Merge pull request #4216 from github/backport-v3.38.3-24c54180a

Merge releases/v4 into releases/v3
Rebuild
2026-11-07 10:01:02 +03:00 · 2026-10-08 16:43:50 +02:00 · 2026-10-08 13:02:55 +00:00 · 2026-10-08 13:02:45 +00:00 · 2026-10-08 13:02:45 +00:00 · 2026-10-08 13:02:45 +00:00
117 changed files with 3013 additions and 4626 deletions
@@ -16,5 +16,5 @@ inputs:
      Comma separated list of query ids that should NOT be included in this SARIF file.

 runs:
-  using: node24
+  using: node20
  main: index.js
@@ -1,6 +1,6 @@
 name: Verify that the best-effort debug artifact scan completed
 description: Verifies that the best-effort debug artifact scan completed successfully during tests
 runs:
-  using: node24
+  using: node20
  main: index.js
  post: post.js
@@ -87,7 +87,7 @@ jobs:
          post-processed-sarif-path: '${{ runner.temp }}/post-processed'

      - name: Upload SARIF files
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: |
            analysis-kinds-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }}
@@ -95,7 +95,7 @@ jobs:
          retention-days: 7

      - name: Upload post-processed SARIF
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: |
            post-processed-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }}
@@ -65,7 +65,7 @@ jobs:
          output: '${{ runner.temp }}/results'
          upload-database: false
      - name: Upload SARIF
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: config-export-${{ matrix.os }}-${{ matrix.version }}.sarif.json
          path: '${{ runner.temp }}/results/javascript.sarif'
@@ -47,7 +47,7 @@ jobs:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Install Node.js
-        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 20.x
          cache: npm
@@ -76,7 +76,7 @@ jobs:
          output: '${{ runner.temp }}/results'
          upload-database: false
      - name: Upload SARIF
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: diagnostics-export-${{ matrix.os }}-${{ matrix.version }}.sarif.json
          path: '${{ runner.temp }}/results/javascript.sarif'
@@ -97,7 +97,7 @@ jobs:
        with:
          output: '${{ runner.temp }}/results'
      - name: Upload SARIF
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: with-baseline-information-${{ matrix.os }}-${{ matrix.version }}.sarif.json
          path: '${{ runner.temp }}/results/javascript.sarif'
@@ -44,6 +44,8 @@ jobs:
      fail-fast: false
      matrix:
        include:
+          - os: ubuntu-latest
+            version: stable-v2.19.4
          - os: ubuntu-latest
            version: stable-v2.20.7
          - os: ubuntu-latest
@@ -54,8 +56,6 @@ jobs:
            version: stable-v2.23.9
          - os: ubuntu-latest
            version: stable-v2.24.3
-          - os: ubuntu-latest
-            version: stable-v2.25.6
          - os: ubuntu-latest
            version: default
          - os: ubuntu-latest
@@ -44,6 +44,8 @@ jobs:
      fail-fast: false
      matrix:
        include:
+          - os: ubuntu-latest
+            version: stable-v2.19.4
          - os: ubuntu-latest
            version: stable-v2.20.7
          - os: ubuntu-latest
@@ -54,8 +56,6 @@ jobs:
            version: stable-v2.23.9
          - os: ubuntu-latest
            version: stable-v2.24.3
-          - os: ubuntu-latest
-            version: stable-v2.25.6
          - os: ubuntu-latest
            version: default
          - os: ubuntu-latest
@@ -44,6 +44,8 @@ jobs:
      fail-fast: false
      matrix:
        include:
+          - os: ubuntu-latest
+            version: stable-v2.19.4
          - os: ubuntu-latest
            version: stable-v2.20.7
          - os: ubuntu-latest
@@ -54,8 +56,6 @@ jobs:
            version: stable-v2.23.9
          - os: ubuntu-latest
            version: stable-v2.24.3
-          - os: ubuntu-latest
-            version: stable-v2.25.6
          - os: ubuntu-latest
            version: default
          - os: ubuntu-latest
@@ -62,7 +62,7 @@ jobs:
        with:
          output: '${{ runner.temp }}/results'
      - name: Upload SARIF
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: ${{ matrix.os }}-${{ matrix.version }}.sarif.json
          path: '${{ runner.temp }}/results/javascript.sarif'
@@ -54,6 +54,10 @@ jobs:
      fail-fast: false
      matrix:
        include:
+          - os: ubuntu-latest
+            version: stable-v2.19.4
+          - os: macos-15-xlarge
+            version: stable-v2.19.4
          - os: ubuntu-latest
            version: stable-v2.20.7
          - os: macos-15-xlarge
@@ -74,10 +78,6 @@ jobs:
            version: stable-v2.24.3
          - os: macos-latest-xlarge
            version: stable-v2.24.3
-          - os: ubuntu-latest
-            version: stable-v2.25.6
-          - os: macos-latest-xlarge
-            version: stable-v2.25.6
          - os: ubuntu-latest
            version: default
          - os: macos-latest-xlarge
@@ -80,7 +80,7 @@ jobs:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
      - name: Install Node.js
-        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 20.x
          cache: npm
@@ -80,7 +80,7 @@ jobs:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
      - name: Install Node.js
-        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 20.x
          cache: npm
@@ -80,7 +80,7 @@ jobs:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
      - name: Install Node.js
-        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 20.x
          cache: npm
@@ -80,7 +80,7 @@ jobs:
          go-version: ${{ inputs.go-version || '>=1.21.0' }}
          cache: false
      - name: Install Node.js
-        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 20.x
          cache: npm
@@ -35,7 +35,7 @@ jobs:
      matrix:
        include:
          - os: ubuntu-latest
-            version: stable-v2.20.7
+            version: stable-v2.19.4
          - os: ubuntu-latest
            version: stable-v2.22.1
          - os: ubuntu-latest
@@ -57,7 +57,7 @@ jobs:
      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

    - name: Set up Node.js
-      uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
      with:
        node-version: 24
        cache: 'npm'
@@ -30,7 +30,7 @@ jobs:
      fail-fast: false
      matrix:
        version:
-        - stable-v2.20.7
+        - stable-v2.20.3
        - default
        - linked
        - nightly-latest
@@ -89,7 +89,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Download all artifacts
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
      - name: Check expected artifacts exist
        run: |
          LANGUAGES="cpp csharp go java javascript python"
@@ -29,7 +29,7 @@ jobs:
      fail-fast: false
      matrix:
        version:
-        - stable-v2.20.7
+        - stable-v2.20.3
        - default
        - linked
        - nightly-latest
@@ -82,10 +82,10 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Download all artifacts
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
      - name: Check expected artifacts exist
        run: |
-          VERSIONS="stable-v2.20.7 default linked nightly-latest"
+          VERSIONS="stable-v2.20.3 default linked nightly-latest"
          LANGUAGES="cpp csharp go java javascript python"
          for version in $VERSIONS; do
            pushd "./my-debug-artifacts-${version//./}"
@@ -47,7 +47,7 @@ jobs:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0  # ensure we have all tags and can push commits
-      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24
          cache: 'npm'
@@ -42,7 +42,7 @@ jobs:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Node.js
-        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: ${{ matrix.node-version }}
          cache: "npm"
@@ -110,7 +110,7 @@ jobs:
          fi

      - name: Set up Node.js
-        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24
          cache: "npm"
@@ -175,7 +175,7 @@ jobs:

      - name: Upload repo size comment
        if: steps.fetch-base.outcome == 'success'
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: repo-size-comment
          path: ${{ runner.temp }}/repo-size/
@@ -223,7 +223,7 @@ jobs:

    steps:
      - name: Download repo size comment
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: repo-size-comment
          path: repo-size-comment
@@ -33,7 +33,7 @@ jobs:
      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

    - name: Install Node.js
-      uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
      with:
        node-version: 24
        cache: npm
@@ -30,7 +30,7 @@ jobs:
          ref: ${{ env.HEAD_REF }}

      - name: Set up Node.js
-        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24
          cache: 'npm'
@@ -41,7 +41,7 @@ jobs:
          git config --global user.name "github-actions[bot]"

      - name: Set up Node.js
-        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24
          cache: 'npm'
@@ -26,7 +26,7 @@ jobs:
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Node.js
-        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24
          cache: 'npm'
@@ -2,113 +2,102 @@

 See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs.

-## [UNRELEASED]
-
-No user facing changes.
-
-## 4.39.0 - 15 Oct 2026
-
- _Breaking change_: Bump the minimum required CodeQL bundle version to 2.20.7. [#4205](https://github.com/github/codeql-action/pull/4205)
- The `codeql-action/analyze` step now validates that a correct argument for the `checkout_path` input has been provided. The `checkout_path` input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by `codeql-action/init`, then the CodeQL Action now produces a warning. [#4148](https://github.com/github/codeql-action/pull/4148)
- Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. [#4206](https://github.com/github/codeql-action/pull/4206)
- The `codeql-action/start-proxy` step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as `codeql-action/init`. This primarily benefits customers who are using GitHub instances other than `github.com` where the `codeql-action/start-proxy` step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. [#4198](https://github.com/github/codeql-action/pull/4198)
-
-## 4.38.3 - 08 Oct 2026
+## 3.38.3 - 08 Oct 2026

 - _Upcoming breaking change_: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. [#4188](https://github.com/github/codeql-action/pull/4188)
 - Update default CodeQL bundle version to [2.27.2](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2). [#4203](https://github.com/github/codeql-action/pull/4203)
 - Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. [#4184](https://github.com/github/codeql-action/pull/4184)

-## 4.38.2 - 24 Sept 2026
+## 3.38.2 - 24 Sept 2026

 - Update default CodeQL bundle version to [2.27.1](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1). [#4160](https://github.com/github/codeql-action/pull/4160)

-## 4.38.1 - 18 Sept 2026
+## 3.38.1 - 18 Sept 2026

 - The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. [#4146](https://github.com/github/codeql-action/pull/4146)

-## 4.38.0 - 09 Sept 2026
+## 3.38.0 - 09 Sept 2026

 - On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. [#4124](https://github.com/github/codeql-action/pull/4124)
 - The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native `linux-arm64` CodeQL bundle when available. [#4072](https://github.com/github/codeql-action/pull/4072)
 - Update default CodeQL bundle version to [2.27.0](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0). [#4129](https://github.com/github/codeql-action/pull/4129)

-## 4.37.9 - 26 Aug 2026
+## 3.37.9 - 26 Aug 2026

 - Update default CodeQL bundle version to [2.26.4](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4). [#4106](https://github.com/github/codeql-action/pull/4106)

-## 4.37.8 - 21 Aug 2026
+## 3.37.8 - 21 Aug 2026

 No user facing changes.

-## 4.37.7 - 13 Aug 2026
+## 3.37.7 - 13 Aug 2026

 - Update default CodeQL bundle version to [2.26.3](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3). [#4085](https://github.com/github/codeql-action/pull/4085)

-## 4.37.6 - 04 Aug 2026
+## 3.37.6 - 04 Aug 2026

 - Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to `.github/codeql-config.yml` to align it with the suggested path that is used elsewhere. [#4070](https://github.com/github/codeql-action/pull/4070)

-## 4.37.5 - 03 Aug 2026
+## 3.37.5 - 03 Aug 2026

 - Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the `init` Action instead of falling back to downloading the bundle before extracting it. [#4061](https://github.com/github/codeql-action/pull/4061)

-## 4.37.4 - 29 Jul 2026
+## 3.37.4 - 29 Jul 2026

 - This version of the CodeQL Action adds support for the `tools` input for the `codeql-action/init` step to be specified using a `github-codeql-tools` [repository property](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization). This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to `toolcache` to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for `tools` in the workflow definition always takes precedence unless the value of the repository property starts with `!`. [#4037](https://github.com/github/codeql-action/pull/4037)
 - Update default CodeQL bundle version to [2.26.2](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2). [#4051](https://github.com/github/codeql-action/pull/4051)

-## 4.37.3 - 22 Jul 2026
+## 3.37.3 - 22 Jul 2026

 No user facing changes.

-## 4.37.2 - 21 Jul 2026
+## 3.37.2 - 21 Jul 2026

 - The new address format for the `config-file` input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the `remote=` prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. [#4023](https://github.com/github/codeql-action/pull/4023)
 - The CodeQL Action can now make use of [configured private registries](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries) in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. [#4007](https://github.com/github/codeql-action/pull/4007)

-## 4.37.1 - 16 Jul 2026
+## 3.37.1 - 16 Jul 2026

 - _Upcoming breaking change_: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. [#3956](https://github.com/github/codeql-action/pull/3956)
 - Update default CodeQL bundle version to [2.26.1](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1). [#4019](https://github.com/github/codeql-action/pull/4019)

-## 4.37.0 - 08 Jul 2026
+## 3.37.0 - 08 Jul 2026

 - Update default CodeQL bundle version to [2.26.0](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0). [#3995](https://github.com/github/codeql-action/pull/3995)
 - In addition to the existing input format, the `config-file` input for the `codeql-action/init` step will soon support a new `[owner/]repo[@ref][:path]` format. All components except the repository name are optional. If omitted, `owner` defaults to the same owner as the repository the analysis is running for, `ref` to `main`, and `path` to `.github/codeql-action.yaml`. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. [#3973](https://github.com/github/codeql-action/pull/3973)

-## 4.36.3 - 01 Jul 2026
+## 3.36.3 - 01 Jul 2026

 No user facing changes.

-## 4.36.2 - 04 Jun 2026
+## 3.36.2 - 04 Jun 2026

 - Cache CodeQL CLI version information across Actions steps. [#3943](https://github.com/github/codeql-action/pull/3943)
 - Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. [#3937](https://github.com/github/codeql-action/pull/3937)
 - Update default CodeQL bundle version to [2.25.6](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6). [#3948](https://github.com/github/codeql-action/pull/3948)

-## 4.36.1 - 02 Jun 2026
+## 3.36.1 - 02 Jun 2026

 No user facing changes.

-## 4.36.0 - 22 May 2026
+## 3.36.0 - 22 May 2026

 - _Breaking change_: Bump the minimum required CodeQL bundle version to 2.19.4. [#3894](https://github.com/github/codeql-action/pull/3894)
 - Add support for SHA-256 Git object IDs. [#3893](https://github.com/github/codeql-action/pull/3893)
 - Update default CodeQL bundle version to [2.25.5](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5). [#3926](https://github.com/github/codeql-action/pull/3926)

-## 4.35.5 - 15 May 2026
+## 3.35.5 - 15 May 2026

 - We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. [#3899](https://github.com/github/codeql-action/pull/3899)
 - For performance and accuracy reasons, [improved incremental analysis](https://github.com/github/roadmap/issues/1158) will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. [#3791](https://github.com/github/codeql-action/pull/3791)
 - If multiple inputs are provided for the GitHub-internal `analysis-kinds` input, only `code-scanning` will be enabled. The `analysis-kinds` input is experimental, for GitHub-internal use only, and may change without notice at any time. [#3892](https://github.com/github/codeql-action/pull/3892)
 - Added an experimental change which, when running a Code Scanning analysis for a PR with [improved incremental analysis](https://github.com/github/roadmap/issues/1158) enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. [#3880](https://github.com/github/codeql-action/pull/3880)

-## 4.35.4 - 07 May 2026
+## 3.35.4 - 07 May 2026

 - Update default CodeQL bundle version to [2.25.4](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4). [#3881](https://github.com/github/codeql-action/pull/3881)

-## 4.35.3 - 01 May 2026
+## 3.35.3 - 01 May 2026

 - _Upcoming breaking change_: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. [#3837](https://github.com/github/codeql-action/pull/3837)
 - Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. [#3850](https://github.com/github/codeql-action/pull/3850)
@@ -116,7 +105,7 @@ No user facing changes.
 - Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. [#3852](https://github.com/github/codeql-action/pull/3852)
 - Update default CodeQL bundle version to [2.25.3](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.3). [#3865](https://github.com/github/codeql-action/pull/3865)

-## 4.35.2 - 15 Apr 2026
+## 3.35.2 - 15 Apr 2026

 - The undocumented TRAP cache cleanup feature that could be enabled using the `CODEQL_ACTION_CLEANUP_TRAP_CACHES` environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the `trap-caching: false` input to the `init` Action. [#3795](https://github.com/github/codeql-action/pull/3795)
 - The Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. [#3789](https://github.com/github/codeql-action/pull/3789)
@@ -124,26 +113,26 @@ No user facing changes.
 - Fixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. [#3807](https://github.com/github/codeql-action/pull/3807)
 - Update default CodeQL bundle version to [2.25.2](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.2). [#3823](https://github.com/github/codeql-action/pull/3823)

-## 4.35.1 - 27 Mar 2026
+## 3.35.1 - 27 Mar 2026

 - Fix incorrect minimum required Git version for [improved incremental analysis](https://github.com/github/roadmap/issues/1158): it should have been 2.36.0, not 2.11.0. [#3781](https://github.com/github/codeql-action/pull/3781)

-## 4.35.0 - 27 Mar 2026
+## 3.35.0 - 27 Mar 2026

 - Reduced the minimum Git version required for [improved incremental analysis](https://github.com/github/roadmap/issues/1158) from 2.38.0 to 2.11.0. [#3767](https://github.com/github/codeql-action/pull/3767)
 - Update default CodeQL bundle version to [2.25.1](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.1). [#3773](https://github.com/github/codeql-action/pull/3773)

-## 4.34.1 - 20 Mar 2026
+## 3.34.1 - 20 Mar 2026

 - Downgrade default CodeQL bundle version to [2.24.3](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3) due to issues with a small percentage of Actions and JavaScript analyses. [#3762](https://github.com/github/codeql-action/pull/3762)

-## 4.34.0 - 20 Mar 2026
+## 3.34.0 - 20 Mar 2026

 - Added an experimental change which disables TRAP caching when [improved incremental analysis](https://github.com/github/roadmap/issues/1158) is enabled, since improved incremental analysis supersedes TRAP caching. This will improve performance and reduce Actions cache usage. We expect to roll this change out to everyone in March. [#3569](https://github.com/github/codeql-action/pull/3569)
 - We are rolling out improved incremental analysis to C/C++ analyses that use build mode `none`. We expect this rollout to be complete by the end of April 2026. [#3584](https://github.com/github/codeql-action/pull/3584)
 - Update default CodeQL bundle version to [2.25.0](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.0). [#3585](https://github.com/github/codeql-action/pull/3585)

-## 4.33.0 - 16 Mar 2026
+## 3.33.0 - 16 Mar 2026

 - Upcoming change: Starting April 2026, the CodeQL Action will skip collecting file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses. Pull request analyses will log a warning about this upcoming change. [#3562](https://github.com/github/codeql-action/pull/3562)

@@ -157,11 +146,11 @@ No user facing changes.
 - Fixed the retry mechanism for database uploads. Previously this would fail with the error "Response body object should not be disturbed or locked". [#3564](https://github.com/github/codeql-action/pull/3564)
 - A warning is now emitted if the CodeQL Action detects a repository property whose name suggests that it relates to the CodeQL Action, but which is not one of the properties recognised by the current version of the CodeQL Action. [#3570](https://github.com/github/codeql-action/pull/3570)

-## 4.32.6 - 05 Mar 2026
+## 3.32.6 - 05 Mar 2026

 - Update default CodeQL bundle version to [2.24.3](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3). [#3548](https://github.com/github/codeql-action/pull/3548)

-## 4.32.5 - 02 Mar 2026
+## 3.32.5 - 02 Mar 2026

 - Repositories owned by an organization can now set up the `github-codeql-disable-overlay` custom repository property to disable [improved incremental analysis for CodeQL](https://github.com/github/roadmap/issues/1158). First, create a custom repository property with the name `github-codeql-disable-overlay` and the type "True/false" in the organization's settings. Then in the repository's settings, set this property to `true` to disable improved incremental analysis. For more information, see [Managing custom properties for repositories in your organization](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization). This feature is not yet available on GitHub Enterprise Server. [#3507](https://github.com/github/codeql-action/pull/3507)
 - Added an experimental change so that when [improved incremental analysis](https://github.com/github/roadmap/issues/1158) fails on a runner — potentially due to insufficient disk space — the failure is recorded in the Actions cache so that subsequent runs will automatically skip improved incremental analysis until something changes (e.g. a larger runner is provisioned or a new CodeQL version is released). We expect to roll this change out to everyone in March. [#3487](https://github.com/github/codeql-action/pull/3487)
@@ -171,7 +160,7 @@ No user facing changes.
 - Added an experimental change which allows the `start-proxy` action to resolve the CodeQL CLI version from feature flags instead of using the linked CLI bundle version. We expect to roll this change out to everyone in March. [#3512](https://github.com/github/codeql-action/pull/3512)
 - The previously experimental changes from versions 4.32.3, 4.32.4, 3.32.3 and 3.32.4 are now enabled by default. [#3503](https://github.com/github/codeql-action/pull/3503), [#3504](https://github.com/github/codeql-action/pull/3504)

-## 4.32.4 - 20 Feb 2026
+## 3.32.4 - 20 Feb 2026

 - Update default CodeQL bundle version to [2.24.2](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.2). [#3493](https://github.com/github/codeql-action/pull/3493)
 - Added an experimental change which improves how certificates are generated for the authentication proxy that is used by the CodeQL Action in Default Setup when [private package registries are configured](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries). This is expected to generate more widely compatible certificates and should have no impact on analyses which are working correctly already. We expect to roll this change out to everyone in February. [#3473](https://github.com/github/codeql-action/pull/3473)
@@ -179,89 +168,89 @@ No user facing changes.
 - Added a setting which allows the CodeQL Action to enable network debugging for Java programs. This will help GitHub staff support customers with troubleshooting issues in GitHub-managed CodeQL workflows, such as Default Setup. This setting can only be enabled by GitHub staff. [#3485](https://github.com/github/codeql-action/pull/3485)
 - Added a setting which enables GitHub-managed workflows, such as Default Setup, to use a [nightly CodeQL CLI release](https://github.com/dsp-testing/codeql-cli-nightlies) instead of the latest, stable release that is used by default. This will help GitHub staff support customers whose analyses for a given repository or organization require early access to a change in an upcoming CodeQL CLI release. This setting can only be enabled by GitHub staff. [#3484](https://github.com/github/codeql-action/pull/3484)

-## 4.32.3 - 13 Feb 2026
+## 3.32.3 - 13 Feb 2026

 - Added experimental support for testing connections to [private package registries](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries). This feature is not currently enabled for any analysis. In the future, it may be enabled by default for Default Setup. [#3466](https://github.com/github/codeql-action/pull/3466)

-## 4.32.2 - 05 Feb 2026
+## 3.32.2 - 05 Feb 2026

 - Update default CodeQL bundle version to [2.24.1](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.1). [#3460](https://github.com/github/codeql-action/pull/3460)

-## 4.32.1 - 02 Feb 2026
+## 3.32.1 - 02 Feb 2026

 - A warning is now shown in Default Setup workflow logs if a [private package registry is configured](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries) using a GitHub Personal Access Token (PAT), but no username is configured. [#3422](https://github.com/github/codeql-action/pull/3422)
 - Fixed a bug which caused the CodeQL Action to fail when repository properties cannot successfully be retrieved. [#3421](https://github.com/github/codeql-action/pull/3421)

-## 4.32.0 - 26 Jan 2026
+## 3.32.0 - 26 Jan 2026

 - Update default CodeQL bundle version to [2.24.0](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.0). [#3425](https://github.com/github/codeql-action/pull/3425)

-## 4.31.11 - 23 Jan 2026
+## 3.31.11 - 23 Jan 2026

 - When running a Default Setup workflow with [Actions debugging enabled](https://docs.github.com/en/actions/how-tos/monitor-workflows/enable-debug-logging), the CodeQL Action will now use more unique names when uploading logs from the Dependabot authentication proxy as workflow artifacts. This ensures that the artifact names do not clash between multiple jobs in a build matrix. [#3409](https://github.com/github/codeql-action/pull/3409)
 - Improved error handling throughout the CodeQL Action. [#3415](https://github.com/github/codeql-action/pull/3415)
 - Added experimental support for automatically excluding [generated files](https://docs.github.com/en/repositories/working-with-files/managing-files/customizing-how-changed-files-appear-on-github) from the analysis. This feature is not currently enabled for any analysis. In the future, it may be enabled by default for some GitHub-managed analyses. [#3318](https://github.com/github/codeql-action/pull/3318)
 - The changelog extracts that are included with releases of the CodeQL Action are now shorter to avoid duplicated information from appearing in Dependabot PRs. [#3403](https://github.com/github/codeql-action/pull/3403)

-## 4.31.10 - 12 Jan 2026
+## 3.31.10 - 12 Jan 2026

 - Update default CodeQL bundle version to 2.23.9. [#3393](https://github.com/github/codeql-action/pull/3393)

-## 4.31.9 - 16 Dec 2025
+## 3.31.9 - 16 Dec 2025

 No user facing changes.

-## 4.31.8 - 11 Dec 2025
+## 3.31.8 - 11 Dec 2025

 - Update default CodeQL bundle version to 2.23.8. [#3354](https://github.com/github/codeql-action/pull/3354)

-## 4.31.7 - 05 Dec 2025
+## 3.31.7 - 05 Dec 2025

 - Update default CodeQL bundle version to 2.23.7. [#3343](https://github.com/github/codeql-action/pull/3343)

-## 4.31.6 - 01 Dec 2025
+## 3.31.6 - 01 Dec 2025

 No user facing changes.

-## 4.31.5 - 24 Nov 2025
+## 3.31.5 - 24 Nov 2025

 - Update default CodeQL bundle version to 2.23.6. [#3321](https://github.com/github/codeql-action/pull/3321)

-## 4.31.4 - 18 Nov 2025
+## 3.31.4 - 18 Nov 2025

 No user facing changes.

-## 4.31.3 - 13 Nov 2025
+## 3.31.3 - 13 Nov 2025

 - CodeQL Action v3 will be deprecated in December 2026.  The Action now logs a warning for customers who are running v3 but could be running v4. For more information, see [Upcoming deprecation of CodeQL Action v3](https://github.blog/changelog/2025-10-28-upcoming-deprecation-of-codeql-action-v3/).
 - Update default CodeQL bundle version to 2.23.5. [#3288](https://github.com/github/codeql-action/pull/3288)

-## 4.31.2 - 30 Oct 2025
+## 3.31.2 - 30 Oct 2025

 No user facing changes.

-## 4.31.1 - 30 Oct 2025
+## 3.31.1 - 30 Oct 2025

 - The `add-snippets` input has been removed from the `analyze` action. This input has been deprecated since CodeQL Action 3.26.4 in August 2024 when this removal was announced.

-## 4.31.0 - 24 Oct 2025
+## 3.31.0 - 24 Oct 2025

 - Bump minimum CodeQL bundle version to 2.17.6. [#3223](https://github.com/github/codeql-action/pull/3223)
 - When SARIF files are uploaded by the `analyze` or `upload-sarif` actions, the CodeQL Action automatically performs post-processing steps to prepare the data for the upload. Previously, these post-processing steps were only performed before an upload took place. We are now changing this so that the post-processing steps will always be performed, even when the SARIF files are not uploaded. This does not change anything for the `upload-sarif` action. For `analyze`, this may affect Advanced Setup for CodeQL users who specify a value other than `always` for the `upload` input. [#3222](https://github.com/github/codeql-action/pull/3222)

-## 4.30.9 - 17 Oct 2025
+## 3.30.9 - 17 Oct 2025

 - Update default CodeQL bundle version to 2.23.3. [#3205](https://github.com/github/codeql-action/pull/3205)
 - Experimental: A new `setup-codeql` action has been added which is similar to `init`, except it only installs the CodeQL CLI and does not initialize a database. Do not use this in production as it is part of an internal experiment and subject to change at any time. [#3204](https://github.com/github/codeql-action/pull/3204)

-## 4.30.8 - 10 Oct 2025
+## 3.30.8 - 10 Oct 2025

 No user facing changes.

-## 4.30.7 - 06 Oct 2025
+## 3.30.7 - 06 Oct 2025

- [v4+ only] The CodeQL Action now runs on Node.js v24. [#3169](https://github.com/github/codeql-action/pull/3169)

+No user facing changes.
 ## 3.30.6 - 02 Oct 2025

 - Update default CodeQL bundle version to 2.23.2. [#3168](https://github.com/github/codeql-action/pull/3168)
@@ -53,7 +53,6 @@ Here are a few things you can do that will increase the likelihood of your pull
 - Write tests.
 - Keep your change as focused as possible. If there are multiple changes you would like to make that are not dependent upon each other, consider submitting them as separate pull requests.
 - Write a [good commit message](http://tbaggery.com/2008/04/19/a-note-about-git-commit-messages.html).
- For user-facing changes, add a change-note file. See [unreleased-change-notes/README.md](unreleased-change-notes/README.md).

 ## Releasing (write access required)

@@ -94,6 +94,6 @@ outputs:
  sarif-id:
    description: The ID of the uploaded SARIF file.
 runs:
-  using: node24
+  using: node20
  main: "../lib/analyze-entry.js"
  post: "../lib/analyze-post-entry.js"
@@ -15,5 +15,5 @@ inputs:
      $GITHUB_WORKSPACE as its working directory.
    required: false
 runs:
-  using: node24
+  using: node20
  main: '../lib/autobuild-entry.js'
@@ -1,4 +1,3 @@
 import pkg from "./package.json" with { type: "json" };

 globalThis.__CODEQL_ACTION_VERSION__ = pkg.version;
-globalThis.__CODEQL_ACTION_TEST_ENV__ = "unit-test";
@@ -78,7 +78,7 @@ const UPLOAD_LIB_SRC = "./src/upload-lib";
 *
 * The virtual module additionally re-exports `upload-lib` under the `uploadLib` namespace so that
 * external consumers can access it via the small `lib/upload-lib.js` stub emitted below.
- *
+ * 
 * A tiny stub file is emitted for each Action entrypoint, and one for `upload-lib`. Each stub
 * imports the shared bundle and calls/re-exports from the respective entry point.
 *
@@ -212,7 +212,6 @@ const context = await esbuild.context({
  target: ["node20"],
  define: {
    __CODEQL_ACTION_VERSION__: JSON.stringify(pkg.version),
-    __CODEQL_ACTION_TEST_ENV__: JSON.stringify(""),
  },
  metafile: true,
 });
@@ -140,17 +140,6 @@ export default [
      "no-async-foreach/no-async-foreach": "error",
      "no-sequences": "error",
      "no-shadow": "off",
-
-      // A basic check that we don't use `exportVariable` from `@actions/core`.
-      "no-restricted-syntax": [
-        "error",
-        {
-          selector: "MemberExpression[property.name='exportVariable']",
-          message:
-            "Use the `export` method of an `Env` instance or `exportEnvVar` from `environment.ts` instead.",
-        },
-      ],
-
      // This is overly restrictive with unsetting `EnvVar`s
      "@typescript-eslint/no-dynamic-delete": "off",
      "@typescript-eslint/no-shadow": "error",
@@ -168,15 +157,6 @@ export default [
      ],
    },
  },
-  {
-    files: ["src/environment.ts"],
-
-    // We allow `exportVariable` from `@actions/core` to be used in this file
-    // since it defines the wrapper around it that other modules use.
-    rules: {
-      "no-restricted-syntax": "off",
-    },
-  },
  {
    files: ["**/*.ts", "**/*.js"],

@@ -177,6 +177,6 @@ outputs:
  codeql-version:
    description: The version of the CodeQL binary used for analysis
 runs:
-  using: node24
+  using: node20
  main: '../lib/init-entry.js'
  post: '../lib/init-post-entry.js'
@@ -1,12 +1,12 @@
 {
  "name": "codeql",
-  "version": "4.39.1",
+  "version": "4.38.3",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "codeql",
-      "version": "4.39.1",
+      "version": "4.38.3",
      "license": "MIT",
      "workspaces": [
        "pr-checks"
@@ -14,7 +14,7 @@
      "dependencies": {
        "@actions/artifact": "^5.0.3",
        "@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2",
-        "@actions/cache": "^5.3.0",
+        "@actions/cache": "^5.2.0",
        "@actions/core": "^2.0.3",
        "@actions/exec": "^2.0.0",
        "@actions/github": "^8.0.1",
@@ -23,14 +23,15 @@
        "@actions/io": "^2.0.0",
        "@actions/tool-cache": "^3.0.1",
        "@octokit/core": "^7.0.8",
-        "@octokit/plugin-paginate-rest": "^16.0.0",
+        "@octokit/plugin-paginate-rest": "^15.0.0",
        "@octokit/plugin-rest-endpoint-methods": "^18.0.0",
        "@octokit/plugin-retry": "^8.1.1",
        "archiver": "^8.0.0",
-        "follow-redirects": "^1.16.1",
+        "fast-deep-equal": "^3.1.3",
+        "follow-redirects": "^1.16.0",
        "get-folder-size": "^5.0.0",
        "https-proxy-agent": "^7.0.6",
-        "js-yaml": "^5.4.3",
+        "js-yaml": "^5.4.2",
        "jsonschema": "1.5.0",
        "long": "^5.3.2",
        "node-forge": "^1.4.0",
@@ -57,14 +58,14 @@
        "eslint-import-resolver-typescript": "^4.4.5",
        "eslint-plugin-github": "^6.1.2",
        "eslint-plugin-import-x": "^4.17.1",
-        "eslint-plugin-jsdoc": "^65.2.0",
+        "eslint-plugin-jsdoc": "^64.5.4",
        "eslint-plugin-no-async-foreach": "^0.1.1",
        "glob": "^13.0.6",
-        "globals": "^17.13.0",
+        "globals": "^17.12.0",
        "nock": "^14.0.17",
        "sinon": "^22.1.0",
        "typescript": "^6.0.3",
-        "typescript-eslint": "^8.71.1"
+        "typescript-eslint": "^8.70.1"
      }
    },
    "node_modules/@aashutoshrathi/word-wrap": {
@@ -458,19 +459,19 @@
      }
    },
    "node_modules/@actions/cache": {
-      "version": "5.3.0",
-      "resolved": "https://registry.npmjs.org/@actions/cache/-/cache-5.3.0.tgz",
-      "integrity": "sha512-VqJBlQFt1lpp7op7o/Z0syWywX9cN8TxjFCPjHyGHmXCiczU5NII5ZdEpGpTelUnOGFG2bO7viUx9q3q7WR/Gg==",
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/@actions/cache/-/cache-5.2.0.tgz",
+      "integrity": "sha512-1R1Oc8cuDNCygsIP7gLiKLGCymOw/k5FkGQkXZFcLz6/RWyMImkfP0dZX6kjA9SRAmANcKNocI2XrsIaZ1it8w==",
      "license": "MIT",
      "dependencies": {
-        "@actions/core": "^2.0.3",
+        "@actions/core": "^2.0.0",
        "@actions/exec": "^2.0.0",
        "@actions/glob": "^0.5.1",
        "@actions/http-client": "^3.0.2",
        "@actions/io": "^2.0.0",
        "@azure/abort-controller": "^1.1.0",
-        "@azure/core-rest-pipeline": "^1.25.0",
-        "@azure/storage-blob": "^12.34.0",
+        "@azure/core-rest-pipeline": "^1.22.0",
+        "@azure/storage-blob": "^12.29.1",
        "@protobuf-ts/runtime-rpc": "^2.11.1",
        "semver": "^6.3.1"
      }
@@ -2204,12 +2205,12 @@
      "license": "MIT"
    },
    "node_modules/@octokit/plugin-paginate-rest": {
-      "version": "16.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-16.0.0.tgz",
-      "integrity": "sha512-7RtUeGZypAK4EA4LrjTCnsLALNOoUcYh5vOnCNXpdIQVTQCPh4OFu7324iPqAls3KGgVnZktKUnNKZCOKyHrlA==",
+      "version": "15.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-15.0.0.tgz",
+      "integrity": "sha512-lw9A9YL5s4VPj+VEx8uMxaxQm2YTgrPDkrLEuZuu18R8TK3oPcXF4K6t52nx6xn1RcogZC9i188sAr/4XYJaQQ==",
      "license": "MIT",
      "dependencies": {
-        "@octokit/types": "^18.0.0"
+        "@octokit/types": "^17.0.0"
      },
      "engines": {
        "node": ">= 20"
@@ -2218,6 +2219,21 @@
        "@octokit/core": ">=6"
      }
    },
+    "node_modules/@octokit/plugin-paginate-rest/node_modules/@octokit/openapi-types": {
+      "version": "28.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-28.0.0.tgz",
+      "integrity": "sha512-0rFyLuyHvIj6uuZWuDslxkowFYdPXoNIkeAv4b27dzm2Tf4vGWXnPsMcxs7d65kLdMERgP3wc1AEPlqMz8e1cQ==",
+      "license": "MIT"
+    },
+    "node_modules/@octokit/plugin-paginate-rest/node_modules/@octokit/types": {
+      "version": "17.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-17.0.0.tgz",
+      "integrity": "sha512-ByP1v7YL5SMveFPP7+sj0/ZuWCOOg/Chs4NafOMpq6WNIM/hdGY0S7C0TCGDBWu1aGmOxmUIhMx3cO+IdwYZ1Q==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/openapi-types": "^28.0.0"
+      }
+    },
    "node_modules/@octokit/plugin-request-log": {
      "version": "1.0.4",
      "resolved": "https://registry.npmjs.org/@octokit/plugin-request-log/-/plugin-request-log-1.0.4.tgz",
@@ -2702,17 +2718,17 @@
      "license": "MIT"
    },
    "node_modules/@typescript-eslint/eslint-plugin": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.71.1.tgz",
-      "integrity": "sha512-nNlBf6HuotqMgZvSkWD5hNdemiBIxQ2NmrlgfcUIeZRs+BbakjscCQRq/Hb74EFVnFiSWWdL12JruqwBy3ERDw==",
+      "version": "8.70.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.70.1.tgz",
+      "integrity": "sha512-nDNrUQ/4ruSNYbu749TRY7cfrzPtoLHEXSNBI8aaNY32LlZCajixqRf3FqcKC4p5Cam4VOHYx/t+i5+nKXvrqA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
        "@eslint-community/regexpp": "^4.12.2",
-        "@typescript-eslint/scope-manager": "8.71.1",
-        "@typescript-eslint/type-utils": "8.71.1",
-        "@typescript-eslint/utils": "8.71.1",
-        "@typescript-eslint/visitor-keys": "8.71.1",
+        "@typescript-eslint/scope-manager": "8.70.1",
+        "@typescript-eslint/type-utils": "8.70.1",
+        "@typescript-eslint/utils": "8.70.1",
+        "@typescript-eslint/visitor-keys": "8.70.1",
        "ignore": "^7.0.5",
        "natural-compare": "^1.4.0",
        "ts-api-utils": "^2.5.0"
@@ -2725,7 +2741,7 @@
        "url": "https://opencollective.com/typescript-eslint"
      },
      "peerDependencies": {
-        "@typescript-eslint/parser": "^8.71.1",
+        "@typescript-eslint/parser": "^8.70.1",
        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
        "typescript": ">=4.8.4 <6.1.0"
      }
@@ -2741,16 +2757,16 @@
      }
    },
    "node_modules/@typescript-eslint/parser": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.71.1.tgz",
-      "integrity": "sha512-oM/5sAqz/l1v/zYK1qTOPrn2+JIrBGC1V6uNYucRO5gh6eT9vWJ/RhPbGE59byvZEUQ4VP6XkLBaS5Jti5jpvw==",
+      "version": "8.70.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.70.1.tgz",
+      "integrity": "sha512-nO974WLllwhSFWQXnMLj6nDGa8f0khKEz1JzpPJ1u7Vm/4X1X6ZHajpoknU4bb41vJyMB0HHVyS2GqdhWfIXZw==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/scope-manager": "8.71.1",
-        "@typescript-eslint/types": "8.71.1",
-        "@typescript-eslint/typescript-estree": "8.71.1",
-        "@typescript-eslint/visitor-keys": "8.71.1",
+        "@typescript-eslint/scope-manager": "8.70.1",
+        "@typescript-eslint/types": "8.70.1",
+        "@typescript-eslint/typescript-estree": "8.70.1",
+        "@typescript-eslint/visitor-keys": "8.70.1",
        "debug": "^4.4.3"
      },
      "engines": {
@@ -2784,14 +2800,14 @@
      }
    },
    "node_modules/@typescript-eslint/project-service": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.71.1.tgz",
-      "integrity": "sha512-Oijc9RUsohHjncg6iGi7gCtjnEjYt9FWv9u6ygK8uKcHK5eLjLAkqERQ9BaytbpceOFdk6kifPCS/zAZE+A99g==",
+      "version": "8.70.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.70.1.tgz",
+      "integrity": "sha512-62xOgboPfwc3/IgPSX/W6oQR3ZbF04194FPGUGH8HL8iLFHbt/456/8Ph1wLNUgVF+s94FlHoipBsz+v7+LMnA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/tsconfig-utils": "^8.71.1",
-        "@typescript-eslint/types": "^8.71.1",
+        "@typescript-eslint/tsconfig-utils": "^8.70.1",
+        "@typescript-eslint/types": "^8.70.1",
        "debug": "^4.4.3"
      },
      "engines": {
@@ -2824,14 +2840,14 @@
      }
    },
    "node_modules/@typescript-eslint/scope-manager": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.71.1.tgz",
-      "integrity": "sha512-1YUDZXdTnXLlob03SFHBipdyMBsDVm7zoSz0ytTJ39dk5J1TgsTK03VlR/dLXG/RLLUrPcYbD4rp23BmHxHP0w==",
+      "version": "8.70.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.70.1.tgz",
+      "integrity": "sha512-Pa0EeSeAusQc1WbjQMac+YfenewYTBu0KjgYvkUKwhXaHUKbFog23Dm/rp0DX/6tyYOQ3Xl1a+3EcFNZynGHCw==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/types": "8.71.1",
-        "@typescript-eslint/visitor-keys": "8.71.1"
+        "@typescript-eslint/types": "8.70.1",
+        "@typescript-eslint/visitor-keys": "8.70.1"
      },
      "engines": {
        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -2842,9 +2858,9 @@
      }
    },
    "node_modules/@typescript-eslint/tsconfig-utils": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.71.1.tgz",
-      "integrity": "sha512-oTvkml5SxXhgg+WWKhod5qWQICDXtOB+/Hi9VdPKFAANJ2b7YOgMffgvzXuqog7R6A/JtrzRf128dsxummyWhg==",
+      "version": "8.70.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.70.1.tgz",
+      "integrity": "sha512-jumze1fPI+sDOaM2TWGQdn39PDxTr7TZGeuyLkAbNyx2vtMT3uRnVKChN0hfht5V2TugphJzF6bYXvBcE09qqg==",
      "dev": true,
      "license": "MIT",
      "engines": {
@@ -2859,15 +2875,15 @@
      }
    },
    "node_modules/@typescript-eslint/type-utils": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.71.1.tgz",
-      "integrity": "sha512-kH3t3jZCYv2PZSBEWPKTariLrCaoF1CLoPitYFBJOhAGEwWnSRAtGEifrfrpBa4K9JlwWNZotgA5w3/wLSk/FQ==",
+      "version": "8.70.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.70.1.tgz",
+      "integrity": "sha512-7zKTnyvaVWqzLZHPFQtX1hVHqgkMC+WebPWakNCSyrQVbIP1AM0L0TlBZtACldIRb6PptI8Odk+jyZ5kP3B1VA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/types": "8.71.1",
-        "@typescript-eslint/typescript-estree": "8.71.1",
-        "@typescript-eslint/utils": "8.71.1",
+        "@typescript-eslint/types": "8.70.1",
+        "@typescript-eslint/typescript-estree": "8.70.1",
+        "@typescript-eslint/utils": "8.70.1",
        "debug": "^4.4.3",
        "ts-api-utils": "^2.5.0"
      },
@@ -2902,9 +2918,9 @@
      }
    },
    "node_modules/@typescript-eslint/types": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.71.1.tgz",
-      "integrity": "sha512-ybYnPTUwg3VQQOFEiBPLs8Jxl1ry2vXdn1kVKguomBbvxpetdu3MKTNDqFNUrlG8ylP9MpZosmXMFYlGQHk1oQ==",
+      "version": "8.70.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.70.1.tgz",
+      "integrity": "sha512-Dm1ypdhhrGCTyyehxElhgJ6kgk8MVCv5qXdoOVqPr1uqk42jX8KjrZqhROvdShczA8qrDoYiOWn1ykWlx2k81Q==",
      "dev": true,
      "license": "MIT",
      "engines": {
@@ -2916,16 +2932,16 @@
      }
    },
    "node_modules/@typescript-eslint/typescript-estree": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.71.1.tgz",
-      "integrity": "sha512-pSKSEK1JJpHs6KiKVtABCE4iJK5d7FLFzDXQNBQ2oRY7LEd3UwOt3TZemTgu9syTIf56dJWlTn/pdmrO9oKUXQ==",
+      "version": "8.70.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.70.1.tgz",
+      "integrity": "sha512-TU8PwyGN0PQJUcE96mw8eCQ44SmxGdQlJmlWakHaHQ15eIuuvye5yNtmh/i6oS88jzXVQB71xdNkbkB/fMwL0g==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/project-service": "8.71.1",
-        "@typescript-eslint/tsconfig-utils": "8.71.1",
-        "@typescript-eslint/types": "8.71.1",
-        "@typescript-eslint/visitor-keys": "8.71.1",
+        "@typescript-eslint/project-service": "8.70.1",
+        "@typescript-eslint/tsconfig-utils": "8.70.1",
+        "@typescript-eslint/types": "8.70.1",
+        "@typescript-eslint/visitor-keys": "8.70.1",
        "debug": "^4.4.3",
        "minimatch": "^10.2.2",
        "semver": "^7.7.3",
@@ -3001,16 +3017,16 @@
      }
    },
    "node_modules/@typescript-eslint/utils": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.71.1.tgz",
-      "integrity": "sha512-CBjT6gfAz3DW2j9Q4moFnqt208Aq+506sVGXfpRcyAeqn0EpayL0mjdWoCO2t3RC7GewNrFxdeehuEaPg6DMzQ==",
+      "version": "8.70.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.70.1.tgz",
+      "integrity": "sha512-Esgul8MsnKnRLdYU2Eb2cRV9bS5HJYtKj1ByJnOzzG2M58DGdSUQ1jUuILxipqcpB2h9WLrbD5GijIWUjX/Tqw==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
        "@eslint-community/eslint-utils": "^4.9.1",
-        "@typescript-eslint/scope-manager": "8.71.1",
-        "@typescript-eslint/types": "8.71.1",
-        "@typescript-eslint/typescript-estree": "8.71.1"
+        "@typescript-eslint/scope-manager": "8.70.1",
+        "@typescript-eslint/types": "8.70.1",
+        "@typescript-eslint/typescript-estree": "8.70.1"
      },
      "engines": {
        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -3025,13 +3041,13 @@
      }
    },
    "node_modules/@typescript-eslint/visitor-keys": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.71.1.tgz",
-      "integrity": "sha512-0GxiUGqMU0qXJt58cBsiG3DP8lUmBaFo2vChtUX+CT7PnR3v/VGLLrzVP4K9r1lNiZXjHYefMBbPunplr09v6w==",
+      "version": "8.70.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.70.1.tgz",
+      "integrity": "sha512-Vwj9lUIW5Xq3wQ9w6gv3R86g1hMK8f2zNOdGTAgeXUMMXFK78G9ruCjjqutHMNJc0+CH7LYRnHeUB9IT8wFmcw==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/types": "8.71.1",
+        "@typescript-eslint/types": "8.70.1",
        "eslint-visitor-keys": "^5.0.0"
      },
      "engines": {
@@ -5365,15 +5381,15 @@
      }
    },
    "node_modules/eslint-plugin-jsdoc": {
-      "version": "65.2.0",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-jsdoc/-/eslint-plugin-jsdoc-65.2.0.tgz",
-      "integrity": "sha512-IMZaNwdDa5otUQYGWN1pzywZLsGKswitvFFNhcO8IOsBfaWpWIDXYuZh2sYhe9MNyKN9hz0YryOFaKdpbTP5Bw==",
+      "version": "64.5.4",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-jsdoc/-/eslint-plugin-jsdoc-64.5.4.tgz",
+      "integrity": "sha512-xfRhXPSSWT612muJ6XTvxuVJ8zYHv99qNgBqPVqF28aSqoy4s4XbSkrWXnYA2hl5ejC02yEpk6fqkj3BmJ6Xbg==",
      "dev": true,
      "license": "BSD-3-Clause",
      "dependencies": {
        "@es-joy/jsdoccomment": "~0.98.0",
        "@es-joy/resolve.exports": "1.2.0",
-        "@typescript-eslint/utils": "^8.70.1",
+        "@typescript-eslint/utils": "^8.70.0",
        "are-docs-informative": "^0.1.1",
        "comment-parser": "1.4.9",
        "debug": "^4.4.3",
@@ -5801,7 +5817,6 @@
    },
    "node_modules/fast-deep-equal": {
      "version": "3.1.3",
-      "dev": true,
      "license": "MIT"
    },
    "node_modules/fast-diff": {
@@ -5992,9 +6007,9 @@
      "license": "ISC"
    },
    "node_modules/follow-redirects": {
-      "version": "1.16.1",
-      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.1.tgz",
-      "integrity": "sha512-FNvFGzoMLWmE6Yj9spb/zjd7yiNCHiAW9/Tg9CXrQ8wuu32HtlJOwWO11OJafl5FfY3DxTdQ0vj42zU1kvv5jg==",
+      "version": "1.16.0",
+      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.0.tgz",
+      "integrity": "sha512-y5rN/uOsadFT/JfYwhxRS5R7Qce+g3zG97+JrtFZlC9klX/W5hD7iiLzScI4nZqUS7DNUdhPgw4xI8W2LuXlUw==",
      "funding": [
        {
          "type": "individual",
@@ -6278,9 +6293,9 @@
      }
    },
    "node_modules/globals": {
-      "version": "17.13.0",
-      "resolved": "https://registry.npmjs.org/globals/-/globals-17.13.0.tgz",
-      "integrity": "sha512-RwMTC61u7hrG3ZJMkZQOK4JLJrKS8QtoTii63EmWvFXHqycY9FObBJQCbsLxSO8kjKhWE5kV1GC+Vb1g3RI0Zg==",
+      "version": "17.12.0",
+      "resolved": "https://registry.npmjs.org/globals/-/globals-17.12.0.tgz",
+      "integrity": "sha512-cezEd/DTyyht9cvSSURyygXPfy04GtWO/5e6ZPvH7fCtjKz9PYOmuawphw1Ctd1f6C+5JypXfGD7ahNMXvevBA==",
      "dev": true,
      "license": "MIT",
      "engines": {
@@ -7121,9 +7136,9 @@
      }
    },
    "node_modules/js-yaml": {
-      "version": "5.4.3",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.4.3.tgz",
-      "integrity": "sha512-yzzNtgczwgoVHNigCyKTXcQJU4Y8t/ikU4UxXW0BvrLfHTGWZhsNcOT2s/a7vn81/4KqVnNmHjaUEPlvWnNwVw==",
+      "version": "5.4.2",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.4.2.tgz",
+      "integrity": "sha512-m+aqu+LwO1O6sIopafj8HUVl5aawITwZQe/yHpMCKjaWBaA/d07B/QdMb3529REftiU+RMMHL3Vlsw3hON7vWg==",
      "funding": [
        {
          "type": "github",
@@ -7479,9 +7494,9 @@
      }
    },
    "node_modules/mdast-util-from-markdown": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/mdast-util-from-markdown/-/mdast-util-from-markdown-2.1.0.tgz",
-      "integrity": "sha512-KRLgmPaP2H1ul2bpoJkOS+9pAcDAAj9Nu1mqLnh8NLeJG5tlvj42TH80PIGBpROWlRXLk0lDrWNuZCFy/tsB4A==",
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/mdast-util-from-markdown/-/mdast-util-from-markdown-2.0.3.tgz",
+      "integrity": "sha512-W4mAWTvSlKvf8L6J+VN9yLSqQ9AOAAvHuoDAmPkz4dHf553m5gVj2ejadHJhoJmcmxEnOv6Pa8XJhpxE93kb8Q==",
      "license": "MIT",
      "dependencies": {
        "@types/mdast": "^4.0.0",
@@ -9981,16 +9996,16 @@
      }
    },
    "node_modules/typescript-eslint": {
-      "version": "8.71.1",
-      "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.71.1.tgz",
-      "integrity": "sha512-oiNVPC3/NbV1FpaHU07l8O6ynqG9v4PAiW2WvTrAmZdR0f2HI/gE668ElMLCK7Xbsu5k2fK5C4fXNiq05j7/nQ==",
+      "version": "8.70.1",
+      "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.70.1.tgz",
+      "integrity": "sha512-AcWG7KDjZ2THNXsgwttMaGmzVi0VFRlFYfqFHYQRbDpF3owuYbuiL8c7UUrd2k8s3PoSfIQrWfrGXfcElrWLYA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/eslint-plugin": "8.71.1",
-        "@typescript-eslint/parser": "8.71.1",
-        "@typescript-eslint/typescript-estree": "8.71.1",
-        "@typescript-eslint/utils": "8.71.1"
+        "@typescript-eslint/eslint-plugin": "8.70.1",
+        "@typescript-eslint/parser": "8.70.1",
+        "@typescript-eslint/typescript-estree": "8.70.1",
+        "@typescript-eslint/utils": "8.70.1"
      },
      "engines": {
        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -10485,10 +10500,10 @@
        "@actions/core": "^2.0.3",
        "@actions/github": "^8.0.1",
        "@octokit/core": "^7.0.8",
-        "@octokit/plugin-paginate-rest": ">=16.0.0",
+        "@octokit/plugin-paginate-rest": ">=15.0.0",
        "@octokit/plugin-rest-endpoint-methods": "^18.0.0",
        "lite-matter": "^0.1.2",
-        "mdast-util-from-markdown": "^2.1.0",
+        "mdast-util-from-markdown": "^2.0.3",
        "semver": "^7.8.5",
        "yaml": "^2.9.1"
      },
@@ -1,6 +1,6 @@
 {
  "name": "codeql",
-  "version": "4.39.1",
+  "version": "3.38.3",
  "private": true,
  "description": "CodeQL action",
  "scripts": {
@@ -22,7 +22,7 @@
  "dependencies": {
    "@actions/artifact": "^5.0.3",
    "@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2",
-    "@actions/cache": "^5.3.0",
+    "@actions/cache": "^5.2.0",
    "@actions/core": "^2.0.3",
    "@actions/exec": "^2.0.0",
    "@actions/github": "^8.0.1",
@@ -31,14 +31,15 @@
    "@actions/io": "^2.0.0",
    "@actions/tool-cache": "^3.0.1",
    "@octokit/core": "^7.0.8",
-    "@octokit/plugin-paginate-rest": "^16.0.0",
+    "@octokit/plugin-paginate-rest": "^15.0.0",
    "@octokit/plugin-rest-endpoint-methods": "^18.0.0",
    "@octokit/plugin-retry": "^8.1.1",
    "archiver": "^8.0.0",
-    "follow-redirects": "^1.16.1",
+    "fast-deep-equal": "^3.1.3",
+    "follow-redirects": "^1.16.0",
    "get-folder-size": "^5.0.0",
    "https-proxy-agent": "^7.0.6",
-    "js-yaml": "^5.4.3",
+    "js-yaml": "^5.4.2",
    "jsonschema": "1.5.0",
    "long": "^5.3.2",
    "node-forge": "^1.4.0",
@@ -65,14 +66,14 @@
    "eslint-import-resolver-typescript": "^4.4.5",
    "eslint-plugin-github": "^6.1.2",
    "eslint-plugin-import-x": "^4.17.1",
-    "eslint-plugin-jsdoc": "^65.2.0",
+    "eslint-plugin-jsdoc": "^64.5.4",
    "eslint-plugin-no-async-foreach": "^0.1.1",
    "glob": "^13.0.6",
-    "globals": "^17.13.0",
+    "globals": "^17.12.0",
    "nock": "^14.0.17",
    "sinon": "^22.1.0",
    "typescript": "^6.0.3",
-    "typescript-eslint": "^8.71.1"
+    "typescript-eslint": "^8.70.1"
  },
  "overrides": {
    "@actions/tool-cache": {
@@ -154,6 +154,26 @@ await describe("isValidChangenoteFile", async () => {
    assert.equal(isValidChangenoteFile("non-existent-file.md"), false);
  });

+  await it("rejects invalid filename", async () => {
+    await withTmpFile(
+      "fix-bug.md",
+      "---\ncategory: fix\n---\n- Fixed a bug\n",
+      (filePath) => {
+        assert.equal(isValidChangenoteFile(filePath), false);
+      },
+    );
+  });
+
+  await it("rejects missing frontmatter", async () => {
+    await withTmpFile(
+      "2026-01-01-fix-bug.md",
+      "- Fixed a bug\n",
+      (filePath) => {
+        assert.equal(isValidChangenoteFile(filePath), false);
+      },
+    );
+  });
+
  await it("rejects invalid Markdown", async () => {
    await withTmpFile(
      "2026-01-01-fix-bug.md",
@@ -1,4 +1,5 @@
 import * as fs from "node:fs";
+import * as path from "node:path";

 import { matter } from "lite-matter";
 import type { List, ListItem } from "mdast";
@@ -94,7 +95,21 @@ export function isValidChangenoteFile(filename: string): boolean {
    return false;
  }

-  const { content } = matter(fileData);
+  const { data: frontmatter, content } = matter(fileData);
+
+  if (!isValidChangenoteFilename(path.basename(filename))) {
+    isValid = false;
+    console.error(
+      `${filename}: invalid filename; must match pattern YYYY-MM-DD-id.md`,
+    );
+  }
+  if (!hasValidChangenoteCategory(frontmatter)) {
+    isValid = false;
+    const categories = Object.keys(VALID_CHANGE_NOTE_CATEGORIES).join(", ");
+    console.error(
+      `${filename}: invalid category; must be one of: ${categories}`,
+    );
+  }
  if (!isValidChangenoteContent(content)) {
    isValid = false;
    console.error(
@@ -28,12 +28,12 @@ interface ChangenoteFile {

 /**
 * Returns the absolute file paths of all files in
- * {@link CHANGENOTES_DIR} (except ".gitkeep" and "README.md").
+ * {@link CHANGENOTES_DIR} (except ".gitkeep").
 * */
 function listUnreleasedChangenoteDir(): string[] {
  return fs
    .readdirSync(CHANGENOTES_DIR)
-    .filter((name) => ![".gitkeep", "README.md"].includes(name))
+    .filter((name) => name !== ".gitkeep")
    .map((name) => path.join(CHANGENOTES_DIR, name));
 }

@@ -50,28 +50,6 @@ function getChangenotes(): ChangenoteFile[] {
  });
 }

-/**
- * Populates the '[UNRELEASED]' section of CHANGELOG.md with the contents
- * of the changenotes in {@link CHANGENOTES_DIR} and then deletes those changenotes.
- * @param contents The contents of CHANGELOG.md
- * @returns The updated contents of CHANGELOG.md
- */
-export function transferChangenotesToChangelog(contents: string): string {
-  const changenotes = getChangenotes();
-  const changenoteBodies = changenotes.map((c) => c.content.trim());
-  const changenotePaths = changenotes.map((c) => c.absolutePath);
-
-  const changelog = parseChangelog(contents);
-  addBodyLinesToUnreleasedSection(changelog, changenoteBodies);
-  const updatedChangelog = renderChangelog(changelog);
-
-  for (const p of changenotePaths) {
-    fs.unlinkSync(p);
-  }
-
-  return updatedChangelog;
-}
-
 const entryPoint = process.argv[1];
 if (entryPoint && import.meta.url === pathToFileURL(entryPoint).href) {
  try {
@@ -113,13 +91,26 @@ function usage(): ExitCode {

 function assemble(): ExitCode {
  try {
+    const changenotes = getChangenotes();
+    const changenoteBodies = changenotes.map((c) => c.content);
+    const changenotePaths = changenotes.map((c) => c.absolutePath);
+
    withChangelog((contents) => {
-      return transferChangenotesToChangelog(contents);
+      const changelog = parseChangelog(contents);
+      addBodyLinesToUnreleasedSection(changelog, changenoteBodies);
+      return renderChangelog(changelog);
    }, {});
+
+    // Delete changenotes only after successful processing.
+    for (const p of changenotePaths) {
+      fs.unlinkSync(p);
+    }
+
    return ExitCode.Success;
  } catch (e) {
    console.error("Failed to assemble changenotes to 'CHANGELOG.md'", e);
  }
+
  return ExitCode.Failure;
 }

@@ -46,7 +46,7 @@ steps:
      post-processed-sarif-path: "${{ runner.temp }}/post-processed"

  - name: Upload SARIF files
-    uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+    uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
    with:
      name: |
        analysis-kinds-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }}
@@ -54,7 +54,7 @@ steps:
      retention-days: 7

  - name: Upload post-processed SARIF
-    uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+    uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
    with:
      name: |
        post-processed-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }}
@@ -14,7 +14,7 @@ steps:
      output: "${{ runner.temp }}/results"
      upload-database: false
  - name: Upload SARIF
-    uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+    uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
    with:
      name: config-export-${{ matrix.os }}-${{ matrix.version }}.sarif.json
      path: "${{ runner.temp }}/results/javascript.sarif"
@@ -27,7 +27,7 @@ steps:
      output: "${{ runner.temp }}/results"
      upload-database: false
  - name: Upload SARIF
-    uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+    uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
    with:
      name: diagnostics-export-${{ matrix.os }}-${{ matrix.version }}.sarif.json
      path: "${{ runner.temp }}/results/javascript.sarif"
@@ -27,7 +27,7 @@ steps:
    with:
      output: "${{ runner.temp }}/results"
  - name: Upload SARIF
-    uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+    uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
    with:
      name: with-baseline-information-${{ matrix.os }}-${{ matrix.version }}.sarif.json
      path: "${{ runner.temp }}/results/javascript.sarif"
@@ -12,7 +12,7 @@ steps:
    with:
      output: "${{ runner.temp }}/results"
  - name: Upload SARIF
-    uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+    uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
    with:
      name: ${{ matrix.os }}-${{ matrix.version }}.sarif.json
      path: "${{ runner.temp }}/results/javascript.sarif"
@@ -10,6 +10,7 @@ operatingSystems:
  - os: macos
    runner-image: macos-15-xlarge
    codeql-versions:
+      - stable-v2.19.4
      - stable-v2.20.7
      - stable-v2.21.4
      - stable-v2.22.4
@@ -1,8 +1,8 @@
 name: "Rust analysis"
 description: "Tests creation of a Rust database"
 versions:
-  # oldest CodeQL version supported by the Action, where Rust support is experimental and requires the Action to set `CODEQL_ENABLE_EXPERIMENTAL_FEATURES`
-  - stable-v2.20.7
+  # experimental rust support introduced, requires action to set `CODEQL_ENABLE_EXPERIMENTAL_FEATURES`
+  - stable-v2.19.4
  # first public preview version
  - stable-v2.22.1
  - linked
@@ -6,10 +6,10 @@
    "@actions/core": "^2.0.3",
    "@actions/github": "^8.0.1",
    "@octokit/core": "^7.0.8",
-    "@octokit/plugin-paginate-rest": ">=16.0.0",
+    "@octokit/plugin-paginate-rest": ">=15.0.0",
    "@octokit/plugin-rest-endpoint-methods": "^18.0.0",
    "lite-matter": "^0.1.2",
-    "mdast-util-from-markdown": "^2.1.0",
+    "mdast-util-from-markdown": "^2.0.3",
    "semver": "^7.8.5",
    "yaml": "^2.9.1"
  },
@@ -136,6 +136,8 @@ type LanguageSetups = Partial<Record<BuiltInLanguage, LanguageSetup>>;
 // The default set of CodeQL Bundle versions to use for the PR checks.
 const defaultTestVersions = [
  // The oldest supported CodeQL version. If bumping, update `CODEQL_MINIMUM_VERSION` in `codeql.ts`
+  "stable-v2.19.4",
+  // The last CodeQL release in the 2.20 series.
  "stable-v2.20.7",
  // The last CodeQL release in the 2.21 series.
  "stable-v2.21.4",
@@ -145,8 +147,6 @@ const defaultTestVersions = [
  "stable-v2.23.9",
  // The last CodeQL release in the 2.24 series.
  "stable-v2.24.3",
-  // The last CodeQL release in the 2.25 series.
-  "stable-v2.25.6",
  // The default version of CodeQL for Dotcom, as determined by feature flags.
  "default",
  // The version of CodeQL shipped with the Action in `defaults.json`. During the release process
@@ -215,8 +215,8 @@ const languageSetups: LanguageSetups = {
        name: "Install Node.js",
        uses: pinnedUses(
          "actions/setup-node",
-          "949feb2413d6458794dcd2491c4babbbce0c15c1",
-          "v7.1.0",
+          "820762786026740c76f36085b0efc47a31fe5020",
+          "v7.0.0",
        ),
        with: {
          "node-version": defaultLanguageVersions.javascript,
@@ -23,13 +23,7 @@ import { parseArgs } from "node:util";

 import { type ApiClient, getApiClient } from "./api-client";
 import * as changelog from "./changelog";
-import { transferChangenotesToChangelog } from "./changenotes";
-import {
-  CHANGELOG_FILE,
-  CHANGENOTES_DIR,
-  DryRunOption,
-  REPO_ROOT,
-} from "./config";
+import { DryRunOption, REPO_ROOT } from "./config";
 import {
  getCurrentVersion,
  replaceVersionInPackageJson,
@@ -699,14 +693,11 @@ export async function prepareNewBranch(

    console.log("Updating changelog");
    changelog.withChangelog(
-      (contents) => {
-        const populatedContents = transferChangenotesToChangelog(contents);
-        return changelog.setVersionAndDate(version, populatedContents);
-      },
+      (contents) => changelog.setVersionAndDate(version, contents),
      { ...options, initChangelog: true },
    );

-    runGit(["add", CHANGELOG_FILE, CHANGENOTES_DIR], {
+    runGit(["add", "CHANGELOG.md"], {
      dryRun: options.dryRun,
    });
    runGit(["commit", "-m", `Update changelog for v${version}`], {
@@ -23,8 +23,7 @@ predicate isSafeForDefaultSetup(string envVar) {
      "GITHUB_BASE_REF", "GITHUB_EVENT_NAME", "GITHUB_JOB", "GITHUB_RUN_ATTEMPT", "GITHUB_RUN_ID",
      "GITHUB_SHA", "GITHUB_REPOSITORY", "GITHUB_SERVER_URL", "GITHUB_TOKEN", "GITHUB_WORKFLOW",
      "GITHUB_WORKSPACE", "GOFLAGS", "ImageVersion", "JAVA_TOOL_OPTIONS", "RUNNER_ARCH",
-      "RUNNER_ENVIRONMENT", "RUNNER_NAME", "RUNNER_OS", "RUNNER_TEMP", "RUNNER_TOOL_CACHE",
-      "NODE_ENV"
+      "RUNNER_ENVIRONMENT", "RUNNER_NAME", "RUNNER_OS", "RUNNER_TEMP", "RUNNER_TOOL_CACHE"
    ]
 }

@@ -21,5 +21,5 @@ outputs:
  environment:
    description: The inferred build environment configuration.
 runs:
-  using: node24
+  using: node20
  main: '../lib/resolve-environment-entry.js'
@@ -51,5 +51,5 @@ outputs:
  codeql-version:
    description: The version of the CodeQL binary that was installed.
 runs:
-  using: node24
+  using: node20
  main: '../lib/setup-codeql-entry.js'
@@ -19,24 +19,6 @@ import { getErrorMessage } from "./util";

 setupTests(test);

-for (const [key, displayName] of Object.entries(
-  statusReport.ACTION_DISPLAY_NAMES,
-)) {
-  test(`getDisplayActionName - '${displayName}' instead of '${key}'`, (t) => {
-    t.is(statusReport.getDisplayActionName(key as ActionName), displayName);
-  });
-}
-
-test("getDisplayActionName - returns action name", (t) => {
-  for (const actionName of Object.values(ActionName)) {
-    if (statusReport.ACTION_DISPLAY_NAMES[actionName]) {
-      continue;
-    }
-
-    t.is(statusReport.getDisplayActionName(actionName), actionName);
-  }
-});
-
 interface RunInActionsTestOpts {
  runFn?: () => Promise<any>;
  expectedErrorMessage?: string;
@@ -56,29 +56,6 @@ export interface FeatureState {
 /** Identifies a type of state an Action may have. */
 export type StateFeature = keyof FeatureState;

-/**
- * The `Env` feature implies the availability of the `ReadOnlyEnv` feature.
- *
- * If `T` is `Env`, this returns `Env | ReadOnlyEnv`.
- * Otherwise, it is the identity and returns T.
- */
-type ImpliedFeatures<T extends StateFeature> = T extends "Env"
-  ? "Env" | "ReadOnlyEnv"
-  : T;
-
-/**
- * Given an object type `Obj`, this tries to lookup a corresponding `StateFeature`
- * to which the object type belongs in `FeatureState`. Resolves to `never` if there
- * is no match.
- */
-type FeatureNameFor<Obj extends object> = {
-  [K in StateFeature]: [Obj] extends [FeatureState[K]]
-    ? [FeatureState[K]] extends [Obj]
-      ? K
-      : never
-    : never;
-}[StateFeature];
-
 /** Constructs the intersection of all state types identifies by `Fs`. */
 export type FieldsOf<Fs extends readonly StateFeature[]> = Fs extends []
  ? Record<never, never>
@@ -89,54 +66,8 @@ export type FieldsOf<Fs extends readonly StateFeature[]> = Fs extends []
    ? FeatureState[Head] & FieldsOf<Tail>
    : never;

-/**
- * Symbol used for a field in `ActionState` that carries the type array of state features.
- * This is a Symbol so that it doesn't clash with any property names we might want to have.
- */
-const stateFeatures = Symbol();
-
 /** Describes the state of an Action that has access to the state corresponding to `Fs`. */
-export type ActionState<Fs extends readonly StateFeature[]> = FieldsOf<Fs> & {
-  /**
-   * When given a chance, TypeScript will simplify an `ActionState<Fs>` type as much as possible,
-   * which results in a concrete object type that doesn't mention `Fs`.
-   *
-   * That causes problems for functions which accept `ActionState<Fs>` values, but need to know the
-   * feature keys `Fs`. This property here explicitly captures `Fs` in the concrete object type
-   * that results from simplifying `ActionState<Fs>`.
-   *
-   * This is a function rather than a field, because we want to be able to provide values of type
-   * `ActionState<Fs>` to functions expecting `ActionState<As>` where `As` is a subset of `Fs`.
-   *
-   * Since function types are contravariant in the types of their parameters, using a function
-   * type here allows that to happen.
-   *
-   * Because the field is optional, we don't have to explicitly provide a value
-   * for it anywhere while the type is still inferred.
-   *
-   * `Fs[number]` returns the union of all features in `Fs`. We wrap it in `ImpliedFeatures`
-   * so that `Env` is expanded into `Env | ReadOnlyEnv`, allowing functions that expect the
-   * `ReadOnlyEnv` feature to be provided with an `ActionState` that has the `Env` feature
-   * without requiring this to be made explicit.
-   */
-  readonly [stateFeatures]?: (ts: ImpliedFeatures<Fs[number]>) => void;
-};
-
-/** Extends `state` with an `extra` feature. */
-export function extendActionState<
-  // In first position, so that it can be explicitly provided if `FeatureNameFor`
-  // should not work on `extra`.
-  F extends StateFeature,
-  Fs extends readonly StateFeature[],
-  E extends FeatureState[F],
->(
-  state: ActionState<Fs>,
-  extra: E,
-): ActionState<[...Fs, FeatureNameFor<E> & F]> {
-  return { ...state, ...extra } as unknown as ActionState<
-    [...Fs, FeatureNameFor<E> & F]
-  >;
-}
+export type ActionState<Fs extends readonly StateFeature[]> = FieldsOf<Fs>;

 /** The type of an Action's main entry point. This is a function that is provided
 * with a basic `ActionState` object with features that are always available.
@@ -7,13 +7,12 @@ import {
  isAnalyzingPullRequest,
  isDefaultSetup,
  isDynamicWorkflow,
-  printDebugLogs,
 } from "./actions-util";
 import { computeAutomationID } from "./api-client";
 import { EnvVar } from "./environment";
 import { getRunnerLogger } from "./logging";
-import { RecordingLogger, setupTests } from "./testing-utils";
-import { initializeEnvironment, withTmpDir } from "./util";
+import { setupTests } from "./testing-utils";
+import { initializeEnvironment } from "./util";

 setupTests(test);

@@ -101,21 +100,6 @@ test("computeAutomationID()", async (t) => {
  );
 });

-test("printDebugLogs - doesn't throw when config doesn't have needed properties", async (t) => {
-  const logger = new RecordingLogger();
-  await t.notThrowsAsync(printDebugLogs(logger, {}));
-  await t.notThrowsAsync(printDebugLogs(logger, { languages: [] }));
-  await t.notThrowsAsync(printDebugLogs(logger, { dbLocation: "nowhere" }));
-});
-
-test("printDebugLogs - doesn't throw when language db doesn't exist", async (t) =>
-  withTmpDir(async (tmpDir) => {
-    const logger = new RecordingLogger();
-    await t.notThrowsAsync(
-      printDebugLogs(logger, { dbLocation: tmpDir, languages: ["javascript"] }),
-    );
-  }));
-
 test.serial("getPullRequestBranches() with pull request context", (t) => {
  withMockedContext(
    {
@@ -6,7 +6,7 @@ import * as toolrunner from "@actions/exec/lib/toolrunner";
 import * as github from "@actions/github";
 import * as io from "@actions/io";

-import { hasConfigKey, type Config } from "./config/action-config";
+import type { Config } from "./config-utils";
 import { Env, EnvVar, ActionsEnvVars, ReadOnlyEnv } from "./environment";
 import { Logger } from "./logging";
 import {
@@ -30,6 +30,7 @@ declare const __CODEQL_ACTION_VERSION__: string;
 export interface ActionsEnv {
  getRequiredInput: (name: string) => string;
  getOptionalInput: (name: string) => string | undefined;
+  exportVariable: (name: string, value: string) => void;
 }

 /**
@@ -39,6 +40,7 @@ export function getActionsEnv(): ActionsEnv {
  return {
    getRequiredInput,
    getOptionalInput,
+    exportVariable: core.exportVariable,
  };
 }

@@ -93,7 +95,7 @@ export function getActionVersion(): string {
 *
 * This will be "dynamic" for default setup workflow runs.
 */
-export function getWorkflowEventName(env: ReadOnlyEnv = getEnv()) {
+export function getWorkflowEventName(env: Env = getEnv()) {
  return env.getRequired(ActionsEnvVars.GITHUB_EVENT_NAME);
 }

@@ -101,7 +103,7 @@ export function getWorkflowEventName(env: ReadOnlyEnv = getEnv()) {
 * Returns whether the current workflow is executing a local copy of the Action, e.g. we're running
 * a workflow on the codeql-action repo itself.
 */
-export function isRunningLocalAction(env: ReadOnlyEnv = getEnv()): boolean {
+export function isRunningLocalAction(env: Env = getEnv()): boolean {
  const relativeScriptPath = getRelativeScriptPath(env);
  return (
    relativeScriptPath.startsWith("..") || path.isAbsolute(relativeScriptPath)
@@ -113,14 +115,14 @@ export function isRunningLocalAction(env: ReadOnlyEnv = getEnv()): boolean {
 *
 * This can be used to get the Action's name or tell if we're running a local Action.
 */
-function getRelativeScriptPath(env: ReadOnlyEnv): string {
+function getRelativeScriptPath(env: Env): string {
  const runnerTemp = env.getRequired(ActionsEnvVars.RUNNER_TEMP);
  const actionsDirectory = path.join(path.dirname(runnerTemp), "_actions");
  return path.relative(actionsDirectory, __filename);
 }

 /** Returns the contents of `GITHUB_EVENT_PATH` as a JSON object. */
-export function getWorkflowEvent(env: ReadOnlyEnv = getEnv()): any {
+export function getWorkflowEvent(env: Env = getEnv()): any {
  const eventJsonFile = env.getRequired(ActionsEnvVars.GITHUB_EVENT_PATH);
  try {
    return JSON.parse(fs.readFileSync(eventJsonFile, "utf-8"));
@@ -131,38 +133,28 @@ export function getWorkflowEvent(env: ReadOnlyEnv = getEnv()): any {
  }
 }

-export async function printDebugLogs(logger: Logger, config: Partial<Config>) {
-  if (
-    !hasConfigKey(config, "languages") ||
-    !hasConfigKey(config, "dbLocation")
-  ) {
-    logger.debug(
-      `Not printing debug logs, because the configuration does not include the 'languages' or 'dbLocation' fields.`,
-    );
-    return;
-  }
-
+export async function printDebugLogs(config: Config) {
  for (const language of config.languages) {
    const databaseDirectory = getCodeQLDatabasePath(config, language);
    const logsDirectory = path.join(databaseDirectory, "log");
    if (!doesDirectoryExist(logsDirectory)) {
-      logger.info(`Directory ${logsDirectory} does not exist.`);
+      core.info(`Directory ${logsDirectory} does not exist.`);
      continue; // Skip this language database.
    }

    const walkLogFiles = (dir: string) => {
      const entries = fs.readdirSync(dir, { withFileTypes: true });
      if (entries.length === 0) {
-        logger.info(`No debug logs found at directory ${logsDirectory}.`);
+        core.info(`No debug logs found at directory ${logsDirectory}.`);
      }
      for (const entry of entries) {
        if (entry.isFile()) {
          const absolutePath = path.resolve(dir, entry.name);
-          logger.startGroup(
+          core.startGroup(
            `CodeQL Debug Logs - ${language} - ${entry.name} from file at path ${absolutePath}`,
          );
-          logger.info(fs.readFileSync(absolutePath, "utf-8"));
-          logger.endGroup();
+          process.stdout.write(fs.readFileSync(absolutePath));
+          core.endGroup();
        } else if (entry.isDirectory()) {
          walkLogFiles(path.resolve(dir, entry.name));
        }
@@ -9,6 +9,7 @@ import * as core from "@actions/core";

 import * as actionsUtil from "./actions-util";
 import { getGitHubVersion } from "./api-client";
+import { getCodeQL } from "./codeql";
 import { getConfig } from "./config-utils";
 import * as debugArtifacts from "./debug-artifacts";
 import {
@@ -37,9 +38,12 @@ export async function runWrapper() {
        logger,
      );
      if (config !== undefined) {
+        const codeql = await getCodeQL(logger, config.codeQLCmd);
+        const version = await codeql.getVersion();
        await debugArtifacts.uploadCombinedSarifArtifacts(
          logger,
          config.gitHubVersion.type,
+          version.version,
        );
      }
    }
@@ -45,7 +45,6 @@ test.serial(
      requiredInputStub.withArgs("token").returns("fake-token");
      requiredInputStub.withArgs("upload-database").returns("false");
      requiredInputStub.withArgs("output").returns("out");
-      requiredInputStub.withArgs("checkout_path").returns("");
      const optionalInputStub = sinon.stub(actionsUtil, "getOptionalInput");
      optionalInputStub.withArgs("expect-error").returns("false");
      sinon.stub(api, "getGitHubVersion").resolves(gitHubVersion);
@@ -105,7 +104,6 @@ test.serial(
      requiredInputStub.withArgs("token").returns("fake-token");
      requiredInputStub.withArgs("upload-database").returns("false");
      requiredInputStub.withArgs("output").returns("out");
-      requiredInputStub.withArgs("checkout_path").returns("");
      const optionalInputStub = sinon.stub(actionsUtil, "getOptionalInput");
      optionalInputStub.withArgs("expect-error").returns("false");
      sinon.stub(api, "getGitHubVersion").resolves(gitHubVersion);
@@ -4,18 +4,12 @@ import { performance } from "perf_hooks";

 import * as core from "@actions/core";

-import {
-  Action,
-  ActionState,
-  extendActionState,
-  runInActions,
-} from "./action-common";
+import { Action, ActionState, runInActions } from "./action-common";
 import * as actionsUtil from "./actions-util";
 import * as analyses from "./analyses";
 import {
  CodeQLAnalysisError,
  dbIsFinalized,
-  determineCheckoutPath,
  QueriesStatusReport,
  runFinalize,
  runQueries,
@@ -218,11 +212,13 @@ async function runAutobuildIfLegacyGoWorkflow(config: Config, logger: Logger) {
  await runAutobuild(config, BuiltInLanguage.go, logger);
 }

-async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) {
+async function run({
+  startedAt,
+  logger,
+  actions,
+}: ActionState<["Base", "Logger", "Actions"]>) {
  // To capture errors appropriately, keep as much code within the try-catch as
  // possible, and only use safe functions outside.
-  const startedAt = action.startedAt;
-  const logger = action.logger;

  let uploadResults:
    | Partial<Record<analyses.AnalysisKind, UploadResult>>
@@ -271,6 +267,17 @@ async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) {
      );
    }

+    // Unset the CODEQL_PROXY_* environment variables when using older CodeQL
+    // CLIs, as they are not needed and can cause issues.
+    if (
+      process.env.CODEQL_PROXY_HOST === "" &&
+      !(await util.codeQlVersionAtLeast(codeql, "2.20.7"))
+    ) {
+      delete process.env.CODEQL_PROXY_HOST;
+      delete process.env.CODEQL_PROXY_PORT;
+      delete process.env.CODEQL_PROXY_CA_CERTIFICATE;
+    }
+
    if (actionsUtil.getOptionalInput("cleanup-level")) {
      logger.info(
        "The 'cleanup-level' input is ignored since the CodeQL Action now automatically " +
@@ -280,7 +287,7 @@ async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) {

    const apiDetails = getApiDetails();
    const outputDir = actionsUtil.getRequiredInput("output");
-    action.env.export(EnvVar.SARIF_RESULTS_OUTPUT_DIR, outputDir);
+    core.exportVariable(EnvVar.SARIF_RESULTS_OUTPUT_DIR, outputDir);
    const threads = util.getThreadsFlag(
      actionsUtil.getOptionalInput("threads") || process.env["CODEQL_THREADS"],
      logger,
@@ -304,7 +311,7 @@ async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) {
      logger,
    );

-    const checkoutPath = await determineCheckoutPath(action, config);
+    const checkoutPath = actions.getRequiredInput("checkout_path");

    // Setup diff informed analysis if needed (based on whether init created the file)
    const diffRangePackDir = await setupDiffInformedQueryRun(
@@ -396,13 +403,11 @@ async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) {
      checkoutPath,
    );

-    const actionWithFeatures = extendActionState(action, { features });
-
    // Possibly upload the database bundles for remote queries.
    // Note: Take care with the ordering of this call since databases may be cleaned up
    // at the `overlay` or `clear` level.
    databaseUploadResults = await cleanupAndUploadDatabases(
-      actionWithFeatures,
+      { logger, features },
      repositoryNwo,
      codeql,
      config,
@@ -451,7 +456,7 @@ async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) {
        `expect-error input was set to true but no error was thrown.`,
      );
    }
-    action.env.export(EnvVar.ANALYZE_DID_COMPLETE_SUCCESSFULLY, "true");
+    core.exportVariable(EnvVar.ANALYZE_DID_COMPLETE_SUCCESSFULLY, "true");
  } catch (unwrappedError) {
    const error = util.wrapError(unwrappedError);
    if (
@@ -10,12 +10,10 @@ import {
  resolveQuerySuiteAlias,
  addSarifExtension,
  diffRangeExtensionPackContents,
-  determineCheckoutPath,
 } from "./analyze";
 import { createStubCodeQL } from "./codeql";
 import { defaultSuites } from "./config/db-config";
 import { Feature } from "./feature-flags";
-import * as gitUtils from "./git-utils";
 import { BuiltInLanguage } from "./languages";
 import { getRunnerLogger } from "./logging";
 import {
@@ -23,98 +21,12 @@ import {
  setupActionsVars,
  createFeatures,
  createTestConfig,
-  callee,
 } from "./testing-utils";
 import * as uploadLib from "./upload-lib";
 import * as util from "./util";

 setupTests(test);

-test.serial(
-  "determineCheckoutPath - logs when checkout_path is not in a work tree",
-  async (t) => {
-    const expectedPath = path.resolve("/checkout/path");
-    const target = callee(determineCheckoutPath)
-      .withActions((actions) => {
-        sinon
-          .stub(actions, "getRequiredInput")
-          .withArgs("checkout_path")
-          .returns(expectedPath);
-      })
-      .withArgs(createTestConfig({}));
-    sinon.stub(gitUtils, "getGitRoot").resolves(undefined);
-
-    await target
-      .logs(t, "is not in the work tree of a git repository")
-      .passes(t.is, expectedPath);
-  },
-);
-
-test.serial(
-  "determineCheckoutPath - logs when checkout_path is not a repo root",
-  async (t) => {
-    const expectedPath = path.resolve("/checkout/path");
-    const target = callee(determineCheckoutPath)
-      .withActions((actions) => {
-        sinon
-          .stub(actions, "getRequiredInput")
-          .withArgs("checkout_path")
-          .returns(expectedPath);
-      })
-      .withArgs(createTestConfig({}));
-    sinon.stub(gitUtils, "getGitRoot").resolves("/checkout");
-
-    await target
-      .logs(t, "is not the root of the repository")
-      .passes(t.is, expectedPath);
-  },
-);
-
-test.serial(
-  "determineCheckoutPath - logs when checkout_path is not the same as repo root in config",
-  async (t) => {
-    const expectedPath = path.resolve("/checkout/path");
-    const target = callee(determineCheckoutPath)
-      .withActions((actions) => {
-        sinon
-          .stub(actions, "getRequiredInput")
-          .withArgs("checkout_path")
-          .returns(expectedPath);
-      })
-      .withArgs(createTestConfig({ repositoryRoot: "/some/other/path" }));
-    sinon.stub(gitUtils, "getGitRoot").resolves(expectedPath);
-
-    await target
-      .logs(t, "does not match that found by the 'codeql-action/init' step")
-      .passes(t.is, expectedPath);
-  },
-);
-
-test.serial(
-  "determineCheckoutPath - doesn't log any of the messages when all is as expected",
-  async (t) => {
-    const expectedPath = path.resolve("/checkout/path");
-    const target = callee(determineCheckoutPath)
-      .withActions((actions) => {
-        sinon
-          .stub(actions, "getRequiredInput")
-          .withArgs("checkout_path")
-          .returns(expectedPath);
-      })
-      .withArgs(createTestConfig({ repositoryRoot: expectedPath }));
-    sinon.stub(gitUtils, "getGitRoot").resolves(expectedPath);
-
-    await target
-      .notLogs(
-        t,
-        "is not in the work tree of a git repository",
-        "is not the root of the repository",
-        "does not match that found by the 'codeql-action/init' step",
-      )
-      .passes(t.is, expectedPath);
-  },
-);
-
 /**
 * Checks the status report produced by the analyze Action.
 *
@@ -5,12 +5,10 @@ import { performance } from "perf_hooks";
 import * as io from "@actions/io";
 import * as yaml from "js-yaml";

-import type { ActionState } from "./action-common";
 import { getTemporaryDirectory } from "./actions-util";
 import * as analyses from "./analyses";
 import { setupCppAutobuild } from "./autobuild";
 import { type CodeQL } from "./codeql";
-import type { ActionConfig } from "./config/action-config";
 import { defaultSuites } from "./config/db-config";
 import * as configUtils from "./config-utils";
 import {
@@ -24,7 +22,6 @@ import {
 } from "./diff-informed-analysis-utils";
 import { EnvVar } from "./environment";
 import { FeatureEnablement, Feature } from "./feature-flags";
-import { getGitRoot } from "./git-utils";
 import { BuiltInLanguage, Language } from "./languages";
 import { Logger, withGroupAsync } from "./logging";
 import { OverlayDatabaseMode } from "./overlay/overlay-database-mode";
@@ -89,58 +86,6 @@ export interface QueriesStatusReport
  event_reports?: EventReport[];
 }

-/**
- * Determines the path at which the repository being analysed is checked out at.
- * Returns the value of the required `checkout_path` input and validates that it
- * refers to the root of a repository.
- *
- * @param action The action state.
- * @param config The CodeQL Action configuration state.
- */
-export async function determineCheckoutPath(
-  action: ActionState<["Logger", "Actions"]>,
-  config: configUtils.Config,
-) {
-  const checkoutPathInput = action.actions.getRequiredInput("checkout_path");
-
-  // Try to obtain the root path of the repository and validate that it matches the input.
-  const absCheckoutPathInput = path.resolve(checkoutPathInput);
-  const repositoryRoot = await getGitRoot(absCheckoutPathInput);
-
-  if (repositoryRoot === undefined) {
-    action.logger.warning(
-      [
-        `The directory at '${absCheckoutPathInput}' is not in the work tree of a git repository.`,
-        "If the repository being analyzed is checked out elsewhere,",
-        "you must explicitly set the 'checkout_path' input for the 'codeql-action/analyze' step to",
-        "the checkout path.",
-      ].join(" "),
-    );
-  } else if (repositoryRoot !== absCheckoutPathInput) {
-    action.logger.warning(
-      [
-        `The directory at '${absCheckoutPathInput}' is not the root of the repository ('${repositoryRoot}').`,
-        "Set the 'checkout_path' input for the 'codeql-action/analyze' step to the root path of the checkout.",
-      ].join(" "),
-    );
-  } else if (
-    config.repositoryRoot !== undefined &&
-    repositoryRoot !== config.repositoryRoot
-  ) {
-    // The repository root that was persisted by the `init` step doesn't match the one we have found here.
-    action.logger.warning(
-      [
-        `The repository path at '${repositoryRoot}' does not match that found by the 'codeql-action/init' step: '${config.repositoryRoot}'.`,
-        "Ensure that the 'checkout_path' input for the 'codeql-action/analyze' step is set to the path of the same repository that",
-        "the 'codeql-action/init' step determined. This is either the GitHub Actions workspace or the repository root corresponding to",
-        "the 'source-root' input if that was provided.",
-      ].join(" "),
-    );
-  }
-
-  return absCheckoutPathInput;
-}
-
 async function setupPythonExtractor(logger: Logger) {
  const codeqlPython = process.env["CODEQL_PYTHON"];
  if (codeqlPython === undefined || codeqlPython.length === 0) {
@@ -179,7 +124,7 @@ export async function runExtraction(
          language === BuiltInLanguage.cpp &&
          config.buildMode === BuildMode.Autobuild
        ) {
-          await setupCppAutobuild(logger);
+          await setupCppAutobuild(codeql, logger);
        }

        // The Java and C# `build-mode: none` extractors place dependencies in the
@@ -226,7 +171,7 @@ async function shouldExtractLanguage(
 }

 export function dbIsFinalized(
-  config: ActionConfig<"dbLocation">,
+  config: configUtils.Config,
  language: Language,
  logger: Logger,
 ) {
@@ -8,14 +8,7 @@ import * as actionsUtil from "./actions-util";
 import * as api from "./api-client";
 import { DO_NOT_RETRY_STATUSES } from "./api-client";
 import { ActionsEnvVars, RegistryProxyVars } from "./environment";
-import { GITHUB_DOTCOM_API_URL, GITHUB_DOTCOM_URL } from "./github";
-import {
-  callee,
-  getTestEnv,
-  RecordingLogger,
-  SAMPLE_DOTCOM_API_DETAILS,
-  setupTests,
-} from "./testing-utils";
+import { callee, getTestEnv, setupTests } from "./testing-utils";
 import * as util from "./util";

 setupTests(test);
@@ -291,62 +284,3 @@ test("makeProxyRequestOptions - returns fetch with custom proxy", async (t) => {
    githubUtils.defaults.request,
  );
 });
-
-test.serial(
-  "getApiClientWithExternalAuth constructs clients with or without tokens",
-  (t) => {
-    t.notThrows(() => {
-      api.getApiClientWithExternalAuth(SAMPLE_DOTCOM_API_DETAILS);
-      api.getApiClientWithExternalAuth({
-        ...SAMPLE_DOTCOM_API_DETAILS,
-        auth: undefined,
-      });
-    });
-  },
-);
-
-test("getAuthorizationHeaderFor - returns undefined if there's no token", (t) => {
-  const logger = new RecordingLogger();
-
-  for (const authValue of [undefined, "", "    "]) {
-    const client = new api.InstanceApiClient({
-      ...SAMPLE_DOTCOM_API_DETAILS,
-      auth: authValue,
-    });
-    t.is(
-      client.getAuthorizationHeaderFor(logger, `${GITHUB_DOTCOM_URL}/github`),
-      undefined,
-    );
-  }
-});
-
-test("getAuthorizationHeaderFor - returns header value with token if url is allowed", (t) => {
-  const logger = new RecordingLogger();
-  const client = new api.InstanceApiClient({
-    ...SAMPLE_DOTCOM_API_DETAILS,
-  });
-
-  for (const url of [
-    `${GITHUB_DOTCOM_URL}/github`,
-    `${GITHUB_DOTCOM_API_URL}/github`,
-  ]) {
-    t.is(
-      client.getAuthorizationHeaderFor(logger, url),
-      `token ${SAMPLE_DOTCOM_API_DETAILS.auth}`,
-    );
-  }
-});
-
-test("getAuthorizationHeaderFor - returns undefined if url is not allowed", (t) => {
-  const logger = new RecordingLogger();
-  const client = new api.InstanceApiClient({
-    ...SAMPLE_DOTCOM_API_DETAILS,
-  });
-
-  for (const url of [
-    `https://localhost/github`,
-    `https://api.localhost/github`,
-  ]) {
-    t.is(client.getAuthorizationHeaderFor(logger, url), undefined);
-  }
-});
@@ -1,6 +1,5 @@
 import * as core from "@actions/core";
 import * as githubUtils from "@actions/github/lib/utils";
-import type { OctokitOptions } from "@octokit/core";
 import * as retry from "@octokit/plugin-retry";
 import { RequestRequestOptions } from "@octokit/types";
 import {
@@ -13,34 +12,25 @@ import {
 import type { ActionState } from "./action-common";
 import { getActionVersion, getRequiredInput } from "./actions-util";
 import {
+  ActionsEnvVars,
  EnvVar,
  ReadOnlyEnv,
  RegistryProxyVars,
  getEnv,
-  exportEnvVar,
-  ActionsEnvVars,
 } from "./environment";
-import {
-  getCurrentInstance,
-  getDotcomInstance,
-  GITHUB_DOTCOM_URL,
-  parseGitHubUrl,
-  type GitHubApiCombinedDetails,
-  type GitHubApiDetails,
-} from "./github";
 import { Logger } from "./logging";
 import { getRepositoryNwo, RepositoryNwo } from "./repository";
 import {
  asHTTPError,
  ConfigurationError,
  getRequiredEnvParam,
+  GITHUB_DOTCOM_URL,
  GitHubVariant,
  GitHubVersion,
+  parseGitHubUrl,
  parseMatrixInput,
 } from "./util";

-export type { GitHubApiDetails, GitHubApiCombinedDetails } from "./github";
-
 const GITHUB_ENTERPRISE_VERSION_HEADER = "x-github-enterprise-version";

 /**
@@ -52,6 +42,21 @@ const GITHUB_ENTERPRISE_VERSION_HEADER = "x-github-enterprise-version";
 */
 export const DO_NOT_RETRY_STATUSES = [400, 410, 422, 451];

+export type GitHubApiCombinedDetails = GitHubApiDetails &
+  GitHubApiExternalRepoDetails;
+
+export interface GitHubApiDetails {
+  auth: string;
+  url: string;
+  apiURL: string | undefined;
+}
+
+export interface GitHubApiExternalRepoDetails {
+  externalRepoAuth?: string;
+  url: string;
+  apiURL: string | undefined;
+}
+
 /**
 * Gets the configuration for the private registry authentication proxy,
 * if it is available in the environment.
@@ -122,66 +127,6 @@ export function makeProxyRequestOptions(
 /** The type of GitHub API client we use. */
 export type ApiClient = InstanceType<typeof githubUtils.GitHub>;

-/**
- * Encapsulates a {@link GitHubApiCombinedDetails} along with operations which ensure that any credentials
- * are only used with the GitHub instance that is represented by the {@link GitHubApiCombinedDetails} value.
- */
-export class InstanceApiClient {
-  private readonly client: ApiClient;
-  private readonly apiDetails: GitHubApiCombinedDetails;
-  private readonly authorizationHeader: string | undefined;
-
-  constructor(
-    apiDetails: GitHubApiCombinedDetails,
-    clientOptions: CreateApiClientOptions = {},
-  ) {
-    this.apiDetails = apiDetails;
-    this.client = createApiClientWithDetails(apiDetails, clientOptions);
-
-    // Compute the Authorization header value if we have a token.
-    const token = this.apiDetails.auth?.trim();
-    if (token !== undefined && token !== "") {
-      this.authorizationHeader = `token ${token}`;
-    }
-  }
-
-  /**
-   * In most cases, we use an {@link ApiClient} which automatically handles auth for requests
-   * made with it and this method is not needed and should not be used in that setting.
-   *
-   * In some cases, we need to make requests that can't go through an {@link ApiClient}, but still
-   * require auth. For example, this is the case when using the `toolcache` module to download
-   * files. For these cases, this method gets a value for the `Authorization` header for a request
-   * to `url`; or `undefined` if the `Authorization` header should not be set for `url`.
-   *
-   * @param logger The logger to use for debugging messages.
-   * @param url The URL for which we want to add an `Authorization` header.
-   */
-  public getAuthorizationHeaderFor(
-    logger: Logger,
-    url: string,
-  ): string | undefined {
-    // We don't have to check the `url` if we don't have a token to begin with.
-    if (this.authorizationHeader === undefined) {
-      return undefined;
-    }
-
-    // We only want to provide an authorization header if we are downloading
-    // from the same GitHub instance the Action is running on.
-    // This avoids leaking Enterprise tokens to dotcom.
-    if (
-      url.startsWith(`${this.apiDetails.url}/`) ||
-      (this.apiDetails.apiURL && url.startsWith(`${this.apiDetails.apiURL}/`))
-    ) {
-      logger.debug(`Providing an authorization token.`);
-      return this.authorizationHeader;
-    }
-
-    logger.debug(`Not using an authorization token.`);
-    return undefined;
-  }
-}
-
 /** Options for `createApiClientWithDetails`. */
 interface CreateApiClientOptions {
  allowExternal?: boolean;
@@ -193,82 +138,37 @@ function createApiClientWithDetails(
  { allowExternal = false, proxy = undefined }: CreateApiClientOptions = {},
 ): ApiClient {
  const auth =
-    allowExternal && apiDetails.externalRepoAuth !== undefined
-      ? apiDetails.externalRepoAuth
-      : apiDetails.auth;
+    (allowExternal && apiDetails.externalRepoAuth) || apiDetails.auth;
  const retryingOctokit = githubUtils.GitHub.plugin(retry.retry);
  const requestOptions = makeProxyRequestOptions(proxy);
-
-  const opts: OctokitOptions = {
-    auth:
-      auth !== undefined && auth.trim() !== "" ? `token ${auth}` : undefined,
-    baseUrl: apiDetails.apiURL,
-    userAgent: `CodeQL-Action/${getActionVersion()}`,
-    log: {
-      debug: core.debug,
-      info: core.info,
-      warn: core.warning,
-      error: core.error,
-    },
-    request: requestOptions,
-    retry: {
-      doNotRetry: DO_NOT_RETRY_STATUSES,
-    },
-  };
-
-  return new retryingOctokit(opts);
+  return new retryingOctokit(
+    githubUtils.getOctokitOptions(auth, {
+      baseUrl: apiDetails.apiURL,
+      userAgent: `CodeQL-Action/${getActionVersion()}`,
+      log: {
+        debug: core.debug,
+        info: core.info,
+        warn: core.warning,
+        error: core.error,
+      },
+      request: requestOptions,
+      retry: {
+        doNotRetry: DO_NOT_RETRY_STATUSES,
+      },
+    }),
+  );
 }

-/**
- * Gets a `GitHubApiDetails` object describing the GitHub instance we are currently running on.
- *
- * @param env The environment variables to read.
- */
 export function getApiDetails(env: ReadOnlyEnv = getEnv()): GitHubApiDetails {
  return {
    auth: getRequiredInput("token"),
-    ...getCurrentInstance(env),
+    url: env.getRequired(ActionsEnvVars.GITHUB_SERVER_URL),
+    apiURL: env.getRequired(ActionsEnvVars.GITHUB_API_URL),
  };
 }

-/**
- * Constructs an {@link ApiClient} using {@link apiDetails}.
- *
- * If {@link apiDetails} is not specified, then the GitHub instance URLs are taken from {@link env}
- * and the auth token is taken from the `token` input.
- *
- * If {@link env} is not specified, then the process environment is used.
- *
- * @param env The environment to obtain the GitHub instance URLs from.
- * @param apiDetails The {@link GitHubApiDetails} to construct the {@link ApiClient} for.
- */
-export function getApiClient(
-  env: ReadOnlyEnv = getEnv(),
-  apiDetails?: GitHubApiDetails,
-) {
-  return createApiClientWithDetails(apiDetails ?? getApiDetails(env));
-}
-
-/*
- * Gets a `GitHubApiDetails` object describing the GitHub Dotcom instance.
- *
- * @param env The environment variables to read.
- */
-export function getDotcomApiDetails(env: ReadOnlyEnv): GitHubApiDetails {
-  // If we are currently running on dotcom, then just call `getApiDetails` which will
-  // construct the appropriate `GitHubApiDetails` from the environment and include the
-  // value of the `token` input. The `token` input relates to the GitHub instance that
-  // we are running on only. Therefore, if we are not currently running on dotcom,
-  // then we construct `GitHubApiDetails` without the `token` value and using the
-  // hard-coded instance and API URLs.
-  if (env.getRequired(ActionsEnvVars.GITHUB_SERVER_URL) === GITHUB_DOTCOM_URL) {
-    return getApiDetails(env);
-  } else {
-    return {
-      auth: undefined,
-      ...getDotcomInstance(),
-    };
-  }
+export function getApiClient(env: ReadOnlyEnv = getEnv()) {
+  return createApiClientWithDetails(getApiDetails(env));
 }

 export function getApiClientWithExternalAuth(
@@ -278,6 +178,36 @@ export function getApiClientWithExternalAuth(
  return createApiClientWithDetails(apiDetails, { allowExternal: true, proxy });
 }

+/**
+ * Gets a value for the `Authorization` header for a request to `url`; or `undefined` if the
+ * `Authorization` header should not be set for `url`.
+ *
+ * @param logger The logger to use for debugging messages.
+ * @param apiDetails Details of the GitHub API we are using.
+ * @param url The URL for which we want to add an `Authorization` header.
+ *
+ * @returns The value for the `Authorization` header or `undefined` if it shouldn't be populated.
+ */
+export function getAuthorizationHeaderFor(
+  logger: Logger,
+  apiDetails: GitHubApiDetails,
+  url: string,
+): string | undefined {
+  // We only want to provide an authorization header if we are downloading
+  // from the same GitHub instance the Action is running on.
+  // This avoids leaking Enterprise tokens to dotcom.
+  if (
+    url.startsWith(`${apiDetails.url}/`) ||
+    (apiDetails.apiURL && url.startsWith(`${apiDetails.apiURL}/`))
+  ) {
+    logger.debug(`Providing an authorization token.`);
+    return `token ${apiDetails.auth}`;
+  }
+
+  logger.debug(`Not using an authorization token.`);
+  return undefined;
+}
+
 let cachedGitHubVersion: GitHubVersion | undefined = undefined;

 export async function getGitHubVersionFromApi(
@@ -386,7 +316,7 @@ export async function getAnalysisKey(): Promise<string> {
  const jobName = getRequiredEnvParam("GITHUB_JOB");

  analysisKey = `${workflowPath}:${jobName}`;
-  exportEnvVar(EnvVar.ANALYSIS_KEY, analysisKey);
+  core.exportVariable(EnvVar.ANALYSIS_KEY, analysisKey);
  return analysisKey;
 }

@@ -68,11 +68,7 @@ async function sendCompletedStatusReport(
  }
 }

-async function run({
-  startedAt,
-  env,
-  logger,
-}: ActionState<["Base", "Env", "Logger"]>) {
+async function run({ startedAt, logger }: ActionState<["Base", "Logger"]>) {
  // To capture errors appropriately, keep as much code within the try-catch as
  // possible, and only use safe functions outside.

@@ -139,7 +135,7 @@ async function run({
    return;
  }

-  env.export(EnvVar.AUTOBUILD_DID_COMPLETE_SUCCESSFULLY, "true");
+  core.exportVariable(EnvVar.AUTOBUILD_DID_COMPLETE_SUCCESSFULLY, "true");

  await sendCompletedStatusReport(config, logger, startedAt, languages ?? []);
 }
@@ -1,9 +1,11 @@
+import * as core from "@actions/core";
+
 import { getTemporaryDirectory, getWorkflowEventName } from "./actions-util";
 import { getGitHubVersion } from "./api-client";
 import { CodeQL, getCodeQL } from "./codeql";
 import * as configUtils from "./config-utils";
 import { DocUrl } from "./doc-url";
-import { ActionsEnvVars, EnvVar, exportEnvVar } from "./environment";
+import { ActionsEnvVars, EnvVar } from "./environment";
 import { Feature, featureConfig, initFeatures } from "./feature-flags";
 import { BuiltInLanguage, Language } from "./languages";
 import { Logger } from "./logging";
@@ -110,7 +112,7 @@ export async function determineAutobuildLanguages(
  return languages;
 }

-export async function setupCppAutobuild(logger: Logger) {
+export async function setupCppAutobuild(codeql: CodeQL, logger: Logger) {
  const envVar = featureConfig[Feature.CppDependencyInstallation].envVar;
  const featureName = "C++ automatic installation of dependencies";
  const gitHubVersion = await getGitHubVersion();
@@ -121,7 +123,7 @@ export async function setupCppAutobuild(logger: Logger) {
    getTemporaryDirectory(),
    logger,
  );
-  if (await features.getValue(Feature.CppDependencyInstallation)) {
+  if (await features.getValue(Feature.CppDependencyInstallation, codeql)) {
    // disable autoinstall on self-hosted runners unless explicitly requested
    if (
      process.env[ActionsEnvVars.RUNNER_ENVIRONMENT] === "self-hosted" &&
@@ -134,16 +136,16 @@ export async function setupCppAutobuild(logger: Logger) {
            : ""
        }`,
      );
-      exportEnvVar(envVar, "false");
+      core.exportVariable(envVar, "false");
    } else {
      logger.info(
        `Enabling ${featureName}. This can be disabled by setting the ${envVar} environment variable to 'false'. See ${DocUrl.DEFINE_ENV_VARIABLES} for more information.`,
      );
-      exportEnvVar(envVar, "true");
+      core.exportVariable(envVar, "true");
    }
  } else {
    logger.info(`Disabling ${featureName}.`);
-    exportEnvVar(envVar, "false");
+    core.exportVariable(envVar, "false");
  }
 }

@@ -155,7 +157,7 @@ export async function runAutobuild(
  logger.startGroup(`Attempting to automatically build ${language} code`);
  const codeQL = await getCodeQL(logger, config.codeQLCmd);
  if (language === BuiltInLanguage.cpp) {
-    await setupCppAutobuild(logger);
+    await setupCppAutobuild(codeQL, logger);
  }
  if (config.buildMode) {
    await codeQL.extractUsingBuildMode(config, language);
@@ -163,7 +165,7 @@ export async function runAutobuild(
    await codeQL.runAutobuild(config, language);
  }
  if (language === BuiltInLanguage.go) {
-    exportEnvVar(EnvVar.DID_AUTOBUILD_GOLANG, "true");
+    core.exportVariable(EnvVar.DID_AUTOBUILD_GOLANG, "true");
  }
  logger.endGroup();
 }
@@ -1,4 +1,3 @@
-import type { GitHubApiDetails } from "./github";
 import { BuiltInLanguage, parseBuiltInLanguage } from "./languages";
 import { BundlePlatform } from "./platform";
 import type { CompressionMethod } from "./tar";
@@ -18,8 +17,6 @@ export type CodeQLBundle =
 export interface CodeQLDownloadSource {
  /** Distinguishes downloads from local archives and cached installations. */
  sourceType: "download";
-  /** Information about the GitHub instance that contains the asset. */
-  apiDetails: GitHubApiDetails;
  /** The bundle to download. */
  bundle: CodeQLBundle;
  /** The compression format of the bundle archive. */
@@ -34,7 +34,6 @@ import {
  makeVersionInfo,
  createTestConfig,
  makeMacro,
-  mockApiDetails,
 } from "./testing-utils";
 import { ToolsDownloadStatusReport } from "./tools-download";
 import * as util from "./util";
@@ -127,6 +126,19 @@ function mockReleaseApi({
    });
 }

+function mockApiDetails(apiDetails: GitHubApiDetails) {
+  // This is a workaround to mock `api.getApiDetails()` since it doesn't seem to be possible to
+  // mock this directly. The difficulty is that `getApiDetails()` is called locally in
+  // `api-client.ts`, but `sinon.stub(api, "getApiDetails")` only affects calls to
+  // `getApiDetails()` via an imported `api` module.
+  sinon
+    .stub(actionsUtil, "getRequiredInput")
+    .withArgs("token")
+    .returns(apiDetails.auth);
+  process.env["GITHUB_SERVER_URL"] = apiDetails.url;
+  process.env["GITHUB_API_URL"] = apiDetails.apiURL || "";
+}
+
 async function stubCodeql(): Promise<codeql.CodeQL> {
  const codeqlObject = await codeql.getCodeQLForTesting();
  sinon.stub(codeqlObject, "getVersion").resolves(makeVersionInfo("2.17.6"));
@@ -278,7 +290,6 @@ for (const { cliVersion, tagName, expectedToolcacheVersion } of [
    async (t) => {
      await util.withTmpDir(async (tmpDir) => {
        setupActionsVars(tmpDir, tmpDir);
-        mockApiDetails(SAMPLE_DOTCOM_API_DETAILS);

        const result = await installIntoToolcache({
          cliVersion,
@@ -459,7 +470,6 @@ test.serial(

    await util.withTmpDir(async (tmpDir) => {
      setupActionsVars(tmpDir, tmpDir);
-      mockApiDetails(SAMPLE_DOTCOM_API_DETAILS);

      await installIntoToolcache({
        tagName: "codeql-bundle-20200601",
@@ -507,7 +517,6 @@ test.serial(

    await util.withTmpDir(async (tmpDir) => {
      setupActionsVars(tmpDir, tmpDir);
-      mockApiDetails(SAMPLE_DOTCOM_API_DETAILS);

      await installIntoToolcache({
        tagName: "codeql-bundle-20200601",
@@ -15,10 +15,9 @@ import * as api from "./api-client";
 import * as outputCache from "./cli/output-cache";
 import type { VersionInfo } from "./cli/types";
 import { CliError, wrapCliConfigurationError } from "./cli-errors";
-import type { ActionConfig } from "./config/action-config";
 import { appendExtraQueryExclusions, type Config } from "./config-utils";
 import { DocUrl } from "./doc-url";
-import { EnvVar, getEnv, exportEnvVar } from "./environment";
+import { EnvVar, getEnv } from "./environment";
 import {
  CodeQLDefaultVersionInfo,
  Feature,
@@ -198,7 +197,7 @@ export interface CodeQL {
  diagnosticsExport(
    sarifFile: string,
    automationDetailsId: string | undefined,
-    config: ActionConfig<"tempDir">,
+    config: Config,
  ): Promise<void>;
  /** Get the location of an extractor for the specified language. */
  resolveExtractor(language: Language): Promise<string>;
@@ -254,7 +253,7 @@ let cachedCodeQL: CodeQL | undefined = undefined;
 * The version flags below can be used to conditionally enable certain features
 * on versions newer than this.
 */
-const CODEQL_MINIMUM_VERSION = "2.20.7";
+const CODEQL_MINIMUM_VERSION = "2.19.4";

 /**
 * This version will shortly become the oldest version of CodeQL that the Action will run with.
@@ -914,7 +913,7 @@ async function getCodeQLForCmd(
    async diagnosticsExport(
      sarifFile: string,
      automationDetailsId: string | undefined,
-      config: ActionConfig<"tempDir">,
+      config: Config,
    ): Promise<void> {
      const args = [
        "diagnostics",
@@ -1055,7 +1054,7 @@ async function getCodeQLForCmd(
        }' by 'github/codeql-action/*@v${getActionVersion()}' in your code scanning workflow to ` +
        "continue using this version of the CodeQL Action.",
    );
-    exportEnvVar(EnvVar.SUPPRESS_DEPRECATED_SOON_WARNING, "true");
+    core.exportVariable(EnvVar.SUPPRESS_DEPRECATED_SOON_WARNING, "true");
  }
  return codeql;
 }
@@ -1225,7 +1224,7 @@ export async function getTrapCachingExtractorConfigArgsForLang(
 ): Promise<string[]> {
  const cacheDir = config.trapCaches[language];
  if (cacheDir === undefined) return [];
-  const write = await isAnalyzingDefaultBranch(getEnv(), config.repositoryRoot);
+  const write = await isAnalyzingDefaultBranch();
  return [
    `-O=${language}.trap.cache.dir=${cacheDir}`,
    `-O=${language}.trap.cache.bound=${TRAP_CACHE_SIZE_MB}`,
@@ -1238,9 +1237,7 @@ export async function getTrapCachingExtractorConfigArgsForLang(
 *
 * This will not exist if the configuration is being parsed in the Action.
 */
-function getGeneratedCodeScanningConfigPath(
-  config: ActionConfig<"tempDir">,
-): string {
+function getGeneratedCodeScanningConfigPath(config: Config): string {
  return path.resolve(config.tempDir, "user-config.yaml");
 }

@@ -172,7 +172,6 @@ test.serial("load empty config", async (t) => {
      createTestInitConfigInputs({
        languagesInput: languages,
        repository: { owner: "github", repo: "example" },
-        sourceRoot: tempDir,
        tempDir,
        codeql,
        logger,
@@ -187,7 +186,6 @@ test.serial("load empty config", async (t) => {
        logger,
      }),
      {},
-      undefined,
    );

    t.deepEqual(config, expectedConfig);
@@ -218,7 +216,6 @@ test.serial("load code quality config", async (t) => {
        analysisKinds: [AnalysisKind.CodeQuality],
        languagesInput: languages,
        repository: { owner: "github", repo: "example" },
-        sourceRoot: tempDir,
        tempDir,
        codeql,
        logger,
@@ -299,7 +296,6 @@ test.serial(
            analysisKinds: [AnalysisKind.CodeQuality],
            languagesInput: languages,
            repository: { owner: "github", repo: "example" },
-            sourceRoot: tempDir,
            tempDir,
            codeql,
            repositoryProperties,
@@ -522,7 +518,6 @@ test.serial("load non-empty input", async (t) => {
    // And the config we expect it to parse to
    const expectedConfig = createTestConfig({
      languages: [BuiltInLanguage.javascript],
-      repositoryRoot: undefined,
      buildMode: BuildMode.None,
      originalUserInput: userConfig,
      computedConfig: userConfig,
@@ -543,7 +538,6 @@ test.serial("load non-empty input", async (t) => {
      state,
      createTestInitConfigInputs({
        languagesInput,
-        sourceRoot: tempDir,
        buildModeInput: "none",
        configFile: configFilePath,
        debugArtifactName: "my-artifact",
@@ -1111,6 +1105,11 @@ const checkOverlayEnablementMacro = makeMacro({
            return lang === BuiltInLanguage.java;
          });

+        // Mock git root detection
+        if (setup.gitRoot !== undefined) {
+          sinon.stub(gitUtils, "getGitRoot").resolves(setup.gitRoot);
+        }
+
        // Mock submodule detection
        sinon.stub(gitUtils, "hasSubmodules").returns(setup.hasSubmodules);

@@ -1123,7 +1122,6 @@ const checkOverlayEnablementMacro = makeMacro({
          codeql,
          features,
          setup.languages,
-          setup.gitRoot, // repositoryRoot
          tempDir, // sourceRoot
          setup.buildMode,
          undefined,
@@ -2,6 +2,7 @@ import * as fs from "fs";
 import * as path from "path";
 import { performance } from "perf_hooks";

+import * as core from "@actions/core";
 import * as yaml from "js-yaml";

 import { ActionState } from "./action-common";
@@ -21,11 +22,7 @@ import {
 import * as api from "./api-client";
 import { getCachingKind } from "./caching-utils";
 import { type CodeQL } from "./codeql";
-import {
-  type AbortedInitConfig,
-  type ActionConfig,
-  type Config,
-} from "./config/action-config";
+import { type Config } from "./config/action-config";
 import {
  calculateAugmentation,
  ExcludeQueryFilter,
@@ -49,7 +46,7 @@ import {
  makeTelemetryDiagnostic,
 } from "./diagnostics";
 import { prepareDiffInformedAnalysis } from "./diff-informed-analysis-utils";
-import { EnvVar, exportEnvVar, getEnv } from "./environment";
+import { EnvVar } from "./environment";
 import * as errorMessages from "./error-messages";
 import { Feature, FeatureEnablement, FeatureWithoutCLI } from "./feature-flags";
 import {
@@ -75,7 +72,6 @@ import {
 import { OverlayDatabaseMode } from "./overlay/overlay-database-mode";
 import { shouldSkipOverlayAnalysis } from "./overlay/status";
 import { RepositoryNwo } from "./repository";
-import { ActionName } from "./status-report";
 import { ToolsFeature } from "./tools-features";
 import { downloadTrapCaches } from "./trap-caching";
 import {
@@ -390,7 +386,6 @@ export async function initActionState(
    enableFileCoverageInformation,
  }: InitConfigInputs,
  userConfig: UserConfig,
-  repositoryRoot: string | undefined,
 ): Promise<Config> {
  const languages = await getLanguages(
    codeql,
@@ -442,7 +437,6 @@ export async function initActionState(

  return {
    version: getActionVersion(),
-    repositoryRoot,
    analysisKinds,
    languages,
    buildMode,
@@ -472,18 +466,12 @@ async function downloadCacheWithTime(
  codeQL: CodeQL,
  languages: Language[],
  logger: Logger,
-  repositoryRoot: string | undefined,
 ): Promise<{
  trapCaches: { [language: string]: string };
  trapCacheDownloadTime: number;
 }> {
  const start = performance.now();
-  const trapCaches = await downloadTrapCaches(
-    codeQL,
-    languages,
-    logger,
-    repositoryRoot,
-  );
+  const trapCaches = await downloadTrapCaches(codeQL, languages, logger);
  const trapCacheDownloadTime = performance.now() - start;
  return { trapCaches, trapCacheDownloadTime };
 }
@@ -731,7 +719,6 @@ export async function checkOverlayEnablement(
  codeql: CodeQL,
  features: FeatureEnablement,
  languages: Language[],
-  repositoryRoot: string | undefined,
  sourceRoot: string,
  buildMode: BuildMode | undefined,
  ramInput: string | undefined,
@@ -761,7 +748,6 @@ export async function checkOverlayEnablement(
      true,
      codeql,
      languages,
-      repositoryRoot,
      sourceRoot,
      buildMode,
      gitVersion,
@@ -835,7 +821,7 @@ export async function checkOverlayEnablement(
      `Setting overlay database mode to ${overlayDatabaseMode} ` +
        "with caching because we are analyzing a pull request.",
    );
-  } else if (await isAnalyzingDefaultBranch(getEnv(), repositoryRoot)) {
+  } else if (await isAnalyzingDefaultBranch()) {
    overlayDatabaseMode = OverlayDatabaseMode.OverlayBase;
    logger.info(
      `Setting overlay database mode to ${overlayDatabaseMode} ` +
@@ -851,7 +837,6 @@ export async function checkOverlayEnablement(
    false,
    codeql,
    languages,
-    repositoryRoot,
    sourceRoot,
    buildMode,
    gitVersion,
@@ -871,7 +856,6 @@ async function validateOverlayDatabaseMode(
  overlayModeSetExplicitly: boolean,
  codeql: CodeQL,
  languages: Language[],
-  repositoryRoot: string | undefined,
  sourceRoot: string,
  buildMode: BuildMode | undefined,
  gitVersion: GitVersionInfo | undefined,
@@ -907,7 +891,8 @@ async function validateOverlayDatabaseMode(
    );
    return new Failure(OverlayDisabledReason.IncompatibleCodeQl);
  }
-  if (repositoryRoot === undefined) {
+  const gitRoot = await getGitRoot(sourceRoot);
+  if (gitRoot === undefined) {
    logger.warning(
      `Cannot build an ${overlayDatabaseMode} database because ` +
        `the source root "${sourceRoot}" is not inside a git repository. ` +
@@ -915,7 +900,7 @@ async function validateOverlayDatabaseMode(
    );
    return new Failure(OverlayDisabledReason.NoGitRoot);
  }
-  if (hasSubmodules(repositoryRoot)) {
+  if (hasSubmodules(gitRoot)) {
    if (gitVersion === undefined) {
      logger.warning(
        `Cannot build an ${overlayDatabaseMode} database because ` +
@@ -980,10 +965,10 @@ async function setCppTrapCachingEnvironmentVariables(
      );
    } else if (config.trapCaches[BuiltInLanguage.cpp]) {
      logger.info("Enabling TRAP caching for C/C++.");
-      exportEnvVar(envVar, "true");
+      core.exportVariable(envVar, "true");
    } else {
      logger.debug(`Disabling TRAP caching for C/C++.`);
-      exportEnvVar(envVar, "false");
+      core.exportVariable(envVar, "false");
    }
  }
 }
@@ -1167,11 +1152,9 @@ export async function initConfig(
  const { logger, features } = actionState;
  const { tempDir } = inputs;

-  const repositoryRoot = await getGitRoot(inputs.sourceRoot);
-
  const userConfig = await determineUserConfig(actionState, tempDir, inputs);

-  const config = await initActionState(inputs, userConfig, repositoryRoot);
+  const config = await initActionState(inputs, userConfig);

  // If Code Quality analysis is the only enabled analysis kind, then we will initialise
  // the database for Code Quality. That entails disabling the default queries and only
@@ -1253,7 +1236,6 @@ export async function initConfig(
    inputs.codeql,
    inputs.features,
    config.languages,
-    repositoryRoot,
    inputs.sourceRoot,
    config.buildMode,
    inputs.ramInput,
@@ -1307,7 +1289,6 @@ export async function initConfig(
      inputs.codeql,
      config.languages,
      logger,
-      repositoryRoot,
    );
    config.trapCaches = trapCaches;
    config.trapCacheDownloadTime = trapCacheDownloadTime;
@@ -1399,86 +1380,31 @@ export function getPathToParsedConfigFile(tempDir: string): string {
  return path.join(tempDir, "config");
 }

-function getPathToFailedConfigFile(tempDir: string): string {
-  return path.join(tempDir, "failed-config");
-}
-
 /**
- * Writes {@link config} to {@link configFilePath}.
- *
- * This function is not intended to be called, other than by
- * {@link saveConfig} and {@link saveAbortedInitConfig} below.
+ * Store the given config to the path returned from getPathToParsedConfigFile.
 */
-function saveConfigFile(
-  logger: Logger,
-  configFilePath: string,
-  config: Partial<Config>,
-) {
+export async function saveConfig(config: Config, logger: Logger) {
  const configString = JSON.stringify(config);
-  fs.mkdirSync(path.dirname(configFilePath), { recursive: true });
-  fs.writeFileSync(configFilePath, configString, "utf8");
+  const configFile = getPathToParsedConfigFile(config.tempDir);
+  fs.mkdirSync(path.dirname(configFile), { recursive: true });
+  fs.writeFileSync(configFile, configString, "utf8");
  logger.debug("Saved config:");
  logger.debug(configString);
 }

 /**
- * Store the given config to the path returned from getPathToParsedConfigFile.
+ * Get the config that has been saved to the given temp dir.
+ * If the config could not be found then returns undefined.
 */
-export async function saveConfig(config: Config, logger: Logger) {
-  const configFile = getPathToParsedConfigFile(config.tempDir);
-  saveConfigFile(logger, configFile, config);
-}
-
-/**
- * Store parts of {@link config} as a failed configuration file.
- *
- * The file will only contain parts of {@link config} that are relevant to
- * the `init-post` step in the workflow.
- */
-export function saveAbortedInitConfig(
-  action: ActionState<["Base", "Logger"]>,
-  config: Config,
-) {
-  // Should only be called by init.
-  if (action.name !== ActionName.Init) {
-    throw new Error(
-      `Internal error: 'saveAbortedInitConfig' should only be called by '${ActionName.Init}', but was called by '${action.name}'.`,
-    );
-  }
-
-  // Create a copy of the input `Config` that only contains the keys we want.
-  const failedConfig: AbortedInitConfig = {
-    version: config.version,
-    tempDir: config.tempDir,
-    codeQLCmd: config.codeQLCmd,
-    debugMode: config.debugMode,
-    gitHubVersion: config.gitHubVersion,
-    languages: config.languages,
-    analysisKinds: config.analysisKinds,
-  };
-
-  action.logger.debug(`Saving config for failed init step.`);
-  saveConfigFile(
-    action.logger,
-    getPathToFailedConfigFile(config.tempDir),
-    failedConfig,
-  );
-}
-
-/**
- * Attempts to read a {@link Config} from {@link configFilePath}.
- *
- * This function is not intended to be called, other than by
- * {@link getConfig} and {@link getAbortedInitConfig} below.
- */
-function readConfigFile(
+export async function getConfig(
+  tempDir: string,
  logger: Logger,
-  configFilePath: string,
-): Config | undefined {
-  if (!fs.existsSync(configFilePath)) {
+): Promise<Config | undefined> {
+  const configFile = getPathToParsedConfigFile(tempDir);
+  if (!fs.existsSync(configFile)) {
    return undefined;
  }
-  const configString = fs.readFileSync(configFilePath, "utf8");
+  const configString = fs.readFileSync(configFile, "utf8");
  logger.debug("Loaded config:");
  logger.debug(configString);

@@ -1503,38 +1429,6 @@ function readConfigFile(
  return config as Config;
 }

-/**
- * Get the config that has been saved to the given temp dir.
- * If the config could not be found then returns undefined.
- */
-export async function getConfig(
-  tempDir: string,
-  logger: Logger,
-): Promise<Config | undefined> {
-  const configFile = getPathToParsedConfigFile(tempDir);
-  return readConfigFile(logger, configFile);
-}
-
-/**
- * Loads a {@link AbortedInitConfig} from a failed `init` step if it exists.
- *
- * The result will only contain parts of a {@link Config} that are relevant to
- * the `init-post` step in the workflow.
- */
-export function getAbortedInitConfig(
-  action: ActionState<["Base", "Logger"]>,
-  tempDir: string,
-): AbortedInitConfig | undefined {
-  // Only intended to be called by the `init-post` action.
-  if (action.name !== ActionName.InitPost) {
-    throw new Error(
-      `Internal error: 'getAbortedInitConfig' should only be called by '${ActionName.InitPost}', but was called by '${action.name}'.`,
-    );
-  }
-
-  return readConfigFile(action.logger, getPathToFailedConfigFile(tempDir));
-}
-
 /**
 * Generate a `qlconfig.yml` file from the `registries` input.
 * This file is used by the CodeQL CLI to list the registries to use for each
@@ -1725,27 +1619,21 @@ export function appendExtraQueryExclusions(
 /**
 * Returns `true` if Code Scanning analysis is enabled, or `false` if not.
 */
-export function isCodeScanningEnabled(
-  config: ActionConfig<"analysisKinds">,
-): boolean {
+export function isCodeScanningEnabled(config: Config): boolean {
  return config.analysisKinds.includes(AnalysisKind.CodeScanning);
 }

 /**
 * Returns `true` if Code Quality analysis is enabled, or `false` if not.
 */
-export function isCodeQualityEnabled(
-  config: ActionConfig<"analysisKinds">,
-): boolean {
+export function isCodeQualityEnabled(config: Config): boolean {
  return config.analysisKinds.includes(AnalysisKind.CodeQuality);
 }

 /**
 * Returns `true` if Code Scanning Risk Assessment analysis is enabled, or `false` if not.
 */
-export function isRiskAssessmentEnabled(
-  config: ActionConfig<"analysisKinds">,
-): boolean {
+export function isRiskAssessmentEnabled(config: Config): boolean {
  return config.analysisKinds.includes(AnalysisKind.RiskAssessment);
 }

@@ -16,11 +16,6 @@ export interface Config {
   * The version of the CodeQL Action that the configuration is for.
   */
  version: string;
-  /**
-   * The path at which the repository being analysed is checked out at, if available.
-   * Persisted in the CodeQL Action configuration state, so that we can consult it in later workflow steps.
-   */
-  repositoryRoot: string | undefined;
  /**
   * Set of analysis kinds that are enabled.
   */
@@ -131,38 +126,3 @@ export interface Config {
   */
  enableFileCoverageInformation: boolean;
 }
-
-/** Properties available in `Config`. */
-export type ActionConfigProperties = keyof Config;
-
-/**
- * The CodeQL Action configuration state that is persisted
- * between steps of the CodeQL Action in a CodeQL workflow.
- *
- * By default, this is equivalent to `Config`. By explicitly
- * providing required property names for `T` this can be restricted
- * to requiring only those. For example, in `ActionConfig<"codeQLCmd">`
- * all properties except `codeqlCmd` are optional.
- */
-export type ActionConfig<
-  T extends ActionConfigProperties = ActionConfigProperties,
-> = Partial<Config> & Pick<Config, T>;
-
-/** Helper function to check whether `config` has `key` to narrow the type of `config`. */
-export function hasConfigKey<Key extends ActionConfigProperties>(
-  config: Partial<Config>,
-  key: Key,
-): config is ActionConfig<Key> {
-  return config[key] !== undefined;
-}
-
-/** A minimal configuration that we can make available even when `init` aborts. */
-export type AbortedInitConfig = ActionConfig<
-  | "version"
-  | "tempDir"
-  | "gitHubVersion"
-  | "debugMode"
-  | "languages"
-  | "analysisKinds"
-  | "codeQLCmd"
->;
@@ -1,5 +1,4 @@
-import fs from "fs";
-import path from "path";
+import * as fs from "fs";

 import * as github from "@actions/github";
 import test from "ava";
@@ -11,10 +10,7 @@ import { GitHubApiDetails } from "./api-client";
 import * as apiClient from "./api-client";
 import { createStubCodeQL } from "./codeql";
 import { Config } from "./config-utils";
-import {
-  cleanupAndUploadDatabases,
-  uploadBundledDatabase,
-} from "./database-upload";
+import { cleanupAndUploadDatabases } from "./database-upload";
 import { Feature } from "./feature-flags";
 import * as gitUtils from "./git-utils";
 import { BuiltInLanguage } from "./languages";
@@ -27,7 +23,6 @@ import {
  getTestEnv,
  initAllState,
  RecordingLogger,
-  SAMPLE_DOTCOM_API_DETAILS,
  setupActionsVars,
  setupTests,
 } from "./testing-utils";
@@ -555,90 +550,3 @@ test.serial(
    });
  },
 );
-
-test.serial(
-  "uploadBundledDatabase provides expected request arguments",
-  async (t) =>
-    withTmpDir(async (tmpDir) => {
-      // Write some file that `uploadBundledDatabase` can use for its `fs.createReadStream(bundledDb)` call
-      // so we don't have to stub that or create a fake `ReadStream`.
-      const dbPath = path.join(tmpDir, "db");
-      const content = JSON.stringify({});
-      fs.writeFileSync(dbPath, content);
-
-      // A simple stub for `fetch` that satisfies Octokit when it inspects the response.
-      const fetchStub = sinon.stub().resolves({
-        status: 200,
-        headers: new Headers(),
-        text: async () => "",
-      });
-
-      // Construct a real `ApiClient`.
-      const client = apiClient.getApiClient(
-        getTestEnv(),
-        SAMPLE_DOTCOM_API_DETAILS,
-      );
-
-      // Then wrap the real `request` method in a stub that calls it with our stubbed `fetch`.
-      // This ensures that we have a real `ApiClient` with a mostly real `request`, but which
-      // does not perform any actual requests.
-      const request = client.request;
-      sinon.stub(client, "request").callsFake(async (route, options) =>
-        request(route, {
-          ...options,
-          request: { ...options?.request, fetch: fetchStub },
-        }),
-      );
-
-      // Stub `getApiClient` to return our modified `ApiClient`.
-      const getApiClient = sinon
-        .stub(apiClient, "getApiClient")
-        .returns(client);
-
-      // Calling `uploadBundledDatabase` shouldn't throw.
-      const nwo: RepositoryNwo = { owner: "test", repo: "foo" };
-      const language: BuiltInLanguage = BuiltInLanguage.java;
-
-      const env = getTestEnv();
-      await t.notThrowsAsync(async () => {
-        await uploadBundledDatabase(
-          nwo,
-          language,
-          "123",
-          dbPath,
-          content.length,
-          SAMPLE_DOTCOM_API_DETAILS,
-          env,
-        );
-      });
-
-      // Check that our stubs were called and that they received the expected arguments.
-      t.is(getApiClient.callCount, 1);
-      t.deepEqual(getApiClient.args[0], [env, SAMPLE_DOTCOM_API_DETAILS]);
-
-      t.is(fetchStub.callCount, 1);
-
-      const args = fetchStub.args[0];
-      t.is(args.length, 2);
-
-      const url = args[0];
-      t.is(
-        url,
-        `https://uploads.github.com/repos/${nwo.owner}/${nwo.repo}/code-scanning/codeql/databases/${language}?name=${language}-database&commit_oid=123`,
-      );
-
-      const options = args[1];
-      t.like(options, {
-        // Going via `new Headers` and `Object.fromEntries` ensures we get the same cases
-        // for the header keys as we are given.
-        headers: Object.fromEntries(
-          new Headers({
-            authorization: `token ${SAMPLE_DOTCOM_API_DETAILS.auth}`,
-            "Content-Type": "application/zip",
-            "Content-Length": content.length.toString(),
-          }).entries(),
-        ),
-        method: "POST",
-      } satisfies RequestInit);
-    }),
-);
@@ -10,15 +10,13 @@ import {
 } from "./api-client";
 import { type CodeQL } from "./codeql";
 import { Config } from "./config-utils";
-import type { ReadOnlyEnv } from "./environment";
 import { Feature } from "./feature-flags";
 import * as gitUtils from "./git-utils";
-import { parseGitHubUrl } from "./github";
 import { Logger, withGroupAsync } from "./logging";
 import { OverlayDatabaseMode } from "./overlay/overlay-database-mode";
 import { RepositoryNwo } from "./repository";
 import * as util from "./util";
-import { asHTTPError, bundleDb, CleanupLevel } from "./util";
+import { asHTTPError, bundleDb, CleanupLevel, parseGitHubUrl } from "./util";

 /** Information about a database upload. */
 export interface DatabaseUploadResult {
@@ -48,7 +46,7 @@ export interface DatabaseUploadResult {
 }

 export async function cleanupAndUploadDatabases(
-  action: ActionState<["ReadOnlyEnv", "Logger", "FeatureFlags"]>,
+  action: ActionState<["Logger", "FeatureFlags"]>,
  repositoryNwo: RepositoryNwo,
  codeql: CodeQL,
  config: Config,
@@ -83,7 +81,7 @@ export async function cleanupAndUploadDatabases(
    return [];
  }

-  if (!(await gitUtils.isAnalyzingDefaultBranch(action.env, checkoutPath))) {
+  if (!(await gitUtils.isAnalyzingDefaultBranch())) {
    // We only want to upload a database if we are analyzing the default branch.
    logger.debug("Not analyzing default branch. Skipping upload.");
    return [];
@@ -115,7 +113,7 @@ export async function cleanupAndUploadDatabases(
        includeDiagnostics: false,
      });
      bundledDbSize = fs.statSync(bundledDb).size;
-      const commitOid = await gitUtils.getCommitOid(action.env, checkoutPath);
+      const commitOid = await gitUtils.getCommitOid(checkoutPath);
      // Upload with manual retry logic. We disable Octokit's built-in retries
      // because the request body is a ReadStream, which can only be consumed
      // once.
@@ -260,19 +258,15 @@ async function recordClearCleanupSizes(
 *
 * @returns the duration of the upload in milliseconds
 */
-export async function uploadBundledDatabase(
+async function uploadBundledDatabase(
  repositoryNwo: RepositoryNwo,
  language: string,
  commitOid: string,
  bundledDb: string,
  bundledDbSize: number,
  apiDetails: GitHubApiDetails,
-  env: ReadOnlyEnv = util.getEnv(),
 ): Promise<number> {
-  // It is important that the `apiDetails` that `getApiClient` uses match the ones we were given,
-  // because we use `apiDetails.url` below to construct the URL to upload the database to. That
-  // URL will be specific to the GitHub instance given by `apiDetails` and so the client must match it.
-  const client = getApiClient(env, apiDetails);
+  const client = getApiClient();

  const uploadsUrl = new URL(parseGitHubUrl(apiDetails.url));
  uploadsUrl.hostname = `uploads.${uploadsUrl.hostname}`;
@@ -298,6 +292,7 @@ export async function uploadBundledDatabase(
        commit_oid: commitOid,
        data: bundledDbReadStream,
        headers: {
+          authorization: `token ${apiDetails.auth}`,
          "Content-Type": "application/zip",
          "Content-Length": bundledDbSize,
        },
@@ -55,20 +55,25 @@ test("getArtifactSuffix", (t) => {
  }
 });

-// These next tests check whether `uploadArtifacts` attempts to upload an artifact. Since it's not
-// easy to mock the actual call to upload an artifact, we check that we get an "upload-failed"
-// result, instead of actually uploading the artifact.
+// These next tests check the correctness of the logic to determine whether or not
+// artifacts are uploaded in debug mode. Since it's not easy to mock the actual
+// call to upload an artifact, we just check that we get an "upload-failed" result,
+// instead of actually uploading the artifact.
+//
+// For tests where we expect artifact upload to be blocked, we check for a different
+// response from the function.

-test("uploadArtifacts returns 'no-artifacts-to-upload' when there are no files to upload", async (t) => {
+test("uploadDebugArtifacts when artifacts empty should emit 'no-artifacts-to-upload'", async (t) => {
  // Test that no error is thrown if artifacts list is empty.
  const logger = getActionsLogger();
  await t.notThrowsAsync(async () => {
-    const uploaded = await debugArtifacts.uploadArtifacts(
+    const uploaded = await debugArtifacts.uploadDebugArtifacts(
      logger,
      [],
      "i-dont-exist",
      "artifactName",
      GitHubVariant.DOTCOM,
+      undefined,
    );
    t.is(
      uploaded,
@@ -78,15 +83,17 @@ test("uploadArtifacts returns 'no-artifacts-to-upload' when there are no files t
  });
 });

-test("uploadArtifacts attempts an upload when there are files to upload", async (t) => {
+test("uploadDebugArtifacts when no codeql version is used should invoke artifact upload", async (t) => {
+  // Test that the artifact is uploaded.
  const logger = getActionsLogger();
  await t.notThrowsAsync(async () => {
-    const uploaded = await debugArtifacts.uploadArtifacts(
+    const uploaded = await debugArtifacts.uploadDebugArtifacts(
      logger,
      ["hucairz"],
      "i-dont-exist",
      "artifactName",
      GitHubVariant.DOTCOM,
+      undefined,
    );
    t.is(
      uploaded,
@@ -96,3 +103,44 @@ test("uploadArtifacts attempts an upload when there are files to upload", async
    );
  });
 });
+
+test("uploadDebugArtifacts when new codeql version is used should invoke artifact upload", async (t) => {
+  // Test that the artifact is uploaded.
+  const logger = getActionsLogger();
+  await t.notThrowsAsync(async () => {
+    const uploaded = await debugArtifacts.uploadDebugArtifacts(
+      logger,
+      ["hucairz"],
+      "i-dont-exist",
+      "artifactName",
+      GitHubVariant.DOTCOM,
+      "2.20.3",
+    );
+    t.is(
+      uploaded,
+      // The failure is expected since we don't want to actually upload any artifacts in unit tests.
+      "upload-failed",
+      "Expect failure to upload artifacts since root dir does not exist",
+    );
+  });
+});
+
+test("uploadDebugArtifacts when old codeql is used should avoid trying to upload artifacts", async (t) => {
+  // Test that the artifact is not uploaded.
+  const logger = getActionsLogger();
+  await t.notThrowsAsync(async () => {
+    const uploaded = await debugArtifacts.uploadDebugArtifacts(
+      logger,
+      ["hucairz"],
+      "i-dont-exist",
+      "artifactName",
+      GitHubVariant.DOTCOM,
+      "2.20.2",
+    );
+    t.is(
+      uploaded,
+      "upload-not-supported",
+      "Expected artifact upload to be blocked because of old CodeQL version",
+    );
+  });
+});
@@ -10,11 +10,15 @@ import { getOptionalInput, getTemporaryDirectory } from "./actions-util";
 import { dbIsFinalized } from "./analyze";
 import { scanArtifactsForTokens } from "./artifact-scanner";
 import { type CodeQL } from "./codeql";
-import type { ActionConfig } from "./config/action-config";
-import { EnvVar, exportEnvVar } from "./environment";
+import { Config } from "./config-utils";
+import { EnvVar } from "./environment";
 import * as json from "./json";
 import { Language } from "./languages";
 import { Logger, withGroup } from "./logging";
+import {
+  isSafeArtifactUpload,
+  SafeArtifactUploadVersion,
+} from "./tools-features";
 import {
  bundleDb,
  doesDirectoryExist,
@@ -36,6 +40,7 @@ export function sanitizeArtifactName(name: string): string {
 export async function uploadCombinedSarifArtifacts(
  logger: Logger,
  gitHubVariant: GitHubVariant,
+  codeQlVersion: string | undefined,
 ) {
  const tempDir = getTemporaryDirectory();

@@ -65,12 +70,13 @@ export async function uploadCombinedSarifArtifacts(
      }

      try {
-        await uploadArtifacts(
+        await uploadDebugArtifacts(
          logger,
          toUpload,
          baseTempDir,
          "combined-sarif-artifacts",
          gitHubVariant,
+          codeQlVersion,
        );
      } catch (e) {
        logger.warning(
@@ -89,7 +95,7 @@ export async function uploadCombinedSarifArtifacts(
 * @return The path to that debug artifact, or undefined if an error occurs.
 */
 function tryPrepareSarifDebugArtifact(
-  config: ActionConfig<"dbLocation">,
+  config: Config,
  language: Language,
  logger: Logger,
 ): string | undefined {
@@ -131,7 +137,7 @@ function tryPrepareSarifDebugArtifact(
 */
 async function tryBundleDatabase(
  codeql: CodeQL,
-  config: ActionConfig<"dbLocation">,
+  config: Config,
  language: Language,
  logger: Logger,
 ): Promise<string | undefined> {
@@ -157,11 +163,6 @@ async function tryBundleDatabase(
  }
 }

-/** The minimal configuration needed for `tryUploadAllAvailableDebugArtifacts`. */
-export type UploadDebugArtifactsConfig = ActionConfig<
-  "languages" | "gitHubVersion" | "dbLocation" | "debugArtifactName"
->;
-
 /**
 * Attempt to upload all available debug artifacts.
 *
@@ -169,8 +170,9 @@ export type UploadDebugArtifactsConfig = ActionConfig<
 */
 export async function tryUploadAllAvailableDebugArtifacts(
  codeql: CodeQL,
-  config: UploadDebugArtifactsConfig,
+  config: Config,
  logger: Logger,
+  codeQlVersion: string | undefined,
 ) {
  const filesToUpload: string[] = [];
  try {
@@ -229,12 +231,13 @@ export async function tryUploadAllAvailableDebugArtifacts(

  try {
    await withGroup("Uploading debug artifacts", async () =>
-      uploadArtifacts(
+      uploadDebugArtifacts(
        logger,
        filesToUpload,
        config.dbLocation,
        config.debugArtifactName,
        config.gitHubVersion.type,
+        codeQlVersion,
      ),
    );
  } catch (e) {
@@ -280,6 +283,26 @@ export type UploadArtifactsResult =
  | "upload-successful"
  | "upload-failed";

+export async function uploadDebugArtifacts(
+  logger: Logger,
+  toUpload: string[],
+  rootDir: string,
+  artifactName: string,
+  ghVariant: GitHubVariant,
+  codeQlVersion: string | undefined,
+): Promise<UploadArtifactsResult | "upload-not-supported"> {
+  const uploadSupported = isSafeArtifactUpload(codeQlVersion);
+
+  if (!uploadSupported) {
+    core.info(
+      `Skipping debug artifact upload because the current CLI does not support safe upload. Please upgrade to CLI v${SafeArtifactUploadVersion} or later.`,
+    );
+    return "upload-not-supported";
+  }
+
+  return uploadArtifacts(logger, toUpload, rootDir, artifactName, ghVariant);
+}
+
 /**
 * Uploads the specified files as a single workflow artifact.
 *
@@ -307,7 +330,7 @@ export async function uploadArtifacts(
  // some issues early.
  if (isInTestMode()) {
    await scanArtifactsForTokens(toUpload, logger);
-    exportEnvVar("CODEQL_ACTION_ARTIFACT_SCAN_FINISHED", "true");
+    core.exportVariable("CODEQL_ACTION_ARTIFACT_SCAN_FINISHED", "true");
  }

  const suffix = getArtifactSuffix(getOptionalInput("matrix"));
@@ -358,7 +381,7 @@ export async function getArtifactUploaderClient(
 * all files in the database folder and return the path.
 */
 async function createPartialDatabaseBundle(
-  config: ActionConfig<"dbLocation">,
+  config: Config,
  language: Language,
 ): Promise<string> {
  const databasePath = getCodeQLDatabasePath(config, language);
@@ -399,7 +422,7 @@ async function createPartialDatabaseBundle(
 */
 async function createDatabaseBundleCli(
  codeql: CodeQL,
-  config: ActionConfig<"dbLocation">,
+  config: Config,
  language: Language,
 ): Promise<string> {
  const databaseBundlePath = await bundleDb(
@@ -313,7 +313,6 @@ export async function downloadDependencyCaches(

    const primaryKey = await cacheKey(codeql, features, language, patterns);
    const restoreKeys: string[] = [
-      primaryKey,
      await cachePrefix(codeql, features, language),
    ];

@@ -1,12 +0,0 @@
-import test from "ava";
-
-import { Env, ReadOnlyEnv } from "./environment";
-import { getTestEnv, setupTests } from "./testing-utils";
-
-setupTests(test);
-
-test("isTestingEnv() is true", (t) => {
-  t.true(new ReadOnlyEnv(process.env).isTestingEnv());
-  t.true(new Env(process.env).isTestingEnv());
-  t.true(getTestEnv().isTestingEnv());
-});
@@ -1,10 +1,3 @@
-import * as core from "@actions/core";
-
-/**
- * This constant is set in `ava.setup.mjs` for tests.
- */
-declare const __CODEQL_ACTION_TEST_ENV__: string | undefined;
-
 /**
 * Environment variables used by Default Setup to communicate the private registry proxy configuration.
 */
@@ -218,20 +211,8 @@ export enum ActionsEnvVars {
  RUNNER_TOOL_CACHE = "RUNNER_TOOL_CACHE",
 }

-/** Environment variables which are not specific to CodeQL. */
-export enum SystemEnvVar {
-  /**
-   * Used by Node and related tools to indicate what kind of environment we are running in.
-   */
-  NODE_ENV = "NODE_ENV",
-}
-
 /** A type representing all known environment variables. */
-export type KnownEnvVar =
-  | EnvVar
-  | ActionsEnvVars
-  | RegistryProxyVars
-  | SystemEnvVar;
+export type KnownEnvVar = EnvVar | ActionsEnvVars | RegistryProxyVars;

 /**
 * Gets an environment variable, but throws an error if it is not set.
@@ -308,26 +289,6 @@ export class ReadOnlyEnv<T extends string | undefined = string | undefined> {
  public entries(): Array<[string, T]> {
    return Object.entries(this.vars);
  }
-
-  /**
-   * Gets a value indicating whether we should skip uploads of
-   * all kinds (SARIF results, status reports, DBs, ...).
-   *
-   * This is not guaranteed to be set in all test environments.
-   */
-  public isSkippingUploadsInTests(): boolean {
-    return this.getOptional(EnvVar.TEST_MODE) === "true";
-  }
-
-  /**
-   * Gets a value indicative of whether we are in a testing environment
-   * by testing whether the value of the `NODE_ENV` variable is "test".
-   * This is expected to be the case if e.g. `ava` is running the tests
-   * or if this instance was constructed by `getTestEnv`.
-   */
-  public isTestingEnv(): boolean {
-    return __CODEQL_ACTION_TEST_ENV__ === "unit-test";
-  }
 }

 /**
@@ -346,33 +307,6 @@ export class Env<
    this.changed = true;
  }

-  /** Sets all environment variables given by `vars`. */
-  public setAll(vars: Record<string, T>): void {
-    for (const [key, val] of Object.entries(vars)) {
-      this.set(key, val);
-    }
-  }
-
-  /**
-   * Wrapper around `core.exportVariable` which does not call `core.exportVariable`
-   * when running unit tests. This is important, because otherwise `core.exportVariable`
-   * sets environment variables for other steps in a workflow when we run unit tests in CI.
-   *
-   * @param name The name of the environment variable to set and export.
-   * @param val The value to set and export for the environment variable.
-   */
-  public export(name: string, val: T): void {
-    // Setting the environment variable for this instance is always OK, including
-    // in tests, since we use fresh `Env` instances whenever needed. This allows
-    // tests to pass that rely on that part of the `core.exportVariable` behaviour.
-    this.set(name, val);
-
-    // Call `core.exportVariable` whenever we are not in a test environment.
-    if (!this.isTestingEnv()) {
-      core.exportVariable(name, val);
-    }
-  }
-
  /** Gets a value indicating whether `set` was called at least once. */
  public hasChanged(): boolean {
    return this.changed;
@@ -383,34 +317,3 @@ export class Env<
 export function getEnv(env: NodeJS.ProcessEnv = process.env): Env {
  return new Env(env);
 }
-
-/**
- * Returns whether we are in test mode. This is used by CodeQL Action PR checks.
- *
- * In test mode, we skip several uploads (SARIF results, status reports, DBs, ...).
- *
- * @deprecated
- *  The purpose of this function is ambiguous. Use `isSkippingUploadsInTests` on
- *  a `ReadOnlyEnv` instance instead for equivalent behaviour. Use `isTestingEnv`
- *  to determine if we are running in a unit test.
- */
-export function isInTestMode(): boolean {
-  return getEnv().isSkippingUploadsInTests();
-}
-
-/**
- * Wrapper around `core.exportVariable` which does not call `core.exportVariable`
- * when running unit tests. This is important, because otherwise `core.exportVariable`
- * sets environment variables for other steps in a workflow when we run unit tests in CI.
- *
- * @deprecated Use `export` on an `Env` instance instead.
- */
-export function exportEnvVar(name: string, val: any): void {
-  const env = getEnv();
-
-  if (typeof val === "string") {
-    env.export(name, val);
-  } else {
-    env.export(name, JSON.stringify(val));
-  }
-}
@@ -240,7 +240,7 @@ export const featureConfig = {
    defaultValue: false,
    envVar: "CODEQL_EXTRACTOR_CPP_AUTOINSTALL_DEPENDENCIES",
    legacyApi: true,
-    minimumVersion: undefined,
+    minimumVersion: "2.15.0",
  },
  [Feature.CsharpCacheBuildModeNone]: {
    defaultValue: false,
@@ -7,42 +7,35 @@ import test from "ava";
 import * as sinon from "sinon";

 import * as actionsUtil from "./actions-util";
-import { ActionsEnvVars, EnvVar } from "./environment";
 import * as gitUtils from "./git-utils";
-import { getTestEnv, setupActionsVars, setupTests } from "./testing-utils";
+import { setupActionsVars, setupTests } from "./testing-utils";
 import { withTmpDir } from "./util";

 setupTests(test);

-test("getRef() throws on the empty string", async (t) => {
-  const env = getTestEnv({ [ActionsEnvVars.GITHUB_REF]: "" });
-  await t.throwsAsync(() => gitUtils.getRef(env, ""));
+test.serial("getRef() throws on the empty string", async (t) => {
+  process.env["GITHUB_REF"] = "";
+  await t.throwsAsync(gitUtils.getRef);
 });

 test.serial(
  "getRef() returns merge PR ref if GITHUB_SHA still checked out",
  async (t) => {
    await withTmpDir(async (tmpDir: string) => {
+      setupActionsVars(tmpDir, tmpDir);
      const expectedRef = "refs/pull/1/merge";
      const currentSha = "a".repeat(40);
-
-      const env = getTestEnv();
-      setupActionsVars(tmpDir, tmpDir, {}, env);
-      env.setAll({
-        [ActionsEnvVars.GITHUB_REF]: expectedRef,
-        [ActionsEnvVars.GITHUB_SHA]: currentSha,
-      });
+      process.env["GITHUB_REF"] = expectedRef;
+      process.env["GITHUB_SHA"] = currentSha;

      const callback = sinon.stub(gitUtils, "getCommitOid");
-      callback
-        .withArgs(sinon.match.any, sinon.match.string, "HEAD")
-        .resolves(currentSha);
+      callback.withArgs(sinon.match.string, "HEAD").resolves(currentSha);

-      const actualRef = await gitUtils.getRef(env, tmpDir);
+      const actualRef = await gitUtils.getRef();
      t.deepEqual(actualRef, expectedRef);

      t.is(callback.callCount, 1);
-      t.true(callback.calledOnceWith(env, tmpDir, "HEAD"));
+      t.true(callback.calledOnceWith(tmpDir, "HEAD"));
    });
  },
 );
@@ -51,33 +44,24 @@ test.serial(
  "getRef() returns merge PR ref if GITHUB_REF still checked out but sha has changed (actions checkout@v1)",
  async (t) => {
    await withTmpDir(async (tmpDir: string) => {
+      setupActionsVars(tmpDir, tmpDir);
      const expectedRef = "refs/pull/1/merge";
-      const env = getTestEnv();
-      setupActionsVars(tmpDir, tmpDir, {}, env);
-      env.setAll({
-        [ActionsEnvVars.GITHUB_REF]: expectedRef,
-        [ActionsEnvVars.GITHUB_SHA]: "b".repeat(40),
-      });
+      process.env["GITHUB_REF"] = expectedRef;
+      process.env["GITHUB_SHA"] = "b".repeat(40);
      const sha = "a".repeat(40);

      const callback = sinon.stub(gitUtils, "getCommitOid");
      callback
-        .withArgs(
-          sinon.match.any,
-          sinon.match.string,
-          "refs/remotes/pull/1/merge",
-        )
-        .resolves(sha);
-      callback
-        .withArgs(sinon.match.any, sinon.match.string, "HEAD")
+        .withArgs(sinon.match.string, "refs/remotes/pull/1/merge")
        .resolves(sha);
+      callback.withArgs(sinon.match.any, "HEAD").resolves(sha);

-      const actualRef = await gitUtils.getRef(env, tmpDir);
+      const actualRef = await gitUtils.getRef();
      t.deepEqual(actualRef, expectedRef);

      t.is(callback.callCount, 2);
-      t.true(callback.calledWith(env, tmpDir, "HEAD"));
-      t.true(callback.calledWith(env, tmpDir, "refs/remotes/pull/1/merge"));
+      t.true(callback.calledWith(tmpDir, "HEAD"));
+      t.true(callback.calledWith(tmpDir, "refs/remotes/pull/1/merge"));
    });
  },
 );
@@ -86,28 +70,23 @@ test.serial(
  "getRef() returns head PR ref if GITHUB_REF no longer checked out",
  async (t) => {
    await withTmpDir(async (tmpDir: string) => {
-      const env = getTestEnv();
-      setupActionsVars(tmpDir, tmpDir, {}, env);
-      env.setAll({
-        [ActionsEnvVars.GITHUB_REF]: "refs/pull/1/merge",
-        [ActionsEnvVars.GITHUB_SHA]: "a".repeat(40),
-      });
+      setupActionsVars(tmpDir, tmpDir);
+      process.env["GITHUB_REF"] = "refs/pull/1/merge";
+      process.env["GITHUB_SHA"] = "a".repeat(40);

      const callback = sinon.stub(gitUtils, "getCommitOid");
      callback
-        .withArgs(sinon.match.any, tmpDir, "refs/remotes/pull/1/merge")
+        .withArgs(tmpDir, "refs/remotes/pull/1/merge")
        .resolves("a".repeat(40));
-      callback
-        .withArgs(sinon.match.any, tmpDir, "HEAD")
-        .resolves("b".repeat(40));
+      callback.withArgs(tmpDir, "HEAD").resolves("b".repeat(40));
      callback.throws(new Error("Unexpected getCommitOid call in test."));

-      const actualRef = await gitUtils.getRef(env, tmpDir);
+      const actualRef = await gitUtils.getRef();
      t.deepEqual(actualRef, "refs/pull/1/head");

      t.is(callback.callCount, 2);
-      t.true(callback.calledWith(env, tmpDir, "refs/remotes/pull/1/merge"));
-      t.true(callback.calledWith(env, tmpDir, "HEAD"));
+      t.true(callback.calledWith(tmpDir, "refs/remotes/pull/1/merge"));
+      t.true(callback.calledWith(tmpDir, "HEAD"));
    });
  },
 );
@@ -116,6 +95,7 @@ test.serial(
  "getRef() returns ref provided as an input and ignores current HEAD",
  async (t) => {
    await withTmpDir(async (tmpDir: string) => {
+      setupActionsVars(tmpDir, tmpDir);
      const getAdditionalInputStub = sinon.stub(
        actionsUtil,
        "getOptionalInput",
@@ -124,22 +104,14 @@ test.serial(
      getAdditionalInputStub.withArgs("sha").resolves("b".repeat(40));

      // These values are be ignored
-      const env = getTestEnv();
-      setupActionsVars(tmpDir, tmpDir, {}, env);
-      env.setAll({
-        [ActionsEnvVars.GITHUB_REF]: "refs/pull/1/merge",
-        [ActionsEnvVars.GITHUB_SHA]: "a".repeat(40),
-      });
+      process.env["GITHUB_REF"] = "refs/pull/1/merge";
+      process.env["GITHUB_SHA"] = "a".repeat(40);

      const callback = sinon.stub(gitUtils, "getCommitOid");
-      callback
-        .withArgs(sinon.match.any, tmpDir, "refs/pull/1/merge")
-        .resolves("b".repeat(40));
-      callback
-        .withArgs(sinon.match.any, sinon.match.string, "HEAD")
-        .resolves("b".repeat(40));
+      callback.withArgs(tmpDir, "refs/pull/1/merge").resolves("b".repeat(40));
+      callback.withArgs(sinon.match.any, "HEAD").resolves("b".repeat(40));

-      const actualRef = await gitUtils.getRef(env, tmpDir);
+      const actualRef = await gitUtils.getRef();
      t.deepEqual(actualRef, "refs/pull/2/merge");

      // getCommitOid shouldn't be called, because the ref should be taken from the input
@@ -152,17 +124,14 @@ test.serial(
  "getRef() returns CODE_SCANNING_REF as a fallback for GITHUB_REF",
  async (t) => {
    await withTmpDir(async (tmpDir: string) => {
+      setupActionsVars(tmpDir, tmpDir);
      const expectedRef = "refs/pull/1/HEAD";
      const currentSha = "a".repeat(40);
-      const env = getTestEnv();
-      setupActionsVars(tmpDir, tmpDir, {}, env);
-      env.setAll({
-        [EnvVar.CODE_SCANNING_REF]: expectedRef,
-        [ActionsEnvVars.GITHUB_REF]: "",
-        [ActionsEnvVars.GITHUB_SHA]: currentSha,
-      });
+      process.env["CODE_SCANNING_REF"] = expectedRef;
+      process.env["GITHUB_REF"] = "";
+      process.env["GITHUB_SHA"] = currentSha;

-      const actualRef = await gitUtils.getRef(env, tmpDir);
+      const actualRef = await gitUtils.getRef();
      t.deepEqual(actualRef, expectedRef);
    });
  },
@@ -172,17 +141,14 @@ test.serial(
  "getRef() returns GITHUB_REF over CODE_SCANNING_REF if both are provided",
  async (t) => {
    await withTmpDir(async (tmpDir: string) => {
+      setupActionsVars(tmpDir, tmpDir);
      const expectedRef = "refs/pull/1/merge";
      const currentSha = "a".repeat(40);
-      const env = getTestEnv();
-      setupActionsVars(tmpDir, tmpDir, {}, env);
-      env.setAll({
-        [EnvVar.CODE_SCANNING_REF]: "refs/pull/1/HEAD",
-        [ActionsEnvVars.GITHUB_REF]: expectedRef,
-        [ActionsEnvVars.GITHUB_SHA]: currentSha,
-      });
+      process.env["CODE_SCANNING_REF"] = "refs/pull/1/HEAD";
+      process.env["GITHUB_REF"] = expectedRef;
+      process.env["GITHUB_SHA"] = currentSha;

-      const actualRef = await gitUtils.getRef(env, tmpDir);
+      const actualRef = await gitUtils.getRef();
      t.deepEqual(actualRef, expectedRef);
    });
  },
@@ -192,9 +158,7 @@ test.serial(
  "getRef() throws an error if only `ref` is provided as an input",
  async (t) => {
    await withTmpDir(async (tmpDir: string) => {
-      const env = getTestEnv();
-      setupActionsVars(tmpDir, tmpDir, {}, env);
-
+      setupActionsVars(tmpDir, tmpDir);
      const getAdditionalInputStub = sinon.stub(
        actionsUtil,
        "getOptionalInput",
@@ -203,7 +167,7 @@ test.serial(

      await t.throwsAsync(
        async () => {
-          await gitUtils.getRef(env, tmpDir);
+          await gitUtils.getRef();
        },
        {
          instanceOf: Error,
@@ -219,12 +183,8 @@ test.serial(
  "getRef() throws an error if only `sha` is provided as an input",
  async (t) => {
    await withTmpDir(async (tmpDir: string) => {
-      const env = getTestEnv();
-      setupActionsVars(tmpDir, tmpDir, {}, env);
-      env.setAll({
-        [ActionsEnvVars.GITHUB_WORKSPACE]: "/tmp",
-      });
-
+      setupActionsVars(tmpDir, tmpDir);
+      process.env["GITHUB_WORKSPACE"] = "/tmp";
      const getAdditionalInputStub = sinon.stub(
        actionsUtil,
        "getOptionalInput",
@@ -233,7 +193,7 @@ test.serial(

      await t.throwsAsync(
        async () => {
-          await gitUtils.getRef(env, tmpDir);
+          await gitUtils.getRef();
        },
        {
          instanceOf: Error,
@@ -246,16 +206,13 @@ test.serial(
 );

 test.serial("isAnalyzingDefaultBranch()", async (t) => {
-  const env = getTestEnv({
-    [ActionsEnvVars.GITHUB_EVENT_NAME]: "push",
-    CODE_SCANNING_IS_ANALYZING_DEFAULT_BRANCH: "true",
-  });
-  t.deepEqual(await gitUtils.isAnalyzingDefaultBranch(env, ""), true);
-
-  env.set("CODE_SCANNING_IS_ANALYZING_DEFAULT_BRANCH", "false");
+  process.env["GITHUB_EVENT_NAME"] = "push";
+  process.env["CODE_SCANNING_IS_ANALYZING_DEFAULT_BRANCH"] = "true";
+  t.deepEqual(await gitUtils.isAnalyzingDefaultBranch(), true);
+  process.env["CODE_SCANNING_IS_ANALYZING_DEFAULT_BRANCH"] = "false";

  await withTmpDir(async (tmpDir) => {
-    setupActionsVars(tmpDir, tmpDir, {}, env);
+    setupActionsVars(tmpDir, tmpDir);
    const envFile = path.join(tmpDir, "event.json");
    fs.writeFileSync(
      envFile,
@@ -265,17 +222,17 @@ test.serial("isAnalyzingDefaultBranch()", async (t) => {
        },
      }),
    );
-    env.set(ActionsEnvVars.GITHUB_EVENT_PATH, envFile);
+    process.env["GITHUB_EVENT_PATH"] = envFile;

-    env.set(ActionsEnvVars.GITHUB_REF, "main");
-    env.set(ActionsEnvVars.GITHUB_SHA, "1234");
-    t.deepEqual(await gitUtils.isAnalyzingDefaultBranch(env, tmpDir), true);
+    process.env["GITHUB_REF"] = "main";
+    process.env["GITHUB_SHA"] = "1234";
+    t.deepEqual(await gitUtils.isAnalyzingDefaultBranch(), true);

-    env.set(ActionsEnvVars.GITHUB_REF, "refs/heads/main");
-    t.deepEqual(await gitUtils.isAnalyzingDefaultBranch(env, tmpDir), true);
+    process.env["GITHUB_REF"] = "refs/heads/main";
+    t.deepEqual(await gitUtils.isAnalyzingDefaultBranch(), true);

-    env.set(ActionsEnvVars.GITHUB_REF, "feature");
-    t.deepEqual(await gitUtils.isAnalyzingDefaultBranch(env, tmpDir), false);
+    process.env["GITHUB_REF"] = "feature";
+    t.deepEqual(await gitUtils.isAnalyzingDefaultBranch(), false);

    fs.writeFileSync(
      envFile,
@@ -283,9 +240,9 @@ test.serial("isAnalyzingDefaultBranch()", async (t) => {
        schedule: "0 0 * * *",
      }),
    );
-    env.set(ActionsEnvVars.GITHUB_EVENT_NAME, "schedule");
-    env.set(ActionsEnvVars.GITHUB_REF, "refs/heads/main");
-    t.deepEqual(await gitUtils.isAnalyzingDefaultBranch(env, tmpDir), true);
+    process.env["GITHUB_EVENT_NAME"] = "schedule";
+    process.env["GITHUB_REF"] = "refs/heads/main";
+    t.deepEqual(await gitUtils.isAnalyzingDefaultBranch(), true);

    const getAdditionalInputStub = sinon.stub(actionsUtil, "getOptionalInput");
    getAdditionalInputStub
@@ -294,9 +251,9 @@ test.serial("isAnalyzingDefaultBranch()", async (t) => {
    getAdditionalInputStub
      .withArgs("sha")
      .resolves("0000000000000000000000000000000000000000");
-    env.set(ActionsEnvVars.GITHUB_EVENT_NAME, "schedule");
-    env.set(ActionsEnvVars.GITHUB_REF, "refs/heads/main");
-    t.deepEqual(await gitUtils.isAnalyzingDefaultBranch(env, tmpDir), false);
+    process.env["GITHUB_EVENT_NAME"] = "schedule";
+    process.env["GITHUB_REF"] = "refs/heads/main";
+    t.deepEqual(await gitUtils.isAnalyzingDefaultBranch(), false);
  });
 });

@@ -13,7 +13,6 @@ import {
  getWorkflowEvent,
  getWorkflowEventName,
 } from "./actions-util";
-import { ActionsEnvVars, EnvVar, type ReadOnlyEnv } from "./environment";
 import { ConfigurationError, getRequiredEnvParam } from "./util";

 /**
@@ -102,7 +101,6 @@ export const runGitCommand = async function (
 * Gets the SHA of the commit that is currently checked out.
 */
 export const getCommitOid = async function (
-  env: ReadOnlyEnv,
  checkoutPath: string,
  ref = "HEAD",
 ): Promise<string> {
@@ -121,9 +119,7 @@ export const getCommitOid = async function (
    );
    return stdout.trim();
  } catch {
-    return (
-      getOptionalInput("sha") || env.getRequired(ActionsEnvVars.GITHUB_SHA)
-    );
+    return getOptionalInput("sha") || getRequiredEnvParam("GITHUB_SHA");
  }
 };

@@ -245,7 +241,7 @@ export const getGitRoot = async function (
      ["rev-parse", "--show-toplevel"],
      `Cannot find Git repository root from the source root ${sourceRoot}.`,
    );
-    return path.resolve(stdout.trim());
+    return stdout.trim();
  } catch {
    // Errors are already logged by runGitCommand()
    return undefined;
@@ -318,18 +314,18 @@ export const getFileOidsUnderPath = async function (
  return fileOidMap;
 };

-function getRefFromEnv(env: ReadOnlyEnv): string {
+function getRefFromEnv(): string {
  // To workaround a limitation of Actions dynamic workflows not setting
  // the GITHUB_REF in some cases, we accept also the ref within the
  // CODE_SCANNING_REF variable. When possible, however, we prefer to use
  // the GITHUB_REF as that is a protected variable and cannot be overwritten.
  let refEnv: string;
  try {
-    refEnv = env.getRequired(ActionsEnvVars.GITHUB_REF);
+    refEnv = getRequiredEnvParam("GITHUB_REF");
  } catch (e) {
    // If the GITHUB_REF is not set, we try to rescue by getting the
    // CODE_SCANNING_REF.
-    const maybeRef = env.getOptional(EnvVar.CODE_SCANNING_REF);
+    const maybeRef = process.env["CODE_SCANNING_REF"];
    if (maybeRef === undefined || maybeRef.length === 0) {
      throw e;
    }
@@ -341,16 +337,15 @@ function getRefFromEnv(env: ReadOnlyEnv): string {
 /**
 * Get the ref currently being analyzed.
 */
-export async function getRef(
-  env: ReadOnlyEnv,
-  checkoutPath: string | undefined,
-): Promise<string> {
+export async function getRef(): Promise<string> {
  // Will be in the form "refs/heads/master" on a push event
  // or in the form "refs/pull/N/merge" on a pull_request event
  const refInput = getOptionalInput("ref");
  const shaInput = getOptionalInput("sha");
-  checkoutPath =
-    checkoutPath ?? env.getRequired(ActionsEnvVars.GITHUB_WORKSPACE);
+  const checkoutPath =
+    getOptionalInput("checkout_path") ||
+    getOptionalInput("source-root") ||
+    getRequiredEnvParam("GITHUB_WORKSPACE");

  const hasRefInput = !!refInput;
  const hasShaInput = !!shaInput;
@@ -361,8 +356,8 @@ export async function getRef(
    );
  }

-  const ref = refInput || getRefFromEnv(env);
-  const sha = shaInput || env.getRequired(ActionsEnvVars.GITHUB_SHA);
+  const ref = refInput || getRefFromEnv();
+  const sha = shaInput || getRequiredEnvParam("GITHUB_SHA");

  // If the ref is a user-provided input, we have to skip logic
  // and assume that it is really where they want to upload the results.
@@ -379,7 +374,7 @@ export async function getRef(
    return ref;
  }

-  const head = await getCommitOid(env, checkoutPath, "HEAD");
+  const head = await getCommitOid(checkoutPath, "HEAD");

  // in actions/checkout@v2+ we can check if git rev-parse HEAD == GITHUB_SHA
  // in actions/checkout@v1 this may not be true as it checks out the repository
@@ -389,7 +384,6 @@ export async function getRef(
  const hasChangedRef =
    sha !== head &&
    (await getCommitOid(
-      env,
      checkoutPath,
      ref.replace(/^refs\/pull\//, "refs/remotes/pull/"),
    )) !== head;
@@ -416,23 +410,20 @@ function removeRefsHeadsPrefix(ref: string): string {
 * environment variable can be set in cases where repository information might not be available, for
 * example dynamic workflows.
 */
-export async function isAnalyzingDefaultBranch(
-  env: ReadOnlyEnv,
-  checkoutPath: string | undefined,
-): Promise<boolean> {
-  if (env.getOptional("CODE_SCANNING_IS_ANALYZING_DEFAULT_BRANCH") === "true") {
+export async function isAnalyzingDefaultBranch(): Promise<boolean> {
+  if (process.env.CODE_SCANNING_IS_ANALYZING_DEFAULT_BRANCH === "true") {
    return true;
  }

  // Get the current ref and trim and refs/heads/ prefix
-  let currentRef = await getRef(env, checkoutPath);
+  let currentRef = await getRef();
  currentRef = removeRefsHeadsPrefix(currentRef);

-  const event = getWorkflowEvent(env);
+  const event = getWorkflowEvent();
  let defaultBranch = event?.repository?.default_branch;

-  if (getWorkflowEventName(env) === "schedule") {
-    defaultBranch = removeRefsHeadsPrefix(getRefFromEnv(env));
+  if (getWorkflowEventName() === "schedule") {
+    defaultBranch = removeRefsHeadsPrefix(getRefFromEnv());
  }

  return currentRef === defaultBranch;
@@ -1,111 +0,0 @@
-import test from "ava";
-
-import { ActionsEnvVars } from "./environment";
-import * as github from "./github";
-import { getTestEnv, setupTests } from "./testing-utils";
-
-setupTests(test);
-
-test("parseGitHubUrl", (t) => {
-  t.deepEqual(github.parseGitHubUrl("github.com"), "https://github.com");
-  t.deepEqual(
-    github.parseGitHubUrl("https://github.com"),
-    "https://github.com",
-  );
-  t.deepEqual(
-    github.parseGitHubUrl("https://api.github.com"),
-    "https://github.com",
-  );
-  t.deepEqual(
-    github.parseGitHubUrl("https://github.com/foo/bar"),
-    "https://github.com",
-  );
-
-  t.deepEqual(
-    github.parseGitHubUrl("github.example.com"),
-    "https://github.example.com/",
-  );
-  t.deepEqual(
-    github.parseGitHubUrl("https://github.example.com"),
-    "https://github.example.com/",
-  );
-  t.deepEqual(
-    github.parseGitHubUrl("https://api.github.example.com"),
-    "https://github.example.com/",
-  );
-  t.deepEqual(
-    github.parseGitHubUrl("https://github.example.com/api/v3"),
-    "https://github.example.com/",
-  );
-  t.deepEqual(
-    github.parseGitHubUrl("https://github.example.com:1234"),
-    "https://github.example.com:1234/",
-  );
-  t.deepEqual(
-    github.parseGitHubUrl("https://api.github.example.com:1234"),
-    "https://github.example.com:1234/",
-  );
-  t.deepEqual(
-    github.parseGitHubUrl("https://github.example.com:1234/api/v3"),
-    "https://github.example.com:1234/",
-  );
-  t.deepEqual(
-    github.parseGitHubUrl("https://github.example.com/base/path"),
-    "https://github.example.com/base/path/",
-  );
-  t.deepEqual(
-    github.parseGitHubUrl("https://github.example.com/base/path/api/v3"),
-    "https://github.example.com/base/path/",
-  );
-
-  t.throws(() => github.parseGitHubUrl(""), {
-    message: '"" is not a valid URL',
-  });
-  t.throws(() => github.parseGitHubUrl("ssh://github.com"), {
-    message: '"ssh://github.com" is not a http or https URL',
-  });
-  t.throws(() => github.parseGitHubUrl("http:///::::433"), {
-    message: '"http:///::::433" is not a valid URL',
-  });
-});
-
-test("getCurrentInstance throws if required env vars aren't set", (t) => {
-  t.throws(() => github.getCurrentInstance(getTestEnv()));
-  t.throws(() => {
-    const env = getTestEnv({
-      [ActionsEnvVars.GITHUB_SERVER_URL]: "https://localhost",
-    });
-    github.getCurrentInstance(env);
-  });
-  t.throws(() => {
-    const env = getTestEnv({
-      [ActionsEnvVars.GITHUB_API_URL]: "https://api.localhost",
-    });
-    github.getCurrentInstance(env);
-  });
-});
-
-test("getCurrentInstance constructs instance from environment", (t) => {
-  const url = "https://localhost";
-  const apiUrl = "https://api.localhost";
-
-  const env = getTestEnv({
-    [ActionsEnvVars.GITHUB_SERVER_URL]: url,
-    [ActionsEnvVars.GITHUB_API_URL]: apiUrl,
-  });
-  const instance = github.getCurrentInstance(env);
-
-  t.is(instance.url, url);
-  t.is(instance.apiURL, apiUrl);
-});
-
-test("getCurrentInstance constructs dotcom instance with dotcom env vars", (t) => {
-  const env = getTestEnv({
-    [ActionsEnvVars.GITHUB_SERVER_URL]: github.GITHUB_DOTCOM_URL,
-    [ActionsEnvVars.GITHUB_API_URL]: github.GITHUB_DOTCOM_API_URL,
-  });
-  const instance = github.getCurrentInstance(env);
-  const dotcomInstance = github.getDotcomInstance();
-
-  t.deepEqual(dotcomInstance, instance);
-});
@@ -1,110 +0,0 @@
-import { ActionsEnvVars, type ReadOnlyEnv } from "./environment";
-import { ConfigurationError } from "./util";
-
-/** A string representing a GitHub instance address. */
-export type InstanceURL = string;
-
-/**
- * The URL for github.com.
- */
-export const GITHUB_DOTCOM_URL: InstanceURL = "https://github.com";
-
-/** A string representing a GitHub API instance address. */
-export type InstanceApiURL = string;
-
-/**
- * The URL for api.github.com.
- */
-export const GITHUB_DOTCOM_API_URL: InstanceApiURL = "https://api.github.com";
-
-/**
- * Represents information about a GitHub instance, how to authenticate to it,
- * and how to authenticate to other repos on it.
- */
-export type GitHubApiCombinedDetails = GitHubApiDetails &
-  GitHubApiExternalRepoDetails;
-
-/** Represents information about a GitHub instance. */
-export type GitHubInstance = {
-  /** The base URL of the GitHub instance, such as `https://github.com`. */
-  url: string;
-  /**
-   * The API base URL of the GitHub instance, such as `https://api.github.com`.
-   * Typically this is the `api.` subdomain of the `url` domain.
-   */
-  apiURL: string | undefined;
-};
-
-/** Represents a {@link GitHubInstance} with a token for accessing the API. */
-export type GitHubApiDetails = GitHubInstance & {
-  /** The token to use for accessing the API of the GitHub instance. */
-  auth?: string;
-};
-
-/**
- * Represents information for accessing a repository on the same GitHub instance as the Action
- * is currently running on.
- */
-export type GitHubApiExternalRepoDetails = {
-  /** An optional token for accessing repo(s) on the same GitHub instance. */
-  externalRepoAuth?: string;
-};
-
-/**
- * Parses user input of a github.com or GHES URL to a canonical form.
- * Removes any API prefix or suffix if one is present.
- */
-export function parseGitHubUrl(inputUrl: string): string {
-  const originalUrl = inputUrl;
-  if (inputUrl.indexOf("://") === -1) {
-    inputUrl = `https://${inputUrl}`;
-  }
-  if (!inputUrl.startsWith("http://") && !inputUrl.startsWith("https://")) {
-    throw new ConfigurationError(`"${originalUrl}" is not a http or https URL`);
-  }
-
-  let url: URL;
-  try {
-    url = new URL(inputUrl);
-  } catch {
-    throw new ConfigurationError(`"${originalUrl}" is not a valid URL`);
-  }
-
-  // If we detect this is trying to be to github.com
-  // then return with a fixed canonical URL.
-  if (url.hostname === "github.com" || url.hostname === "api.github.com") {
-    return GITHUB_DOTCOM_URL;
-  }
-
-  // Remove the API prefix if it's present
-  if (url.pathname.indexOf("/api/v3") !== -1) {
-    url.pathname = url.pathname.substring(0, url.pathname.indexOf("/api/v3"));
-  }
-  // Also consider subdomain isolation on GHES
-  if (url.hostname.startsWith("api.")) {
-    url.hostname = url.hostname.substring(4);
-  }
-
-  // Normalise path to having a trailing slash for consistency
-  if (!url.pathname.endsWith("/")) {
-    url.pathname = `${url.pathname}/`;
-  }
-
-  return url.toString();
-}
-
-/** Retrieves a {@link GitHubInstance} describing the instance we are running on. */
-export function getCurrentInstance(env: ReadOnlyEnv): GitHubInstance {
-  return {
-    url: env.getRequired(ActionsEnvVars.GITHUB_SERVER_URL),
-    apiURL: env.getRequired(ActionsEnvVars.GITHUB_API_URL),
-  };
-}
-
-/** Retrieves a {@link GitHubInstance} describing the GitHub.com instance. */
-export function getDotcomInstance(): GitHubInstance {
-  return {
-    url: GITHUB_DOTCOM_URL,
-    apiURL: GITHUB_DOTCOM_API_URL,
-  };
-}
@@ -7,11 +7,6 @@ import * as actionsUtil from "./actions-util";
 import { CodeScanning, RiskAssessment } from "./analyses";
 import { getApiClient, getGitHubVersion } from "./api-client";
 import { CodeQL, getCodeQL } from "./codeql";
-import {
-  hasConfigKey,
-  type AbortedInitConfig,
-  type ActionConfig,
-} from "./config/action-config";
 import {
  Config,
  isCodeScanningEnabled,
@@ -21,7 +16,6 @@ import {
  getArtifactSuffix,
  getArtifactUploaderClient,
  sanitizeArtifactName,
-  type UploadDebugArtifactsConfig,
 } from "./debug-artifacts";
 import * as dependencyCaching from "./dependency-caching";
 import { EnvVar, ReadOnlyEnv } from "./environment";
@@ -50,7 +44,7 @@ import {
 } from "./util";
 import {
  getCategoryInputOrThrow,
-  getRepositoryRootOrThrow,
+  getCheckoutPathInputOrThrow,
  getUploadInputOrThrow,
  getWorkflow,
 } from "./workflow";
@@ -92,11 +86,6 @@ interface FailedSarifInfo {
  checkoutPath: string;
 }

-/** The minimal Action configuration required to prepare and upload a failed SARIF. */
-export type FailedSarifConfig = ActionConfig<
-  "codeQLCmd" | "tempDir" | "analysisKinds" | "languages"
->;
-
 /**
 * Tries to prepare a SARIF file that contains information about a failed analysis.
 *
@@ -105,7 +94,7 @@ export type FailedSarifConfig = ActionConfig<
 async function prepareFailedSarif(
  logger: Logger,
  features: FeatureEnablement,
-  config: FailedSarifConfig,
+  config: Config,
 ): Promise<Result<FailedSarifInfo, UploadFailedSarifResult>> {
  if (!config.codeQLCmd) {
    return new Failure({
@@ -155,15 +144,7 @@ async function prepareFailedSarif(
      });
    }
    const category = getCategoryInputOrThrow(workflow, jobName, matrix);
-
-    // Try to determine the path at which the repository that we failed to analyse is checked out at.
-    // We need this to relativise the paths in the SARIF.
-    const checkoutPath = getRepositoryRootOrThrow(
-      workflow,
-      jobName,
-      matrix,
-      config,
-    );
+    const checkoutPath = getCheckoutPathInputOrThrow(workflow, jobName, matrix);

    const result = await generateFailedSarif(
      logger,
@@ -179,7 +160,7 @@ async function prepareFailedSarif(
 async function generateFailedSarif(
  logger: Logger,
  features: FeatureEnablement,
-  config: ActionConfig<"codeQLCmd" | "tempDir">,
+  config: Config,
  category: string | undefined,
  checkoutPath: string,
  sarifFile?: string,
@@ -211,7 +192,7 @@ async function generateFailedSarif(
 * category for the workflow.
 */
 async function maybeUploadFailedSarif(
-  config: FailedSarifConfig,
+  config: Config,
  repositoryNwo: RepositoryNwo,
  features: FeatureEnablement,
  logger: Logger,
@@ -246,7 +227,7 @@ async function maybeUploadFailedSarif(

 /** Uploads a failed SARIF file as workflow artifact, if it can be generated. */
 async function maybeUploadFailedSarifArtifact(
-  config: FailedSarifConfig,
+  config: Config,
  features: FeatureEnablement,
  logger: Logger,
 ): Promise<UploadFailedSarifResult> {
@@ -286,7 +267,7 @@ async function maybeUploadFailedSarifArtifact(
 * @returns The results of uploading the SARIF file for the failure.
 */
 export async function tryUploadSarifIfRunFailed(
-  config: FailedSarifConfig,
+  config: Config,
  repositoryNwo: RepositoryNwo,
  features: FeatureEnablement,
  logger: Logger,
@@ -343,12 +324,13 @@ export async function tryUploadSarifIfRunFailed(
 export async function uploadFailureInfo(
  uploadAllAvailableDebugArtifacts: (
    codeql: CodeQL,
-    config: UploadDebugArtifactsConfig,
+    config: Config,
    logger: Logger,
+    codeQlVersion: string,
  ) => Promise<void>,
-  printDebugLogs: (logger: Logger, config: Partial<Config>) => Promise<void>,
+  printDebugLogs: (config: Config) => Promise<void>,
  codeql: CodeQL,
-  config: Config | AbortedInitConfig,
+  config: Config,
  repositoryNwo: RepositoryNwo,
  features: FeatureEnablement,
  jobStatus: string | undefined,
@@ -395,15 +377,21 @@ export async function uploadFailureInfo(
  }

  // Upload appropriate Actions artifacts for debugging
-  if (config.debugMode && hasConfigKey(config, "dbLocation")) {
+  if (config.debugMode) {
    logger.info(
      "Debug mode is on. Uploading available database bundles and logs as Actions debugging artifacts...",
    );
-    await uploadAllAvailableDebugArtifacts(codeql, config, logger);
-    await printDebugLogs(logger, config);
+    const version = await codeql.getVersion();
+    await uploadAllAvailableDebugArtifacts(
+      codeql,
+      config,
+      logger,
+      version.version,
+    );
+    await printDebugLogs(config);
  }

-  if (actionsUtil.isSelfHostedRunner() && config.dbLocation) {
+  if (actionsUtil.isSelfHostedRunner()) {
    try {
      fs.rmSync(config.dbLocation, {
        recursive: true,
@@ -418,10 +406,6 @@ export async function uploadFailureInfo(
        `Failed to clean up database cluster directory ${config.dbLocation}. Details: ${e}`,
      );
    }
-  } else if (config.dbLocation === undefined) {
-    logger.debug(
-      "Skipping cleanup of database cluster directory since the configuration does not include a database path.",
-    );
  } else {
    logger.debug(
      "Skipping cleanup of database cluster directory since we are running on a GitHub-hosted " +
@@ -470,7 +454,7 @@ function isConclusiveJobStatus(jobStatus: string | undefined): boolean {
 */
 async function recordOverlayStatus(
  codeql: CodeQL,
-  config: Partial<Config>,
+  config: Config,
  features: FeatureEnablement,
  jobStatus: string | undefined,
  env: ReadOnlyEnv,
@@ -482,11 +466,6 @@ async function recordOverlayStatus(
    !(await features.getValue(Feature.OverlayAnalysisStatusSave))
  ) {
    return;
-  } else if (config.languages === undefined) {
-    logger.debug(
-      "Not recording overlay status, because the configuration contains no 'languages'.",
-    );
-    return;
  }

  // Only record a failure when the job outcome tells us something about the analysis. A cancelled
@@ -6,7 +6,6 @@

 import * as core from "@actions/core";

-import { runInActions, type Action, type ActionState } from "./action-common";
 import {
  restoreInputs,
  getOptionalInput,
@@ -16,25 +15,22 @@ import {
 import { getGitHubVersion, wrapApiConfigurationError } from "./api-client";
 import { CachingKind } from "./caching-utils";
 import { getCodeQL } from "./codeql";
-import {
-  hasConfigKey,
-  type AbortedInitConfig,
-  type Config,
-} from "./config/action-config";
-import { getAbortedInitConfig, getConfig } from "./config-utils";
+import { type Config, getConfig } from "./config-utils";
 import * as debugArtifacts from "./debug-artifacts";
 import {
  DependencyCachingUsageReport,
  getDependencyCacheUsage,
 } from "./dependency-caching";
-import { EnvVar, type ReadOnlyEnv } from "./environment";
+import { EnvVar, getEnv } from "./environment";
 import { initFeatures } from "./feature-flags";
 import * as gitUtils from "./git-utils";
 import * as initActionPostHelper from "./init-action-post-helper";
+import { getActionsLogger } from "./logging";
 import { getRepositoryNwo } from "./repository";
 import {
  StatusReportBase,
  sendStatusReport,
+  sendUnhandledErrorStatusReport,
  createStatusReportBase,
  getActionsStatus,
  ActionName,
@@ -49,17 +45,16 @@ interface InitPostStatusReport
    initActionPostHelper.JobStatusReport,
    initActionPostHelper.DependencyCachingUsageReport {}

-async function run(action: ActionState<["Base", "Logger", "Env"]>) {
+async function run(startedAt: Date) {
  // To capture errors appropriately, keep as much code within the try-catch as
  // possible, and only use safe functions outside.
-  const logger = action.logger;

-  let config: Config | AbortedInitConfig | undefined;
+  const logger = getActionsLogger();
+  let config: Config | undefined;
  let uploadFailedSarifResult:
    | initActionPostHelper.UploadFailedSarifResult
    | undefined;
  let dependencyCachingUsage: DependencyCachingUsageReport | undefined;
-
  try {
    // Read the job status before restoring inputs, since it is provided by the Actions runtime
    // environment for this step and would otherwise be overwritten by the value that the `init`
@@ -69,15 +64,7 @@ async function run(action: ActionState<["Base", "Logger", "Env"]>) {
    // Restore inputs from `init` Action.
    restoreInputs(logger);

-    const tmpDir = getTemporaryDirectory();
-    config = await getConfig(tmpDir, logger);
-
-    // If we weren't able to read the normal configuration file, the `init` step failed before it could write it.
-    // Try to load the "failed" configuration file instead which may have been written by the `init` step
-    // with a minimal configuration for this post-action.
-    if (config === undefined) {
-      config = getAbortedInitConfig(action, tmpDir);
-    }
+    config = await getConfig(getTemporaryDirectory(), logger);

    const gitHubVersion = config?.gitHubVersion ?? (await getGitHubVersion());
    checkGitHubVersionInRange(gitHubVersion, logger);
@@ -105,7 +92,7 @@ async function run(action: ActionState<["Base", "Logger", "Env"]>) {
        repositoryNwo,
        features,
        jobStatus,
-        action.env,
+        getEnv(),
        logger,
      );

@@ -114,11 +101,7 @@ async function run(action: ActionState<["Base", "Logger", "Env"]>) {
      // do this under these circumstances to avoid slowing down analyses for PRs
      // and where caching may not be enabled.
      if (
-        (await gitUtils.isAnalyzingDefaultBranch(
-          action.env,
-          config.repositoryRoot,
-        )) &&
-        hasConfigKey(config, "dependencyCachingEnabled") &&
+        (await gitUtils.isAnalyzingDefaultBranch()) &&
        config.dependencyCachingEnabled !== CachingKind.None
      ) {
        dependencyCachingUsage = await getDependencyCacheUsage(logger);
@@ -129,9 +112,9 @@ async function run(action: ActionState<["Base", "Logger", "Env"]>) {
    core.setFailed(error.message);

    const statusReportBase = await createStatusReportBase(
-      action.name,
+      ActionName.InitPost,
      getActionsStatus(error),
-      action.startedAt,
+      startedAt,
      config,
      await checkDiskUsage(logger),
      logger,
@@ -143,13 +126,13 @@ async function run(action: ActionState<["Base", "Logger", "Env"]>) {
    }
    return;
  }
-  const jobStatus = getFinalJobStatus(action, config);
+  const jobStatus = getFinalJobStatus(config);
  logger.info(`CodeQL job status was ${getJobStatusDisplayName(jobStatus)}.`);

  const statusReportBase = await createStatusReportBase(
-    action.name,
+    ActionName.InitPost,
    "success",
-    action.startedAt,
+    startedAt,
    config,
    await checkDiskUsage(logger),
    logger,
@@ -174,21 +157,16 @@ async function run(action: ActionState<["Base", "Logger", "Env"]>) {
 * Otherwise, we determine the job status based on whether the analyze step
 * completed successfully and whether we have a valid CodeQL config.
 */
-function getFinalJobStatus(
-  action: ActionState<["Env"]>,
-  config: Partial<Config> | undefined,
-): JobStatus {
-  const existingJobStatus = getJobStatusFromEnvironment(action.env);
+function getFinalJobStatus(config: Config | undefined): JobStatus {
+  const existingJobStatus = getJobStatusFromEnvironment();
  if (existingJobStatus !== undefined) {
    return existingJobStatus;
  }

  let jobStatus: JobStatus;

-  if (
-    action.env.getOptional(EnvVar.ANALYZE_DID_COMPLETE_SUCCESSFULLY) === "true"
-  ) {
-    action.env.export(EnvVar.JOB_STATUS, JobStatus.SuccessStatus);
+  if (process.env[EnvVar.ANALYZE_DID_COMPLETE_SUCCESSFULLY] === "true") {
+    core.exportVariable(EnvVar.JOB_STATUS, JobStatus.SuccessStatus);
    jobStatus = JobStatus.SuccessStatus;
  } else if (config !== undefined) {
    // - We have computed a CodeQL config
@@ -213,7 +191,7 @@ function getFinalJobStatus(

  // This shouldn't be necessary, but in the odd case that we run more than one
  // `init` post step, ensure the job status is consistent between them.
-  action.env.export(EnvVar.JOB_STATUS, jobStatus);
+  core.exportVariable(EnvVar.JOB_STATUS, jobStatus);
  return jobStatus;
 }

@@ -222,8 +200,8 @@ function getFinalJobStatus(
 *
 * If the job status is invalid, return `UnknownStatus`.
 */
-function getJobStatusFromEnvironment(env: ReadOnlyEnv): JobStatus | undefined {
-  const jobStatusFromEnvironment = env.getOptional(EnvVar.JOB_STATUS);
+function getJobStatusFromEnvironment(): JobStatus | undefined {
+  const jobStatusFromEnvironment = process.env[EnvVar.JOB_STATUS];

  if (jobStatusFromEnvironment !== undefined) {
    // Validate the job status from the environment. If it is invalid, return unknown.
@@ -238,11 +216,18 @@ function getJobStatusFromEnvironment(env: ReadOnlyEnv): JobStatus | undefined {
  return undefined;
 }

-const initPost: Action = {
-  name: ActionName.InitPost,
-  run,
-};
-
 export async function runWrapper() {
-  return await runInActions(initPost);
+  const startedAt = new Date();
+  const logger = getActionsLogger();
+  try {
+    await run(startedAt);
+  } catch (error) {
+    core.setFailed(`init post action failed: ${wrapError(error).message}`);
+    await sendUnhandledErrorStatusReport(
+      ActionName.InitPost,
+      startedAt,
+      error,
+      logger,
+    );
+  }
 }
@@ -5,12 +5,7 @@ import * as core from "@actions/core";
 import * as io from "@actions/io";
 import * as semver from "semver";

-import {
-  Action,
-  ActionState,
-  extendActionState,
-  runInActions,
-} from "./action-common";
+import { Action, ActionState, runInActions } from "./action-common";
 import {
  FileCmdNotFoundError,
  getActionVersion,
@@ -50,7 +45,6 @@ import {
  loadRepositoryProperties,
  RepositoryPropertyName,
 } from "./feature-flags/properties";
-import * as github from "./github";
 import {
  checkInstallPython311,
  checkPacksForOverlayCompatibility,
@@ -99,6 +93,7 @@ import {
  checkActionVersion,
  getErrorMessage,
  BuildMode,
+  getOptionalEnvVar,
 } from "./util";
 import { checkWorkflow } from "./workflow";

@@ -234,7 +229,8 @@ async function run(
    apiDetails = {
      auth: getRequiredInput("token"),
      externalRepoAuth: getOptionalInput("external-repository-token"),
-      ...github.getCurrentInstance(actionState.env),
+      url: actionState.env.getRequired(ActionsEnvVars.GITHUB_SERVER_URL),
+      apiURL: actionState.env.getRequired(ActionsEnvVars.GITHUB_API_URL),
    };

    const gitHubVersion = await getGitHubVersion();
@@ -257,7 +253,7 @@ async function run(
    );
    const repositoryProperties = repositoryPropertiesResult.orElse({});

-    actionState.env.export(EnvVar.INIT_ACTION_HAS_RUN, "true");
+    core.exportVariable(EnvVar.INIT_ACTION_HAS_RUN, "true");

    // path.resolve() respects the intended semantics of source-root. If
    // source-root is relative, it is relative to the GITHUB_WORKSPACE. If
@@ -282,9 +278,7 @@ async function run(
    }

    // Compute the value of the `config-file` input.
-    const actionStateWithFeatures = extendActionState(actionState, {
-      features,
-    });
+    const actionStateWithFeatures = { ...actionState, features };
    configFile = await getConfigFileInput(
      actionStateWithFeatures,
      repositoryProperties,
@@ -355,7 +349,7 @@ async function run(
    // to the workflow log. No exceptions are thrown.
    await checkWorkflow(logger, codeql);

-    // Set CODEQL_ENABLE_EXPERIMENTAL_FEATURES for Rust if the CLI is older than 2.22.1.
+    // Set CODEQL_ENABLE_EXPERIMENTAL_FEATURES for Rust if between 2.19.3 (included) and 2.22.1 (excluded)
    // We need to set this environment variable before initializing the config, otherwise Rust
    // analysis will not be enabled (experimental language packs are only active with that environment
    // variable set to `true`).
@@ -366,10 +360,16 @@ async function run(
        .getRawLanguagesNoAutodetect(getOptionalInput("languages"))
        .includes(BuiltInLanguage.rust)
    ) {
+      const experimental = "2.19.3";
      const publicPreview = "2.22.1";
      const actualVer = (await codeql.getVersion()).version;
+      if (semver.lt(actualVer, experimental)) {
+        throw new ConfigurationError(
+          `Rust analysis is supported by CodeQL CLI version ${experimental} or higher, but found version ${actualVer}`,
+        );
+      }
      if (semver.lt(actualVer, publicPreview)) {
-        actionState.env.export(EnvVar.EXPERIMENTAL_FEATURES, "true");
+        core.exportVariable(EnvVar.EXPERIMENTAL_FEATURES, "true");
        logger.info("Experimental Rust analysis enabled");
      }
    }
@@ -457,18 +457,6 @@ async function run(

    await checkInstallPython311(config.languages, codeql);
  } catch (unwrappedError) {
-    // If we have initialised the Action state, then try to save a subset of it for use by the `init-post` action
-    // so that it can try to create and upload additional diagnostic information.
-    if (config !== undefined) {
-      try {
-        configUtils.saveAbortedInitConfig(actionState, config);
-      } catch (configSaveError) {
-        logger.warning(
-          `Unable to save configuration for '${ActionName.InitPost}' step: ${getErrorMessage(configSaveError)}`,
-        );
-      }
-    }
-
    const error = wrapError(unwrappedError);
    core.setFailed(error.message);
    const statusReportBase = await createStatusReportBase(
@@ -529,9 +517,9 @@ async function run(
    }

    // Forward Go flags
-    const goFlags = actionState.env.getOptional("GOFLAGS");
+    const goFlags = process.env["GOFLAGS"];
    if (goFlags) {
-      actionState.env.export("GOFLAGS", goFlags);
+      core.exportVariable("GOFLAGS", goFlags);
      core.warning(
        "Passing the GOFLAGS env parameter to the init action is deprecated. Please move this to the analyze action.",
      );
@@ -577,7 +565,7 @@ async function run(

            // Store the original location of our wrapper script somewhere where we can
            // later retrieve it from and cross-check that it hasn't been changed.
-            actionState.env.export(EnvVar.GO_BINARY_LOCATION, goWrapperPath);
+            core.exportVariable(EnvVar.GO_BINARY_LOCATION, goWrapperPath);
          } catch (e) {
            logger.warning(
              `Analyzing Go on Linux, but failed to install wrapper script. Tracing custom builds may fail: ${e}`,
@@ -586,7 +574,7 @@ async function run(
        } else {
          // Store the location of the original Go binary, so we can check that no setup tasks were performed after the
          // `init` Action ran.
-          actionState.env.export(EnvVar.GO_BINARY_LOCATION, goBinaryPath);
+          core.exportVariable(EnvVar.GO_BINARY_LOCATION, goBinaryPath);
        }
      } catch (e) {
        logger.warning(
@@ -621,12 +609,12 @@ async function run(
    // threads it would ask extractors to use. See help text for the "--ram" and "--threads"
    // options at https://codeql.github.com/docs/codeql-cli/manual/database-trace-command/
    // for details.
-    actionState.env.export(
+    core.exportVariable(
      "CODEQL_RAM",
      process.env["CODEQL_RAM"] ||
        getCodeQLMemoryLimit(getOptionalInput("ram"), logger).toString(),
    );
-    actionState.env.export(
+    core.exportVariable(
      "CODEQL_THREADS",
      process.env["CODEQL_THREADS"] ||
        getThreadsFlagValue(getOptionalInput("threads"), logger).toString(),
@@ -634,15 +622,21 @@ async function run(

    // Disable Kotlin extractor if feature flag set
    if (await features.getValue(Feature.DisableKotlinAnalysisEnabled)) {
-      actionState.env.export(
-        "CODEQL_EXTRACTOR_JAVA_AGENT_DISABLE_KOTLIN",
-        "true",
-      );
+      core.exportVariable("CODEQL_EXTRACTOR_JAVA_AGENT_DISABLE_KOTLIN", "true");
    }

    // Emergency override to force the CodeQL CLI back to the JGit-based Git backend.
    if (await features.getValue(Feature.ForceJGit)) {
-      actionState.env.export("CODEQL_GIT_BACKEND", "jgit");
+      core.exportVariable("CODEQL_GIT_BACKEND", "jgit");
+    }
+
+    const kotlinLimitVar =
+      "CODEQL_EXTRACTOR_KOTLIN_OVERRIDE_MAXIMUM_VERSION_LIMIT";
+    if (
+      (await codeQlVersionAtLeast(codeql, "2.20.3")) &&
+      !(await codeQlVersionAtLeast(codeql, "2.20.4"))
+    ) {
+      core.exportVariable(kotlinLimitVar, "2.1.20");
    }

    // Restore dependency cache(s), if they exist.
@@ -691,7 +685,7 @@ async function run(
      config.buildMode === BuildMode.None &&
      config.languages.includes(BuiltInLanguage.java)
    ) {
-      actionState.env.export(
+      core.exportVariable(
        EnvVar.JAVA_EXTRACTOR_MINIMIZE_DEPENDENCY_JARS,
        "true",
      );
@@ -749,7 +743,7 @@ async function run(
    const tracerConfig = await getCombinedTracerConfig(logger, codeql, config);
    if (tracerConfig !== undefined) {
      for (const [key, value] of Object.entries(tracerConfig.env)) {
-        actionState.env.export(key, value);
+        core.exportVariable(key, value);
      }
    }

@@ -757,10 +751,10 @@ async function run(
    if (await features.getValue(Feature.JavaNetworkDebugging)) {
      // Get the existing value of `JAVA_TOOL_OPTIONS`, if any.
      const existingJavaToolOptions =
-        actionState.env.getOptional(JavaEnvVars.JAVA_TOOL_OPTIONS) ?? "";
+        getOptionalEnvVar(JavaEnvVars.JAVA_TOOL_OPTIONS) || "";

      // Add the network debugging options.
-      actionState.env.export(
+      core.exportVariable(
        JavaEnvVars.JAVA_TOOL_OPTIONS,
        `${existingJavaToolOptions} -Djavax.net.debug=all`,
      );
@@ -1,13 +1,14 @@
 import * as fs from "fs";
 import path from "path";

+import * as core from "@actions/core";
 import * as github from "@actions/github";
 import test, { ExecutionContext } from "ava";
 import * as sinon from "sinon";

 import * as actionsUtil from "./actions-util";
 import { createStubCodeQL } from "./codeql";
-import * as environment from "./environment";
+import { ActionsEnvVars } from "./environment";
 import { Feature } from "./feature-flags";
 import {
  checkPacksForOverlayCompatibility,
@@ -84,7 +85,7 @@ for (const { runnerEnv, ErrorConstructor, message } of [
    `cleanupDatabaseClusterDirectory throws a ${ErrorConstructor.name} when cleanup fails on ${runnerEnv} runner`,
    async (t) => {
      await withTmpDir(async (tmpDir: string) => {
-        process.env[environment.ActionsEnvVars.RUNNER_ENVIRONMENT] = runnerEnv;
+        process.env[ActionsEnvVars.RUNNER_ENVIRONMENT] = runnerEnv;

        const dbLocation = path.resolve(tmpDir, "dbs");
        fs.mkdirSync(dbLocation, { recursive: true });
@@ -545,7 +546,7 @@ test.serial(
 test.serial(
  "file coverage deprecation warning for org-owned repo with default setup recommends repo property",
  (t) => {
-    const exportEnvVarStub = sinon.stub(environment, "exportEnvVar");
+    const exportVariableStub = sinon.stub(core, "exportVariable");
    sinon.stub(actionsUtil, "isDefaultSetup").returns(true);
    github.context.payload = {
      repository: {
@@ -565,14 +566,14 @@ test.serial(
        'with the name `github-codeql-file-coverage-on-prs` and the type "True/false", then set this property to ' +
        "`true` in the repository's settings.",
    );
-    t.true(exportEnvVarStub.calledOnce);
+    t.true(exportVariableStub.calledOnce);
  },
 );

 test.serial(
  "file coverage deprecation warning for org-owned repo with advanced setup recommends env var and repo property",
  (t) => {
-    const exportEnvVarStub = sinon.stub(environment, "exportEnvVar");
+    const exportVariableStub = sinon.stub(core, "exportVariable");
    sinon.stub(actionsUtil, "isDefaultSetup").returns(false);
    github.context.payload = {
      repository: {
@@ -593,14 +594,14 @@ test.serial(
        'with the name `github-codeql-file-coverage-on-prs` and the type "True/false", then set this property to ' +
        "`true` in the repository's settings.",
    );
-    t.true(exportEnvVarStub.calledOnce);
+    t.true(exportVariableStub.calledOnce);
  },
 );

 test.serial(
  "file coverage deprecation warning for user-owned repo with default setup recommends advanced setup",
  (t) => {
-    const exportEnvVarStub = sinon.stub(environment, "exportEnvVar");
+    const exportVariableStub = sinon.stub(core, "exportVariable");
    sinon.stub(actionsUtil, "isDefaultSetup").returns(true);
    github.context.payload = {
      repository: {
@@ -619,14 +620,14 @@ test.serial(
        "To opt out of this change, switch to an advanced setup workflow and " +
        "set the `CODEQL_ACTION_FILE_COVERAGE_ON_PRS` environment variable to `true`.",
    );
-    t.true(exportEnvVarStub.calledOnce);
+    t.true(exportVariableStub.calledOnce);
  },
 );

 test.serial(
  "file coverage deprecation warning for user-owned repo with advanced setup recommends env var",
  (t) => {
-    const exportEnvVarStub = sinon.stub(environment, "exportEnvVar");
+    const exportVariableStub = sinon.stub(core, "exportVariable");
    sinon.stub(actionsUtil, "isDefaultSetup").returns(false);
    github.context.payload = {
      repository: {
@@ -644,14 +645,14 @@ test.serial(
        "to improve analysis performance. File coverage information will still be computed on non-PR analyses.\n\n" +
        "To opt out of this change, set the `CODEQL_ACTION_FILE_COVERAGE_ON_PRS` environment variable to `true`.",
    );
-    t.true(exportEnvVarStub.calledOnce);
+    t.true(exportVariableStub.calledOnce);
  },
 );

 test.serial(
  "file coverage deprecation warning for unknown owner type with default setup recommends advanced setup",
  (t) => {
-    const exportEnvVarStub = sinon.stub(environment, "exportEnvVar");
+    const exportVariableStub = sinon.stub(core, "exportVariable");
    sinon.stub(actionsUtil, "isDefaultSetup").returns(true);
    github.context.payload = { repository: undefined };
    const messages: LoggedMessage[] = [];
@@ -665,14 +666,14 @@ test.serial(
        "To opt out of this change, switch to an advanced setup workflow and " +
        "set the `CODEQL_ACTION_FILE_COVERAGE_ON_PRS` environment variable to `true`.",
    );
-    t.true(exportEnvVarStub.calledOnce);
+    t.true(exportVariableStub.calledOnce);
  },
 );

 test.serial(
  "file coverage deprecation warning for unknown owner type with advanced setup recommends env var",
  (t) => {
-    const exportEnvVarStub = sinon.stub(environment, "exportEnvVar");
+    const exportVariableStub = sinon.stub(core, "exportVariable");
    sinon.stub(actionsUtil, "isDefaultSetup").returns(false);
    github.context.payload = { repository: undefined };
    const messages: LoggedMessage[] = [];
@@ -685,7 +686,7 @@ test.serial(
        "to improve analysis performance. File coverage information will still be computed on non-PR analyses.\n\n" +
        "To opt out of this change, set the `CODEQL_ACTION_FILE_COVERAGE_ON_PRS` environment variable to `true`.",
    );
-    t.true(exportEnvVarStub.calledOnce);
+    t.true(exportVariableStub.calledOnce);
  },
 );

@@ -694,10 +695,10 @@ test.serial(
  (t) => {
    process.env["CODEQL_ACTION_DID_LOG_FILE_COVERAGE_ON_PRS_DEPRECATION"] =
      "true";
-    const exportEnvVarStub = sinon.stub(environment, "exportEnvVar");
+    const exportVariableStub = sinon.stub(core, "exportVariable");
    const messages: LoggedMessage[] = [];
    logFileCoverageOnPrsDeprecationWarning(getRecordingLogger(messages));
    t.is(messages.length, 0);
-    t.true(exportEnvVarStub.notCalled);
+    t.true(exportVariableStub.notCalled);
  },
 );
@@ -1,6 +1,7 @@
 import * as fs from "fs";
 import * as path from "path";

+import * as core from "@actions/core";
 import * as toolrunner from "@actions/exec/lib/toolrunner";
 import * as github from "@actions/github";
 import * as io from "@actions/io";
@@ -16,7 +17,7 @@ import {
 import { GitHubApiDetails } from "./api-client";
 import { CodeQL, setupCodeQL } from "./codeql";
 import * as configUtils from "./config-utils";
-import { EnvVar, exportEnvVar } from "./environment";
+import { EnvVar } from "./environment";
 import {
  CodeQLDefaultVersionInfo,
  Feature,
@@ -410,5 +411,5 @@ export function logFileCoverageOnPrsDeprecationWarning(logger: Logger): void {
  }

  logger.warning(message);
-  exportEnvVar(EnvVar.DID_LOG_FILE_COVERAGE_ON_PRS_DEPRECATION, "true");
+  core.exportVariable(EnvVar.DID_LOG_FILE_COVERAGE_ON_PRS_DEPRECATION, "true");
 }
@@ -8,7 +8,6 @@ import * as sinon from "sinon";
 import * as actionsUtil from "../actions-util";
 import * as apiClient from "../api-client";
 import type { ResolveDatabaseOutput } from "../codeql";
-import * as environment from "../environment";
 import * as gitUtils from "../git-utils";
 import { BuiltInLanguage } from "../languages";
 import { getRunnerLogger } from "../logging";
@@ -83,7 +82,7 @@ const testDownloadOverlayBaseDatabaseFromCache = makeMacro({

      sinon.stub(apiClient, "getAutomationID").resolves("test-automation-id/");

-      sinon.stub(environment, "isInTestMode").returns(testCase.isInTestMode);
+      sinon.stub(utils, "isInTestMode").returns(testCase.isInTestMode);

      if (testCase.restoreCacheResult instanceof Error) {
        sinon
@@ -15,7 +15,6 @@ import {
  CleanupLevel,
  getBaseDatabaseOidsFilePath,
  getCodeQLDatabasePath,
-  getEnv,
  getErrorMessage,
  isInTestMode,
  tryGetFolderBytes,
@@ -291,7 +290,7 @@ export async function downloadOverlayBaseDatabaseFromCache(
      actionsCache.restoreCache(
        [dbLocation],
        cacheRestoreKeyPrefix,
-        [cacheRestoreKeyPrefix],
+        undefined,
        {
          // Azure SDK download (which is the default) uses 128MB segments; see
          // https://github.com/actions/toolkit/blob/main/packages/cache/README.md.
@@ -378,7 +377,7 @@ export async function getCacheSaveKey(
      `Failed to get workflow run ID or attempt ID. Reason: ${getErrorMessage(e)}`,
    );
  }
-  const sha = await getCommitOid(getEnv(), checkoutPath);
+  const sha = await getCommitOid(checkoutPath);
  const restoreKeyPrefix = await getCacheRestoreKeyPrefix(
    config,
    codeQlVersion,
@@ -130,7 +130,7 @@ export async function getOverlayStatus(
    await fs.promises.mkdir(path.dirname(statusFile), { recursive: true });
    const foundKey = await waitForResultWithTimeLimit(
      MAX_CACHE_OPERATION_MS,
-      actionsCache.restoreCache([statusFile], cacheKey, [cacheKey]),
+      actionsCache.restoreCache([statusFile], cacheKey),
      () => {
        logger.warning("Timed out restoring overlay status from cache.");
      },
@@ -6,14 +6,6 @@ export interface RepositoryNwo {
  repo: string;
 }

-/** An approximation of what a repository NWO string looks like. */
-export type RepositoryNwoStr = `${string}/${string}`;
-
-/** A basic check that `val` looks like a `RepositoryNwoStr`. */
-export function isRepositoryNwoStr(val: string): val is RepositoryNwoStr {
-  return val.includes("/");
-}
-
 /**
 * Get the repository name with owner from the environment variable
 * `GITHUB_REPOSITORY`.
@@ -1,11 +1,6 @@
 import * as core from "@actions/core";

-import {
-  Action,
-  ActionState,
-  extendActionState,
-  runInActions,
-} from "./action-common";
+import { Action, ActionState, runInActions } from "./action-common";
 import {
  getActionVersion,
  getOptionalInput,
@@ -17,10 +12,9 @@ import { getGitHubVersion } from "./api-client";
 import { CodeQL } from "./codeql";
 import { ComputedInput, getToolsInput } from "./config/inputs";
 import { getRawLanguagesNoAutodetect } from "./config-utils";
-import { EnvVar } from "./environment";
+import { ActionsEnvVars, EnvVar } from "./environment";
 import { initFeatures } from "./feature-flags";
 import { loadRepositoryProperties } from "./feature-flags/properties";
-import * as github from "./github";
 import { initCodeQL } from "./init";
 import { Logger } from "./logging";
 import { getRepositoryNwo } from "./repository";
@@ -113,7 +107,8 @@ async function run(
    const apiDetails = {
      auth: getRequiredInput("token"),
      externalRepoAuth: getOptionalInput("external-repository-token"),
-      ...github.getCurrentInstance(actionState.env),
+      url: actionState.env.getRequired(ActionsEnvVars.GITHUB_SERVER_URL),
+      apiURL: actionState.env.getRequired(ActionsEnvVars.GITHUB_API_URL),
    };

    const gitHubVersion = await getGitHubVersion();
@@ -136,9 +131,7 @@ async function run(
    );
    const repositoryProperties = repositoryPropertiesResult.orElse({});

-    const actionStateWithFeatures = extendActionState(actionState, {
-      features,
-    });
+    const actionStateWithFeatures = { ...actionState, features };

    const statusReportBase = await createStatusReportBase(
      ActionName.SetupCodeQL,
@@ -191,7 +184,7 @@ async function run(
    core.setOutput("codeql-path", codeql.getPath());
    core.setOutput("codeql-version", (await codeql.getVersion()).version);

-    actionState.env.export(EnvVar.SETUP_CODEQL_ACTION_HAS_RUN, "true");
+    core.exportVariable(EnvVar.SETUP_CODEQL_ACTION_HAS_RUN, "true");
  } catch (unwrappedError) {
    const error = wrapError(unwrappedError);
    core.setFailed(error.message);
@@ -32,7 +32,6 @@ import {
  getTestEnv,
  initAllState,
  makeMacro,
-  mockApiDetails,
  mockBundleDownloadApi,
  setupActionsVars,
  setupTests,
@@ -127,6 +126,24 @@ test.serial("convert to semver", (t) => {
  }
 });

+test.serial("getCodeQLActionRepository", (t) => {
+  const logger = getRunnerLogger(true);
+
+  initializeEnvironment("1.2.3");
+
+  // isRunningLocalAction() === true
+  delete process.env["GITHUB_ACTION_REPOSITORY"];
+  process.env["RUNNER_TEMP"] = path.dirname(__dirname);
+  const repoLocalRunner = setupCodeql.getCodeQLActionRepository(logger);
+  t.deepEqual(repoLocalRunner, "github/codeql-action");
+
+  // isRunningLocalAction() === false
+  sinon.stub(actionsUtil, "isRunningLocalAction").returns(false);
+  process.env["GITHUB_ACTION_REPOSITORY"] = "xxx/yyy";
+  const repoEnv = setupCodeql.getCodeQLActionRepository(logger);
+  t.deepEqual(repoEnv, "xxx/yyy");
+});
+
 test.serial(
  "getCodeQLSource sets CLI version for a semver tagged bundle",
  async (t) => {
@@ -156,7 +173,6 @@ test.serial(
        compressionMethod: "gzip",
        sourceType: "download",
        toolsVersion: "1.2.3",
-        apiDetails: SAMPLE_DOTCOM_API_DETAILS,
      } satisfies setupCodeql.CodeQLDownloadSource);
    });
  },
@@ -223,7 +239,6 @@ for (const {

      await withTmpDir(async (tmpDir) => {
        setupActionsVars(tmpDir, tmpDir);
-        mockApiDetails(SAMPLE_DOTCOM_API_DETAILS);
        const source = await setupCodeql.getCodeQLSource(
          "linked",
          SAMPLE_DEFAULT_CLI_VERSION,
@@ -258,7 +273,6 @@ test.serial(

    await withTmpDir(async (tmpDir) => {
      setupActionsVars(tmpDir, tmpDir);
-      mockApiDetails(SAMPLE_DOTCOM_API_DETAILS);
      const source = await setupCodeql.getCodeQLSource(
        "latest",
        SAMPLE_DEFAULT_CLI_VERSION,
@@ -302,7 +316,6 @@ test.serial(

    await withTmpDir(async (tmpDir) => {
      setupActionsVars(tmpDir, tmpDir);
-      mockApiDetails(SAMPLE_DOTCOM_API_DETAILS);
      const result = await setupCodeql.setupCodeQLBundle(
        "linked",
        SAMPLE_DOTCOM_API_DETAILS,
@@ -436,7 +449,6 @@ test.serial(
        compressionMethod: "zstd",
        sourceType: "download",
        toolsVersion: expectedVersion,
-        apiDetails: SAMPLE_DOTCOM_API_DETAILS,
      } satisfies setupCodeql.CodeQLToolsSource);

      const result = await setupCodeql.setupCodeQLBundle(
@@ -485,7 +497,6 @@ test.serial(

    await withTmpDir(async (tmpDir) => {
      setupActionsVars(tmpDir, tmpDir, { GITHUB_EVENT_NAME: "dynamic" });
-      mockApiDetails(SAMPLE_DOTCOM_API_DETAILS);

      const source = await setupCodeql.getCodeQLSource(
        undefined,
@@ -510,7 +521,6 @@ test.serial(
        compressionMethod: "zstd",
        sourceType: "download",
        toolsVersion: expectedVersion,
-        apiDetails: SAMPLE_DOTCOM_API_DETAILS,
      } satisfies setupCodeql.CodeQLToolsSource);

      // Afterwards, ensure that we see the expected messages in the log.
@@ -632,7 +642,6 @@ for (const toolsInput of ["nightly", "nightly-latest"]) {

      await withTmpDir(async (tmpDir) => {
        setupActionsVars(tmpDir, tmpDir);
-        mockApiDetails(SAMPLE_DOTCOM_API_DETAILS);
        const source = await setupCodeql.getCodeQLSource(
          toolsInput,
          SAMPLE_DEFAULT_CLI_VERSION,
@@ -658,7 +667,6 @@ for (const toolsInput of ["nightly", "nightly-latest"]) {
          cliVersion: undefined,
          compressionMethod: "zstd",
          toolsVersion: "0.0.0-30260213",
-          apiDetails: SAMPLE_DOTCOM_API_DETAILS,
        } satisfies setupCodeql.CodeQLDownloadSource);
        t.true(latestNightlyRequest.calledOnce);
      });
@@ -811,7 +819,6 @@ for (const date of ["20200101", "30260213"]) {
            cliVersion: undefined,
            compressionMethod: "zstd",
            toolsVersion: `0.0.0-${date}`,
-            apiDetails: SAMPLE_DOTCOM_API_DETAILS,
          } satisfies setupCodeql.CodeQLDownloadSource);

          await t.throwsAsync(
@@ -956,7 +963,6 @@ const toolcacheInputFallbackMacro = makeMacro({

    await withTmpDir(async (tmpDir) => {
      setupActionsVars(tmpDir, tmpDir);
-      mockApiDetails(SAMPLE_DOTCOM_API_DETAILS);

      for (const [k, v] of Object.entries(environment)) {
        process.env[k] = v;
@@ -1177,7 +1183,6 @@ test.serial(

    await withTmpDir(async (tmpDir) => {
      setupActionsVars(tmpDir, tmpDir);
-      mockApiDetails(SAMPLE_DOTCOM_API_DETAILS);
      const source = await setupCodeql.getCodeQLSource(
        undefined,
        PER_LANGUAGE_CLI_VERSION,
@@ -1220,7 +1225,6 @@ test.serial(

    await withTmpDir(async (tmpDir) => {
      setupActionsVars(tmpDir, tmpDir);
-      mockApiDetails(SAMPLE_DOTCOM_API_DETAILS);
      for (const { otherLanguagePacksReason, features } of [
        // The per-language feature is disabled.
        { otherLanguagePacksReason: undefined, features: createFeatures([]) },
@@ -1290,14 +1294,7 @@ for (const fallback of [false, true]) {
        request: { fetch: fetchRelease },
      });
      sinon.stub(api, "getApiClient").value(() => client);
-
-      const spyClient = new api.InstanceApiClient(SAMPLE_DOTCOM_API_DETAILS);
-      const authorizationSpy = sinon.spy(
-        spyClient,
-        "getAuthorizationHeaderFor",
-      );
-      sinon.stub(api, "InstanceApiClient").returns(spyClient);
-
+      const authorizationSpy = sinon.spy(api, "getAuthorizationHeaderFor");
      const extractStub = stubDownloadAndExtract();
      if (fallback) {
        extractStub.onFirstCall().rejects(new HTTPError("Not Found", 404));
@@ -1307,7 +1304,6 @@ for (const fallback of [false, true]) {
        setupActionsVars(tmpDir, tmpDir, {
          GITHUB_ACTION_REPOSITORY: "codeql-testing/action-fork",
        });
-        mockApiDetails(SAMPLE_DOTCOM_API_DETAILS);
        const result = await setupCodeql.setupCodeQLBundle(
          undefined,
          SAMPLE_DOTCOM_API_DETAILS,
@@ -1330,9 +1326,9 @@ for (const fallback of [false, true]) {
        t.is(extractStub.firstCall.args[0], assetURL);
        t.is(extractStub.lastCall.args[0], fallback ? combinedURL : assetURL);
        t.is(authorizationSpy.callCount, extractStub.callCount);
-        t.is(authorizationSpy.firstCall.args[1], assetURL);
+        t.is(authorizationSpy.firstCall.args[2], assetURL);
        t.is(
-          authorizationSpy.lastCall.args[1],
+          authorizationSpy.lastCall.args[2],
          fallback ? combinedURL : assetURL,
        );
        t.is(extractStub.lastCall.args[3], "token token");
@@ -1575,7 +1571,6 @@ for (const error of [

      await withTmpDir(async (tmpDir) => {
        setupActionsVars(tmpDir, tmpDir);
-        mockApiDetails(SAMPLE_DOTCOM_API_DETAILS);
        await t.throwsAsync(
          setupCodeql.setupCodeQLBundle(
            undefined,
@@ -1876,8 +1871,8 @@ async function runDownloadCodeQL(
      cliVersion: CLEANUP_CLI_VERSION,
      sourceType: "download",
      toolsVersion: CLEANUP_CLI_VERSION,
-      apiDetails: SAMPLE_DOTCOM_API_DETAILS,
    },
+    SAMPLE_DOTCOM_API_DETAILS,
    undefined, // tarVersion
    toolcacheRoot, // tempDir
  );
@@ -2282,7 +2277,6 @@ test.serial(
  async (t) => {
    await withTmpDir(async (tmpDir) => {
      setupActionsVars(tmpDir, tmpDir);
-      mockApiDetails(SAMPLE_DOTCOM_API_DETAILS);
      delete process.env[EnvVar.HAS_SET_UP_CODEQL];

      stubDownloadAndExtract();
@@ -2318,7 +2312,6 @@ test.serial(

    await withTmpDir(async (tmpDir) => {
      setupActionsVars(tmpDir, tmpDir);
-      mockApiDetails(SAMPLE_DOTCOM_API_DETAILS);
      process.env[ActionsEnvVars.RUNNER_ENVIRONMENT] = "github-hosted";
      delete process.env[EnvVar.HAS_SET_UP_CODEQL];
      const staleDirectory = createToolcacheEntry(
@@ -3,7 +3,9 @@ import { OutgoingHttpHeaders } from "http";
 import * as path from "path";
 import { performance } from "perf_hooks";

+import * as core from "@actions/core";
 import * as toolcache from "@actions/tool-cache";
+import { default as deepEqual } from "fast-deep-equal";
 import * as semver from "semver";
 import { v4 as uuidV4 } from "uuid";

@@ -12,6 +14,7 @@ import {
  isAnalyzingPullRequest,
  isDynamicWorkflow,
  isGitHubHostedRunner,
+  isRunningLocalAction,
 } from "./actions-util";
 import * as api from "./api-client";
 import {
@@ -26,7 +29,7 @@ import {
  makeDiagnostic,
  makeTelemetryDiagnostic,
 } from "./diagnostics";
-import { EnvVar, exportEnvVar, getEnv } from "./environment";
+import { EnvVar, getEnv } from "./environment";
 import {
  CODEQL_VERSION_ZSTD_BUNDLE,
  CodeQLDefaultVersionInfo,
@@ -42,7 +45,6 @@ import {
  logPerLanguageBundleFallback,
 } from "./per-language-bundles";
 import { getBundlePlatform } from "./platform";
-import { getCodeQLAssetDownloadURL } from "./setup/repository";
 import * as tar from "./tar";
 import {
  deleteToolcacheBundles,
@@ -64,6 +66,7 @@ export enum ToolsSource {
  Download = "DOWNLOAD",
 }

+const CODEQL_DEFAULT_ACTION_REPOSITORY = "github/codeql-action";
 const CODEQL_NIGHTLIES_REPOSITORY_OWNER = "dsp-testing";
 const CODEQL_NIGHTLIES_REPOSITORY_NAME = "codeql-cli-nightlies";

@@ -71,6 +74,75 @@ const CODEQL_BUNDLE_VERSION_ALIAS: string[] = ["linked", "latest"];
 const CODEQL_NIGHTLY_TOOLS_INPUTS = ["nightly", "nightly-latest"];
 const CODEQL_TOOLCACHE_INPUT = "toolcache";

+export function getCodeQLActionRepository(logger: Logger): string {
+  if (isRunningLocalAction()) {
+    // This handles the case where the Action does not come from an Action repository,
+    // e.g. our integration tests which use the Action code from the current checkout.
+    // In these cases, the GITHUB_ACTION_REPOSITORY environment variable is not set.
+    logger.info(
+      "The CodeQL Action is checked out locally. Using the default CodeQL Action repository.",
+    );
+    return CODEQL_DEFAULT_ACTION_REPOSITORY;
+  }
+
+  return util.getRequiredEnvParam("GITHUB_ACTION_REPOSITORY");
+}
+
+async function getCodeQLBundleDownloadURL(
+  tagName: string,
+  apiDetails: api.GitHubApiDetails,
+  codeQLBundleName: string,
+  logger: Logger,
+): Promise<string> {
+  const codeQLActionRepository = getCodeQLActionRepository(logger);
+  const potentialDownloadSources = [
+    // This GitHub instance, and this Action.
+    [apiDetails.url, codeQLActionRepository],
+    // This GitHub instance, and the canonical Action.
+    [apiDetails.url, CODEQL_DEFAULT_ACTION_REPOSITORY],
+    // GitHub.com, and the canonical Action.
+    [util.GITHUB_DOTCOM_URL, CODEQL_DEFAULT_ACTION_REPOSITORY],
+  ];
+  // We now filter out any duplicates.
+  // Duplicates will happen either because the GitHub instance is GitHub.com, or because the Action is not a fork.
+  const uniqueDownloadSources = potentialDownloadSources.filter(
+    (source, index, self) => {
+      return !self.slice(0, index).some((other) => deepEqual(source, other));
+    },
+  );
+  for (const downloadSource of uniqueDownloadSources) {
+    const [apiURL, repository] = downloadSource;
+    // If we've reached the final case, short-circuit the API check since we know the bundle exists and is public.
+    if (
+      apiURL === util.GITHUB_DOTCOM_URL &&
+      repository === CODEQL_DEFAULT_ACTION_REPOSITORY
+    ) {
+      break;
+    }
+    const [repositoryOwner, repositoryName] = repository.split("/");
+    try {
+      const release = await api.getApiClient().rest.repos.getReleaseByTag({
+        owner: repositoryOwner,
+        repo: repositoryName,
+        tag: tagName,
+      });
+      for (const asset of release.data.assets) {
+        if (asset.name === codeQLBundleName) {
+          logger.info(
+            `Found CodeQL bundle ${codeQLBundleName} in ${repository} on ${apiURL} with URL ${asset.url}.`,
+          );
+          return asset.url;
+        }
+      }
+    } catch (e) {
+      logger.info(
+        `Looked for CodeQL bundle ${codeQLBundleName} in ${repository} on ${apiURL} but got error ${e}.`,
+      );
+    }
+  }
+  return `https://github.com/${CODEQL_DEFAULT_ACTION_REPOSITORY}/releases/download/${tagName}/${codeQLBundleName}`;
+}
+
 function tryGetBundleVersionFromTagName(
  tagName: string,
  logger: Logger,
@@ -649,10 +721,9 @@ export async function getCodeQLSource(
        ? "zstd"
        : "gzip";

-    const action = { env: getEnv(), logger };
    const platform = getBundlePlatform();
    const perLanguageBundleLanguage = await getPerLanguageBundleLanguage(
-      { ...action, features },
+      { env: getEnv(), features, logger },
      {
        rawLanguages,
        otherLanguagePacksReason,
@@ -665,11 +736,11 @@ export async function getCodeQLSource(

    // Resolves the combined or per-language bundle URL for the requested release.
    const resolveBundleURL = (language?: BuiltInLanguage) =>
-      getCodeQLAssetDownloadURL(
-        action,
-        apiDetails,
+      getCodeQLBundleDownloadURL(
        bundleTagName,
+        apiDetails,
        getCodeQLBundleName(compressionMethod, platform, language),
+        logger,
      );

    const combinedBundleURL = await resolveBundleURL();
@@ -718,7 +789,6 @@ export async function getCodeQLSource(
    compressionMethod,
    sourceType: "download",
    toolsVersion: resolvedVersion ?? "unknown",
-    apiDetails,
  };
 }

@@ -747,6 +817,7 @@ async function tryGetFallbackToolcacheVersion(
 // be able to stub this function and have other functions in this file use that stub.
 export const downloadCodeQL = async function (
  source: CodeQLDownloadSource,
+  apiDetails: api.GitHubApiDetails,
  tarVersion: tar.TarVersion | undefined,
  tempDir: string,
  logger: Logger,
@@ -767,8 +838,11 @@ export const downloadCodeQL = async function (
  if (searchParams.has("token")) {
    logger.debug("CodeQL tools URL contains an authorization token.");
  } else {
-    const client = new api.InstanceApiClient(source.apiDetails);
-    authorization = client.getAuthorizationHeaderFor(logger, codeqlURL);
+    authorization = api.getAuthorizationHeaderFor(
+      logger,
+      apiDetails,
+      codeqlURL,
+    );
  }

  const toolcacheDestination = getToolcacheDestination({ logger }, source);
@@ -982,6 +1056,7 @@ export async function setupCodeQLBundle(
      const result = await downloadCodeQLBundle(
        { env: getEnv(), features, logger },
        source,
+        apiDetails,
        zstdAvailability.version,
        tempDir,
      );
@@ -996,7 +1071,7 @@ export async function setupCodeQLBundle(

  // Record that this job now has a copy of the CodeQL tools, so that a later step doesn't delete
  // the toolcache out from under the path we are about to return.
-  exportEnvVar(EnvVar.HAS_SET_UP_CODEQL, "true");
+  core.exportVariable(EnvVar.HAS_SET_UP_CODEQL, "true");

  return {
    codeqlFolder,
@@ -1017,6 +1092,7 @@ export async function setupCodeQLBundle(
 export async function downloadCodeQLBundle(
  action: ActionState<["Logger", "ReadOnlyEnv", "FeatureFlags"]>,
  source: CodeQLDownloadSource,
+  apiDetails: api.GitHubApiDetails,
  tarVersion: tar.TarVersion | undefined,
  tempDir: string,
 ): Promise<{
@@ -1030,7 +1106,13 @@ export async function downloadCodeQLBundle(

  const startTime = performance.now();
  try {
-    return await downloadCodeQL(source, tarVersion, tempDir, logger);
+    return await downloadCodeQL(
+      source,
+      apiDetails,
+      tarVersion,
+      tempDir,
+      logger,
+    );
  } catch (e) {
    if (
      bundle.kind !== "per-language" ||
@@ -1046,6 +1128,7 @@ export async function downloadCodeQLBundle(
        ...source,
        bundle: { kind: "combined", url: bundle.combinedBundleURL },
      },
+      apiDetails,
      tarVersion,
      tempDir,
      logger,
@@ -1,35 +0,0 @@
-import * as path from "path";
-
-import test from "ava";
-import * as sinon from "sinon";
-
-import * as actionsUtil from "../actions-util";
-import { ActionsEnvVars } from "../environment";
-import { callee, getTestEnv, setupTests } from "../testing-utils";
-import { initializeEnvironment } from "../util";
-
-import { getCodeQLActionRepository } from "./repository";
-
-setupTests(test);
-
-test.serial("getCodeQLActionRepository", async (t) => {
-  const initialEnv = getTestEnv({
-    [ActionsEnvVars.RUNNER_TEMP]: path.dirname(__dirname),
-  });
-  initializeEnvironment("1.2.3", initialEnv);
-
-  const target = callee(getCodeQLActionRepository)
-    .withArgs()
-    .withEnv(initialEnv);
-
-  // isRunningLocalAction() === true
-  await target.passes(t.deepEqual, "github/codeql-action");
-
-  // isRunningLocalAction() === false
-  sinon.stub(actionsUtil, "isRunningLocalAction").returns(false);
-  await target
-    .withEnv((env) => {
-      env.set(ActionsEnvVars.GITHUB_ACTION_REPOSITORY, "xxx/yyy");
-    })
-    .passes(t.deepEqual, "xxx/yyy");
-});
@@ -1,160 +0,0 @@
-import { ActionState } from "../action-common";
-import { isRunningLocalAction } from "../actions-util";
-import * as api from "../api-client";
-import { ActionsEnvVars } from "../environment";
-import { GITHUB_DOTCOM_URL } from "../github";
-import {
-  isRepositoryNwoStr,
-  parseRepositoryNwo,
-  type RepositoryNwoStr,
-} from "../repository";
-
-/** The NWO of the standard CodeQL Action repository. */
-export const CODEQL_DEFAULT_ACTION_REPOSITORY = "github/codeql-action";
-
-/**
- * Retrieves the NWO of the repository that the CodeQL Action is loaded from.
- * Typically, this will be `github/codeql-action`, but it may be something else for
- * forks of the Action or in environments other than GitHub.com.
- *
- * If this function detects that we are running the Action locally (e.g. in tests),
- * then we default to `CODEQL_DEFAULT_ACTION_REPOSITORY`.
- */
-export function getCodeQLActionRepository(
-  action: ActionState<["ReadOnlyEnv", "Logger"]>,
-): RepositoryNwoStr {
-  if (isRunningLocalAction(action.env)) {
-    // This handles the case where the Action does not come from an Action repository,
-    // e.g. our integration tests which use the Action code from the current checkout.
-    // In these cases, the GITHUB_ACTION_REPOSITORY environment variable is not set.
-    action.logger.info(
-      "The CodeQL Action is checked out locally. Using the default CodeQL Action repository.",
-    );
-    return CODEQL_DEFAULT_ACTION_REPOSITORY;
-  }
-
-  const actionRepository = action.env.getRequired(
-    ActionsEnvVars.GITHUB_ACTION_REPOSITORY,
-  );
-
-  if (isRepositoryNwoStr(actionRepository)) {
-    return actionRepository;
-  }
-
-  throw new Error(
-    `The value of '${ActionsEnvVars.GITHUB_ACTION_REPOSITORY}' is '${actionRepository}', which does not match the expected 'owner/repo' format.`,
-  );
-}
-
-/**A download source is a pair of strings. */
-export type DownloadSource = [api.GitHubApiDetails, RepositoryNwoStr];
-
-/** Decides if the two provided download sources are the same. */
-const isSameDownloadSource = (
-  [srcInstance, srcRepo]: DownloadSource,
-  [otherInstance, otherRepo]: DownloadSource,
-) => {
-  return srcInstance.url === otherInstance.url && srcRepo === otherRepo;
-};
-
-/** A download URL is represented as a string. */
-export type DownloadURL = string;
-
-/** Gets the default GitHub.com download URL for `assetName` in a release tagged `tagName`. */
-export function getDefaultDotcomDownloadURL(
-  tagName: string,
-  assetName: string,
-): DownloadURL {
-  return `${GITHUB_DOTCOM_URL}/${CODEQL_DEFAULT_ACTION_REPOSITORY}/releases/download/${tagName}/${assetName}`;
-}
-
-/** Enumerates log-friendly descriptions of different kinds of assets we might look for in releases. */
-export type ReleaseAssetKind = "CodeQL bundle" | "private registry proxy";
-
-/**
- * Tries to find a download URL for `assetName` in a release tagged with `tagName`.
- *
- * Depending on where and how the CodeQL Action is running, we may be using different `apiDetails` and there may be
- * different options for where to source CodeQL releases from.
- *
- * This function either returns the download URL for the asset for the first release we find, or
- * defaults to the assumed download URL for the asset on the default CodeQL Action repository on GitHub.com.
- * In the latter case, this function does not guarantee that the asset actually exists.
- *
- * @param action The Action state.
- * @param apiDetails The details of the GitHub API in use.
- * @param tagName The name of the release tag we want to obtain the asset from.
- * @param assetName The name of the asset we should look for in the release.
- * @param [assetKind="CodeQL bundle"] The kind of asset we are looking for to show in log messages.
- * @returns A URL that we can use to download the asset.
- */
-export async function getCodeQLAssetDownloadURL(
-  action: ActionState<["ReadOnlyEnv", "Logger"]>,
-  apiDetails: api.GitHubApiDetails,
-  tagName: string,
-  assetName: string,
-  assetKind: ReleaseAssetKind = "CodeQL bundle",
-): Promise<DownloadURL> {
-  const codeQLActionRepository = getCodeQLActionRepository(action);
-
-  // We construct the default GitHub.com source here, because `getDotcomApiDetails`
-  // may retrieve the `token` input if we are currently running on GitHub.com and
-  // we want to avoid doing that statically.
-  const defaultDownloadSource: DownloadSource = [
-    api.getDotcomApiDetails(action.env),
-    CODEQL_DEFAULT_ACTION_REPOSITORY,
-  ];
-
-  const potentialDownloadSources: DownloadSource[] = [
-    // This GitHub instance, and this Action.
-    [apiDetails, codeQLActionRepository],
-    // This GitHub instance, and the canonical Action.
-    [apiDetails, CODEQL_DEFAULT_ACTION_REPOSITORY],
-    // GitHub.com, and the canonical Action.
-    defaultDownloadSource,
-  ];
-
-  // We now filter out any duplicates.
-  // Duplicates will happen either because the GitHub instance is GitHub.com, or because the Action is not a fork.
-  const uniqueDownloadSources = potentialDownloadSources.filter(
-    (source, index, self) => {
-      return !self
-        .slice(0, index)
-        .some((other) => isSameDownloadSource(source, other));
-    },
-  );
-
-  for (const [instance, repository] of uniqueDownloadSources) {
-    // If we've reached the final case, short-circuit the API check since we know the asset exists and is public.
-    if (isSameDownloadSource(defaultDownloadSource, [instance, repository])) {
-      break;
-    }
-
-    const { owner: repositoryOwner, repo: repositoryName } =
-      parseRepositoryNwo(repository);
-    try {
-      const release = await api
-        .getApiClient(action.env, instance)
-        .rest.repos.getReleaseByTag({
-          owner: repositoryOwner,
-          repo: repositoryName,
-          tag: tagName,
-        });
-
-      for (const asset of release.data.assets) {
-        if (asset.name === assetName) {
-          action.logger.info(
-            `Found ${assetKind} ${assetName} in ${repository} on ${instance.apiURL} with URL ${asset.url}.`,
-          );
-          return asset.url;
-        }
-      }
-    } catch (e) {
-      action.logger.info(
-        `Looked for ${assetKind} ${assetName} in ${repository} on ${instance.apiURL} but got error ${e}.`,
-      );
-    }
-  }
-
-  return getDefaultDotcomDownloadURL(tagName, assetName);
-}
@@ -3,14 +3,9 @@ import * as path from "path";

 import * as core from "@actions/core";

-import {
-  Action,
-  ActionState,
-  extendActionState,
-  runInActions,
-} from "./action-common";
+import { Action, ActionState, runInActions } from "./action-common";
 import * as actionsUtil from "./actions-util";
-import { getApiDetails, getGitHubVersion } from "./api-client";
+import { getGitHubVersion } from "./api-client";
 import { FeatureEnablement, initFeatures } from "./feature-flags";
 import { BuiltInLanguage, parseBuiltInLanguage } from "./languages";
 import { Logger } from "./logging";
@@ -103,13 +98,9 @@ async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) {
    };

    // Start the Proxy
-    const actionWithFeatures = extendActionState(action, { features });
-    const proxyBin = await getProxyBinaryPath(
-      actionWithFeatures,
-      getApiDetails(action.env),
-    );
+    const proxyBin = await getProxyBinaryPath({ ...action, features });
    const proxyInfo = await startProxy(
-      proxyBin.path,
+      proxyBin,
      proxyConfig,
      proxyLogFilePath,
      logger,
@@ -125,7 +116,6 @@ async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) {
        languages: language === undefined ? undefined : [language],
      },
      proxyConfig.all_credentials.map((c) => c.type),
-      { proxy_version: proxyBin.version },
      logger,
    );
  } catch (unwrappedError) {
@@ -1,40 +1,120 @@
 import * as filepath from "path";

+import * as core from "@actions/core";
 import * as toolcache from "@actions/tool-cache";
 import test, { ExecutionContext } from "ava";
 import sinon from "sinon";

 import { ActionState } from "./action-common";
-import * as actionsUtil from "./actions-util";
 import * as apiClient from "./api-client";
 import * as defaults from "./defaults.json";
-import { ActionsEnvVars, type Env } from "./environment";
 import { setUpFeatureFlagTests } from "./feature-flags/testing-util";
 import { UnvalidatedObject, validateSchema } from "./json";
 import { makeFromSchema } from "./json/testing-util";
 import { BuiltInLanguage } from "./languages";
 import { getRunnerLogger, Logger } from "./logging";
 import { BundlePlatform, getBundlePlatform } from "./platform";
-import * as repository from "./setup/repository";
 import * as startProxyExports from "./start-proxy";
+import * as statusReport from "./status-report";
 import {
-  addSinonAssertions,
  assertNotLogged,
  checkExpectedLogMessages,
  createFeatures,
  initAllState,
  makeMacro,
  makeTestToken,
-  mockApiDetails,
  RecordingLogger,
-  SAMPLE_DOTCOM_API_DETAILS,
  setupTests,
  withRecordingLoggerAsync,
 } from "./testing-utils";
-import { GitHubVariant, GitHubVersion, withTmpDir } from "./util";
+import {
+  ConfigurationError,
+  GitHubVariant,
+  GitHubVersion,
+  withTmpDir,
+} from "./util";

 setupTests(test);

+const sendFailedStatusReportTest = makeMacro({
+  exec: async (
+    t: ExecutionContext<unknown>,
+    err: Error,
+    expectedMessage: string,
+    expectedStatus: statusReport.ActionStatus = "failure",
+  ) => {
+    const now = new Date();
+
+    // Override core.setFailed to avoid it setting the program's exit code
+    sinon.stub(core, "setFailed").returns();
+
+    const createStatusReportBase = sinon.stub(
+      statusReport,
+      "createStatusReportBase",
+    );
+    createStatusReportBase.resolves(undefined);
+
+    await withRecordingLoggerAsync(async (logger) => {
+      await startProxyExports.sendFailedStatusReport(
+        logger,
+        now,
+        undefined,
+        err,
+      );
+
+      // Check that the stub has been called exactly once, with the expected arguments,
+      // but not with the message from the error.
+      sinon.assert.calledOnceWithExactly(
+        createStatusReportBase,
+        statusReport.ActionName.StartProxy,
+        expectedStatus,
+        now,
+        sinon.match.any,
+        sinon.match.any,
+        sinon.match.any,
+        expectedMessage,
+      );
+      t.false(
+        createStatusReportBase.calledWith(
+          statusReport.ActionName.StartProxy,
+          expectedStatus,
+          now,
+          sinon.match.any,
+          sinon.match.any,
+          sinon.match.any,
+          sinon.match((msg: string) => msg.includes(err.message)),
+        ),
+        "createStatusReportBase was called with the error message",
+      );
+    });
+  },
+
+  title: (providedTitle = "") => `sendFailedStatusReport - ${providedTitle}`,
+});
+
+sendFailedStatusReportTest.serial(
+  "reports generic error message for non-StartProxyError error",
+  new Error("Something went wrong today"),
+  "Error from start-proxy Action omitted (Error).",
+);
+
+sendFailedStatusReportTest.serial(
+  "reports generic error message for non-StartProxyError error with safe error message",
+  new Error(
+    startProxyExports.getStartProxyErrorMessage(
+      startProxyExports.StartProxyErrorType.DownloadFailed,
+    ),
+  ),
+  "Error from start-proxy Action omitted (Error).",
+);
+
+sendFailedStatusReportTest.serial(
+  "reports generic error message for ConfigurationError error",
+  new ConfigurationError("Something went wrong today"),
+  "Error from start-proxy Action omitted (ConfigurationError).",
+  "user-error",
+);
+
 const toEncodedJSON = (data: any) =>
  Buffer.from(JSON.stringify(data)).toString("base64");

@@ -614,45 +694,29 @@ test("getProxyPackage - includes platform in name", (t) => {
  }
 });

-function mockGetApiClient(env: Env, endpoints: any) {
-  const getRequiredInput = mockApiDetails(SAMPLE_DOTCOM_API_DETAILS, env);
-  const getApiClient = sinon
-    .stub(apiClient, "getApiClient")
-    // eslint-disable-next-line @typescript-eslint/no-unsafe-argument
-    .returns({ rest: endpoints } as any);
-
-  return { getRequiredInput, getApiClient };
+function mockGetApiClient(endpoints: any) {
+  return (
+    sinon
+      .stub(apiClient, "getApiClient")
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-argument
+      .returns({ rest: endpoints } as any)
+  );
 }

 type ReleaseAssets = Array<{ name: string; url?: string }>;

-function mockGetReleaseByTag(
-  env: Env,
-  expectedTag?: string,
-  assets?: ReleaseAssets,
-) {
+function mockGetReleaseByTag(assets?: ReleaseAssets) {
  const getReleaseByTag =
    assets === undefined
      ? sinon.stub().rejects()
-      : sinon.stub().callsFake(({ tag }) => {
-          if (tag === expectedTag) {
-            return {
-              status: 200,
-              data: { assets },
-              headers: {},
-              url: "GET /repos/:owner/:repo/releases/tags/:tag",
-            };
-          } else {
-            return {
-              status: 404,
-            };
-          }
+      : sinon.stub().resolves({
+          status: 200,
+          data: { assets },
+          headers: {},
+          url: "GET /repos/:owner/:repo/releases/tags/:tag",
        });

-  return {
-    getReleaseByTag,
-    ...mockGetApiClient(env, { repos: { getReleaseByTag } }),
-  };
+  return mockGetApiClient({ repos: { getReleaseByTag } });
 }

 function mockOfflineFeatures(tempDir: string, logger: Logger) {
@@ -677,6 +741,7 @@ test.serial(
  "getDownloadUrl logs unknown platforms/arch and defaults to linux64",
  async (t) => {
    const logger = new RecordingLogger();
+    mockGetReleaseByTag();

    await withTmpDir(async (tempDir) => {
      const features = mockOfflineFeatures(tempDir, logger);
@@ -686,55 +751,38 @@ test.serial(
        logger,
        features,
      });
-      mockGetReleaseByTag(state.env);
+      const info = await startProxyExports.getDownloadUrl(state);

-      // Stub this to always return `true` so we get the default repo for the tests.
-      sinon.stub(actionsUtil, "isRunningLocalAction").returns(true);
-
-      const info = await startProxyExports.getDownloadUrl(
-        state,
-        SAMPLE_DOTCOM_API_DETAILS,
+      t.is(info.version, startProxyExports.UPDATEJOB_PROXY_VERSION);
+      t.is(
+        info.url,
+        startProxyExports.getFallbackUrl(
+          startProxyExports.getProxyPackage(BundlePlatform.Linux64),
+        ),
      );

      t.true(
        logger.hasMessage(`Unsupported platform android on architecture ppc`),
      );
-
-      t.is(info.version, defaults.cliVersion);
-      t.is(
-        info.url,
-        repository.getDefaultDotcomDownloadURL(
-          defaults.bundleVersion,
-          startProxyExports.getProxyPackage(BundlePlatform.Linux64),
-        ),
-      );
    });
  },
 );

 test.serial(
-  "getDownloadUrl returns default bundle URL for linked version",
+  "getDownloadUrl returns fallback when `getReleaseByVersion` rejects",
  async (t) => {
    const logger = new RecordingLogger();
+    mockGetReleaseByTag();

    await withTmpDir(async (tempDir) => {
      const features = mockOfflineFeatures(tempDir, logger);
      const state = initAllState({ logger, features });
-      mockGetReleaseByTag(state.env);
+      const info = await startProxyExports.getDownloadUrl(state);

-      // Stub this to always return `true` so we get the default repo for the tests.
-      sinon.stub(actionsUtil, "isRunningLocalAction").returns(true);
-
-      const info = await startProxyExports.getDownloadUrl(
-        state,
-        SAMPLE_DOTCOM_API_DETAILS,
-      );
-
-      t.is(info.version, defaults.cliVersion);
+      t.is(info.version, startProxyExports.UPDATEJOB_PROXY_VERSION);
      t.is(
        info.url,
-        repository.getDefaultDotcomDownloadURL(
-          defaults.bundleVersion,
+        startProxyExports.getFallbackUrl(
          startProxyExports.getProxyPackage(getTestPlatform(state)),
        ),
      );
@@ -743,7 +791,7 @@ test.serial(
 );

 test.serial(
-  "getDownloadUrl doesn't check that the default asset exists",
+  "getDownloadUrl returns fallback when there's no matching release asset",
  async (t) => {
    const logger = new RecordingLogger();
    const testAssets = [[], [{ name: "foo" }]];
@@ -752,33 +800,19 @@ test.serial(
      const features = mockOfflineFeatures(tempDir, logger);
      const state = initAllState({ logger, features });

-      // Stub this to always return `true` so we get the default repo for the tests.
-      sinon.stub(actionsUtil, "isRunningLocalAction").returns(true);
-
      for (const assets of testAssets) {
-        const stubs = mockGetReleaseByTag(
-          state.env,
-          defaults.bundleVersion,
-          assets,
-        );
-        const info = await startProxyExports.getDownloadUrl(
-          state,
-          SAMPLE_DOTCOM_API_DETAILS,
-        );
+        const stub = mockGetReleaseByTag(assets);
+        const info = await startProxyExports.getDownloadUrl(state);

-        t.is(info.version, defaults.cliVersion);
+        t.is(info.version, startProxyExports.UPDATEJOB_PROXY_VERSION);
        t.is(
          info.url,
-          repository.getDefaultDotcomDownloadURL(
-            defaults.bundleVersion,
+          startProxyExports.getFallbackUrl(
            startProxyExports.getProxyPackage(getTestPlatform(state)),
          ),
        );

-        // mockGetReleaseByTag stubs the global getApiClient; since we are calling
-        // that in a loop, we need to manually restore it here
-        stubs.getApiClient.restore();
-        stubs.getRequiredInput.restore();
+        stub.restore();
      }
    });
  },
@@ -794,22 +828,11 @@ test.serial("getDownloadUrl returns matching release asset", async (t) => {
      url: "url-we-want",
    },
  ];
-  const stubs = mockGetReleaseByTag(state.env, defaults.bundleVersion, assets);
+  mockGetReleaseByTag(assets);

  await withTmpDir(async (tempDir) => {
-    state.env.set(ActionsEnvVars.RUNNER_TEMP, tempDir);
    const features = mockOfflineFeatures(tempDir, logger);
-
-    // Stub this to always return `false` so we force `getCodeQLAssetDownloadURL` to use the (mocked) API.
-    sinon.stub(actionsUtil, "isRunningLocalAction").returns(false);
-    state.env.set(ActionsEnvVars.GITHUB_ACTION_REPOSITORY, "test/repo");
-
-    const info = await startProxyExports.getDownloadUrl(
-      { ...state, features },
-      SAMPLE_DOTCOM_API_DETAILS,
-    );
-
-    t.is(stubs.getReleaseByTag.callCount, 1);
+    const info = await startProxyExports.getDownloadUrl({ ...state, features });

    t.is(info.version, defaults.cliVersion);
    t.is(info.url, "url-we-want");
@@ -936,31 +959,22 @@ test.serial(
  "getProxyBinaryPath - returns path from tool cache if available",
  async (t) => {
    const logger = new RecordingLogger();
-
-    sinon.stub(apiClient, "getApiDetails").returns(SAMPLE_DOTCOM_API_DETAILS);
+    mockGetReleaseByTag();

    await withTmpDir(async (tempDir) => {
      const toolcachePath = "/path/to/proxy/dir";
      sinon.stub(toolcache, "find").returns(toolcachePath);

-      // Stub this to always return `true` so we get the default repo for the tests.
-      sinon.stub(actionsUtil, "isRunningLocalAction").returns(true);
-
      const features = mockOfflineFeatures(tempDir, logger);
-      const state = initAllState({ logger, features });
-      mockGetReleaseByTag(state.env);
-
-      const result = await startProxyExports.getProxyBinaryPath(
-        state,
-        SAMPLE_DOTCOM_API_DETAILS,
+      const path = await startProxyExports.getProxyBinaryPath(
+        initAllState({ logger, features }),
      );

-      t.assert(result);
+      t.assert(path);
      t.is(
-        result.path,
+        path,
        filepath.join(toolcachePath, startProxyExports.getProxyFilename()),
      );
-      t.is(result.version, defaults.cliVersion);
    });
  },
 );
@@ -971,7 +985,7 @@ test.serial(
    const logger = new RecordingLogger();
    const state = initAllState({ logger });
    const downloadUrl = "url-we-want";
-    const stubs = mockGetReleaseByTag(state.env, defaults.bundleVersion, [
+    mockGetReleaseByTag([
      {
        name: startProxyExports.getProxyPackage(getTestPlatform(state)),
        url: downloadUrl,
@@ -980,16 +994,14 @@ test.serial(

    const toolcachePath = "/path/to/proxy/dir";
    const find = sinon.stub(toolcache, "find").returns("");
-    const apiDetails = {
+    const getApiDetails = sinon.stub(apiClient, "getApiDetails").returns({
      auth: "",
      url: "",
      apiURL: "",
-    } satisfies apiClient.GitHubApiDetails;
-    const client = new apiClient.InstanceApiClient(apiDetails);
+    });
    const getAuthorizationHeaderFor = sinon
-      .stub(client, "getAuthorizationHeaderFor")
+      .stub(apiClient, "getAuthorizationHeaderFor")
      .returns(undefined);
-    sinon.stub(apiClient, "InstanceApiClient").returns(client);
    const archivePath = "/path/to/archive";
    const downloadTool = sinon
      .stub(toolcache, "downloadTool")
@@ -1000,36 +1012,25 @@ test.serial(
      .resolves(extractedPath);
    const cacheDir = sinon.stub(toolcache, "cacheDir").resolves(toolcachePath);

-    // Stub this to always return `false` so we force `getCodeQLAssetDownloadURL` to use the (mocked) API.
-    sinon.stub(actionsUtil, "isRunningLocalAction").returns(false);
-    state.env.set(ActionsEnvVars.GITHUB_ACTION_REPOSITORY, "test/repo");
+    const path = await startProxyExports.getProxyBinaryPath({
+      ...state,
+      features: createFeatures([]),
+    });

-    const result = await startProxyExports.getProxyBinaryPath(
-      {
-        ...state,
-        features: createFeatures([]),
-      },
-      SAMPLE_DOTCOM_API_DETAILS,
-    );
-
-    t.is(stubs.getReleaseByTag.callCount, 1);
    t.assert(find.calledOnce);
+    t.assert(getApiDetails.calledOnce);
    t.assert(getAuthorizationHeaderFor.calledOnce);
-
-    const st = addSinonAssertions(t);
-    st.onceWith(downloadTool, downloadUrl);
-    st.onceWith(extractTar, archivePath);
-    st.onceWith(cacheDir, extractedPath);
-
-    t.assert(result);
+    t.assert(downloadTool.calledOnceWith(downloadUrl));
+    t.assert(extractTar.calledOnceWith(archivePath));
+    t.assert(cacheDir.calledOnceWith(extractedPath));
+    t.assert(path);
    t.is(
-      result.path,
+      path,
      filepath.join(toolcachePath, startProxyExports.getProxyFilename()),
    );
-    t.is(result.version, defaults.cliVersion);

    checkExpectedLogMessages(t, logger.messages, [
-      `Found private registry proxy ${startProxyExports.getProxyPackage(getTestPlatform(state))} in test/repo on https://api.github.com with URL ${downloadUrl}`,
+      `Found '${startProxyExports.getProxyPackage(getTestPlatform(state))}' in release '${defaults.bundleVersion}' at '${downloadUrl}'`,
    ]);
  },
 );
@@ -1039,11 +1040,10 @@ test.serial(
  async (t) => {
    const logger = new RecordingLogger();
    const state = initAllState({ logger });
-    const expectedVersion = "2.20.1";
-    const expectedTag = `codeql-bundle-v${expectedVersion}`;
+    const expectedTag = "codeql-bundle-v2.20.1";
    const expectedParams = {
-      owner: "test",
-      repo: "repo",
+      owner: "github",
+      repo: "codeql-action",
      tag: expectedTag,
    };
    const downloadUrl = "url-we-want";
@@ -1061,21 +1061,19 @@ test.serial(
      headers: {},
      url: "GET /repos/:owner/:repo/releases/tags/:tag",
    });
-    mockGetApiClient(state.env, { repos: { getReleaseByTag } });
+    mockGetApiClient({ repos: { getReleaseByTag } });

    await withTmpDir(async (tempDir) => {
      const toolcachePath = "/path/to/proxy/dir";
      const find = sinon.stub(toolcache, "find").returns("");
-      const apiDetails = {
+      const getApiDetails = sinon.stub(apiClient, "getApiDetails").returns({
        auth: "",
        url: "",
        apiURL: "",
-      } satisfies apiClient.GitHubApiDetails;
-      const client = new apiClient.InstanceApiClient(apiDetails);
+      });
      const getAuthorizationHeaderFor = sinon
-        .stub(client, "getAuthorizationHeaderFor")
+        .stub(apiClient, "getAuthorizationHeaderFor")
        .returns(undefined);
-      sinon.stub(apiClient, "InstanceApiClient").returns(client);
      const archivePath = "/path/to/archive";
      const downloadTool = sinon
        .stub(toolcache, "downloadTool")
@@ -1100,43 +1098,34 @@ test.serial(
      const getDefaultCliVersion = sinon
        .stub(features, "getEnabledDefaultCliVersions")
        .resolves({
-          enabledVersions: [
-            { cliVersion: expectedVersion, tagName: expectedTag },
-          ],
+          enabledVersions: [{ cliVersion: "2.20.1", tagName: expectedTag }],
        });
-
-      // Stub this to always return `false` so we force `getCodeQLAssetDownloadURL` to use the (mocked) API.
-      sinon.stub(actionsUtil, "isRunningLocalAction").returns(false);
-      state.env.set(ActionsEnvVars.GITHUB_ACTION_REPOSITORY, "test/repo");
-
-      const result = await startProxyExports.getProxyBinaryPath(
-        {
-          ...state,
-          features,
-        },
-        SAMPLE_DOTCOM_API_DETAILS,
-      );
+      const path = await startProxyExports.getProxyBinaryPath({
+        ...state,
+        features,
+      });

      t.assert(getDefaultCliVersion.calledOnce);
-
-      const st = addSinonAssertions(t);
-      st.onceWith(getReleaseByTag, expectedParams);
+      sinon.assert.calledOnceWithMatch(
+        getReleaseByTag,
+        sinon.match(expectedParams),
+      );
      t.assert(find.calledOnce);
+      t.assert(getApiDetails.calledOnce);
      t.assert(getAuthorizationHeaderFor.calledOnce);
-      st.onceWith(downloadTool, downloadUrl);
-      st.onceWith(extractTar, archivePath);
-      st.onceWith(cacheDir, extractedPath);
+      t.assert(downloadTool.calledOnceWith(downloadUrl));
+      t.assert(extractTar.calledOnceWith(archivePath));
+      t.assert(cacheDir.calledOnceWith(extractedPath));

-      t.assert(result);
+      t.assert(path);
      t.is(
-        result.path,
+        path,
        filepath.join(toolcachePath, startProxyExports.getProxyFilename()),
      );
-      t.is(result.version, expectedVersion);
    });

    checkExpectedLogMessages(t, logger.messages, [
-      `Found private registry proxy ${startProxyExports.getProxyPackage(getTestPlatform(state))} in test/repo on https://api.github.com with URL url-we-want.`,
+      `Found '${startProxyExports.getProxyPackage(getTestPlatform(state))}' in release '${expectedTag}' at '${downloadUrl}'`,
    ]);
  },
 );