQL was used"
+          EXPECTED_LOCATIONS: "0"
+          EXPECTED_MESSAGE: |
+            GitHub configured this analysis to use a nightly release of CodeQL to allow you to preview changes from an upcoming release.
+        run: npx tsx ./pr-checks/check-diagnostics.ts
+    env:
+      CODEQL_ACTION_TEST_MODE: true
@@ -30,6 +30,11 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
  workflow_call:
    inputs:
      dotnet-version:
@@ -42,12 +47,17 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: export-file-baseline-information-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: export-file-baseline-information-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
  export-file-baseline-information:
    strategy:
@@ -79,6 +89,11 @@ jobs:
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
@@ -91,6 +106,11 @@ jobs:
        with:
          languages: javascript
          tools: ${{ steps.prepare-test.outputs.tools-url }}
+          # To balance speed and coverage, analyze only JavaScript but use the combined bundle so
+          # baseline information is reported for every language in the multi-language repository. A
+          # custom configuration prevents per-language bundles from being used.
+          config: |
+            paths-ignore: []
      - name: Build code
        run: ./build.sh
      - uses: ./../action/analyze
@@ -124,5 +144,4 @@ jobs:
    env:
      CODEQL_ACTION_SKIP_FILE_COVERAGE_ON_PRS: false
      CODEQL_ACTION_SUBLANGUAGE_FILE_COVERAGE: true
-      CODEQL_ACTION_PER_LANGUAGE_BUNDLES: false
      CODEQL_ACTION_TEST_MODE: true
@@ -19,15 +19,25 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
  workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: extractor-ram-threads-${{github.ref}}
+  group: extractor-ram-threads-${{github.ref}}-${{inputs.java-version}}
 jobs:
  extractor-ram-threads:
    strategy:
@@ -46,6 +56,11 @@ jobs:
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
@@ -30,6 +30,11 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
  workflow_call:
    inputs:
      dotnet-version:
@@ -42,12 +47,17 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: go-custom-queries-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: go-custom-queries-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
  go-custom-queries:
    strategy:
@@ -77,6 +87,11 @@ jobs:
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
@@ -25,6 +25,11 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
  workflow_call:
    inputs:
      go-version:
@@ -32,12 +37,17 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: go-indirect-tracing-workaround-diagnostic-${{github.ref}}-${{inputs.go-version}}
+  group: go-indirect-tracing-workaround-diagnostic-${{github.ref}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
  go-indirect-tracing-workaround-diagnostic:
    strategy:
@@ -61,6 +71,11 @@ jobs:
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
@@ -25,6 +25,11 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
  workflow_call:
    inputs:
      go-version:
@@ -32,12 +37,17 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: go-indirect-tracing-workaround-no-file-program-${{github.ref}}-${{inputs.go-version}}
+  group: go-indirect-tracing-workaround-no-file-program-${{github.ref}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
  go-indirect-tracing-workaround-no-file-program:
    strategy:
@@ -61,6 +71,11 @@ jobs:
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
@@ -25,6 +25,11 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
  workflow_call:
    inputs:
      go-version:
@@ -32,12 +37,17 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: go-indirect-tracing-workaround-${{github.ref}}-${{inputs.go-version}}
+  group: go-indirect-tracing-workaround-${{github.ref}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
  go-indirect-tracing-workaround:
    strategy:
@@ -61,6 +71,11 @@ jobs:
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
@@ -25,6 +25,11 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
  workflow_call:
    inputs:
      go-version:
@@ -32,12 +37,17 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: go-tracing-autobuilder-${{github.ref}}-${{inputs.go-version}}
+  group: go-tracing-autobuilder-${{github.ref}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
  go-tracing-autobuilder:
    strategy:
@@ -81,6 +91,11 @@ jobs:
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
@@ -25,6 +25,11 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
  workflow_call:
    inputs:
      go-version:
@@ -32,12 +37,17 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: go-tracing-custom-build-steps-${{github.ref}}-${{inputs.go-version}}
+  group: go-tracing-custom-build-steps-${{github.ref}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
  go-tracing-custom-build-steps:
    strategy:
@@ -81,6 +91,11 @@ jobs:
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
@@ -25,6 +25,11 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
  workflow_call:
    inputs:
      go-version:
@@ -32,12 +37,17 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: go-tracing-legacy-workflow-${{github.ref}}-${{inputs.go-version}}
+  group: go-tracing-legacy-workflow-${{github.ref}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
  go-tracing-legacy-workflow:
    strategy:
@@ -81,6 +91,11 @@ jobs:
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
@@ -20,6 +20,11 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 jobs:
  go-custom-queries:
    name: 'Go: Custom queries'
@@ -30,6 +35,7 @@ jobs:
    with:
      dotnet-version: ${{ inputs.dotnet-version }}
      go-version: ${{ inputs.go-version }}
+      java-version: ${{ inputs.java-version }}
  go-indirect-tracing-workaround-diagnostic:
    name: 'Go: diagnostic when Go is changed after init step'
    permissions:
@@ -38,6 +44,7 @@ jobs:
    uses: ./.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml
    with:
      go-version: ${{ inputs.go-version }}
+      java-version: ${{ inputs.java-version }}
  go-indirect-tracing-workaround-no-file-program:
    name: 'Go: diagnostic when `file` is not installed'
    permissions:
@@ -46,6 +53,7 @@ jobs:
    uses: ./.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml
    with:
      go-version: ${{ inputs.go-version }}
+      java-version: ${{ inputs.java-version }}
  go-indirect-tracing-workaround:
    name: 'Go: workaround for indirect tracing'
    permissions:
@@ -54,6 +62,7 @@ jobs:
    uses: ./.github/workflows/__go-indirect-tracing-workaround.yml
    with:
      go-version: ${{ inputs.go-version }}
+      java-version: ${{ inputs.java-version }}
  go-tracing-autobuilder:
    name: 'Go: tracing with autobuilder step'
    permissions:
@@ -62,6 +71,7 @@ jobs:
    uses: ./.github/workflows/__go-tracing-autobuilder.yml
    with:
      go-version: ${{ inputs.go-version }}
+      java-version: ${{ inputs.java-version }}
  go-tracing-custom-build-steps:
    name: 'Go: tracing with custom build steps'
    permissions:
@@ -70,6 +80,7 @@ jobs:
    uses: ./.github/workflows/__go-tracing-custom-build-steps.yml
    with:
      go-version: ${{ inputs.go-version }}
+      java-version: ${{ inputs.java-version }}
  go-tracing-legacy-workflow:
    name: 'Go: tracing with legacy workflow'
    permissions:
@@ -78,3 +89,4 @@ jobs:
    uses: ./.github/workflows/__go-tracing-legacy-workflow.yml
    with:
      go-version: ${{ inputs.go-version }}
+      java-version: ${{ inputs.java-version }}
@@ -19,15 +19,25 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
  workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: init-with-registries-${{github.ref}}
+  group: init-with-registries-${{github.ref}}-${{inputs.java-version}}
 jobs:
  init-with-registries:
    strategy:
@@ -50,6 +60,11 @@ jobs:
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
@@ -19,15 +19,25 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
  workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: javascript-source-root-${{github.ref}}
+  group: javascript-source-root-${{github.ref}}-${{inputs.java-version}}
 jobs:
  javascript-source-root:
    strategy:
@@ -50,6 +60,11 @@ jobs:
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
@@ -19,15 +19,25 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
  workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: job-run-uuid-sarif-${{github.ref}}
+  group: job-run-uuid-sarif-${{github.ref}}-${{inputs.java-version}}
 jobs:
  job-run-uuid-sarif:
    strategy:
@@ -46,6 +56,11 @@ jobs:
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
@@ -19,15 +19,25 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
  workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: language-aliases-${{github.ref}}
+  group: language-aliases-${{github.ref}}-${{inputs.java-version}}
 jobs:
  language-aliases:
    strategy:
@@ -46,6 +56,11 @@ jobs:
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
@@ -30,6 +30,11 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
  workflow_call:
    inputs:
      dotnet-version:
@@ -42,12 +47,17 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: linux-arm64-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: linux-arm64-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
  linux-arm64:
    strategy:
@@ -75,6 +85,11 @@ jobs:
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
@@ -30,6 +30,11 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
  workflow_call:
    inputs:
      dotnet-version:
@@ -42,12 +47,17 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: local-bundle-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: local-bundle-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
  local-bundle:
    strategy:
@@ -75,6 +85,11 @@ jobs:
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
@@ -30,6 +30,11 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
  workflow_call:
    inputs:
      dotnet-version:
@@ -42,12 +47,17 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: multi-language-autodetect-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: multi-language-autodetect-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
  multi-language-autodetect:
    strategy:
@@ -109,6 +119,11 @@ jobs:
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
@@ -192,6 +207,5 @@ jobs:
            exit 1
          fi
    env:
-      CODEQL_ACTION_CLEANUP_TOOLCACHE_BUNDLES: true
      CODEQL_ACTION_RESOLVE_SUPPORTED_LANGUAGES_USING_CLI: true
      CODEQL_ACTION_TEST_MODE: true
@@ -19,15 +19,25 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
  workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: overlay-init-fallback-${{github.ref}}
+  group: overlay-init-fallback-${{github.ref}}-${{inputs.java-version}}
 jobs:
  overlay-init-fallback:
    strategy:
@@ -48,6 +58,11 @@ jobs:
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
@@ -30,6 +30,11 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
  workflow_call:
    inputs:
      dotnet-version:
@@ -42,12 +47,17 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: packaging-codescanning-config-inputs-js-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: packaging-codescanning-config-inputs-js-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
  packaging-codescanning-config-inputs-js:
    strategy:
@@ -79,6 +89,11 @@ jobs:
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
      - name: Install Node.js
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
@@ -30,6 +30,11 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
  workflow_call:
    inputs:
      dotnet-version:
@@ -42,12 +47,17 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: packaging-config-inputs-js-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: packaging-config-inputs-js-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
  packaging-config-inputs-js:
    strategy:
@@ -79,6 +89,11 @@ jobs:
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
      - name: Install Node.js
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
@@ -30,6 +30,11 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
  workflow_call:
    inputs:
      dotnet-version:
@@ -42,12 +47,17 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: packaging-config-js-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: packaging-config-js-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
  packaging-config-js:
    strategy:
@@ -79,6 +89,11 @@ jobs:
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
      - name: Install Node.js
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
@@ -30,6 +30,11 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
  workflow_call:
    inputs:
      dotnet-version:
@@ -42,12 +47,17 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: packaging-inputs-js-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: packaging-inputs-js-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
  packaging-inputs-js:
    strategy:
@@ -79,6 +89,11 @@ jobs:
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
      - name: Install Node.js
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
@@ -19,15 +19,25 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
  workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: per-language-bundle-validation-${{github.ref}}
+  group: per-language-bundle-validation-${{github.ref}}-${{inputs.java-version}}
 jobs:
  per-language-bundle-validation:
    strategy:
@@ -36,40 +46,40 @@ jobs:
        include:
          - language: actions
            os: ubuntu-latest
-            version: nightly-latest
+            version: linked
            expected-extractors: actions javascript
          - language: cpp
            os: ubuntu-latest
-            version: nightly-latest
+            version: linked
            build-mode: manual
            build-command: gcc -o main main.c
          - language: csharp
            os: ubuntu-latest
-            version: nightly-latest
+            version: linked
            build-mode: none
          - language: go
            os: ubuntu-latest
-            version: nightly-latest
+            version: linked
            build-mode: autobuild
          - language: java
            os: ubuntu-latest
-            version: nightly-latest
+            version: linked
            build-mode: none
          - language: javascript
            os: ubuntu-latest
-            version: nightly-latest
+            version: linked
          - language: python
            os: ubuntu-latest
-            version: nightly-latest
+            version: linked
          - language: ruby
            os: ubuntu-latest
-            version: nightly-latest
+            version: linked
          - language: rust
            os: ubuntu-latest
-            version: nightly-latest
+            version: linked
          - language: swift
            os: macos-latest-xlarge
-            version: nightly-latest
+            version: linked
            build-mode: autobuild
    name: Per-language bundles
    if: github.triggering_actor != 'dependabot[bot]'
@@ -81,6 +91,20 @@ jobs:
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
+      - name: Install Node.js
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 20.x
+          cache: npm
+      - name: Install newer npm
+        run: npm install -g npm@11.19.1
+      - name: Install dependencies
+        run: npm ci
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
@@ -88,6 +112,10 @@ jobs:
          version: ${{ matrix.version }}
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
+      - name: Remove CodeQL from toolcache
+        run: |
+          cd ./../action
+          npx tsx ./pr-checks/toolcache.ts clear
      - uses: ./../action/init
        id: init
        with:
@@ -128,9 +156,8 @@ jobs:
          CODEQL_PATH: ${{ steps.init.outputs.codeql-path }}
        run: |
          # A bundle that is missing most of its extractors must never be left in the toolcache,
-          # where a later job analyzing a different language could pick it up. The runner image
-          # ships with its own CodeQL in the toolcache, so check where this bundle was extracted to
-          # rather than whether the toolcache contains CodeQL at all.
+          # where a later job analyzing a different language could pick it up. Per-language bundles
+          # must instead be extracted under the runner's temporary directory.
          echo "CodeQL is at $CODEQL_PATH"
          if [[ "$CODEQL_PATH" == "$RUNNER_TOOL_CACHE"/* ]]; then
            echo "::error::The per-language bundle was added to the toolcache at $CODEQL_PATH."
@@ -160,5 +187,4 @@ jobs:
          fi
          echo "Created a ${LANGUAGE} database at ${database}."
    env:
-      CODEQL_ACTION_PER_LANGUAGE_BUNDLES: true
      CODEQL_ACTION_TEST_MODE: true
@@ -30,6 +30,11 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
  workflow_call:
    inputs:
      dotnet-version:
@@ -42,12 +47,17 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: remote-config-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: remote-config-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
  remote-config:
    strategy:
@@ -77,6 +87,11 @@ jobs:
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
@@ -19,15 +19,25 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
  workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: resolve-environment-action-${{github.ref}}
+  group: resolve-environment-action-${{github.ref}}-${{inputs.java-version}}
 jobs:
  resolve-environment-action:
    strategy:
@@ -50,6 +60,11 @@ jobs:
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
@@ -19,15 +19,25 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
  workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: rubocop-multi-language-${{github.ref}}
+  group: rubocop-multi-language-${{github.ref}}-${{inputs.java-version}}
 jobs:
  rubocop-multi-language:
    strategy:
@@ -46,6 +56,11 @@ jobs:
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
@@ -54,7 +69,7 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Set up Ruby
-        uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1.327.0
+        uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
        with:
          ruby-version: 2.6
      - name: Install Code Scanning integration
@@ -19,15 +19,25 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
  workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: ruby-${{github.ref}}
+  group: ruby-${{github.ref}}-${{inputs.java-version}}
 jobs:
  ruby:
    strategy:
@@ -56,6 +66,11 @@ jobs:
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
@@ -19,15 +19,25 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
  workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: rust-${{github.ref}}
+  group: rust-${{github.ref}}-${{inputs.java-version}}
 jobs:
  rust:
    strategy:
@@ -54,6 +64,11 @@ jobs:
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
@@ -30,6 +30,11 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
  workflow_call:
    inputs:
      dotnet-version:
@@ -42,12 +47,17 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: split-workflow-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: split-workflow-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
  split-workflow:
    strategy:
@@ -85,6 +95,11 @@ jobs:
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
@@ -19,15 +19,25 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
  workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: start-proxy-${{github.ref}}
+  group: start-proxy-${{github.ref}}-${{inputs.java-version}}
 jobs:
  start-proxy:
    strategy:
@@ -50,6 +60,11 @@ jobs:
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
@@ -19,15 +19,25 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
  workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: submit-sarif-failure-${{github.ref}}
+  group: submit-sarif-failure-${{github.ref}}-${{inputs.java-version}}
 jobs:
  submit-sarif-failure:
    strategy:
@@ -50,6 +60,11 @@ jobs:
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
@@ -71,7 +86,9 @@ jobs:
        run: exit 1
      - uses: ./analyze
        # In a real workflow, this step wouldn't run. Since we used `continue-on-error`
-        # above, we manually disable it with an `if` condition.
+        # above, we manually disable it with an `if` condition. Having this step is required
+        # for the init post-action because it checks the workflow definition for e.g. the
+        # `category` input. Without this step, that part of the init post-action would fail.
        if: false
        with:
          category: '/test-codeql-version:${{ matrix.version }}'
@@ -19,15 +19,25 @@ on:
  schedule:
    - cron: '0 5 * * *'
  workflow_dispatch:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
  workflow_call:
-    inputs: {}
+    inputs:
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: swift-autobuild-${{github.ref}}
+  group: swift-autobuild-${{github.ref}}-${{inputs.java-version}}
 jobs:
  swift-autobuild:
    strategy:
@@ -46,6 +56,11 @@ jobs:
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
@@ -30,6 +30,11 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
  workflow_call:
    inputs:
      dotnet-version:
@@ -42,12 +47,17 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: swift-custom-build-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: swift-custom-build-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
  swift-custom-build:
    strategy:
@@ -79,6 +89,11 @@ jobs:
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
@@ -30,6 +30,11 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
  workflow_call:
    inputs:
      dotnet-version:
@@ -42,12 +47,17 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: unset-environment-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: unset-environment-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
  unset-environment:
    strategy:
@@ -77,6 +87,11 @@ jobs:
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
@@ -30,6 +30,11 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
  workflow_call:
    inputs:
      dotnet-version:
@@ -42,12 +47,17 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: upload-ref-sha-input-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: upload-ref-sha-input-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
  upload-ref-sha-input:
    strategy:
@@ -75,6 +85,11 @@ jobs:
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
@@ -30,6 +30,11 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
  workflow_call:
    inputs:
      dotnet-version:
@@ -42,12 +47,17 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: upload-sarif-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: upload-sarif-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
  upload-sarif:
    strategy:
@@ -82,6 +92,11 @@ jobs:
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
@@ -30,6 +30,11 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
  workflow_call:
    inputs:
      dotnet-version:
@@ -42,12 +47,17 @@ on:
        description: The version of Go to install
        required: false
        default: '>=1.21.0'
+      java-version:
+        type: string
+        description: The version of Java to install
+        required: false
+        default: '17'
 defaults:
  run:
    shell: bash
 concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: with-checkout-path-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}
+  group: with-checkout-path-${{github.ref}}-${{inputs.dotnet-version}}-${{inputs.go-version}}-${{inputs.java-version}}
 jobs:
  with-checkout-path:
    strategy:
@@ -76,6 +86,11 @@ jobs:
        with:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
+      - name: Install Java
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        with:
+          java-version: ${{ inputs.java-version || '17' }}
+          distribution: temurin
      - name: Prepare test
        id: prepare-test
        uses: ./.github/actions/prepare-test
@@ -134,7 +134,7 @@ jobs:
          echo "::endgroup::"

      - name: Generate token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
        id: app-token
        with:
          app-id: ${{ vars.AUTOMATION_APP_ID }}
@@ -2,6 +2,9 @@ name: PR Checks

 on:
  push:
+    branches:
+      - "main"
+      - "releases/v*"
  pull_request:
  merge_group:
    types: [checks_requested]
@@ -145,12 +148,11 @@ jobs:

      - name: Fetch base commit
        id: fetch-base
-        # Forks and Dependabot PRs don't have permission to write comments, so skip the repo size
-        # check in those cases.
+        # Skip this (and subsequent steps) if the PR originates from a fork, since this workflow
+        # won't have the necessary permissions to post comments on the PR.
        if: >-
          github.event_name == 'pull_request' &&
-          github.event.pull_request.head.repo.full_name == github.repository &&
-          github.event.pull_request.user.login != 'dependabot[bot]'
+          github.event.pull_request.head.repo.full_name == github.repository
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
@@ -209,7 +211,7 @@ jobs:
    if: >-
      github.event_name == 'pull_request' &&
      github.event.pull_request.head.repo.full_name == github.repository &&
-      github.event.pull_request.user.login != 'dependabot[bot]' &&
+      github.actor != 'dependabot[bot]' &&
      needs.other-checks.result == 'success'
    permissions:
      contents: read
@@ -0,0 +1,28 @@
+name: PR dequeued
+
+on:
+  pull_request:
+    types:
+      - dequeued
+
+jobs:
+  notify:
+    name: Notify
+    runs-on: ubuntu-slim
+
+    if: github.event.pull_request.merged != true
+
+    permissions:
+      pull-requests: write
+
+    steps:
+      - name: Notify that the PR was removed from the merge queue
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          REASON: ${{ github.event.reason }}
+          USER: ${{ github.event.pull_request.user.login }}
+        run: |
+          echo "@$USER The pull request was removed from the merge queue (\`$REASON\`)." \
+            "Please resolve any issues if required and enqueue the PR again." |
+            gh pr comment --body-file - --repo github/codeql-action "$PR_NUMBER"
@@ -139,7 +139,7 @@ jobs:

      - name: Generate token
        if: github.event_name == 'workflow_dispatch'
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
        id: app-token
        with:
          app-id: ${{ vars.AUTOMATION_APP_ID }}
@@ -95,7 +95,7 @@ jobs:
      pull-requests: write # needed to create pull request
    steps:
    - name: Generate token
-      uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
      id: app-token
      with:
        app-id: ${{ vars.AUTOMATION_APP_ID }}
@@ -6,6 +6,10 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th

 No user facing changes.

+## 4.39.1 - 21 Oct 2026
+
+- Update default CodeQL bundle version to [2.27.3](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.3). [#4256](https://github.com/github/codeql-action/pull/4256)
+
 ## 4.39.0 - 15 Oct 2026

 - _Breaking change_: Bump the minimum required CodeQL bundle version to 2.20.7. [#4205](https://github.com/github/codeql-action/pull/4205)
@@ -153,7 +153,10 @@ inputs:
    required: false
  trap-caching:
    description: >-
-      Explicitly enable or disable TRAP caching rather than respecting the feature flag for it.
+      Explicitly enable or disable TRAP caching instead of using the automatically determined default.
+      TRAP caching is disabled by default when improved incremental analysis is enabled,
+      because improved incremental analysis of a pull request only extracts changed files,
+      which rarely benefit from TRAP caching.
    required: false
  dependency-caching:
    description: >-
@@ -1,6 +1,6 @@
 {
-  "bundleVersion": "codeql-bundle-v2.27.2",
-  "cliVersion": "2.27.2",
-  "priorBundleVersion": "codeql-bundle-v2.27.1",
-  "priorCliVersion": "2.27.1"
+  "bundleVersion": "codeql-bundle-v2.27.3",
+  "cliVersion": "2.27.3",
+  "priorBundleVersion": "codeql-bundle-v2.27.2",
+  "priorCliVersion": "2.27.2"
 }
@@ -1,12 +1,12 @@
 {
  "name": "codeql",
-  "version": "4.39.1",
+  "version": "4.39.2",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "codeql",
-      "version": "4.39.1",
+      "version": "4.39.2",
      "license": "MIT",
      "workspaces": [
        "pr-checks"
@@ -36,7 +36,7 @@
        "node-forge": "^1.4.0",
        "semver": "^7.8.5",
        "undici": "^6.28.0",
-        "uuid": "^14.0.2"
+        "uuid": "^14.0.3"
      },
      "devDependencies": {
        "@ava/typescript": "6.0.0",
@@ -57,14 +57,14 @@
        "eslint-import-resolver-typescript": "^4.4.5",
        "eslint-plugin-github": "^6.1.2",
        "eslint-plugin-import-x": "^4.17.1",
-        "eslint-plugin-jsdoc": "^65.2.0",
+        "eslint-plugin-jsdoc": "^65.3.4",
        "eslint-plugin-no-async-foreach": "^0.1.1",
        "glob": "^13.0.6",
        "globals": "^17.13.0",
        "nock": "^14.0.17",
        "sinon": "^22.1.0",
        "typescript": "^6.0.3",
-        "typescript-eslint": "^8.71.1"
+        "typescript-eslint": "^8.71.2"
      }
    },
    "node_modules/@aashutoshrathi/word-wrap": {
@@ -2702,17 +2702,17 @@
      "license": "MIT"
    },
    "node_modules/@typescript-eslint/eslint-plugin": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.71.1.tgz",
-      "integrity": "sha512-nNlBf6HuotqMgZvSkWD5hNdemiBIxQ2NmrlgfcUIeZRs+BbakjscCQRq/Hb74EFVnFiSWWdL12JruqwBy3ERDw==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.71.2.tgz",
+      "integrity": "sha512-K72/pvT7qpm8q3k8G5u93NCSN1RcLxX5h7Gw0bQpbMXviBHeY6Nx1WEwmk9wP+eKTSQ8ecxvcgt/ZX/rB938xQ==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
        "@eslint-community/regexpp": "^4.12.2",
-        "@typescript-eslint/scope-manager": "8.71.1",
-        "@typescript-eslint/type-utils": "8.71.1",
-        "@typescript-eslint/utils": "8.71.1",
-        "@typescript-eslint/visitor-keys": "8.71.1",
+        "@typescript-eslint/scope-manager": "8.71.2",
+        "@typescript-eslint/type-utils": "8.71.2",
+        "@typescript-eslint/utils": "8.71.2",
+        "@typescript-eslint/visitor-keys": "8.71.2",
        "ignore": "^7.0.5",
        "natural-compare": "^1.4.0",
        "ts-api-utils": "^2.5.0"
@@ -2725,7 +2725,7 @@
        "url": "https://opencollective.com/typescript-eslint"
      },
      "peerDependencies": {
-        "@typescript-eslint/parser": "^8.71.1",
+        "@typescript-eslint/parser": "^8.71.2",
        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
        "typescript": ">=4.8.4 <6.1.0"
      }
@@ -2741,16 +2741,16 @@
      }
    },
    "node_modules/@typescript-eslint/parser": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.71.1.tgz",
-      "integrity": "sha512-oM/5sAqz/l1v/zYK1qTOPrn2+JIrBGC1V6uNYucRO5gh6eT9vWJ/RhPbGE59byvZEUQ4VP6XkLBaS5Jti5jpvw==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.71.2.tgz",
+      "integrity": "sha512-aTtmZjp/x3gsGHkDs04/1I8kNogBJkpQaeGaN0PfiG43NzDEmW2n+OP5im9wfsvyX0yP1UZWBrAGtDBfH9jEVw==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/scope-manager": "8.71.1",
-        "@typescript-eslint/types": "8.71.1",
-        "@typescript-eslint/typescript-estree": "8.71.1",
-        "@typescript-eslint/visitor-keys": "8.71.1",
+        "@typescript-eslint/scope-manager": "8.71.2",
+        "@typescript-eslint/types": "8.71.2",
+        "@typescript-eslint/typescript-estree": "8.71.2",
+        "@typescript-eslint/visitor-keys": "8.71.2",
        "debug": "^4.4.3"
      },
      "engines": {
@@ -2784,14 +2784,14 @@
      }
    },
    "node_modules/@typescript-eslint/project-service": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.71.1.tgz",
-      "integrity": "sha512-Oijc9RUsohHjncg6iGi7gCtjnEjYt9FWv9u6ygK8uKcHK5eLjLAkqERQ9BaytbpceOFdk6kifPCS/zAZE+A99g==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.71.2.tgz",
+      "integrity": "sha512-Pd68GsLVh5ZXlcEccFPdhSOvtHZ/2WU0XsA8zmXOS3F158lVlcTLhfQ6qvtL1RzbMie0Kp8xtbVwAg4nejKPHw==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/tsconfig-utils": "^8.71.1",
-        "@typescript-eslint/types": "^8.71.1",
+        "@typescript-eslint/tsconfig-utils": "^8.71.2",
+        "@typescript-eslint/types": "^8.71.2",
        "debug": "^4.4.3"
      },
      "engines": {
@@ -2824,14 +2824,14 @@
      }
    },
    "node_modules/@typescript-eslint/scope-manager": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.71.1.tgz",
-      "integrity": "sha512-1YUDZXdTnXLlob03SFHBipdyMBsDVm7zoSz0ytTJ39dk5J1TgsTK03VlR/dLXG/RLLUrPcYbD4rp23BmHxHP0w==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.71.2.tgz",
+      "integrity": "sha512-YF4wgg5iUX5Obywoac27B56FhozMNFhdJSbh11H5GBAwmBtfyRhmgTQqW9tRNNmHDvsZ2CX6UGzoz+YfYn2Leg==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/types": "8.71.1",
-        "@typescript-eslint/visitor-keys": "8.71.1"
+        "@typescript-eslint/types": "8.71.2",
+        "@typescript-eslint/visitor-keys": "8.71.2"
      },
      "engines": {
        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -2842,9 +2842,9 @@
      }
    },
    "node_modules/@typescript-eslint/tsconfig-utils": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.71.1.tgz",
-      "integrity": "sha512-oTvkml5SxXhgg+WWKhod5qWQICDXtOB+/Hi9VdPKFAANJ2b7YOgMffgvzXuqog7R6A/JtrzRf128dsxummyWhg==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.71.2.tgz",
+      "integrity": "sha512-jz49TAWokm/7yWD9/o837nYax9DyALxIPOImdImvVzo6canBCZYzin8zJyqNR5k1j9K1DE0bVvr0XYB+99uAdg==",
      "dev": true,
      "license": "MIT",
      "engines": {
@@ -2859,15 +2859,15 @@
      }
    },
    "node_modules/@typescript-eslint/type-utils": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.71.1.tgz",
-      "integrity": "sha512-kH3t3jZCYv2PZSBEWPKTariLrCaoF1CLoPitYFBJOhAGEwWnSRAtGEifrfrpBa4K9JlwWNZotgA5w3/wLSk/FQ==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.71.2.tgz",
+      "integrity": "sha512-cC8UaalCViJkb3rH/xLIvidEwoFRtMZMUqDjjJMGEKaTFwYRHYBcoczlEGHuvkHEO8svRDrgZ0yQgOArFmwang==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/types": "8.71.1",
-        "@typescript-eslint/typescript-estree": "8.71.1",
-        "@typescript-eslint/utils": "8.71.1",
+        "@typescript-eslint/types": "8.71.2",
+        "@typescript-eslint/typescript-estree": "8.71.2",
+        "@typescript-eslint/utils": "8.71.2",
        "debug": "^4.4.3",
        "ts-api-utils": "^2.5.0"
      },
@@ -2902,9 +2902,9 @@
      }
    },
    "node_modules/@typescript-eslint/types": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.71.1.tgz",
-      "integrity": "sha512-ybYnPTUwg3VQQOFEiBPLs8Jxl1ry2vXdn1kVKguomBbvxpetdu3MKTNDqFNUrlG8ylP9MpZosmXMFYlGQHk1oQ==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.71.2.tgz",
+      "integrity": "sha512-y5Ukl3oVp7e/VGxqIoEXoeb/Roj71PAJ4WG/N/RGj+eeDvKRLM15kGr9MijLbN0i03S52zxu31Z98E5gWChJKw==",
      "dev": true,
      "license": "MIT",
      "engines": {
@@ -2916,16 +2916,16 @@
      }
    },
    "node_modules/@typescript-eslint/typescript-estree": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.71.1.tgz",
-      "integrity": "sha512-pSKSEK1JJpHs6KiKVtABCE4iJK5d7FLFzDXQNBQ2oRY7LEd3UwOt3TZemTgu9syTIf56dJWlTn/pdmrO9oKUXQ==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.71.2.tgz",
+      "integrity": "sha512-DgNOEsl4pdYzwSL+N/Cl33tX1Hlw3FvId73LnKXfq7jnrF2viOEn7X+P7RBkkSWCVm92gnWd28GIC5vJuLREeA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/project-service": "8.71.1",
-        "@typescript-eslint/tsconfig-utils": "8.71.1",
-        "@typescript-eslint/types": "8.71.1",
-        "@typescript-eslint/visitor-keys": "8.71.1",
+        "@typescript-eslint/project-service": "8.71.2",
+        "@typescript-eslint/tsconfig-utils": "8.71.2",
+        "@typescript-eslint/types": "8.71.2",
+        "@typescript-eslint/visitor-keys": "8.71.2",
        "debug": "^4.4.3",
        "minimatch": "^10.2.2",
        "semver": "^7.7.3",
@@ -3001,16 +3001,16 @@
      }
    },
    "node_modules/@typescript-eslint/utils": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.71.1.tgz",
-      "integrity": "sha512-CBjT6gfAz3DW2j9Q4moFnqt208Aq+506sVGXfpRcyAeqn0EpayL0mjdWoCO2t3RC7GewNrFxdeehuEaPg6DMzQ==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.71.2.tgz",
+      "integrity": "sha512-RyKa1G1M9rKHDhrk+HJtiF1MvLD5Ux2JW3TSkzw+02pRALdpJb+QzG1Y5em+LvCgzGwgg8H7mBRFKljNz7ImPw==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
        "@eslint-community/eslint-utils": "^4.9.1",
-        "@typescript-eslint/scope-manager": "8.71.1",
-        "@typescript-eslint/types": "8.71.1",
-        "@typescript-eslint/typescript-estree": "8.71.1"
+        "@typescript-eslint/scope-manager": "8.71.2",
+        "@typescript-eslint/types": "8.71.2",
+        "@typescript-eslint/typescript-estree": "8.71.2"
      },
      "engines": {
        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -3025,13 +3025,13 @@
      }
    },
    "node_modules/@typescript-eslint/visitor-keys": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.71.1.tgz",
-      "integrity": "sha512-0GxiUGqMU0qXJt58cBsiG3DP8lUmBaFo2vChtUX+CT7PnR3v/VGLLrzVP4K9r1lNiZXjHYefMBbPunplr09v6w==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.71.2.tgz",
+      "integrity": "sha512-zozlN0UA32bSG2zkKAgQyRYSbEISVoyU6vvkKYo2aSny74D8Jh4e+POkJ6Lk0dlezZi5x7TtD+88Xb06IB8nhg==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/types": "8.71.1",
+        "@typescript-eslint/types": "8.71.2",
        "eslint-visitor-keys": "^5.0.0"
      },
      "engines": {
@@ -5365,9 +5365,9 @@
      }
    },
    "node_modules/eslint-plugin-jsdoc": {
-      "version": "65.2.0",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-jsdoc/-/eslint-plugin-jsdoc-65.2.0.tgz",
-      "integrity": "sha512-IMZaNwdDa5otUQYGWN1pzywZLsGKswitvFFNhcO8IOsBfaWpWIDXYuZh2sYhe9MNyKN9hz0YryOFaKdpbTP5Bw==",
+      "version": "65.3.4",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-jsdoc/-/eslint-plugin-jsdoc-65.3.4.tgz",
+      "integrity": "sha512-Z3/ro8sZPqnXKhyAzCNa3F7KCZ3js5xVx/q9BEvTjUGzN6OIQfdb+q3Sc9lJ3zCfyPnN0tI524ulZjYRxAwnAw==",
      "dev": true,
      "license": "BSD-3-Clause",
      "dependencies": {
@@ -9981,16 +9981,16 @@
      }
    },
    "node_modules/typescript-eslint": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.71.1.tgz",
-      "integrity": "sha512-oiNVPC3/NbV1FpaHU07l8O6ynqG9v4PAiW2WvTrAmZdR0f2HI/gE668ElMLCK7Xbsu5k2fK5C4fXNiq05j7/nQ==",
+      "version": "8.71.2",
+      "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.71.2.tgz",
+      "integrity": "sha512-Rz4effbMy2g9wnvOJZG6SbVavX313Lap1vNEbk1RUochzickvzP8P4HB+bkNg5e50eVz1hQGjh9K1omI1xB4Bw==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/eslint-plugin": "8.71.1",
-        "@typescript-eslint/parser": "8.71.1",
-        "@typescript-eslint/typescript-estree": "8.71.1",
-        "@typescript-eslint/utils": "8.71.1"
+        "@typescript-eslint/eslint-plugin": "8.71.2",
+        "@typescript-eslint/parser": "8.71.2",
+        "@typescript-eslint/typescript-estree": "8.71.2",
+        "@typescript-eslint/utils": "8.71.2"
      },
      "engines": {
        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -10167,9 +10167,9 @@
      "license": "MIT"
    },
    "node_modules/uuid": {
-      "version": "14.0.2",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-14.0.2.tgz",
-      "integrity": "sha512-xZe/16rV4aa+HGSOCiY2YeLT1OybRLrrkL/Rqaq7p7GMVXjFh+6wN4oMYgjFmnSnhY8t6Xpdl2l9qmnHYuMHwQ==",
+      "version": "14.0.3",
+      "resolved": "https://registry.npmjs.org/uuid/-/uuid-14.0.3.tgz",
+      "integrity": "sha512-Sc5u1VVln93y1Xnz4R+CunOZc7R9LUcTmhj7Rc7Eg3HVcf7rVn2FOoa812fe0W8p3jD7xeoGSYbfqCGGH2B6xw==",
      "funding": [
        "https://github.com/sponsors/broofa",
        "https://github.com/sponsors/ctavan"
@@ -10484,6 +10484,7 @@
      "dependencies": {
        "@actions/core": "^2.0.3",
        "@actions/github": "^8.0.1",
+        "@actions/tool-cache": "^3.0.1",
        "@octokit/core": "^7.0.8",
        "@octokit/plugin-paginate-rest": ">=16.0.0",
        "@octokit/plugin-rest-endpoint-methods": "^18.0.0",
@@ -1,6 +1,6 @@
 {
  "name": "codeql",
-  "version": "4.39.1",
+  "version": "4.39.2",
  "private": true,
  "description": "CodeQL action",
  "scripts": {
@@ -44,7 +44,7 @@
    "node-forge": "^1.4.0",
    "semver": "^7.8.5",
    "undici": "^6.28.0",
-    "uuid": "^14.0.2"
+    "uuid": "^14.0.3"
  },
  "devDependencies": {
    "@ava/typescript": "6.0.0",
@@ -65,14 +65,14 @@
    "eslint-import-resolver-typescript": "^4.4.5",
    "eslint-plugin-github": "^6.1.2",
    "eslint-plugin-import-x": "^4.17.1",
-    "eslint-plugin-jsdoc": "^65.2.0",
+    "eslint-plugin-jsdoc": "^65.3.4",
    "eslint-plugin-no-async-foreach": "^0.1.1",
    "glob": "^13.0.6",
    "globals": "^17.13.0",
    "nock": "^14.0.17",
    "sinon": "^22.1.0",
    "typescript": "^6.0.3",
-    "typescript-eslint": "^8.71.1"
+    "typescript-eslint": "^8.71.2"
  },
  "overrides": {
    "@actions/tool-cache": {
@@ -0,0 +1,92 @@
+import fs from "fs";
+
+import * as core from "@actions/core";
+
+import * as sarif from "../src/sarif";
+
+const DIAGNOSTIC_ID =
+  process.env["DIAGNOSTIC_ID"] ?? "lang/diagnostics/example";
+const DIAGNOSTIC_NAME = process.env["DIAGNOSTIC_NAME"] ?? "Diagnostic name";
+const EXPECTED_MESSAGE = process.env["EXPECTED_MESSAGE"] ?? "Plaintext message";
+const EXPECTED_LOCATIONS = Number.parseInt(
+  process.env["EXPECTED_LOCATIONS"] ?? "1",
+);
+
+function checkStatusPageNotification(n: sarif.Notification) {
+  const expectedMessage = EXPECTED_MESSAGE.trim();
+  if (!n.message.text?.includes(expectedMessage)) {
+    if (n.message.text !== undefined) {
+      core.setFailed(
+        `Expected the status page diagnostic to contain the message '${expectedMessage}', but found '${n.message.text.replaceAll("\n", "\\n")}'.`,
+      );
+    } else {
+      core.setFailed(
+        `Expected the status page diagnostic to contain the message '${expectedMessage}', but found nothing.`,
+      );
+    }
+  }
+
+  const locationCount = n.locations?.length ?? 0;
+  if (locationCount !== EXPECTED_LOCATIONS) {
+    core.setFailed(
+      `Expected the status page diagnostic to have exactly ${EXPECTED_LOCATIONS} location(s), but found ${locationCount}.`,
+    );
+  }
+}
+
+const sarifPath = process.env["SARIF_PATH"];
+
+if (sarifPath === undefined) {
+  throw new Error("The path to a SARIF file must be set in 'SARIF_PATH'.");
+}
+
+const log = JSON.parse(fs.readFileSync(sarifPath, "utf8")) as sarif.Log;
+const run = log.runs[0];
+
+if (run.invocations === undefined) {
+  throw new Error("run.invocations is undefined");
+}
+
+const toolExecutionNotifications =
+  run.invocations[0].toolExecutionNotifications;
+
+if (toolExecutionNotifications === undefined) {
+  throw new Error("toolExecutionNotifications is undefined");
+}
+
+const statusPageNotifications = toolExecutionNotifications.filter(
+  (n) =>
+    n.descriptor?.id === DIAGNOSTIC_ID && n.properties?.visibility?.statusPage,
+);
+if (statusPageNotifications.length !== 1) {
+  core.setFailed(
+    "Expected exactly one status page reporting descriptor for this diagnostic in the " +
+      `'runs[].invocations[].toolExecutionNotifications[]' SARIF property, but found ` +
+      `${statusPageNotifications.length}. All notification reporting descriptors: ` +
+      `${JSON.stringify(toolExecutionNotifications)}.`,
+  );
+}
+checkStatusPageNotification(statusPageNotifications[0]);
+
+const notifications = run.tool.driver.notifications;
+
+if (notifications === undefined) {
+  throw new Error("notifications is undefined");
+}
+
+const diagnosticNotification = notifications.filter(
+  (n) =>
+    n.id === DIAGNOSTIC_ID &&
+    n.name === DIAGNOSTIC_ID &&
+    n.fullDescription?.text === DIAGNOSTIC_NAME,
+);
+if (diagnosticNotification.length !== 1) {
+  core.setFailed(
+    "Expected exactly one notification for this diagnostic in the " +
+      `'runs[].tool.driver.notifications[]' SARIF property, but found ` +
+      `${diagnosticNotification.length}. All notifications: ` +
+      `${JSON.stringify(notifications)}.`,
+  );
+}
+
+core.info("Finished diagnostic export test");
@@ -2,30 +2,20 @@ name: "Bundle: From toolcache"
 description: "The CodeQL bundle should be cached within the toolcache"
 versions:
  - toolcache
+installNode: true
 steps:
-  - name: Install @actions/tool-cache
-    run: npm install @actions/tool-cache@3
  - name: Check toolcache contains CodeQL
    continue-on-error: true
-    uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-    with:
-      script: |
-        const toolcache = require('@actions/tool-cache');
-        const allCodeqlVersions = toolcache.findAllVersions('CodeQL');
-        if (allCodeqlVersions.length === 0) {
-          throw new Error(`CodeQL could not be found in the toolcache`);
-        }
+    run: |
+      cd ./../action
+      npx tsx ./pr-checks/toolcache.ts installed
+
  - id: setup-codeql
    uses: ./../action/setup-codeql
    with:
      tools: ${{ steps.prepare-test.outputs.tools-url }}
+
  - name: Check CodeQL is installed within the toolcache
-    uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-    with:
-      script: |
-        const toolcache = require('@actions/tool-cache');
-        const allCodeqlVersions = toolcache.findAllVersions('CodeQL');
-        console.log(`Found CodeQL versions: ${allCodeqlVersions}`);
-        if (allCodeqlVersions.length === 0) {
-          throw new Error('CodeQL not found in toolcache');
-        }
+    run: |
+      cd ./../action
+      npx tsx ./pr-checks/toolcache.ts installed
@@ -6,47 +6,31 @@ operatingSystems:
  - ubuntu
  - macos
  - windows
+installNode: true
 steps:
  - name: Remove CodeQL from toolcache
-    uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-    with:
-      script: |
-        const fs = require('fs');
-        const path = require('path');
-        const codeqlPath = path.join(process.env['RUNNER_TOOL_CACHE'], 'CodeQL');
-        fs.rmdirSync(codeqlPath, { recursive: true });
-  - name: Install @actions/tool-cache
-    run: npm install @actions/tool-cache@3
+    run: |
+      cd ./../action
+      npx tsx ./pr-checks/toolcache.ts clear
+
  - name: Check toolcache does not contain CodeQL
-    uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-    with:
-      script: |
-        const toolcache = require('@actions/tool-cache');
-        const allCodeqlVersions = toolcache.findAllVersions('CodeQL');
-        if (allCodeqlVersions.length !== 0) {
-          throw new Error(`CodeQL should not be found in the toolcache, but found ${allCodeqlVersions}`);
-        }
-        console.log('No versions of CodeQL found in the toolcache');
+    run: |
+      cd ./../action
+      npx tsx ./pr-checks/toolcache.ts absent
+
  - id: init
    uses: ./../action/init
    with:
      # Request multiple languages so this check uses the combined bundle.
      languages: javascript,python
      tools: ${{ steps.prepare-test.outputs.tools-url }}
+
  - uses: ./../action/analyze
    with:
      output: ${{ runner.temp }}/results
      upload-database: false
+
  - name: Check CodeQL is installed within the toolcache
-    uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-    with:
-      script: |
-        const toolcache = require('@actions/tool-cache');
-        const allCodeqlVersions = toolcache.findAllVersions('CodeQL');
-        console.log(`Found CodeQL versions: ${allCodeqlVersions}`);
-        if (allCodeqlVersions.length === 0) {
-          throw new Error('CodeQL not found in toolcache');
-        }
-        if (allCodeqlVersions.length > 1) {
-          throw new Error('Multiple CodeQL versions found in toolcache');
-        }
+    run: |
+      cd ./../action
+      npx tsx ./pr-checks/toolcache.ts installed -n 1
@@ -5,6 +5,7 @@ versions:
  - nightly-latest
 env:
  CODEQL_ACTION_EXPORT_DIAGNOSTICS: true
+installNode: true
 steps:
  - uses: ./../action/init
    id: init
@@ -32,53 +33,10 @@ steps:
      name: diagnostics-export-${{ matrix.os }}-${{ matrix.version }}.sarif.json
      path: "${{ runner.temp }}/results/javascript.sarif"
      retention-days: 7
+
  - name: Check diagnostics appear in SARIF
-    uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
    env:
      SARIF_PATH: "${{ runner.temp }}/results/javascript.sarif"
-    with:
-      script: |
-        const fs = require('fs');
-
-        function checkStatusPageNotification(n) {
-          const expectedMessage = 'Plaintext message';
-          if (n.message.text !== expectedMessage) {
-            core.setFailed(`Expected the status page diagnostic to have the message '${expectedMessage}', but found '${n.message.text}'.`);
-          }
-          if (n.locations.length !== 1) {
-            core.setFailed(`Expected the status page diagnostic to have exactly 1 location, but found ${n.locations.length}.`);
-          }
-        }
-
-        const sarif = JSON.parse(fs.readFileSync(process.env['SARIF_PATH'], 'utf8'));
-        const run = sarif.runs[0];
-
-        const toolExecutionNotifications = run.invocations[0].toolExecutionNotifications;
-        const statusPageNotifications = toolExecutionNotifications.filter(n =>
-          n.descriptor.id === 'lang/diagnostics/example' && n.properties?.visibility?.statusPage
-        );
-        if (statusPageNotifications.length !== 1) {
-          core.setFailed(
-            'Expected exactly one status page reporting descriptor for this diagnostic in the ' +
-              `'runs[].invocations[].toolExecutionNotifications[]' SARIF property, but found ` +
-              `${statusPageNotifications.length}. All notification reporting descriptors: ` +
-              `${JSON.stringify(toolExecutionNotifications)}.`
-          );
-        }
-        checkStatusPageNotification(statusPageNotifications[0]);
-
-        const notifications = run.tool.driver.notifications;
-        const diagnosticNotification = notifications.filter(n =>
-          n.id === 'lang/diagnostics/example' && n.name === 'lang/diagnostics/example' &&
-            n.fullDescription.text === 'Diagnostic name'
-        );
-        if (diagnosticNotification.length !== 1) {
-          core.setFailed(
-            'Expected exactly one notification for this diagnostic in the ' +
-              `'runs[].tool.driver.notifications[]' SARIF property, but found ` +
-              `${diagnosticNotification.length}. All notifications: ` +
-              `${JSON.stringify(notifications)}.`
-          );
-        }
-
-        core.info('Finished diagnostic export test');
+    run: |
+      cd ../action
+      npx tsx ./pr-checks/check-diagnostics.ts
@@ -0,0 +1,72 @@
+name: "Diagnostic export without database"
+description: "Tests that temporary diagnostics are correctly included in the failed SARIF."
+versions:
+  # Overridden by the FF in the `init` step below.
+  - linked
+installNode: true
+
+env:
+  # Allow the failed SARIF file to be generated.
+  CODEQL_ACTION_SKIP_GENERATE_FAILED_SARIF: false
+  # But don't actually upload it.
+  CODEQL_ACTION_SKIP_SARIF_UPLOAD: true
+  # Mark telemetry for this workflow so it can be treated separately.
+  CODEQL_ACTION_TESTING_ENVIRONMENT: codeql-action-pr-checks
+
+steps:
+  # We deliberately need to make this step fail before the database is initialised, but after
+  # some diagnostic has been produced. The simplest way to do that right now is to:
+  #
+  # - Produce a diagnostic before the db is initialised by forcing the use of a nightly release
+  #   with the `CODEQL_ACTION_FORCE_NIGHTLY` feature flag.
+  # - Cause `init` to abort because we are attempting to analyse Swift on a non-macOS runner.
+  #
+  - name: Initialise failing analysis
+    id: init
+    uses: ./../action/init
+    continue-on-error: true
+    env:
+      CODEQL_ACTION_FORCE_NIGHTLY: true
+    with:
+      languages: swift
+      tools: ${{ steps.prepare-test.outputs.tools-url }}
+
+  - name: Analyze
+    uses: ./analyze
+    # In a real workflow, this step wouldn't run. Since we used `continue-on-error`
+    # above, we manually disable it with an `if` condition. Having this step is required
+    # for the init post-action because it checks the workflow definition for e.g. the
+    # `category` input. Without this step, that part of the init post-action would fail.
+    if: false
+    with:
+      category: "/test-codeql-version:${{ matrix.version }}"
+
+  - name: Check diagnostics appear on disk
+    env:
+      DIAGNOSTICS_DIR: "${{ runner.temp }}/codeql-action-temp-diagnostics/"
+    run: |
+      cd ../action
+      npx tsx ./pr-checks/diagnostics-without-db.ts
+validationJobs:
+  diagnostics-without-db-validation:
+    checkout: true
+    installNode: true
+    steps:
+      - name: Download workflow artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          pattern: test-mode-sarif-*
+          path: sarif
+
+      - name: List artifact contents
+        run: ls -laR ./sarif
+
+      - name: Check diagnostics appear in SARIF
+        env:
+          SARIF_PATH: "./sarif/codeql-failed-run.sarif"
+          DIAGNOSTIC_ID: "codeql-action/forced-nightly-cli"
+          DIAGNOSTIC_NAME: "A nightly release of CodeQL was used"
+          EXPECTED_LOCATIONS: "0"
+          EXPECTED_MESSAGE: |
+            GitHub configured this analysis to use a nightly release of CodeQL to allow you to preview changes from an upcoming release.
+        run: npx tsx ./pr-checks/check-diagnostics.ts
@@ -11,16 +11,17 @@ installDotNet: true
 env:
  CODEQL_ACTION_SKIP_FILE_COVERAGE_ON_PRS: false
  CODEQL_ACTION_SUBLANGUAGE_FILE_COVERAGE: true
-  # To balance speed and coverage, we analyze only a single language (JavaScript), but use the
-  # combined bundle so we can test that baseline information is reported for each language in the
-  # multi-language source directory.
-  CODEQL_ACTION_PER_LANGUAGE_BUNDLES: false
 steps:
  - uses: ./../action/init
    id: init
    with:
      languages: javascript
      tools: ${{ steps.prepare-test.outputs.tools-url }}
+      # To balance speed and coverage, analyze only JavaScript but use the combined bundle so
+      # baseline information is reported for every language in the multi-language repository. A
+      # custom configuration prevents per-language bundles from being used.
+      config: |
+        paths-ignore: []
  - name: Build code
    run: ./build.sh
  - uses: ./../action/analyze
@@ -14,7 +14,6 @@ operatingSystems:
      - stable-v2.21.4
      - stable-v2.22.4
 env:
-  CODEQL_ACTION_CLEANUP_TOOLCACHE_BUNDLES: true
  CODEQL_ACTION_RESOLVE_SUPPORTED_LANGUAGES_USING_CLI: true
 installGo: true
 installDotNet: true
@@ -1,49 +1,51 @@
 name: Per-language bundles
 description: Validates extraction and analysis using each per-language CodeQL bundle.
-# TODO: Use a released bundle once releases include per-language bundles.
 matrix:
  include:
    - language: actions
      os: ubuntu-latest
-      version: nightly-latest
+      version: linked
      # Actions also needs the JavaScript extractor.
      expected-extractors: actions javascript
    - language: cpp
      os: ubuntu-latest
-      version: nightly-latest
+      version: linked
      build-mode: manual
      build-command: gcc -o main main.c
    - language: csharp
      os: ubuntu-latest
-      version: nightly-latest
+      version: linked
      build-mode: none
    - language: go
      os: ubuntu-latest
-      version: nightly-latest
+      version: linked
      build-mode: autobuild
    - language: java
      os: ubuntu-latest
-      version: nightly-latest
+      version: linked
      build-mode: none
    - language: javascript
      os: ubuntu-latest
-      version: nightly-latest
+      version: linked
    - language: python
      os: ubuntu-latest
-      version: nightly-latest
+      version: linked
    - language: ruby
      os: ubuntu-latest
-      version: nightly-latest
+      version: linked
    - language: rust
      os: ubuntu-latest
-      version: nightly-latest
+      version: linked
    - language: swift
      os: macos-latest-xlarge
-      version: nightly-latest
+      version: linked
      build-mode: autobuild
-env:
-  CODEQL_ACTION_PER_LANGUAGE_BUNDLES: true
+installNode: true
 steps:
+  - name: Remove CodeQL from toolcache
+    run: |
+      cd ./../action
+      npx tsx ./pr-checks/toolcache.ts clear
  - uses: ./../action/init
    id: init
    with:
@@ -84,9 +86,8 @@ steps:
      CODEQL_PATH: ${{ steps.init.outputs.codeql-path }}
    run: |
      # A bundle that is missing most of its extractors must never be left in the toolcache,
-      # where a later job analyzing a different language could pick it up. The runner image
-      # ships with its own CodeQL in the toolcache, so check where this bundle was extracted to
-      # rather than whether the toolcache contains CodeQL at all.
+      # where a later job analyzing a different language could pick it up. Per-language bundles
+      # must instead be extracted under the runner's temporary directory.
      echo "CodeQL is at $CODEQL_PATH"
      if [[ "$CODEQL_PATH" == "$RUNNER_TOOL_CACHE"/* ]]; then
        echo "::error::The per-language bundle was added to the toolcache at $CODEQL_PATH."
@@ -5,7 +5,7 @@ versions:
  - default
 steps:
  - name: Set up Ruby
-    uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1.327.0
+    uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
    with:
      ruby-version: 2.6
  - name: Install Code Scanning integration
@@ -35,7 +35,9 @@ steps:
    run: exit 1
  - uses: ./analyze
    # In a real workflow, this step wouldn't run. Since we used `continue-on-error`
-    # above, we manually disable it with an `if` condition.
+    # above, we manually disable it with an `if` condition. Having this step is required
+    # for the init post-action because it checks the workflow definition for e.g. the
+    # `category` input. Without this step, that part of the init post-action would fail.
    if: false
    with:
      category: "/test-codeql-version:${{ matrix.version }}"
@@ -0,0 +1,48 @@
+import * as fs from "fs";
+import * as path from "path";
+
+import * as core from "@actions/core";
+
+import type * as diagnostics from "../src/diagnostics";
+
+const DIAGNOSTIC_ID = "codeql-action/forced-nightly-cli";
+const diagnosticDirectory = process.env["DIAGNOSTICS_DIR"];
+
+if (diagnosticDirectory === undefined) {
+  throw new Error("DIAGNOSTICS_DIR is undefined.");
+}
+
+const paths = fs
+  .readdirSync(diagnosticDirectory, {
+    recursive: true,
+    encoding: "utf-8",
+  })
+  .filter((p) => p.endsWith(".json"));
+
+core.info(`Found ${paths.length} paths in '${diagnosticDirectory}'.`);
+core.info(`Searching for a diagnostic with id '${DIAGNOSTIC_ID}'...`);
+
+let found = false;
+for (const diagnosticPath of paths) {
+  if (path.extname(diagnosticPath) !== ".json") {
+    core.info(`Skipping ${diagnosticPath}.`);
+    continue;
+  }
+  core.info(`Found ${diagnosticPath}.`);
+
+  const contents = JSON.parse(
+    fs.readFileSync(path.resolve(diagnosticDirectory, diagnosticPath), "utf-8"),
+  ) as diagnostics.DiagnosticMessage;
+
+  if (contents.source.id === DIAGNOSTIC_ID) {
+    core.info(
+      `Found '${DIAGNOSTIC_ID}' in '${diagnosticPath}'. Skipping remaining files.`,
+    );
+    found = true;
+    break;
+  }
+}
+
+if (!found) {
+  throw new Error(`Didn't find '${DIAGNOSTIC_ID}' diagnostic.`);
+}
@@ -20,3 +20,7 @@ is:
  - "Release info"
  - "Upload results"
  - "Update release branch"
+  # These checks are known not to run on every PR (for example, some release
+  # PRs), so requiring them would block the PRs they don't run on.
+  - "github-advanced-security"
+  - "License compliance check"
@@ -5,6 +5,7 @@
  "dependencies": {
    "@actions/core": "^2.0.3",
    "@actions/github": "^8.0.1",
+    "@actions/tool-cache": "^3.0.1",
    "@octokit/core": "^7.0.8",
    "@octokit/plugin-paginate-rest": ">=16.0.0",
    "@octokit/plugin-rest-endpoint-methods": "^18.0.0",
@@ -90,7 +90,7 @@ interface Specification extends JobSpecification {
  services?: any;

  /** Additional jobs to run after the main PR check job. */
-  validationJobs?: Record<string, JobSpecification>;
+  validationJobs?: Record<string, ValidationJobSpecification>;

  /** If set, this check is part of a named collection that gets its own caller workflow. */
  collection?: string;
@@ -122,6 +122,10 @@ interface JobSpecification {
  installYq?: boolean;
 }

+type ValidationJobSpecification = JobSpecification & {
+  checkout?: boolean;
+};
+
 /** Describes language/framework-specific steps and inputs. */
 interface LanguageSetup {
  specProperty: keyof JobSpecification;
@@ -263,8 +267,8 @@ const languageSetups: LanguageSetups = {
        name: "Install Java",
        uses: pinnedUses(
          "actions/setup-java",
-          "de7274f081f381c8f8158605e0321c36c376e2e6",
-          "v6.0.1",
+          "b843ebf9b913146b38da2eaa7aeddf76074ae1ad",
+          "v6.1.0",
        ),
        with: {
          "java-version": `\${{ inputs.java-version || '${defaultLanguageVersions.java}' }}`,
@@ -462,6 +466,20 @@ function generateJobMatrix(
  return matrix;
 }

+/**
+ * Gets the `actions/checkout` step.
+ */
+function getCheckoutStep(): Step {
+  return {
+    name: "Check out repository",
+    uses: pinnedUses(
+      "actions/checkout",
+      "3d3c42e5aac5ba805825da76410c181273ba90b1",
+      "v7.0.1",
+    ),
+  };
+}
+
 /**
 * Retrieves setup steps and additional input definitions based on specific languages or frameworks
 * that are requested by the `checkSpecification`.
@@ -525,20 +543,17 @@ function generateJob(
    ? checkSpecification.useAllPlatformBundle
    : "false";

-  // Determine which languages or frameworks have to be installed.
-  const setupInfo = getSetupSteps(checkSpecification);
+  // Kotlin requires a compatible JDK rather than the runner image's default.
+  const setupInfo = getSetupSteps({
+    ...checkSpecification,
+    installJava:
+      checkSpecification.installJava ?? !("container" in checkSpecification),
+  });
  const workflowInputs = setupInfo.inputs;

  // Construct the workflow steps needed for this check.
  const steps: Step[] = [
-    {
-      name: "Check out repository",
-      uses: pinnedUses(
-        "actions/checkout",
-        "3d3c42e5aac5ba805825da76410c181273ba90b1",
-        "v7.0.1",
-      ),
-    },
+    getCheckoutStep(),
    ...setupInfo.steps,
    {
      name: "Prepare test",
@@ -609,13 +624,16 @@ function generateJob(
 /** Generates a validation job. */
 function generateValidationJob(
  specDocument: yaml.Document,
-  jobSpecification: JobSpecification,
+  jobSpecification: ValidationJobSpecification,
  checkName: string,
  name: string,
 ) {
  // Determine which languages or frameworks have to be installed.
  const { inputs, steps } = getSetupSteps(jobSpecification);

+  // Construct a checkout step if requested.
+  const checkoutStep = jobSpecification.checkout ? [getCheckoutStep()] : [];
+
  // Extract the sequence of steps from the YAML document to persist as much formatting as possible.
  const specSteps = specDocument.getIn([
    "validationJobs",
@@ -624,7 +642,7 @@ function generateValidationJob(
  ]) as yaml.YAMLSeq;

  // Add the generated steps in front of the ones from the specification.
-  specSteps.items.unshift(...steps);
+  specSteps.items.unshift(...checkoutStep, ...steps);

  const validationJob: Record<string, any> = {
    name: jobSpecification.name,
@@ -635,7 +653,7 @@ function generateValidationJob(
      "security-events": "read",
    },
    "timeout-minutes": 5,
-    "runs-on": "ubuntu-slim",
+    "runs-on": "ubuntu-latest",
    steps: specSteps,
  };

@@ -0,0 +1,94 @@
+#!/usr/bin/env npx tsx
+
+/**
+ * Provides utility commands for working with the Actions toolcache in PR checks.
+ */
+
+import fs from "fs";
+import { parseArgs } from "node:util";
+import path from "path";
+
+import * as core from "@actions/core";
+import * as toolcache from "@actions/tool-cache";
+
+function removeCodeQLFromToolcache() {
+  const toolcachePath = process.env["RUNNER_TOOL_CACHE"];
+
+  if (toolcachePath === undefined) {
+    throw new Error("Expected RUNNER_TOOL_CACHE to be defined");
+  }
+
+  const codeqlPath = path.join(toolcachePath, "CodeQL");
+  fs.rmSync(codeqlPath, { recursive: true });
+
+  core.info(`Removed '${codeqlPath}' from the toolcache.`);
+}
+
+function findCodeQL() {
+  return toolcache.findAllVersions("CodeQL");
+}
+
+function checkNoCodeQLInToolcache() {
+  const allCodeqlVersions = findCodeQL();
+  if (allCodeqlVersions.length !== 0) {
+    throw new Error(
+      `CodeQL should not be found in the toolcache, but found ${allCodeqlVersions}`,
+    );
+  }
+  core.info("No versions of CodeQL found in the toolcache");
+}
+
+function hasCodeQLInToolcache(expectedNumber?: string) {
+  const expected =
+    expectedNumber !== undefined
+      ? Number.parseInt(expectedNumber, 10)
+      : undefined;
+
+  const allCodeqlVersions = findCodeQL();
+  if (allCodeqlVersions.length === 0) {
+    throw new Error("CodeQL not found in toolcache");
+  }
+
+  core.info(`Found CodeQL versions: ${allCodeqlVersions.join(", ")}`);
+  if (expected !== undefined && allCodeqlVersions.length !== expected) {
+    throw new Error(
+      `Expected ${expected} versions of CodeQL in the toolcache, but found ${allCodeqlVersions.length}`,
+    );
+  }
+}
+
+function main() {
+  const { positionals, values } = parseArgs({
+    options: {
+      // The number of expected versions in the toolcache.
+      "expected-version-count": { type: "string", short: "n" },
+    },
+    allowPositionals: true,
+  });
+
+  if (positionals.length < 1) {
+    throw new Error("Command not specified.");
+  }
+
+  const cmd = positionals[0];
+
+  switch (cmd.trim().toLowerCase()) {
+    case "clear":
+      removeCodeQLFromToolcache();
+      return;
+    case "absent":
+      checkNoCodeQLInToolcache();
+      return;
+    case "installed":
+      hasCodeQLInToolcache(values["expected-version-count"]);
+      return;
+    default:
+      throw new Error(`Unknown command '${cmd}'.`);
+  }
+}
+
+try {
+  main();
+} catch (err) {
+  core.setFailed(err instanceof Error ? err.message : String(err));
+}
@@ -11,7 +11,6 @@ import {
 } from "./actions-util";
 import { computeAutomationID } from "./api-client";
 import { EnvVar } from "./environment";
-import { getRunnerLogger } from "./logging";
 import { RecordingLogger, setupTests } from "./testing-utils";
 import { initializeEnvironment, withTmpDir } from "./util";

@@ -238,7 +237,7 @@ test.serial("fixCodeQualityCategory", (t) => {
      GITHUB_EVENT_NAME: "dynamic",
    },
    () => {
-      const logger = getRunnerLogger(true);
+      const logger = new RecordingLogger();

      // Categories that should get adjusted.
      t.is(fixCodeQualityCategory(logger, "/language:c#"), "/language:csharp");
@@ -15,7 +15,6 @@ import {
  supportedAnalysisKinds,
 } from "./analyses";
 import { EnvVar } from "./environment";
-import { getRunnerLogger } from "./logging";
 import {
  createFeatures,
  RecordingLogger,
@@ -65,7 +64,7 @@ test.serial(
      .withArgs("analysis-kinds")
      .returns("code-scanning,code-quality");
    const result = await getAnalysisKinds(
-      getRunnerLogger(true),
+      new RecordingLogger(),
      features,
      true,
    );
@@ -139,7 +138,7 @@ test.serial(
    const optionalInputStub = sinon.stub(actionsUtil, "getOptionalInput");
    optionalInputStub.withArgs("quality-queries").returns("code-quality");
    const result = await getAnalysisKinds(
-      getRunnerLogger(true),
+      new RecordingLogger(),
      features,
      true,
    );
@@ -155,7 +154,7 @@ test.serial(
    const requiredInputStub = sinon.stub(actionsUtil, "getRequiredInput");
    requiredInputStub.withArgs("analysis-kinds").returns("no-such-thing");
    await t.throwsAsync(
-      getAnalysisKinds(getRunnerLogger(true), features, true),
+      getAnalysisKinds(new RecordingLogger(), features, true),
    );
  },
 );
@@ -181,7 +180,7 @@ for (let i = 0; i < analysisKinds.length; i++) {
            .withArgs("analysis-kinds")
            .returns([analysisKind, otherAnalysis].join(","));
          const result = await getAnalysisKinds(
-            getRunnerLogger(true),
+            new RecordingLogger(),
            features,
            true,
          );
@@ -199,7 +198,7 @@ for (let i = 0; i < analysisKinds.length; i++) {
            .withArgs("analysis-kinds")
            .returns([analysisKind, otherAnalysis].join(","));
          await t.throwsAsync(
-            getAnalysisKinds(getRunnerLogger(true), features, true),
+            getAnalysisKinds(new RecordingLogger(), features, true),
            {
              instanceOf: ConfigurationError,
              message: `${analysisKind} and ${otherAnalysis} cannot be enabled at the same time`,
@@ -50,9 +50,8 @@ import {
  StatusReportBase,
 } from "./status-report";
 import {
-  cleanupTrapCaches,
-  TrapCacheCleanupStatusReport,
  uploadTrapCaches,
+  warnIfTrapCacheCleanupEnvVarIsSet,
 } from "./trap-caching";
 import * as uploadLib from "./upload-lib";
 import { UploadResult } from "./upload-lib";
@@ -86,7 +85,6 @@ async function sendStatusReport(
  trapCacheUploadTime: number | undefined,
  dbCreationTimings: DatabaseCreationTimings | undefined,
  didUploadTrapCaches: boolean,
-  trapCacheCleanup: TrapCacheCleanupStatusReport | undefined,
  dependencyCacheResults: DependencyCacheUploadStatusReport | undefined,
  databaseUploadResults: DatabaseUploadResult[],
  logger: Logger,
@@ -107,7 +105,6 @@ async function sendStatusReport(
      ...statusReportBase,
      ...(stats || {}),
      ...(dbCreationTimings || {}),
-      ...(trapCacheCleanup || {}),
      dependency_caching_upload_results: dependencyCacheResults,
      database_upload_results: databaseUploadResults,
    };
@@ -229,8 +226,6 @@ async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) {
    | undefined = undefined;
  let runStats: QueriesStatusReport | undefined = undefined;
  let config: Config | undefined = undefined;
-  let trapCacheCleanupTelemetry: TrapCacheCleanupStatusReport | undefined =
-    undefined;
  let trapCacheUploadTime: number | undefined = undefined;
  let dbCreationTimings: DatabaseCreationTimings | undefined = undefined;
  let didUploadTrapCaches = false;
@@ -278,6 +273,8 @@ async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) {
      );
    }

+    warnIfTrapCacheCleanupEnvVarIsSet(action);
+
    const apiDetails = getApiDetails();
    const outputDir = actionsUtil.getRequiredInput("output");
    action.env.export(EnvVar.SARIF_RESULTS_OUTPUT_DIR, outputDir);
@@ -361,6 +358,7 @@ async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) {
      uploadResults = await postProcessAndUploadSarif(
        logger,
        features,
+        config,
        uploadKind,
        checkoutPath,
        outputDir,
@@ -415,13 +413,6 @@ async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) {
    didUploadTrapCaches = await uploadTrapCaches(codeql, config, logger);
    trapCacheUploadTime = performance.now() - trapCacheUploadStartTime;

-    // Clean up TRAP caches
-    trapCacheCleanupTelemetry = await cleanupTrapCaches(
-      config,
-      features,
-      logger,
-    );
-
    // Store dependency cache(s) if dependency caching is enabled.
    if (shouldStoreCache(config.dependencyCachingEnabled)) {
      dependencyCacheResults = await uploadDependencyCaches(
@@ -433,8 +424,10 @@ async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) {
    }

    // We don't upload results in test mode, so don't wait for processing
-    if (util.isInTestMode()) {
-      logger.debug("In test mode. Waiting for processing is disabled.");
+    if (util.shouldSkipSarifUpload()) {
+      logger.debug(
+        "SARIF upload is disabled and nothing was uploaded, so we do not need to wait for processing to finish.",
+      );
    } else if (
      uploadResults?.[analyses.AnalysisKind.CodeScanning] !== undefined &&
      actionsUtil.getRequiredInput("wait-for-processing") === "true"
@@ -471,7 +464,6 @@ async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) {
      trapCacheUploadTime,
      dbCreationTimings,
      didUploadTrapCaches,
-      trapCacheCleanupTelemetry,
      dependencyCacheResults,
      databaseUploadResults,
      logger,
@@ -494,7 +486,6 @@ async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) {
      trapCacheUploadTime,
      dbCreationTimings,
      didUploadTrapCaches,
-      trapCacheCleanupTelemetry,
      dependencyCacheResults,
      databaseUploadResults,
      logger,
@@ -508,7 +499,6 @@ async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) {
      trapCacheUploadTime,
      dbCreationTimings,
      didUploadTrapCaches,
-      trapCacheCleanupTelemetry,
      dependencyCacheResults,
      databaseUploadResults,
      logger,
@@ -522,7 +512,6 @@ async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) {
      trapCacheUploadTime,
      dbCreationTimings,
      didUploadTrapCaches,
-      trapCacheCleanupTelemetry,
      dependencyCacheResults,
      databaseUploadResults,
      logger,
@@ -17,12 +17,12 @@ import { defaultSuites } from "./config/db-config";
 import { Feature } from "./feature-flags";
 import * as gitUtils from "./git-utils";
 import { BuiltInLanguage } from "./languages";
-import { getRunnerLogger } from "./logging";
 import {
  setupTests,
  setupActionsVars,
  createFeatures,
  createTestConfig,
+  RecordingLogger,
  callee,
 } from "./testing-utils";
 import * as uploadLib from "./upload-lib";
@@ -195,7 +195,7 @@ test.serial("status report fields", async (t) => {
        undefined,
        codeql,
        config,
-        getRunnerLogger(true),
+        new RecordingLogger(),
        createFeatures([Feature.QaTelemetryEnabled]),
      );
      t.deepEqual(Object.keys(statusReport).sort(), [
@@ -401,21 +401,6 @@ export async function listActionsCaches(
  );
 }

-/**
- * Delete an Actions cache item by its ID.
- *
- * See https://docs.github.com/en/rest/actions/cache#delete-a-github-actions-cache-for-a-repository-using-a-cache-id.
- */
-export async function deleteActionsCache(id: number) {
-  const repositoryNwo = getRepositoryNwo();
-
-  await getApiClient().rest.actions.deleteActionsCacheById({
-    owner: repositoryNwo.owner,
-    repo: repositoryNwo.repo,
-    cache_id: id,
-  });
-}
-
 /**
 * Retrieve all custom repository properties.
 *
@@ -10,12 +10,12 @@ import {
  scanArtifactsForTokens,
  TokenType,
 } from "./artifact-scanner";
-import { getRunnerLogger } from "./logging";
 import {
  checkExpectedLogMessages,
  getRecordingLogger,
  LoggedMessage,
  makeTestToken,
+  RecordingLogger,
 } from "./testing-utils";

 test("makeTestToken", (t) => {
@@ -121,7 +121,7 @@ for (const { type, value, checkPattern } of testTokens) {
 }

 test("scanArtifactsForTokens handles files without tokens", async (t) => {
-  const logger = getRunnerLogger(true);
+  const logger = new RecordingLogger();
  const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "scanner-test-"));

  try {
@@ -3,15 +3,14 @@ import path from "path";

 import test from "ava";

-import { getRunnerLogger } from "../logging";
-import { setupTests } from "../testing-utils";
+import { RecordingLogger, setupTests } from "../testing-utils";
 import * as util from "../util";

 import { getCachedCodeQlVersion } from "./output-cache";

 setupTests(test);

-const logger = getRunnerLogger(true);
+const logger = new RecordingLogger();

 test.serial(
  "getCachedCodeQlVersion reuses a version persisted by an earlier step",
@@ -22,7 +22,6 @@ import type { Config } from "./config-utils";
 import * as defaults from "./defaults.json";
 import { DocUrl } from "./doc-url";
 import { BuiltInLanguage } from "./languages";
-import { getRunnerLogger } from "./logging";
 import { ToolsSource } from "./setup-codeql";
 import {
  setupTests,
@@ -34,6 +33,8 @@ import {
  makeVersionInfo,
  createTestConfig,
  makeMacro,
+  getCodeQLForTesting,
+  RecordingLogger,
 } from "./testing-utils";
 import { ToolsDownloadStatusReport } from "./tools-download";
 import * as util from "./util";
@@ -102,7 +103,7 @@ async function installIntoToolcache({
    undefined, // otherLanguagePacksReason
    false, // useOverlayAwareDefaultCliVersion
    createFeatures([]),
-    getRunnerLogger(true),
+    new RecordingLogger(),
    false,
  );
 }
@@ -140,7 +141,7 @@ function mockApiDetails(apiDetails: Required<GitHubApiDetails>) {
 }

 async function stubCodeql(): Promise<codeql.CodeQL> {
-  const codeqlObject = await codeql.getCodeQLForTesting();
+  const codeqlObject = await getCodeQLForTesting();
  sinon.stub(codeqlObject, "getVersion").resolves(makeVersionInfo("2.17.6"));
  sinon
    .stub(codeqlObject, "isTracedLanguage")
@@ -176,7 +177,7 @@ test.serial(
          undefined, // otherLanguagePacksReason
          false, // useOverlayAwareDefaultCliVersion
          features,
-          getRunnerLogger(true),
+          new RecordingLogger(),
          false,
        );

@@ -212,7 +213,7 @@ test.serial(
        undefined, // otherLanguagePacksReason
        false, // useOverlayAwareDefaultCliVersion
        features,
-        getRunnerLogger(true),
+        new RecordingLogger(),
        false,
      );

@@ -252,7 +253,7 @@ test.serial(
        undefined, // otherLanguagePacksReason
        false, // useOverlayAwareDefaultCliVersion
        features,
-        getRunnerLogger(true),
+        new RecordingLogger(),
        false,
      );
      t.assert(toolcache.find("CodeQL", "0.0.0-20200610"));
@@ -362,7 +363,7 @@ for (const {
          undefined, // otherLanguagePacksReason
          false, // useOverlayAwareDefaultCliVersion
          features,
-          getRunnerLogger(true),
+          new RecordingLogger(),
          false,
        );
        t.assert(toolcache.find("CodeQL", expectedToolcacheVersion));
@@ -405,7 +406,7 @@ for (const toolcacheVersion of [
          undefined, // otherLanguagePacksReason
          false, // useOverlayAwareDefaultCliVersion
          features,
-          getRunnerLogger(true),
+          new RecordingLogger(),
          false,
        );
        t.is(
@@ -450,7 +451,7 @@ test.serial(
        undefined, // otherLanguagePacksReason
        false, // useOverlayAwareDefaultCliVersion
        features,
-        getRunnerLogger(true),
+        new RecordingLogger(),
        false,
      );
      t.deepEqual(result.toolsVersion, "0.0.0-20200601");
@@ -497,7 +498,7 @@ test.serial(
        undefined, // otherLanguagePacksReason
        false, // useOverlayAwareDefaultCliVersion
        features,
-        getRunnerLogger(true),
+        new RecordingLogger(),
        false,
      );
      t.deepEqual(result.toolsVersion, defaults.cliVersion);
@@ -537,7 +538,7 @@ test.serial(
        undefined, // otherLanguagePacksReason
        false, // useOverlayAwareDefaultCliVersion
        features,
-        getRunnerLogger(true),
+        new RecordingLogger(),
        false,
      );
      t.deepEqual(result.toolsVersion, defaults.cliVersion);
@@ -579,7 +580,7 @@ test.serial(
        undefined, // otherLanguagePacksReason
        false, // useOverlayAwareDefaultCliVersion
        features,
-        getRunnerLogger(true),
+        new RecordingLogger(),
        false,
      );

@@ -664,7 +665,7 @@ const injectedConfigMacro = makeMacro({
        tempDir,
      };
      thisStubConfig.computedConfig = generateCodeScanningConfig(
-        getRunnerLogger(true),
+        new RecordingLogger(),
        thisStubConfig.originalUserInput,
        augmentationProperties,
      );
@@ -1039,7 +1040,7 @@ test.serial("runTool summarizes autobuilder errors", async (t) => {
    [2019-09-18 12:00:01] [autobuild] A non-error message
  `;
  stubToolRunnerConstructor(1, stderr);
-  const codeqlObject = await codeql.getCodeQLForTesting();
+  const codeqlObject = await getCodeQLForTesting();
  sinon.stub(codeqlObject, "getVersion").resolves(makeVersionInfo("2.17.6"));
  sinon.stub(codeqlObject, "resolveExtractor").resolves("/path/to/extractor");
  // io throws because of the test CodeQL object.
@@ -1095,7 +1096,7 @@ test.serial("runTool recognizes fatal internal errors", async (t) => {
    com.semmle.util.exception.CatastrophicError: An error occurred while evaluating ControlFlowGraph::ControlFlow::Root.isRootOf/1#dispred#f610e6ed/2@86282cc8
    Severe disk cache trouble (corruption or out of space) at /home/runner/work/_temp/codeql_databases/go/db-go/default/cache/pages/28/33.pack: Failed to write item to disk`;
  stubToolRunnerConstructor(1, stderr);
-  const codeqlObject = await codeql.getCodeQLForTesting();
+  const codeqlObject = await getCodeQLForTesting();
  sinon.stub(codeqlObject, "getVersion").resolves(makeVersionInfo("2.17.6"));
  sinon.stub(codeqlObject, "resolveExtractor").resolves("/path/to/extractor");
  // io throws because of the test CodeQL object.
@@ -26,7 +26,7 @@ import {
 } from "./feature-flags";
 import { isAnalyzingDefaultBranch } from "./git-utils";
 import { Language } from "./languages";
-import { getRunnerLogger, Logger } from "./logging";
+import type { Logger } from "./logging";
 import { writeBaseDatabaseOidsFile, writeOverlayChangesFile } from "./overlay";
 import { OverlayDatabaseMode } from "./overlay/overlay-database-mode";
 import * as setupCodeql from "./setup-codeql";
@@ -199,6 +199,7 @@ export interface CodeQL {
    sarifFile: string,
    automationDetailsId: string | undefined,
    config: ActionConfig<"tempDir">,
+    diagnosticDir: string | undefined,
  ): Promise<void>;
  /** Get the location of an extractor for the specified language. */
  resolveExtractor(language: Language): Promise<string>;
@@ -486,18 +487,6 @@ export function createStubCodeQL(partialCodeql: Partial<CodeQL>): CodeQL {
  };
 }

-/**
- * Get a real, newly created CodeQL instance for testing. The instance refers to
- * a non-existent placeholder codeql command, so tests that use this function
- * should also stub the toolrunner.ToolRunner constructor.
- */
-export async function getCodeQLForTesting(
-  cmd = "codeql-for-testing",
-  logger: Logger = getRunnerLogger(true),
-): Promise<CodeQL> {
-  return getCodeQLForCmd(logger, cmd, false);
-}
-
 /**
 * Return a CodeQL object for CodeQL CLI access.
 *
@@ -506,7 +495,7 @@ export async function getCodeQLForTesting(
 *        version requirement. Must be set to true outside tests.
 * @returns A new CodeQL object
 */
-async function getCodeQLForCmd(
+export async function getCodeQLForCmd(
  logger: Logger,
  cmd: string,
  checkVersion: boolean,
@@ -915,15 +904,43 @@ async function getCodeQLForCmd(
      sarifFile: string,
      automationDetailsId: string | undefined,
      config: ActionConfig<"tempDir">,
+      diagnosticDir: string | undefined,
    ): Promise<void> {
+      // We may be exporting diagnostics for a failed SARIF, in which case the configuration
+      // file may not have been written to disk and there may not be a database. The CLI
+      // will produce a SARIF for diagnostics from `diagnosticDir` without it. Therefore,
+      // we check whether `configPath` exists and only provide it to the CLI if it does.
+      // Although not needed, the CLI will produce an error if it
+      // is provided with an argument to `--sarif-codescanning-config` that does not exist.
+      let configPath: string | undefined =
+        getGeneratedCodeScanningConfigPath(config);
+
+      if (!fs.existsSync(configPath)) {
+        // Warn if there is no configuration file, even though `config` claims that `init`
+        // was successful. This shouldn't be happening.
+        if (config.successfullyInitialised) {
+          logger.warning(
+            [
+              `Expected a configuration file at '${configPath}', which does not exist.`,
+              "Continuing with diagnostics export anyway, without a configuration file.",
+            ].join(" "),
+          );
+        }
+
+        configPath = undefined;
+      }
+
      const args = [
        "diagnostics",
        "export",
        "--format=sarif-latest",
        `--output=${sarifFile}`,
-        `--sarif-codescanning-config=${getGeneratedCodeScanningConfigPath(
-          config,
-        )}`,
+        ...(configPath !== undefined
+          ? [`--sarif-codescanning-config=${configPath}`]
+          : []),
+        ...(diagnosticDir !== undefined
+          ? [`--diagnostic-dir=${diagnosticDir}`]
+          : []),
        ...getExtraOptionsFromEnv(["diagnostics", "export"]),
      ];
      if (automationDetailsId !== undefined) {
@@ -21,7 +21,6 @@ import { RepositoryProperties } from "./feature-flags/properties";
 import * as gitUtils from "./git-utils";
 import { GitVersionInfo } from "./git-utils";
 import { BuiltInLanguage, Language } from "./languages";
-import { getRunnerLogger } from "./logging";
 import { CODEQL_OVERLAY_MINIMUM_VERSION } from "./overlay";
 import * as overlayDiagnostics from "./overlay/diagnostics";
 import { OverlayDisabledReason } from "./overlay/diagnostics";
@@ -42,6 +41,7 @@ import {
  callee,
  SAMPLE_DOTCOM_API_DETAILS,
  AssertableTarget,
+  RecordingLogger,
 } from "./testing-utils";
 import {
  GitHubVariant,
@@ -102,7 +102,7 @@ function createTestInitConfigInputs(
      features: createFeatures([]),
      repositoryProperties: {},
      enableFileCoverageInformation: true,
-      logger: getRunnerLogger(true),
+      logger: new RecordingLogger(),
    } satisfies configUtils.InitConfigInputs,
    overrides,
  );
@@ -150,7 +150,7 @@ function mockListLanguages(languages: string[]) {

 test.serial("load empty config", async (t) => {
  return await withTmpDir(async (tempDir) => {
-    const logger = getRunnerLogger(true);
+    const logger = new RecordingLogger();
    const languages = "javascript,python";

    setupActionsVars(tempDir, tempDir);
@@ -196,7 +196,7 @@ test.serial("load empty config", async (t) => {

 test.serial("load code quality config", async (t) => {
  return await withTmpDir(async (tempDir) => {
-    const logger = getRunnerLogger(true);
+    const logger = new RecordingLogger();
    const languages = "actions";

    setupActionsVars(tempDir, tempDir);
@@ -252,7 +252,7 @@ test.serial(
  "initActionState doesn't throw if there are queries configured in the repository properties",
  async (t) => {
    return await withTmpDir(async (tempDir) => {
-      const logger = getRunnerLogger(true);
+      const logger = new RecordingLogger();
      const languages = "javascript";

      setupActionsVars(tempDir, tempDir);
@@ -315,7 +315,7 @@ test.serial(

 test.serial("loading a saved config produces the same config", async (t) => {
  return await withTmpDir(async (tempDir) => {
-    const logger = getRunnerLogger(true);
+    const logger = new RecordingLogger();

    const codeql = createStubCodeQL({
      async resolveLanguages() {
@@ -363,7 +363,7 @@ test.serial("loading a saved config produces the same config", async (t) => {

 test.serial("loading config with version mismatch throws", async (t) => {
  return await withTmpDir(async (tempDir) => {
-    const logger = getRunnerLogger(true);
+    const logger = new RecordingLogger();

    const codeql = createStubCodeQL({
      async resolveLanguages() {
@@ -788,12 +788,12 @@ test.serial("Unknown languages", async (t) => {
  });
 });

-const mockLogger = getRunnerLogger(true);
+const mockLogger = new RecordingLogger();

 test.serial("no generateRegistries when registries is undefined", async (t) => {
  return await withTmpDir(async (tmpDir) => {
    const registriesInput = undefined;
-    const logger = getRunnerLogger(true);
+    const logger = new RecordingLogger();
    const { registriesAuthTokens, qlconfigFile } =
      await configUtils.generateRegistries(registriesInput, tmpDir, logger);

@@ -814,7 +814,7 @@ test.serial(
          token: "not-a-token",
        },
      ]);
-      const logger = getRunnerLogger(true);
+      const logger = new RecordingLogger();
      const { registriesAuthTokens, qlconfigFile } =
        await configUtils.generateRegistries(registriesInput, tmpDir, logger);

@@ -2126,7 +2126,7 @@ test.serial("getPrimaryAnalysisConfig - Code Scanning + Code Quality", (t) => {
 });

 test.serial(
-  "isTrapCachingEnabled: explicit input true is respected",
+  "isTrapCachingEnabled: explicit true input overrides self-hosted default",
  async (t) => {
    return await withTmpDir(async (tmpDir) => {
      setupActionsVars(tmpDir, tmpDir);
@@ -2134,12 +2134,40 @@ test.serial(
        .stub(actionsUtil, "getOptionalInput")
        .withArgs("trap-caching")
        .returns("true");
-      t.true(
-        await configUtils.isTrapCachingEnabled(
-          createFeatures([]),
-          OverlayDatabaseMode.None,
-        ),
-      );
+      t.true(configUtils.isTrapCachingEnabled(OverlayDatabaseMode.None));
+    });
+  },
+);
+
+test.serial(
+  "isTrapCachingEnabled: explicit true input overrides overlay defaults",
+  async (t) => {
+    return await withTmpDir(async (tmpDir) => {
+      setupActionsVars(tmpDir, path.join(tmpDir, "hostedtoolcache"));
+      sinon
+        .stub(actionsUtil, "getOptionalInput")
+        .withArgs("trap-caching")
+        .returns("true");
+      for (const overlayDatabaseMode of [
+        OverlayDatabaseMode.Overlay,
+        OverlayDatabaseMode.OverlayBase,
+      ]) {
+        t.true(configUtils.isTrapCachingEnabled(overlayDatabaseMode));
+      }
+    });
+  },
+);
+
+test.serial(
+  "isTrapCachingEnabled: explicit false input overrides hosted default",
+  async (t) => {
+    return await withTmpDir(async (tmpDir) => {
+      setupActionsVars(tmpDir, path.join(tmpDir, "hostedtoolcache"));
+      sinon
+        .stub(actionsUtil, "getOptionalInput")
+        .withArgs("trap-caching")
+        .returns("false");
+      t.false(configUtils.isTrapCachingEnabled(OverlayDatabaseMode.None));
    });
  },
 );
@@ -2153,18 +2181,13 @@ test.serial(
        .stub(actionsUtil, "getOptionalInput")
        .withArgs("trap-caching")
        .returns(undefined);
-      t.false(
-        await configUtils.isTrapCachingEnabled(
-          createFeatures([]),
-          OverlayDatabaseMode.None,
-        ),
-      );
+      t.false(configUtils.isTrapCachingEnabled(OverlayDatabaseMode.None));
    });
  },
 );

 test.serial(
-  "isTrapCachingEnabled: enabled on hosted runner by default",
+  "isTrapCachingEnabled: enabled on hosted runner without overlay analysis",
  async (t) => {
    return await withTmpDir(async (tmpDir) => {
      const hostedToolCache = path.join(tmpDir, "hostedtoolcache");
@@ -2173,18 +2196,13 @@ test.serial(
        .stub(actionsUtil, "getOptionalInput")
        .withArgs("trap-caching")
        .returns(undefined);
-      t.true(
-        await configUtils.isTrapCachingEnabled(
-          createFeatures([]),
-          OverlayDatabaseMode.None,
-        ),
-      );
+      t.true(configUtils.isTrapCachingEnabled(OverlayDatabaseMode.None));
    });
  },
 );

 test.serial(
-  "isTrapCachingEnabled: enabled on hosted runner when overlay enabled but feature flag off",
+  "isTrapCachingEnabled: disabled on hosted runner with overlay analysis",
  async (t) => {
    return await withTmpDir(async (tmpDir) => {
      const hostedToolCache = path.join(tmpDir, "hostedtoolcache");
@@ -2193,52 +2211,12 @@ test.serial(
        .stub(actionsUtil, "getOptionalInput")
        .withArgs("trap-caching")
        .returns(undefined);
-      t.true(
-        await configUtils.isTrapCachingEnabled(
-          createFeatures([]),
-          OverlayDatabaseMode.Overlay,
-        ),
-      );
-    });
-  },
-);
-
-test.serial(
-  "isTrapCachingEnabled: disabled on hosted runner when overlay enabled and feature flag on",
-  async (t) => {
-    return await withTmpDir(async (tmpDir) => {
-      const hostedToolCache = path.join(tmpDir, "hostedtoolcache");
-      setupActionsVars(tmpDir, hostedToolCache);
-      sinon
-        .stub(actionsUtil, "getOptionalInput")
-        .withArgs("trap-caching")
-        .returns(undefined);
-      t.false(
-        await configUtils.isTrapCachingEnabled(
-          createFeatures([Feature.OverlayAnalysisDisableTrapCaching]),
-          OverlayDatabaseMode.Overlay,
-        ),
-      );
-    });
-  },
-);
-
-test.serial(
-  "isTrapCachingEnabled: enabled on hosted runner when overlay is None even with feature flag on",
-  async (t) => {
-    return await withTmpDir(async (tmpDir) => {
-      const hostedToolCache = path.join(tmpDir, "hostedtoolcache");
-      setupActionsVars(tmpDir, hostedToolCache);
-      sinon
-        .stub(actionsUtil, "getOptionalInput")
-        .withArgs("trap-caching")
-        .returns(undefined);
-      t.true(
-        await configUtils.isTrapCachingEnabled(
-          createFeatures([Feature.OverlayAnalysisDisableTrapCaching]),
-          OverlayDatabaseMode.None,
-        ),
-      );
+      for (const overlayDatabaseMode of [
+        OverlayDatabaseMode.Overlay,
+        OverlayDatabaseMode.OverlayBase,
+      ]) {
+        t.false(configUtils.isTrapCachingEnabled(overlayDatabaseMode));
+      }
    });
  },
 );
@@ -2247,7 +2225,7 @@ test("applyIncrementalAnalysisSettings: no-op when mode is not Overlay and diff
  const config = createTestConfig({});
  config.overlayDatabaseMode = OverlayDatabaseMode.None;
  const codeql = createStubCodeQL({});
-  const logger = getRunnerLogger(true);
+  const logger = new RecordingLogger();

  await configUtils.applyIncrementalAnalysisSettings(
    config,
@@ -2265,7 +2243,7 @@ test("applyIncrementalAnalysisSettings: keeps overlay mode and adds exclusions w
    overlayDatabaseMode: OverlayDatabaseMode.Overlay,
  });
  const codeql = createStubCodeQL({});
-  const logger = getRunnerLogger(true);
+  const logger = new RecordingLogger();

  await configUtils.applyIncrementalAnalysisSettings(
    config,
@@ -2288,7 +2266,7 @@ test.serial(
    });
    config.useOverlayDatabaseCaching = true;
    const codeql = createStubCodeQL({});
-    const logger = getRunnerLogger(true);
+    const logger = new RecordingLogger();
    const addDiagnosticsStub = sinon
      .stub(overlayDiagnostics, "addOverlayDisablementDiagnostics")
      .resolves();
@@ -2320,7 +2298,7 @@ test.serial(
    config.useOverlayDatabaseCaching = false;
    config.overlayModeSetExplicitly = true;
    const codeql = createStubCodeQL({});
-    const logger = getRunnerLogger(true);
+    const logger = new RecordingLogger();
    const addDiagnosticsStub = sinon
      .stub(overlayDiagnostics, "addOverlayDisablementDiagnostics")
      .resolves();
@@ -2343,7 +2321,7 @@ test("applyIncrementalAnalysisSettings: adds exclusions for diff-informed-only r
  const config = createTestConfig({});
  config.overlayDatabaseMode = OverlayDatabaseMode.None;
  const codeql = createStubCodeQL({});
-  const logger = getRunnerLogger(true);
+  const logger = new RecordingLogger();

  await configUtils.applyIncrementalAnalysisSettings(
    config,
@@ -2557,7 +2535,7 @@ test("determineUserConfig - merges configs if FF is enabled in Default Setup", a
    // also check whether loading the configuration from disk that was written
    // by `determineUserConfig` matches our expectations.
    const loadedFromDisk = configUtils.getLocalConfig(
-      getRunnerLogger(true),
+      new RecordingLogger(),
      expectedConfigPath,
      false,
    );
@@ -465,6 +465,8 @@ export async function initActionState(
    overlayModeSetExplicitly: false,
    repositoryProperties,
    enableFileCoverageInformation,
+    // We don't set this to `true` until `init` is successful.
+    successfullyInitialised: false,
  };
 }

@@ -944,10 +946,14 @@ async function validateOverlayDatabaseMode(
  });
 }

-export async function isTrapCachingEnabled(
-  features: FeatureEnablement,
+/**
+ * Determines whether TRAP caching is enabled for the current run.
+ *
+ * @returns Whether TRAP caches should be downloaded and uploaded.
+ */
+export function isTrapCachingEnabled(
  overlayDatabaseMode: OverlayDatabaseMode,
-): Promise<boolean> {
+): boolean {
  // If the workflow specified something, always respect that.
  const trapCaching = getOptionalInput("trap-caching");
  if (trapCaching !== undefined) return trapCaching === "true";
@@ -955,12 +961,8 @@ export async function isTrapCachingEnabled(
  // On self-hosted runners which may have slow network access, disable TRAP caching by default.
  if (!looksLikeHostedRunner()) return false;

-  // If overlay analysis is enabled, then disable TRAP caching since overlay analysis supersedes it.
-  // This change is gated behind a feature flag.
-  if (
-    overlayDatabaseMode !== OverlayDatabaseMode.None &&
-    (await features.getValue(Feature.OverlayAnalysisDisableTrapCaching))
-  ) {
+  // Overlay analysis supersedes TRAP caching, so disable TRAP caching by default when it is active.
+  if (overlayDatabaseMode !== OverlayDatabaseMode.None) {
    return false;
  }

@@ -1302,7 +1304,7 @@ export async function initConfig(
    logger,
  );

-  if (await isTrapCachingEnabled(features, config.overlayDatabaseMode)) {
+  if (isTrapCachingEnabled(config.overlayDatabaseMode)) {
    const { trapCaches, trapCacheDownloadTime } = await downloadCacheWithTime(
      inputs.codeql,
      config.languages,
@@ -130,6 +130,9 @@ export interface Config {
   * Whether to enable file coverage information.
   */
  enableFileCoverageInformation: boolean;
+
+  /** Whether the analysis was successfully initialised using the configuration. */
+  successfullyInitialised: boolean;
 }

 /** Properties available in `Config`. */
@@ -2,15 +2,15 @@ import test, { ExecutionContext } from "ava";

 import { RepositoryProperties } from "../feature-flags/properties";
 import { BuiltInLanguage, Language } from "../languages";
-import { getRunnerLogger } from "../logging";
 import {
  checkExpectedLogMessages,
  getRecordingLogger,
  LoggedMessage,
  makeMacro,
  RecordingLogger,
+  setupActionsVars,
 } from "../testing-utils";
-import { ConfigurationError, prettyPrintPack } from "../util";
+import { ConfigurationError, prettyPrintPack, withTmpDir } from "../util";

 import * as dbConfig from "./db-config";

@@ -384,7 +384,7 @@ calculateAugmentationErrorMacro(

 test("parseUserConfig - successfully parses valid YAML", (t) => {
  const result = dbConfig.parseUserConfig(
-    getRunnerLogger(true),
+    new RecordingLogger(),
    "test",
    `
    paths-ignore:
@@ -410,7 +410,7 @@ test("parseUserConfig - throws a ConfigurationError if the file is not valid YAM
  t.throws(
    () =>
      dbConfig.parseUserConfig(
-        getRunnerLogger(true),
+        new RecordingLogger(),
        "test",
        `
        paths-ignore:
@@ -562,74 +562,89 @@ test("mergeDefaultSetupAndUserConfigs - keeps other properties from user-supplie
  t.deepEqual(result, configFile);
 });

-test("mergeDefaultSetupAndUserConfigs - ignores, but warns about, unknown keys from Default Setup", async (t) => {
-  const logger = new RecordingLogger();
-  const configFile: dbConfig.UserConfig = {
-    "query-filters": [{ exclude: { a: "b" } }],
-    "paths-ignore": ["path"],
-  };
+test.serial(
+  "mergeDefaultSetupAndUserConfigs - ignores, but warns about, unknown keys from Default Setup",
+  async (t) => {
+    const logger = new RecordingLogger();
+    const configFile: dbConfig.UserConfig = {
+      "query-filters": [{ exclude: { a: "b" } }],
+      "paths-ignore": ["path"],
+    };

-  const result = dbConfig.mergeDefaultSetupAndUserConfigs(
-    logger,
-    {
-      "default-setup": {
-        borg: [],
-        org: {
-          unknown: "foo",
-          "model-packs": [],
+    await withTmpDir(async (tmpDir) => {
+      setupActionsVars(tmpDir, tmpDir);
+      const result = dbConfig.mergeDefaultSetupAndUserConfigs(
+        logger,
+        {
+          "default-setup": {
+            borg: [],
+            org: {
+              unknown: "foo",
+              "model-packs": [],
+            },
+          } as unknown as dbConfig.DefaultSetupConfig,
+          "paths-ignore": ["other-path"],
        },
-      } as unknown as dbConfig.DefaultSetupConfig,
-      "paths-ignore": ["other-path"],
-    },
-    configFile,
-  );
+        configFile,
+      );

-  t.deepEqual(result, {
-    ...configFile,
-    "default-setup": { org: { "model-packs": [] } },
-  });
+      t.deepEqual(result, {
+        ...configFile,
+        "default-setup": { org: { "model-packs": [] } },
+      });

-  const expectedUnrecognisedKeys = [
-    ".default-setup.org.unknown",
-    ".default-setup.borg",
-    ".paths-ignore",
-  ].join(", ");
-  checkExpectedLogMessages(t, logger.messages, [
-    `Unrecognised keys in Default Setup configuration: ${expectedUnrecognisedKeys}`,
-  ]);
-});
+      const expectedUnrecognisedKeys = [
+        ".default-setup.org.unknown",
+        ".default-setup.borg",
+        ".paths-ignore",
+      ].join(", ");
+      checkExpectedLogMessages(t, logger.messages, [
+        `Unrecognised keys in Default Setup configuration: ${expectedUnrecognisedKeys}`,
+      ]);
+    });
+  },
+);

-test("mergeDefaultSetupAndUserConfigs - warns about invalid keys from Default Setup", async (t) => {
-  const logger = new RecordingLogger();
-  const configFile: dbConfig.UserConfig = {};
+test.serial(
+  "mergeDefaultSetupAndUserConfigs - warns about invalid keys from Default Setup",
+  async (t) => {
+    const logger = new RecordingLogger();
+    const configFile: dbConfig.UserConfig = {};

-  const result = dbConfig.mergeDefaultSetupAndUserConfigs(
-    logger,
-    {
-      "default-setup": {
-        org: {
-          "model-packs": [123],
+    await withTmpDir(async (tmpDir) => {
+      setupActionsVars(tmpDir, tmpDir);
+
+      const result = dbConfig.mergeDefaultSetupAndUserConfigs(
+        logger,
+        {
+          "default-setup": {
+            org: {
+              "model-packs": [123],
+            },
+          } as unknown as dbConfig.DefaultSetupConfig,
        },
-      } as unknown as dbConfig.DefaultSetupConfig,
-    },
-    configFile,
-  );
+        configFile,
+      );

-  t.deepEqual(result, {
-    ...configFile,
-    "default-setup": { org: { "model-packs": [123] } },
-  });
+      t.deepEqual(result, {
+        ...configFile,
+        "default-setup": { org: { "model-packs": [123] } },
+      });

-  const expectedInvalidKeys = [".default-setup.org.model-packs[0]"].join(", ");
-  checkExpectedLogMessages(t, logger.messages, [
-    `Invalid keys in Default Setup configuration: ${expectedInvalidKeys}`,
-  ]);
-});
+      const expectedInvalidKeys = [".default-setup.org.model-packs[0]"].join(
+        ", ",
+      );
+      checkExpectedLogMessages(t, logger.messages, [
+        `Invalid keys in Default Setup configuration: ${expectedInvalidKeys}`,
+      ]);
+    });
+  },
+);

 /** Parses `contents` as a configuration without validating it. */
 function parseUnvalidatedConfig(contents: string): dbConfig.UserConfig {
  return dbConfig.parseUserConfig(
-    getRunnerLogger(true),
+    new RecordingLogger(),
    "test",
    contents,
    false,
@@ -1,6 +1,6 @@
 {
-  "bundleVersion": "codeql-bundle-v2.27.2",
-  "cliVersion": "2.27.2",
-  "priorBundleVersion": "codeql-bundle-v2.27.1",
-  "priorCliVersion": "2.27.1"
+  "bundleVersion": "codeql-bundle-v2.27.3",
+  "cliVersion": "2.27.3",
+  "priorBundleVersion": "codeql-bundle-v2.27.2",
+  "priorCliVersion": "2.27.2"
 }
@@ -0,0 +1,165 @@
+import * as fs from "fs";
+import path from "path";
+
+import test, { type ExecutionContext } from "ava";
+
+import * as diagnostics from "./diagnostics";
+import { BuiltInLanguage } from "./languages";
+import {
+  checkExpectedLogMessages,
+  createTestConfig,
+  initAllState,
+  RecordingLogger,
+  setupTests,
+} from "./testing-utils";
+import { withTmpDir } from "./util";
+
+setupTests(test);
+
+const id = "codeql-action/test-diagnostic";
+const name = "Test title";
+
+test("makeDiagnostic - adds expected properties", (t) => {
+  const diagnostic = diagnostics.makeDiagnostic(id, name, {});
+
+  t.truthy(diagnostic.timestamp);
+  t.is(diagnostic.source.id, id);
+  t.is(diagnostic.source.name, name);
+});
+
+test("getLanguageDiagnosticsPath gets language-specific path", async (t) =>
+  withTmpDir(async (tmpDir) => {
+    for (const language of Object.values(BuiltInLanguage)) {
+      t.is(
+        diagnostics.getLanguageDiagnosticsPath(tmpDir, language),
+        path.resolve(
+          tmpDir,
+          language,
+          ...diagnostics.CODEQL_ACTION_DIAGNOSTIC_SUBDIR_PARTS,
+        ),
+      );
+    }
+  }));
+
+test("getTempLanguageDiagnosticsPath returns path without language", async (t) =>
+  withTmpDir(async (tmpDir) => {
+    t.is(
+      diagnostics.getTempLanguageDiagnosticsPath(tmpDir),
+      path.resolve(
+        tmpDir,
+        diagnostics.TEMP_DIAGNOSTIC_DIR_NAME,
+        ...diagnostics.CODEQL_ACTION_DIAGNOSTIC_SUBDIR_PARTS,
+      ),
+    );
+  }));
+
+test("getTempLanguageDiagnosticsPath returns language-specific path if a language is provided", async (t) =>
+  withTmpDir(async (tmpDir) => {
+    t.is(
+      diagnostics.getTempLanguageDiagnosticsPath(tmpDir, BuiltInLanguage.swift),
+      path.resolve(
+        tmpDir,
+        diagnostics.TEMP_DIAGNOSTIC_DIR_NAME,
+        BuiltInLanguage.swift,
+        ...diagnostics.CODEQL_ACTION_DIAGNOSTIC_SUBDIR_PARTS,
+      ),
+    );
+  }));
+
+test("getDatabaseDiagnosticsPath returns language-specific path", async (t) =>
+  withTmpDir(async (tmpDir) => {
+    t.is(
+      diagnostics.getDatabaseDiagnosticsPath(
+        createTestConfig({ dbLocation: tmpDir }),
+        BuiltInLanguage.swift,
+      ),
+      path.resolve(
+        tmpDir,
+        BuiltInLanguage.swift,
+        ...diagnostics.CODEQL_ACTION_DIAGNOSTIC_SUBDIR_PARTS,
+      ),
+    );
+  }));
+
+/**
+ * Diagnostic files that are written to disk don't have deterministic names.
+ * This function recursively finds all `.json` files at {@link rootPath},
+ * asserts that there is exactly one, and that it matches {@link expected}.
+ *
+ * @param rootPath The path to start searching from.
+ */
+function assertSingleDiagnosticIn(
+  t: ExecutionContext<unknown>,
+  rootPath: string,
+  expected: diagnostics.DiagnosticMessage,
+) {
+  // Find all `.json` files in `rootPath` and check that there is exactly one.
+  const filePaths = fs
+    .readdirSync(rootPath, {
+      recursive: true,
+      encoding: "utf-8",
+    })
+    .filter((p) => p.endsWith(".json"));
+
+  t.is(filePaths.length, 1);
+
+  // Check that the written diagnostic matches the one we added.
+  const contents = fs.readFileSync(
+    path.resolve(rootPath, filePaths[0]),
+    "utf-8",
+  );
+
+  const readDiagnostic = JSON.parse(contents) as diagnostics.DiagnosticMessage;
+  t.deepEqual(readDiagnostic, expected);
+}
+
+test("addDiagnostic writes temporary diagnostics and flushDiagnostics moves them to the database", async (t) =>
+  withTmpDir(async (tmpDir) => {
+    const logger = new RecordingLogger();
+
+    const tempDiagDir = path.resolve(tmpDir, "temp");
+    const testDbDir = path.resolve(tmpDir, "test", "database");
+    const diagnostic = diagnostics.makeDiagnostic(id, name, {});
+
+    // Write the diagnostic. The path provided for `dbLocation` doesn't exist,
+    // so the diagnostic will be written to a temporary location.
+    t.notThrows(() => {
+      diagnostics.addDiagnostic(
+        createTestConfig({ tempDir: tempDiagDir, dbLocation: testDbDir }),
+        BuiltInLanguage.actions,
+        diagnostic,
+        logger,
+      );
+    });
+
+    // Check that `tempDiagDir` was created.
+    t.true(fs.existsSync(tempDiagDir));
+
+    // Check that the diagnostic exists under `tempDiagDir`.
+    assertSingleDiagnosticIn(t, tempDiagDir, diagnostic);
+
+    // Flush the diagnostics. This will cause the diagnostic we wrote previously to
+    // be moved to a location under `dbLocation`.
+    t.notThrows(() => {
+      diagnostics.flushDiagnostics(
+        initAllState({ logger }),
+        createTestConfig({
+          tempDir: tempDiagDir,
+          dbLocation: testDbDir,
+        }),
+      );
+    });
+
+    // Check that `testDbDir` was created.
+    t.true(fs.existsSync(testDbDir));
+
+    // Check that the diagnostic exists under `testDbDir`.
+    assertSingleDiagnosticIn(t, testDbDir, diagnostic);
+
+    // Check that we logged that the database directory doesn't exist yet
+    // and that we moved one diagnostic.
+    checkExpectedLogMessages(t, logger.messages, [
+      `but the database at ${path.join(testDbDir, "actions")} does not exist yet`,
+      "Moving 1 diagnostic(s) to their respective databases.",
+    ]);
+  }));
Author	SHA1	Message	Date
Sam Robson	fbc9ae9062	fix(ci): set up Java before Kotlin in PR checks	2026-10-26 11:54:59 +00:00
Michael B. Gale	3306ba4df7	Merge pull request #4263 from github/mbg/pr-dequeue-notify Add workflow to comment on a PR when it was dequeued	2026-10-23 12:00:00 +00:00
Henry Mercer	562acf5a94	Merge pull request #4264 from github/henrymercer/exclude-pr-only-checks-from-sync-checks Exclude checks that don't always run from the sync script	2026-10-23 11:30:29 +00:00
Michael B. Gale	37a5faff25	Switch to `pull_request.user.login`	2026-10-23 12:19:29 +01:00
Michael B. Gale	54b2801f20	Merge branch 'main' into mbg/pr-dequeue-notify	2026-10-22 17:33:56 +01:00
Michael B. Gale	040890448b	Add workflow to comment on a PR when it was dequeued	2026-10-22 16:11:13 +01:00
Henry MercerandCopilot App	c1ab1b4065	Don't require github-advanced-security or License compliance check Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>	2026-10-22 15:13:50 +01:00
Henry Mercer	c2293b32da	Merge pull request #4244 from github/henrymercer/graduate-per-language-bundles Use per-language CodeQL bundles by default	2026-10-22 14:01:48 +00:00
Michael B. Gale	0acb923c1d	Merge pull request #4223 from github/mbg/diagnostics/failed-sarif Include diagnostics in failed SARIF if they were created before a database was initialised	2026-10-22 13:38:57 +00:00
Michael B. Gale	5196baec01	Merge remote-tracking branch 'origin/main' into mbg/diagnostics/failed-sarif	2026-10-22 14:24:21 +01:00
Henry Mercer	bdadc0358c	Merge pull request #4246 from github/henrymercer/graduate-overlay-version-match Graduate overlay-aware CodeQL version selection	2026-10-22 12:52:48 +00:00
Michael B. Gale	87da5f37e5	Improve wording to address review feedback	2026-10-22 13:48:48 +01:00
Henry MercerandCopilot App	6aa7e65207	Merge remote-tracking branch 'origin/main' into henrymercer/graduate-overlay-version-match Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>	2026-10-22 12:40:12 +01:00
Henry MercerandCopilot App	f033e23010	Clarify why the file baseline check uses a custom configuration Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>	2026-10-22 12:04:37 +01:00
Henry MercerandCopilot App	0171a2b52f	Take a single `ActionState` parameter in `getPerLanguageBundleLanguage` Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>	2026-10-22 12:04:37 +01:00
Henry MercerandCopilot App	626d8b9364	Use `toolcache.ts` in `per-language-bundle-validation.yml` Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>	2026-10-22 11:49:39 +01:00
Henry MercerandCopilot App	922e2ff061	Merge remote-tracking branch 'origin/main' into henrymercer/graduate-per-language-bundles Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>	2026-10-22 11:43:17 +01:00
Michael B. Gale	ac509b698f	Merge branch 'main' into mbg/diagnostics/failed-sarif	2026-10-22 11:42:14 +01:00
Michael B. Gale	b484113f11	Merge pull request #4260 from github/dependabot/npm_and_yarn/npm-minor-74c39c9262 Bump the npm-minor group across 1 directory with 3 updates	2026-10-22 10:39:44 +00:00
Michael B. Gale	2d0d1c1dcd	Merge branch 'main' into mbg/diagnostics/failed-sarif	2026-10-22 11:36:46 +01:00
Michael B. Gale	e0b72fe71a	Merge pull request #4261 from github/dependabot/github_actions/dot-github/workflows/actions-minor-4a8da92e94 Bump the actions-minor group across 1 directory with 3 updates	2026-10-22 10:34:34 +00:00
Michael B. Gale	b79966a8ee	Clean up path functions in `diagnostics.ts` and add some tests	2026-10-22 11:32:04 +01:00
Henry MercerandCopilot App	54af742a29	Simplify the condition for overlay-aware version selection Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>	2026-10-22 11:23:40 +01:00
Michael B. Gale	a50b39a27f	Merge pull request #4235 from github/mbg/deprecate-getRunnerLogger Remove `getRunnerLogger`	2026-10-22 10:20:15 +00:00
Michael B. Gale	d04fe60a48	Merge pull request #4255 from github/mbg/npm-versions Add `toolcache.ts` script for `bundle(-from)-toolcache` checks	2026-10-22 09:47:21 +00:00
Michael B. Gale	308d941317	Only warn for missing config if `init` was successful	2026-10-22 10:37:37 +01:00
Michael B. Gale	26f5c5e4e0	Improve logging and error handling in `logTemporaryDiagnostics`	2026-10-22 10:30:34 +01:00
Michael B. Gale	347d5ce5d5	Trigger workflows	2026-10-22 10:17:39 +01:00
Michael B. Gale	c758339759	Trigger workflows	2026-10-22 10:17:07 +01:00
Michael B. Gale	0a00d0c14f	Rename `noCodeQLInToolcache`	2026-10-21 19:36:54 +01:00
Michael B. Gale	6b344309f7	Log versions if there are some	2026-10-21 19:36:06 +01:00
Michael B. Gale	34f75b50e7	Rename argument	2026-10-21 19:34:35 +01:00
Michael B. Gale	487ba2e156	Merge branch 'main' into mbg/deprecate-getRunnerLogger	2026-10-21 19:30:29 +01:00
github-actions[bot]	fb5d8688b9	Rebuild	2026-10-21 17:58:09 +00:00
dependabot[bot]	ec3f8658b6	Bump the actions-minor group across 1 directory with 3 updates Bumps the actions-minor group with 3 updates in the /.github/workflows directory: [actions/setup-java](https://github.com/actions/setup-java), [ruby/setup-ruby](https://github.com/ruby/setup-ruby) and [actions/create-github-app-token](https://github.com/actions/create-github-app-token). Updates `actions/setup-java` from 6.0.1 to 6.1.0 - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](https://github.com/actions/setup-java/compare/de7274f081f381c8f8158605e0321c36c376e2e6...b843ebf9b913146b38da2eaa7aeddf76074ae1ad) Updates `ruby/setup-ruby` from 1.327.0 to 1.329.0 - [Release notes](https://github.com/ruby/setup-ruby/releases) - [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb) - [Commits](https://github.com/ruby/setup-ruby/compare/14594264cd68ce8a2345dd349bc3d138a4ef85c8...651ff0d62c5c79bed6d53ec518387aae20e72c1a) Updates `actions/create-github-app-token` from 3.2.0 to 3.3.0 - [Release notes](https://github.com/actions/create-github-app-token/releases) - [Changelog](https://github.com/actions/create-github-app-token/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/create-github-app-token/compare/bcd2ba49218906704ab6c1aa796996da409d3eb1...64ab729a6294000f5aa4a4bc0b73d1f32bc45510) --- updated-dependencies: - dependency-name: actions/setup-java dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-minor - dependency-name: ruby/setup-ruby dependency-version: 1.329.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-minor - dependency-name: actions/create-github-app-token dependency-version: 3.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-minor ... Signed-off-by: dependabot[bot] <support@github.com>	2026-10-21 17:56:03 +00:00
dependabot[bot]	d1db36d302	Bump the npm-minor group across 1 directory with 3 updates Bumps the npm-minor group with 3 updates in the / directory: [uuid](https://github.com/uuidjs/uuid), [eslint-plugin-jsdoc](https://github.com/gajus/eslint-plugin-jsdoc) and [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint). Updates `uuid` from 14.0.2 to 14.0.3 - [Release notes](https://github.com/uuidjs/uuid/releases) - [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md) - [Commits](https://github.com/uuidjs/uuid/compare/v14.0.2...v14.0.3) Updates `eslint-plugin-jsdoc` from 65.2.0 to 65.3.4 - [Release notes](https://github.com/gajus/eslint-plugin-jsdoc/releases) - [Commits](https://github.com/gajus/eslint-plugin-jsdoc/compare/v65.2.0...v65.3.4) Updates `typescript-eslint` from 8.71.1 to 8.71.2 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.71.2/packages/typescript-eslint) --- updated-dependencies: - dependency-name: uuid dependency-version: 14.0.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-minor - dependency-name: eslint-plugin-jsdoc dependency-version: 65.3.4 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor - dependency-name: typescript-eslint dependency-version: 8.71.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor ... Signed-off-by: dependabot[bot] <support@github.com>	2026-10-21 17:54:13 +00:00
Mario Campos	4e7f1a8de7	Merge pull request #4258 from github/mergeback/v4.39.1-to-main-9b325408 Mergeback v4.39.1 refs/heads/releases/v4 into main	2026-10-21 16:25:11 +00:00
Mario Campos	0fcd0abe85	Trigger workflows	2026-10-21 11:10:30 -05:00
Henry Mercer	0b9cddc4ff	Merge pull request #4243 from github/henrymercer/remove-trap-cache-cleanup Remove TRAP cache cleanup	2026-10-21 16:03:23 +00:00
Michael B. Gale	16aecb7bc0	Merge branch 'main' into mbg/deprecate-getRunnerLogger	2026-10-21 17:01:07 +01:00
github-actions[bot]	4cf3224289	Rebuild	2026-10-21 15:48:52 +00:00
github-actions[bot]	33f58aa90d	Update changelog and version after v4.39.1	2026-10-21 15:48:42 +00:00
Mario Campos	9b32540854	Merge pull request #4257 from github/update-v4.39.1-c5a2f4b0f Merge main into releases/v4	2026-10-21 10:47:17 -05:00
Mario Campos	b5e1ed9574	Trigger workflows	2026-10-21 10:05:32 -05:00
Michael B. Gale	c3f2a34e23	Clarify comment that explains how the test works	2026-10-21 15:31:30 +01:00
github-actions[bot]	20f5ec3910	Update changelog for v4.39.1	2026-10-21 14:20:41 +00:00
Michael B. Gale	a83f6f50cd	Update skipped `analyze` step comment	2026-10-21 15:17:33 +01:00
Michael B. Gale	67cd8c12d4	Rename env var to `DIAGNOSTICS_DIR`	2026-10-21 15:15:17 +01:00
Henry MercerandCopilot App	961c8405b4	Merge remote-tracking branch 'origin/main' into henrymercer/graduate-overlay-version-match Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>	2026-10-21 13:11:37 +01:00
Michael B. Gale	4707994e6e	Don't include diagnostics if FF is off	2026-10-21 13:03:37 +01:00
Michael B. Gale	98b8e51380	Always check whether config file exists And emit a warning if it doesn't	2026-10-21 12:28:26 +01:00
Michael B. Gale	d7bad7d923	Merge remote-tracking branch 'origin/main' into mbg/diagnostics/failed-sarif	2026-10-21 12:22:54 +01:00
Michael B. Gale	8357829c18	Use same sub-path in `getDiagnosticsPath` for no language case	2026-10-21 12:22:44 +01:00
Michael B. Gale	b963054f39	Add e2e test	2026-10-20 17:48:17 +00:00
Michael B. Gale	ba569ac626	Omit `--sarif-codescanning-config` if the config file doesn't exist	2026-10-20 17:48:17 +00:00
Michael B. Gale	581a0e148e	Refactor `writeTemporaryDiagnosticFile` out of `add[NoLanguage]Diagnostic`	2026-10-20 17:48:17 +00:00
Michael B. Gale	64723df932	Use temporary diagnostic dir in `generateFailedSarif`	2026-10-20 17:48:17 +00:00
Michael B. Gale	67f25913cb	Make diagnostics less dependent on global state Add limited test coverage	2026-10-20 17:48:17 +00:00
Michael B. Gale	f422d8a874	Write diagnostics to temporary location when database isn't ready	2026-10-20 17:48:17 +00:00
Michael B. Gale	56e0d42f68	Refactor `writeDiagnosticFile` out of `writeDiagnostic`	2026-10-20 17:48:17 +00:00
Henry Mercer	c5a2f4b0fe	Merge pull request #4245 from github/henrymercer/graduate-overlay-trap-caching Graduate overlay TRAP caching defaults	2026-10-20 17:45:59 +00:00
Mario Campos	61a5a80dd9	Merge pull request #4256 from github/update-bundle/codeql-bundle-v2.27.3 Update default bundle to 2.27.3	2026-10-20 17:41:23 +00:00
Michael B. Gale	3dd33f8b69	Merge pull request #4249 from github/mbg/upload-improvements-for-4223 Failed SARIF testing and logging improvements	2026-10-20 17:35:13 +00:00
Michael B. Gale	596ae5c8cf	Make comparison strict	2026-10-20 18:12:38 +01:00
Michael B. Gale	b96e3390db	Change comment for `getConfig` call in `upload-sarif`	2026-10-20 18:07:32 +01:00
Michael B. Gale	7fa45180db	Use `shouldSkipSarifUpload` in `analyze-action.ts`	2026-10-20 18:06:24 +01:00
Michael B. Gale	a69c7cb332	Document that setting the env vars to `false` takes precedence	2026-10-20 18:02:30 +01:00
Michael B. Gale	74ddcd9f65	Fix typo in comment	2026-10-20 17:59:12 +01:00
github-actions[bot]	260a53409e	Add changelog note	2026-10-20 16:53:41 +00:00
github-actions[bot]	72cb698832	Update default bundle to codeql-bundle-v2.27.3	2026-10-20 16:53:32 +00:00
Michael B. Gale	d0ab717e67	Replace `rmdir` with `rmSync`	2026-10-20 17:45:21 +01:00
Michael B. Gale	57804e978e	Add `@actions/tool-cache` as an explicit dependency	2026-10-20 17:30:55 +01:00
Michael B. Gale	24408cc688	Use `toolcache.ts` in `bundle-from-toolcache.yml`	2026-10-20 17:30:55 +01:00
Michael B. Gale	297dec926f	Add `toolcache.ts` script for `bundle-toolcache.yml`	2026-10-20 17:30:54 +01:00
Michael B. Gale	950b1479a1	Ensure that `rootDirectory` is suitable for `sarifFile` in `uploadSarifArtifact`	2026-10-20 16:07:25 +00:00
Michael B. Gale	5b69b28796	Improve logging in `uploadSarifArtifact`	2026-10-20 16:07:25 +00:00
Michael B. Gale	1d373e07cd	Upload failed SARIF as workflow artifact in test mode	2026-10-20 16:07:25 +00:00
Michael B. Gale	e7340eea1b	Skip waiting for SARIF if nothing was uploaded	2026-10-20 16:07:25 +00:00
Michael B. Gale	02fb8cc38a	Propagate `Config` to `combineSarifFilesUsingCLI`	2026-10-20 16:07:25 +00:00
Michael B. Gale	6e9aec682d	Add and use `shouldSkipGenerateFailedSarif`	2026-10-20 16:07:25 +00:00
Michael B. Gale	a9cd2f9fa7	Allow to explicitly not skip the SARIF upload	2026-10-20 16:07:25 +00:00
Michael B. Gale	be1223f63e	Log when we didn't get a normal configuration file	2026-10-20 16:07:25 +00:00
Michael B. Gale	0fda7a646f	Merge pull request #4248 from github/mbg/move-diag-export-script Move inline script from `diagnostics-export.yml` to a `.ts` file	2026-10-20 15:53:36 +00:00
Michael B. Gale	3db7caf901	Merge pull request #4219 from github/mbg/ci/improve-pr-checks-triggers Improve `pr-checks.yml` triggers and conditions	2026-10-16 20:31:59 +00:00
Michael B. Gale	604377fd2d	Move inline script from `diagnostics-export.yml` to a `.ts` file	2026-10-16 16:53:07 +01:00
Michael B. Gale	8bb7f8f14a	Add JSDocs for `Logger` logging functions	2026-10-16 16:27:51 +01:00
Michael B. Gale	83e1837c6d	Merge pull request #4247 from github/mbg/copilot/clarify-feature-flags Add Copilot instructions for FFs, and update documentation more generally	2026-10-16 15:20:34 +00:00
Henry MercerandMichael B. Gale	734778abbe	Improve changelog note Co-authored-by: Michael B. Gale <mbg@github.com>	2026-10-16 16:13:47 +01:00
Michael B. Gale	5ecf3b32e9	Suggest "Minor" prefix	2026-10-16 16:03:32 +01:00
Michael B. Gale	e461913b38	Drop "requests" again	2026-10-16 16:03:00 +01:00
Michael B. Gale	6992155901	Elaborate GHES details	2026-10-16 16:02:01 +01:00
Michael B. Gale	f3c93e3106	Add some guidelines for change notes	2026-10-16 15:32:50 +01:00
Michael B. Gale	2441e6e56e	Update "Review instructions" based on recent reviews	2026-10-16 15:31:56 +01:00
Henry MercerandCopilot App	e344c793ad	Document TRAP caching default with improved incremental analysis Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>	2026-10-16 15:28:39 +01:00
Michael B. Gale	0d2baf6822	Update `copilot-instructions.md` to mention feature flags	2026-10-16 15:11:17 +01:00
Henry MercerandCopilot App	912708411b	Remove redundant empty-list check Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>	2026-10-16 15:07:36 +01:00
Michael B. Gale	6cf1931c04	Merge branch 'main' into mbg/deprecate-getRunnerLogger	2026-10-16 15:06:46 +01:00
Henry MercerandCopilot App	e038b67f1c	Graduate overlay TRAP caching defaults Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>	2026-10-16 14:14:00 +01:00
Henry MercerandCopilot App	ba6f82195b	Add change note Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>	2026-10-16 14:02:16 +01:00
Henry MercerandCopilot App	6d82d4f441	Use overlay-aware CodeQL versions by default Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>	2026-10-16 14:01:42 +01:00
Henry MercerandCopilot App	0e72543776	Remove overlay version matching dry run Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>	2026-10-16 14:01:42 +01:00
Henry MercerandCopilot App	9b5d335b99	Warn when `CODEQL_ACTION_CLEANUP_TRAP_CACHES` is set Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>	2026-10-16 14:00:40 +01:00
Henry MercerandCopilot App	2d68850214	Remove per-language bundle rollout flag Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: d9f196d4-6d15-44ca-bd01-cd022d57d2cc	2026-10-16 14:00:39 +01:00
Henry MercerandCopilot App	1a7b87e3d1	Remove TRAP cache cleanup Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>	2026-10-16 14:00:39 +01:00
Henry MercerandCopilot App	9bf78d13c9	Use per-language bundles by default Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: d9f196d4-6d15-44ca-bd01-cd022d57d2cc	2026-10-16 14:00:12 +01:00
Henry MercerandCopilot App	64e5c6243a	Prepare per-language bundle graduation checks Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: d9f196d4-6d15-44ca-bd01-cd022d57d2cc	2026-10-16 13:59:52 +01:00
Henry Mercer	ae098fa9fe	Merge pull request #4242 from github/henrymercer/graduate-toolcache-cleanup Enable cleaning up toolcache bundles by default	2026-10-16 12:43:00 +00:00
Henry MercerandCopilot App	4ebc48bf25	Remove the toolcache cleanup test override Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 9bf883d4-ecd7-4428-970f-86895f760571	2026-10-15 14:54:30 +01:00
Henry MercerandCopilot App	1ec6b03cf4	Enable toolcache bundle cleanup by default Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 9bf883d4-ecd7-4428-970f-86895f760571	2026-10-15 14:54:30 +01:00
Michael B. Gale	2b128fe612	Merge branch 'main' into mbg/deprecate-getRunnerLogger	2026-10-15 14:23:53 +01:00
Michael B. Gale	d63cb97549	Merge branch 'main' into mbg/ci/improve-pr-checks-triggers	2026-10-15 10:58:57 +01:00
Michael B. Gale	7d7a550898	Ensure consistent output formatting in `addMessage`	2026-10-14 15:11:32 +01:00
Michael B. Gale	23d418cf2e	Remove `getRunnerLogger`	2026-10-14 14:50:54 +01:00
Michael B. Gale	924990a9c7	Move `getCodeQLForTesting` to `testing-utils.ts`	2026-10-14 14:38:12 +01:00
Michael B. Gale	4a2ca5c068	Allow logging functions to accept `string[]` directly	2026-10-14 14:13:42 +01:00
Michael B. Gale	a6ff2ad52a	Use `github.actor` for `post-repo-size-comment` condition	2026-10-09 14:30:58 +01:00
Michael B. Gale	2883b5b5db	Fix conditions in `pr-checks` workflow	2026-10-09 10:02:12 +01:00
Michael B. Gale	ba79a4f0b9	Do not run `pr-checks` for all push events	2026-10-09 09:55:02 +01:00