Merge pull request #4262 from github/mbg/cherry-picks/macos-deprecation

Minor improvements to prepare for #4221
Merge pull request #4270 from github/dependabot/github_actions/dot-github/workflows/actions-minor-4af230c318
2026-10-29 15:08:14 +03:00 · 2026-10-28 11:31:43 +00:00 · 2026-10-27 14:06:42 +00:00 · 2026-10-27 13:49:01 +00:00 · 2026-10-27 13:37:01 +00:00 · 2026-10-27 13:28:02 +00:00
34 changed files with 14573 additions and 6627 deletions
@@ -6,11 +6,11 @@ inputs:
    required: true
  use-all-platform-bundle:
    description: "If true, we output a tools URL with codeql-bundle.tar.gz file rather than platform-specific URL"
-    default: 'false'
+    default: "false"
    required: false
  setup-kotlin:
    description: "If true, we setup kotlin"
-    default: 'true'
+    default: "true"
    required: true
 outputs:
  tools-url:
@@ -73,7 +73,10 @@ runs:
          exit 1
        fi

-    - uses: fwilhe2/setup-kotlin@9c245a6425255f5e98ba1ce6c15d31fce7eca9da
+    - uses: fwilhe2/setup-kotlin@b325539ca8f6e1d9ee04efed06f49bdbf5426dbb # v2.1
      if: ${{ inputs.setup-kotlin == 'true' }}
      with:
-        version: 1.8.21
+        # Kotlin is installed on the runners by default, but the version that is pre-installed is too new
+        # to be supported by CodeQL. This Kotlin version is selected to be compatible with both the default Java
+        # version on the `ubuntu-latest` runners and CodeQL.
+        version: 2.1.20
@@ -16,7 +16,7 @@ runs:
      shell: bash

    - name: Set up Node
-      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
      with:
        node-version: 24
        cache: 'npm'
@@ -16,6 +16,14 @@ updates:
      # This might be fixed when we move to eslint v9.
      - dependency-name: "eslint-plugin-import"
        versions: [">=2.30.0"]
+
+      # Some of our dependencies are lagging behind with support for new versions of
+      # `undici` which is why we have to override it in `package.json`. Dependabot
+      # workflows fail when they try to update a dependency that is explicitly
+      # overriden. Since this happens somewhat routinely at the moment, we are
+      # excluding `undici` here and have to manually update it when needed.
+      - dependency-name: "undici"
+        versions: [">=7.30.1"]
    groups:
      npm-minor:
        patterns:
@@ -26,7 +34,7 @@ updates:
  - package-ecosystem: github-actions
    directories:
      - "/.github/workflows"
-      - "/.github/actions"
+      - "/.github/actions/*/"
    schedule:
      interval: weekly
    cooldown:
@@ -122,7 +122,7 @@ jobs:
      - name: Install dependencies
        run: npm ci
      - name: Download workflow artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          pattern: test-mode-sarif-*
          path: sarif
@@ -44,7 +44,7 @@ jobs:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
+          - os: ubuntu-24.04
            version: stable-v2.20.7
          - os: ubuntu-latest
            version: stable-v2.21.4
@@ -44,7 +44,7 @@ jobs:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
+          - os: ubuntu-24.04
            version: stable-v2.20.7
          - os: ubuntu-latest
            version: stable-v2.21.4
@@ -44,7 +44,7 @@ jobs:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
+          - os: ubuntu-24.04
            version: stable-v2.20.7
          - os: ubuntu-latest
            version: stable-v2.21.4
@@ -54,7 +54,7 @@ jobs:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
+          - os: ubuntu-24.04
            version: stable-v2.20.7
          - os: macos-15-xlarge
            version: stable-v2.20.7
@@ -1,74 +0,0 @@
-# Warning: This file is generated automatically, and should not be modified.
-# Instead, please modify the template in the pr-checks directory and run:
-#     pr-checks/sync.sh
-# to regenerate this file.
-
-name: PR Check - RuboCop multi-language
-env:
-  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-  GO111MODULE: auto
-on:
-  push:
-    branches:
-      - main
-      - releases/v*
-  pull_request: {}
-  merge_group:
-    types:
-      - checks_requested
-  schedule:
-    - cron: '0 5 * * *'
-  workflow_dispatch:
-    inputs: {}
-  workflow_call:
-    inputs: {}
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: rubocop-multi-language-${{github.ref}}
-jobs:
-  rubocop-multi-language:
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - os: ubuntu-latest
-            version: default
-    name: RuboCop multi-language
-    if: github.triggering_actor != 'dependabot[bot]'
-    permissions:
-      contents: read
-      security-events: read
-    timeout-minutes: 45
-    runs-on: ${{ matrix.os }}
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Prepare test
-        id: prepare-test
-        uses: ./.github/actions/prepare-test
-        with:
-          version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
-      - name: Set up Ruby
-        uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
-        with:
-          ruby-version: 2.6
-      - name: Install Code Scanning integration
-        run: bundle add code-scanning-rubocop --version 0.3.0 --skip-install
-      - name: Install dependencies
-        run: bundle install
-      - name: RuboCop run
-        run: |
-          bash -c "
-            bundle exec rubocop --require code_scanning --format CodeScanning::SarifFormatter -o rubocop.sarif
-            [[ $? -ne 2 ]]
-          "
-      - uses: ./../action/upload-sarif
-        with:
-          sarif_file: rubocop.sarif
-    env:
-      CODEQL_ACTION_TEST_MODE: true
@@ -34,7 +34,7 @@ jobs:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
+          - os: ubuntu-24.04
            version: stable-v2.20.7
          - os: ubuntu-latest
            version: stable-v2.22.1
@@ -6,13 +6,13 @@ env:
 on:
  push:
    branches:
-    - main
-    - releases/v*
+      - main
+      - releases/v*
  pull_request:
  merge_group:
    types: [checks_requested]
  schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
  workflow_dispatch:

 concurrency:
@@ -30,10 +30,10 @@ jobs:
      fail-fast: false
      matrix:
        version:
-        - stable-v2.20.7
-        - default
-        - linked
-        - nightly-latest
+          - stable-v2.20.7
+          - default
+          - linked
+          - nightly-latest
    name: Upload debug artifacts after failure in analyze
    continue-on-error: true
    env:
@@ -43,7 +43,12 @@ jobs:
      # We currently need `security-events: read` to access feature flags.
      security-events: read
    timeout-minutes: 45
-    runs-on: ubuntu-latest
+
+    # stable-v2.20.7 requires an older version of Java than the default on `ubuntu-latest` (`ubuntu-26.04`).
+    # We could install that older version on the newer runners, or use the older runner.
+    # We do the latter here. This can be removed once we stop supporting `v2.20.7`.
+    runs-on: ${{ case(matrix.version == 'stable-v2.20.7', 'ubuntu-24.04', 'ubuntu-latest') }}
+
    steps:
      - name: Dump GitHub event
        run: cat "${GITHUB_EVENT_PATH}"
@@ -60,7 +65,7 @@ jobs:
      - name: Install .NET
        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
        with:
-          dotnet-version: '9.x'
+          dotnet-version: "9.x"
      - name: Assert best-effort artifact scan completed
        uses: ./../action/.github/actions/verify-debug-artifact-scan-completed
      - uses: ./../action/init
@@ -92,6 +97,7 @@ jobs:
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
      - name: Check expected artifacts exist
        run: |
+          VERSIONS="stable-v2.20.7 default linked nightly-latest"
          LANGUAGES="cpp csharp go java javascript python"
          for version in $VERSIONS; do
            echo "Artifacts from version $version:"
@@ -5,13 +5,13 @@ env:
 on:
  push:
    branches:
-    - main
-    - releases/v*
+      - main
+      - releases/v*
  pull_request:
  merge_group:
    types: [checks_requested]
  schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
  workflow_dispatch:

 concurrency:
@@ -29,10 +29,10 @@ jobs:
      fail-fast: false
      matrix:
        version:
-        - stable-v2.20.7
-        - default
-        - linked
-        - nightly-latest
+          - stable-v2.20.7
+          - default
+          - linked
+          - nightly-latest
    name: Upload debug artifacts
    env:
      CODEQL_ACTION_TEST_MODE: true
@@ -41,7 +41,12 @@ jobs:
      contents: read
      # We currently need `security-events: read` to access feature flags.
      security-events: read
-    runs-on: ubuntu-latest
+
+    # stable-v2.20.7 requires an older version of Java than the default on `ubuntu-latest` (`ubuntu-26.04`).
+    # We could install that older version on the newer runners, or use the older runner.
+    # We do the latter here. This can be removed once we stop supporting `v2.20.7`.
+    runs-on: ${{ case(matrix.version == 'stable-v2.20.7', 'ubuntu-24.04', 'ubuntu-latest') }}
+
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -56,7 +61,7 @@ jobs:
      - name: Install .NET
        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
        with:
-          dotnet-version: '9.x'
+          dotnet-version: "9.x"
      - name: Assert best-effort artifact scan completed
        uses: ./../action/.github/actions/verify-debug-artifact-scan-completed
      - uses: ./../action/init
@@ -60,7 +60,6 @@ on:
      - "PR Check - Proxy test"
      - "PR Check - Remote config file"
      - "PR Check - Resolve environment"
-      - "PR Check - RuboCop multi-language"
      - "PR Check - Ruby analysis"
      - "PR Check - Rust analysis"
      - "PR Check - Split workflow"
@@ -21,8 +21,23 @@ jobs:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
          REASON: ${{ github.event.reason }}
-          USER: ${{ github.event.pull_request.user.login }}
        run: |
-          echo "@$USER The pull request was removed from the merge queue (\`$REASON\`)." \
+          # Mention whoever added the PR to the merge queue rather than the PR author, who may be a
+          # bot such as Dependabot. The `dequeued` event payload doesn't identify the enqueuer, so
+          # look them up in the most recent `AddedToMergeQueueEvent` on the PR's timeline.
+          enqueuer=$(gh api graphql \
+            -F number="$PR_NUMBER" \
+            -f query='
+              query($number: Int!) {
+                repository(owner: "github", name: "codeql-action") {
+                  pullRequest(number: $number) {
+                    timelineItems(itemTypes: [ADDED_TO_MERGE_QUEUE_EVENT], last: 1) {
+                      nodes { ... on AddedToMergeQueueEvent { enqueuer { login } } }
+                    }
+                  }
+                }
+              }' \
+            --jq '.data.repository.pullRequest.timelineItems.nodes[0].enqueuer.login')
+          echo "@$enqueuer The pull request was removed from the merge queue (\`$REASON\`)." \
            "Please resolve any issues if required and enqueue the PR again." |
            gh pr comment --body-file - --repo github/codeql-action "$PR_NUMBER"
@@ -76,7 +76,6 @@ We typically release new minor versions of the CodeQL Action and Bundle when a n
 | `v4.33.0` | `2.24.3` | Enterprise Server 3.21 | |
 | `v4.31.10` | `2.23.9` | Enterprise Server 3.20 | |
 | `v3.29.11` | `2.22.4` | Enterprise Server 3.19 | |
-| `v3.28.21` | `2.21.3` | Enterprise Server 3.18 | |

 See the full list of GHES release and deprecation dates at [GitHub Enterprise Server releases](https://docs.github.com/en/enterprise-server/admin/all-releases#releases-of-github-enterprise-server).

@@ -30,12 +30,12 @@
        "follow-redirects": "^1.16.1",
        "get-folder-size": "^5.0.0",
        "https-proxy-agent": "^7.0.6",
-        "js-yaml": "^5.4.3",
+        "js-yaml": "^5.5.0",
        "jsonschema": "1.5.0",
        "long": "^5.3.2",
        "node-forge": "^1.4.0",
        "semver": "^7.8.5",
-        "undici": "^6.28.0",
+        "undici": "^7.30.1",
        "uuid": "^14.0.3"
      },
      "devDependencies": {
@@ -57,14 +57,14 @@
        "eslint-import-resolver-typescript": "^4.4.5",
        "eslint-plugin-github": "^6.1.2",
        "eslint-plugin-import-x": "^4.17.1",
-        "eslint-plugin-jsdoc": "^65.3.4",
+        "eslint-plugin-jsdoc": "^65.3.15",
        "eslint-plugin-no-async-foreach": "^0.1.1",
        "glob": "^13.0.6",
        "globals": "^17.13.0",
        "nock": "^14.0.17",
        "sinon": "^22.1.0",
        "typescript": "^6.0.3",
-        "typescript-eslint": "^8.71.2"
+        "typescript-eslint": "^8.72.0"
      }
    },
    "node_modules/@aashutoshrathi/word-wrap": {
@@ -2702,17 +2702,17 @@
      "license": "MIT"
    },
    "node_modules/@typescript-eslint/eslint-plugin": {
-      "version": "8.71.2",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.71.2.tgz",
-      "integrity": "sha512-K72/pvT7qpm8q3k8G5u93NCSN1RcLxX5h7Gw0bQpbMXviBHeY6Nx1WEwmk9wP+eKTSQ8ecxvcgt/ZX/rB938xQ==",
+      "version": "8.72.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.72.0.tgz",
+      "integrity": "sha512-aysKgysPX9XOv/dk95UkvUDe++Q3n3dJPG9CEWT3RUccxfkPJ+Qn6nhKPDhZXU6Ofo9kgwGWwKyQCnZIXTgngg==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
        "@eslint-community/regexpp": "^4.12.2",
-        "@typescript-eslint/scope-manager": "8.71.2",
-        "@typescript-eslint/type-utils": "8.71.2",
-        "@typescript-eslint/utils": "8.71.2",
-        "@typescript-eslint/visitor-keys": "8.71.2",
+        "@typescript-eslint/scope-manager": "8.72.0",
+        "@typescript-eslint/type-utils": "8.72.0",
+        "@typescript-eslint/utils": "8.72.0",
+        "@typescript-eslint/visitor-keys": "8.72.0",
        "ignore": "^7.0.5",
        "natural-compare": "^1.4.0",
        "ts-api-utils": "^2.5.0"
@@ -2725,7 +2725,7 @@
        "url": "https://opencollective.com/typescript-eslint"
      },
      "peerDependencies": {
-        "@typescript-eslint/parser": "^8.71.2",
+        "@typescript-eslint/parser": "^8.72.0",
        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
        "typescript": ">=4.8.4 <6.1.0"
      }
@@ -2741,16 +2741,16 @@
      }
    },
    "node_modules/@typescript-eslint/parser": {
-      "version": "8.71.2",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.71.2.tgz",
-      "integrity": "sha512-aTtmZjp/x3gsGHkDs04/1I8kNogBJkpQaeGaN0PfiG43NzDEmW2n+OP5im9wfsvyX0yP1UZWBrAGtDBfH9jEVw==",
+      "version": "8.72.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.72.0.tgz",
+      "integrity": "sha512-0O+x3ynciD6zuXb1CKSu165haQV6ey53DKhHHUnujP7U+XlltJG+/keT0Xhd1HXCze+IHf7Tvt39ovyepX/LNw==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/scope-manager": "8.71.2",
-        "@typescript-eslint/types": "8.71.2",
-        "@typescript-eslint/typescript-estree": "8.71.2",
-        "@typescript-eslint/visitor-keys": "8.71.2",
+        "@typescript-eslint/scope-manager": "8.72.0",
+        "@typescript-eslint/types": "8.72.0",
+        "@typescript-eslint/typescript-estree": "8.72.0",
+        "@typescript-eslint/visitor-keys": "8.72.0",
        "debug": "^4.4.3"
      },
      "engines": {
@@ -2784,14 +2784,14 @@
      }
    },
    "node_modules/@typescript-eslint/project-service": {
-      "version": "8.71.2",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.71.2.tgz",
-      "integrity": "sha512-Pd68GsLVh5ZXlcEccFPdhSOvtHZ/2WU0XsA8zmXOS3F158lVlcTLhfQ6qvtL1RzbMie0Kp8xtbVwAg4nejKPHw==",
+      "version": "8.72.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.72.0.tgz",
+      "integrity": "sha512-bzHngBbmIgzj6TsTjVUCntGx6FFLgE7mPjpO0PzHycOaZHXqS43XnrkFIHRS16LLr/xO6FHSXG3GJFo/F4bSBQ==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/tsconfig-utils": "^8.71.2",
-        "@typescript-eslint/types": "^8.71.2",
+        "@typescript-eslint/tsconfig-utils": "^8.72.0",
+        "@typescript-eslint/types": "^8.72.0",
        "debug": "^4.4.3"
      },
      "engines": {
@@ -2824,14 +2824,14 @@
      }
    },
    "node_modules/@typescript-eslint/scope-manager": {
-      "version": "8.71.2",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.71.2.tgz",
-      "integrity": "sha512-YF4wgg5iUX5Obywoac27B56FhozMNFhdJSbh11H5GBAwmBtfyRhmgTQqW9tRNNmHDvsZ2CX6UGzoz+YfYn2Leg==",
+      "version": "8.72.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.72.0.tgz",
+      "integrity": "sha512-JewPyJOYcXBSAS7PIgufscHOwZqhTGyBRiQJhhuDln66tMchxvvt7nJ90JKKIoOelmdHA3kAQbm9cEUHc4JSEA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/types": "8.71.2",
-        "@typescript-eslint/visitor-keys": "8.71.2"
+        "@typescript-eslint/types": "8.72.0",
+        "@typescript-eslint/visitor-keys": "8.72.0"
      },
      "engines": {
        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -2842,9 +2842,9 @@
      }
    },
    "node_modules/@typescript-eslint/tsconfig-utils": {
-      "version": "8.71.2",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.71.2.tgz",
-      "integrity": "sha512-jz49TAWokm/7yWD9/o837nYax9DyALxIPOImdImvVzo6canBCZYzin8zJyqNR5k1j9K1DE0bVvr0XYB+99uAdg==",
+      "version": "8.72.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.72.0.tgz",
+      "integrity": "sha512-0vbxCf7xLVPSjcOdm6eQbgViH8EDJ8xnl1laLT9yoqSz2YmcSfSg5Vdl0JUvZf6rcuJ0ZivJIuMD4edTg8obaA==",
      "dev": true,
      "license": "MIT",
      "engines": {
@@ -2859,15 +2859,15 @@
      }
    },
    "node_modules/@typescript-eslint/type-utils": {
-      "version": "8.71.2",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.71.2.tgz",
-      "integrity": "sha512-cC8UaalCViJkb3rH/xLIvidEwoFRtMZMUqDjjJMGEKaTFwYRHYBcoczlEGHuvkHEO8svRDrgZ0yQgOArFmwang==",
+      "version": "8.72.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.72.0.tgz",
+      "integrity": "sha512-gEXxmmbSTSOVTC37IYYvremOM31v+UN2W772bJxmVYPhAOPSUxtacyb7wkm1EhkYKU6KzFJsdU44DCV4to0LWw==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/types": "8.71.2",
-        "@typescript-eslint/typescript-estree": "8.71.2",
-        "@typescript-eslint/utils": "8.71.2",
+        "@typescript-eslint/types": "8.72.0",
+        "@typescript-eslint/typescript-estree": "8.72.0",
+        "@typescript-eslint/utils": "8.72.0",
        "debug": "^4.4.3",
        "ts-api-utils": "^2.5.0"
      },
@@ -2902,9 +2902,9 @@
      }
    },
    "node_modules/@typescript-eslint/types": {
-      "version": "8.71.2",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.71.2.tgz",
-      "integrity": "sha512-y5Ukl3oVp7e/VGxqIoEXoeb/Roj71PAJ4WG/N/RGj+eeDvKRLM15kGr9MijLbN0i03S52zxu31Z98E5gWChJKw==",
+      "version": "8.72.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.72.0.tgz",
+      "integrity": "sha512-Adfoy59kxNEjT5E5fnyrp7GpHYuWs8ONbdohu4ez6IU46qDq8LltG90tLmkucZB2uhYL8mqBjtXqGd8yhfjXqQ==",
      "dev": true,
      "license": "MIT",
      "engines": {
@@ -2916,16 +2916,16 @@
      }
    },
    "node_modules/@typescript-eslint/typescript-estree": {
-      "version": "8.71.2",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.71.2.tgz",
-      "integrity": "sha512-DgNOEsl4pdYzwSL+N/Cl33tX1Hlw3FvId73LnKXfq7jnrF2viOEn7X+P7RBkkSWCVm92gnWd28GIC5vJuLREeA==",
+      "version": "8.72.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.72.0.tgz",
+      "integrity": "sha512-gwLfFgWcw15tN2KXDCJvxEOQjPn+P3j/n3eSqkZ5sX4VpW9Cosodr+tWwBZRvJT3TcKx6HnPRGZMCNAiP1Xhug==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/project-service": "8.71.2",
-        "@typescript-eslint/tsconfig-utils": "8.71.2",
-        "@typescript-eslint/types": "8.71.2",
-        "@typescript-eslint/visitor-keys": "8.71.2",
+        "@typescript-eslint/project-service": "8.72.0",
+        "@typescript-eslint/tsconfig-utils": "8.72.0",
+        "@typescript-eslint/types": "8.72.0",
+        "@typescript-eslint/visitor-keys": "8.72.0",
        "debug": "^4.4.3",
        "minimatch": "^10.2.2",
        "semver": "^7.7.3",
@@ -3001,16 +3001,16 @@
      }
    },
    "node_modules/@typescript-eslint/utils": {
-      "version": "8.71.2",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.71.2.tgz",
-      "integrity": "sha512-RyKa1G1M9rKHDhrk+HJtiF1MvLD5Ux2JW3TSkzw+02pRALdpJb+QzG1Y5em+LvCgzGwgg8H7mBRFKljNz7ImPw==",
+      "version": "8.72.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.72.0.tgz",
+      "integrity": "sha512-0up3oArJZBYnzOaEXKo8DmI43QvMZyPoFEt9LWzRJcyl/RcJjfKKPebknN1VbTgXBf3M/KggUh5uUMdURLnseg==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
        "@eslint-community/eslint-utils": "^4.9.1",
-        "@typescript-eslint/scope-manager": "8.71.2",
-        "@typescript-eslint/types": "8.71.2",
-        "@typescript-eslint/typescript-estree": "8.71.2"
+        "@typescript-eslint/scope-manager": "8.72.0",
+        "@typescript-eslint/types": "8.72.0",
+        "@typescript-eslint/typescript-estree": "8.72.0"
      },
      "engines": {
        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -3025,13 +3025,13 @@
      }
    },
    "node_modules/@typescript-eslint/visitor-keys": {
-      "version": "8.71.2",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.71.2.tgz",
-      "integrity": "sha512-zozlN0UA32bSG2zkKAgQyRYSbEISVoyU6vvkKYo2aSny74D8Jh4e+POkJ6Lk0dlezZi5x7TtD+88Xb06IB8nhg==",
+      "version": "8.72.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.72.0.tgz",
+      "integrity": "sha512-E2mroviasaWecDzTGiGMtuEguuLVOeRggnrIn93CJuxYJzQBHbyymlT08aVQydbBal5538o+JkBKXh2sRuCyIA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/types": "8.71.2",
+        "@typescript-eslint/types": "8.72.0",
        "eslint-visitor-keys": "^5.0.0"
      },
      "engines": {
@@ -3576,6 +3576,7 @@
    },
    "node_modules/argparse": {
      "version": "2.0.1",
+      "dev": true,
      "license": "Python-2.0"
    },
    "node_modules/aria-query": {
@@ -5365,9 +5366,9 @@
      }
    },
    "node_modules/eslint-plugin-jsdoc": {
-      "version": "65.3.4",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-jsdoc/-/eslint-plugin-jsdoc-65.3.4.tgz",
-      "integrity": "sha512-Z3/ro8sZPqnXKhyAzCNa3F7KCZ3js5xVx/q9BEvTjUGzN6OIQfdb+q3Sc9lJ3zCfyPnN0tI524ulZjYRxAwnAw==",
+      "version": "65.3.15",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-jsdoc/-/eslint-plugin-jsdoc-65.3.15.tgz",
+      "integrity": "sha512-cpU66X+daaX2X6cndE0grdLAIlodysI3KuUEdrJd6FvQHuuYOOvMRAdy8ToYjyJrsoUv0fXkMclA5RM5kaipMw==",
      "dev": true,
      "license": "BSD-3-Clause",
      "dependencies": {
@@ -7121,9 +7122,9 @@
      }
    },
    "node_modules/js-yaml": {
-      "version": "5.4.3",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.4.3.tgz",
-      "integrity": "sha512-yzzNtgczwgoVHNigCyKTXcQJU4Y8t/ikU4UxXW0BvrLfHTGWZhsNcOT2s/a7vn81/4KqVnNmHjaUEPlvWnNwVw==",
+      "version": "5.5.0",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.5.0.tgz",
+      "integrity": "sha512-paNr4LFIFPjeeSmwNYdrb8FafLLG/Cr2Af3GjbsHJ5CxIjH4r0c2emlmRdAtpPAieP1gRVzk6buBbVP5gBMGAg==",
      "funding": [
        {
          "type": "github",
@@ -7136,12 +7137,28 @@
      ],
      "license": "MIT",
      "dependencies": {
-        "argparse": "^2.0.1"
+        "argparse": "^3.0.3"
      },
      "bin": {
        "js-yaml": "bin/js-yaml.mjs"
      }
    },
+    "node_modules/js-yaml/node_modules/argparse": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/argparse/-/argparse-3.0.3.tgz",
+      "integrity": "sha512-Sn98ftV3KfsO8xfLPHG6oT8y+b0yvbrLgZjgPDXsharNY15tTAjqIsIju4S32nl6/iEUNNE4v+yL2Zhm8ooP3w==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/puzrin"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/nodeca"
+        }
+      ],
+      "license": "PSF-2.0"
+    },
    "node_modules/jschardet": {
      "version": "3.1.4",
      "resolved": "https://registry.npmjs.org/jschardet/-/jschardet-3.1.4.tgz",
@@ -9981,16 +9998,16 @@
      }
    },
    "node_modules/typescript-eslint": {
-      "version": "8.71.2",
-      "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.71.2.tgz",
-      "integrity": "sha512-Rz4effbMy2g9wnvOJZG6SbVavX313Lap1vNEbk1RUochzickvzP8P4HB+bkNg5e50eVz1hQGjh9K1omI1xB4Bw==",
+      "version": "8.72.0",
+      "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.72.0.tgz",
+      "integrity": "sha512-r26Fkc8As+mZvqp7SLsMmNFyYUup/6CjK7/eHBHmhOw6GH6n6YFxHVFrG0jN1c5CMpDzelLPxvgeCOzx7BjN+A==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/eslint-plugin": "8.71.2",
-        "@typescript-eslint/parser": "8.71.2",
-        "@typescript-eslint/typescript-estree": "8.71.2",
-        "@typescript-eslint/utils": "8.71.2"
+        "@typescript-eslint/eslint-plugin": "8.72.0",
+        "@typescript-eslint/parser": "8.72.0",
+        "@typescript-eslint/typescript-estree": "8.72.0",
+        "@typescript-eslint/utils": "8.72.0"
      },
      "engines": {
        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -10024,12 +10041,12 @@
      }
    },
    "node_modules/undici": {
-      "version": "6.28.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-6.28.0.tgz",
-      "integrity": "sha512-LIY910g9TI13YS95lrMFrs8Rm/u/irgHeTWoKCoteeJ04CUJ92eEfj0rVn+7VKMPBpUPiUoBKfhNyLI23EE/KA==",
+      "version": "7.30.1",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-7.30.1.tgz",
+      "integrity": "sha512-03KrMbjIFDWQR5RNPrSw3bd1r12JpyFQl9/yxjUbJtqkjmllqC5lFjZh6ujeuJCKr8EOQvRW872Oy/az+nLYxg==",
      "license": "MIT",
      "engines": {
-        "node": ">=18.17"
+        "node": ">=20.18.1"
      }
    },
    "node_modules/undici-types": {
@@ -10488,6 +10505,7 @@
        "@octokit/core": "^7.0.8",
        "@octokit/plugin-paginate-rest": ">=16.0.0",
        "@octokit/plugin-rest-endpoint-methods": "^18.0.0",
+        "glob": "^13.0.6",
        "lite-matter": "^0.1.2",
        "mdast-util-from-markdown": "^2.1.0",
        "semver": "^7.8.5",
@@ -38,12 +38,12 @@
    "follow-redirects": "^1.16.1",
    "get-folder-size": "^5.0.0",
    "https-proxy-agent": "^7.0.6",
-    "js-yaml": "^5.4.3",
+    "js-yaml": "^5.5.0",
    "jsonschema": "1.5.0",
    "long": "^5.3.2",
    "node-forge": "^1.4.0",
    "semver": "^7.8.5",
-    "undici": "^6.28.0",
+    "undici": "^7.30.1",
    "uuid": "^14.0.3"
  },
  "devDependencies": {
@@ -65,14 +65,14 @@
    "eslint-import-resolver-typescript": "^4.4.5",
    "eslint-plugin-github": "^6.1.2",
    "eslint-plugin-import-x": "^4.17.1",
-    "eslint-plugin-jsdoc": "^65.3.4",
+    "eslint-plugin-jsdoc": "^65.3.15",
    "eslint-plugin-no-async-foreach": "^0.1.1",
    "glob": "^13.0.6",
    "globals": "^17.13.0",
    "nock": "^14.0.17",
    "sinon": "^22.1.0",
    "typescript": "^6.0.3",
-    "typescript-eslint": "^8.71.2"
+    "typescript-eslint": "^8.72.0"
  },
  "overrides": {
    "@actions/tool-cache": {
@@ -94,6 +94,6 @@
      "semver": ">=6.3.1"
    },
    "glob": "^13.0.6",
-    "undici": "^6.28.0"
+    "undici": "^7.30.1"
  }
 }
@@ -1,6 +1,8 @@
 import fs from "fs";
+import path from "path";

 import * as core from "@actions/core";
+import { globSync } from "glob";

 import * as sarif from "../src/sarif";

@@ -34,59 +36,83 @@ function checkStatusPageNotification(n: sarif.Notification) {
  }
 }

+function checkSarif(sarifFile: string) {
+  core.info(`Checking SARIF file at '${sarifFile}'`);
+
+  const log = JSON.parse(fs.readFileSync(sarifFile, "utf8")) as sarif.Log;
+  const run = log.runs[0];
+
+  if (run.invocations === undefined) {
+    throw new Error("run.invocations is undefined");
+  }
+
+  const toolExecutionNotifications =
+    run.invocations[0].toolExecutionNotifications;
+
+  if (toolExecutionNotifications === undefined) {
+    throw new Error("toolExecutionNotifications is undefined");
+  }
+
+  const statusPageNotifications = toolExecutionNotifications.filter(
+    (n) =>
+      n.descriptor?.id === DIAGNOSTIC_ID &&
+      n.properties?.visibility?.statusPage,
+  );
+  if (statusPageNotifications.length !== 1) {
+    core.setFailed(
+      "Expected exactly one status page reporting descriptor for this diagnostic in the " +
+        `'runs[].invocations[].toolExecutionNotifications[]' SARIF property, but found ` +
+        `${statusPageNotifications.length}. All notification reporting descriptors: ` +
+        `${JSON.stringify(toolExecutionNotifications)}.`,
+    );
+  }
+  checkStatusPageNotification(statusPageNotifications[0]);
+
+  const notifications = run.tool.driver.notifications;
+
+  if (notifications === undefined) {
+    throw new Error("notifications is undefined");
+  }
+
+  const diagnosticNotification = notifications.filter(
+    (n) =>
+      n.id === DIAGNOSTIC_ID &&
+      n.name === DIAGNOSTIC_ID &&
+      n.fullDescription?.text === DIAGNOSTIC_NAME,
+  );
+  if (diagnosticNotification.length !== 1) {
+    core.setFailed(
+      "Expected exactly one notification for this diagnostic in the " +
+        `'runs[].tool.driver.notifications[]' SARIF property, but found ` +
+        `${diagnosticNotification.length}. All notifications: ` +
+        `${JSON.stringify(notifications)}.`,
+    );
+  }
+}
+
 const sarifPath = process.env["SARIF_PATH"];

 if (sarifPath === undefined) {
-  throw new Error("The path to a SARIF file must be set in 'SARIF_PATH'.");
-}
-
-const log = JSON.parse(fs.readFileSync(sarifPath, "utf8")) as sarif.Log;
-const run = log.runs[0];
-
-if (run.invocations === undefined) {
-  throw new Error("run.invocations is undefined");
-}
-
-const toolExecutionNotifications =
-  run.invocations[0].toolExecutionNotifications;
-
-if (toolExecutionNotifications === undefined) {
-  throw new Error("toolExecutionNotifications is undefined");
-}
-
-const statusPageNotifications = toolExecutionNotifications.filter(
-  (n) =>
-    n.descriptor?.id === DIAGNOSTIC_ID && n.properties?.visibility?.statusPage,
-);
-if (statusPageNotifications.length !== 1) {
-  core.setFailed(
-    "Expected exactly one status page reporting descriptor for this diagnostic in the " +
-      `'runs[].invocations[].toolExecutionNotifications[]' SARIF property, but found ` +
-      `${statusPageNotifications.length}. All notification reporting descriptors: ` +
-      `${JSON.stringify(toolExecutionNotifications)}.`,
+  throw new Error(
+    "The path to a SARIF file or directory must be set in 'SARIF_PATH'.",
  );
 }
-checkStatusPageNotification(statusPageNotifications[0]);

-const notifications = run.tool.driver.notifications;
+if (fs.statSync(sarifPath).isDirectory()) {
+  const sarifFiles = globSync("**/*.sarif", {
+    cwd: path.resolve(sarifPath),
+    absolute: true,
+  });

-if (notifications === undefined) {
-  throw new Error("notifications is undefined");
-}
+  if (sarifFiles.length < 1) {
+    throw new Error(`Unable to find any .sarif files in '${sarifPath}'.`);
+  }

-const diagnosticNotification = notifications.filter(
-  (n) =>
-    n.id === DIAGNOSTIC_ID &&
-    n.name === DIAGNOSTIC_ID &&
-    n.fullDescription?.text === DIAGNOSTIC_NAME,
-);
-if (diagnosticNotification.length !== 1) {
-  core.setFailed(
-    "Expected exactly one notification for this diagnostic in the " +
-      `'runs[].tool.driver.notifications[]' SARIF property, but found ` +
-      `${diagnosticNotification.length}. All notifications: ` +
-      `${JSON.stringify(notifications)}.`,
-  );
+  for (const sarifFile of sarifFiles) {
+    checkSarif(sarifFile);
+  }
+} else {
+  checkSarif(sarifPath);
 }

 core.info("Finished diagnostic export test");
@@ -53,7 +53,7 @@ validationJobs:
    installNode: true
    steps:
      - name: Download workflow artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          pattern: test-mode-sarif-*
          path: sarif
@@ -1,23 +0,0 @@
-name: "RuboCop multi-language"
-description: "Tests using RuboCop to analyze a multi-language repository and then using the CodeQL Action to upload the resulting SARIF"
-# This check doesn't use CodeQL, so the `version` matrix variable is unused.
-versions:
-  - default
-steps:
-  - name: Set up Ruby
-    uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
-    with:
-      ruby-version: 2.6
-  - name: Install Code Scanning integration
-    run: bundle add code-scanning-rubocop --version 0.3.0 --skip-install
-  - name: Install dependencies
-    run: bundle install
-  - name: RuboCop run
-    run: |
-      bash -c "
-        bundle exec rubocop --require code_scanning --format CodeScanning::SarifFormatter -o rubocop.sarif
-        [[ $? -ne 2 ]]
-      "
-  - uses: ./../action/upload-sarif
-    with:
-      sarif_file: rubocop.sarif
@@ -9,6 +9,7 @@
    "@octokit/core": "^7.0.8",
    "@octokit/plugin-paginate-rest": ">=16.0.0",
    "@octokit/plugin-rest-endpoint-methods": "^18.0.0",
+    "glob": "^13.0.6",
    "lite-matter": "^0.1.2",
    "mdast-util-from-markdown": "^2.1.0",
    "semver": "^7.8.5",
@@ -137,7 +137,15 @@ interface LanguageSetup {
 /** Describes partial mappings from built-in languages to their specific setup information. */
 type LanguageSetups = Partial<Record<BuiltInLanguage, LanguageSetup>>;

-// The default set of CodeQL Bundle versions to use for the PR checks.
+/** A type representing version identifiers. */
+type Version =
+  | "default"
+  | "linked"
+  | "nightly-latest"
+  // This is an approximation, but sufficient validation for our needs here.
+  | `stable-v${number}.${number}.${number}`;
+
+/** The default set of CodeQL Bundle versions to use for the PR checks. */
 const defaultTestVersions = [
  // The oldest supported CodeQL version. If bumping, update `CODEQL_MINIMUM_VERSION` in `codeql.ts`
  "stable-v2.20.7",
@@ -159,7 +167,10 @@ const defaultTestVersions = [
  "linked",
  // A nightly build directly from the our private repo, built in the last 24 hours.
  "nightly-latest",
-];
+] as const satisfies Version[];
+
+/** A type representing the default test versions. */
+type DefaultTestVersion = (typeof defaultTestVersions)[number];

 /** The default versions we use for languages / frameworks, if not specified as a workflow input. */
 const defaultLanguageVersions = {
@@ -313,9 +324,11 @@ const languageSetups: LanguageSetups = {
  },
 };

-// This is essentially an arbitrary version of `yq`, which happened to be the one that
-// `choco` fetched when we moved away from using that here.
-// See https://github.com/github/codeql-action/pull/3423
+/**
+ * This is essentially an arbitrary version of `yq`, which happened to be the one that
+ * `choco` fetched when we moved away from using that here.
+ * See https://github.com/github/codeql-action/pull/3423
+ */
 const YQ_VERSION = "v4.50.1";

 const CHECKS_DIR = path.join(PR_CHECKS_DIR, "checks");
@@ -442,10 +455,23 @@ function generateJobMatrix(
          : [operatingSystemConfig["runner-image"]];

      for (const runnerImage of runnerImagesForOs) {
-        matrix.push({
-          os: runnerImage,
-          version,
-        });
+        // stable-v2.20.7 requires an older version of Java than the default on `ubuntu-latest`.
+        // We could install that older version on the newer runners, or use the older runner.
+        // We do the latter here. This can be removed once we stop supporting `v2.20.7`.
+        // Since this is typed as `DefaultTestVersion`, it will become an error once `stable-v2.20.7`
+        // is removed from `defaultTestVersions`.
+        const requiresOlderRunnerImage: DefaultTestVersion = "stable-v2.20.7";
+        if (
+          runnerImage === "ubuntu-latest" &&
+          version === requiresOlderRunnerImage
+        ) {
+          matrix.push({ os: "ubuntu-24.04", version });
+        } else {
+          matrix.push({
+            os: runnerImage,
+            version,
+          });
+        }
      }
    }
  }
@@ -72,7 +72,7 @@ export const getOptionalInput = function (name: string): string | undefined {
 * directory that has been set in `CODEQL_ACTION_TEMP` by e.g. a previous step, or the
 * value of `RUNNER_TEMP` otherwise.
 */
-export function getTemporaryDirectory(env: Env = getEnv()): string {
+export function getTemporaryDirectory(env: ReadOnlyEnv = getEnv()): string {
  return (
    env.getOptional(EnvVar.TEMP) ?? env.getRequired(ActionsEnvVars.RUNNER_TEMP)
  );
@@ -361,9 +361,10 @@ const MAX_STDERR_BUFFER_SIZE = 20000;
 * Runs a CLI tool.
 *
 * @returns Standard output produced by the tool.
- * @throws A `CommandInvocationError` if the tool exits with a non-zero status code.
+ * @throws A {@link CommandInvocationError} if the tool exits with a non-zero status code.
 */
 export async function runTool(
+  env: Env,
  cmd: string,
  args: string[] = [],
  opts: { stdin?: string; noStreamStdout?: boolean } = {},
@@ -374,6 +375,7 @@ export async function runTool(
    process.stdout.write(`[command]${cmd} ${args.join(" ")}\n`);
  }
  const exitCode = await new toolrunner.ToolRunner(cmd, args, {
+    env: env.getDefined(),
    ignoreReturnCode: true,
    listeners: {
      stdout: (data: Buffer) => {
@@ -1 +1 @@
-{"maximumVersion":"3.23","minimumVersion":"3.18"}
+{"maximumVersion":"3.23","minimumVersion":"3.19"}
@@ -2,7 +2,7 @@ import * as fs from "fs";
 import path from "path";

 import { getTemporaryDirectory } from "../actions-util";
-import { Env } from "../environment";
+import { ReadOnlyEnv } from "../environment";
 import * as json from "../json";
 import { Logger } from "../logging";

@@ -51,7 +51,7 @@ export function resetCachedCodeQlVersion(): void {
 * Returns the path to the temporary file that backs the
 * on-disk cache of CLI responses between workflow steps.
 */
-export function getCommandCacheFilePath(env: Env): string {
+export function getCommandCacheFilePath(env: ReadOnlyEnv): string {
  return path.join(getTemporaryDirectory(env), COMMAND_CACHE_FILENAME);
 }

@@ -18,7 +18,7 @@ import { CliError, wrapCliConfigurationError } from "./cli-errors";
 import type { ActionConfig } from "./config/action-config";
 import { appendExtraQueryExclusions, type Config } from "./config-utils";
 import { DocUrl } from "./doc-url";
-import { EnvVar, getEnv, exportEnvVar } from "./environment";
+import { EnvVar, getEnv, Env, ReadOnlyEnv } from "./environment";
 import {
  CodeQLDefaultVersionInfo,
  Feature,
@@ -260,17 +260,17 @@ const CODEQL_MINIMUM_VERSION = "2.20.7";
 /**
 * This version will shortly become the oldest version of CodeQL that the Action will run with.
 */
-const CODEQL_NEXT_MINIMUM_VERSION = "2.21.3";
+const CODEQL_NEXT_MINIMUM_VERSION = "2.22.4";

 /**
 * This is the version of GHES that was most recently deprecated.
 */
-const GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.17";
+const GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.18";

 /**
 * This is the deprecation date for the version of GHES that was most recently deprecated.
 */
-const GHES_MOST_RECENT_DEPRECATION_DATE = "2026-09-24";
+const GHES_MOST_RECENT_DEPRECATION_DATE = "2026-10-16";

 /** The CLI verbosity level to use for extraction in debug mode. */
 const EXTRACTION_DEBUG_MODE_VERBOSITY = "progress++";
@@ -499,13 +499,14 @@ export async function getCodeQLForCmd(
  logger: Logger,
  cmd: string,
  checkVersion: boolean,
+  env: Env = getEnv(),
 ): Promise<CodeQL> {
  const codeql: CodeQL = {
    getPath() {
      return cmd;
    },
    async getVersion() {
-      const cacheFilePath = outputCache.getCommandCacheFilePath(getEnv());
+      const cacheFilePath = outputCache.getCommandCacheFilePath(env);
      let result = outputCache.getCachedCodeQlVersion(
        logger,
        cacheFilePath,
@@ -513,6 +514,7 @@ export async function getCodeQLForCmd(
      );
      if (result === undefined) {
        result = await runCliJson<VersionInfo>(
+          env,
          cmd,
          ["version", "--format=json"],
          {
@@ -596,6 +598,7 @@ export async function getCodeQLForCmd(
        : ["--no-calculate-baseline"];

      await runCli(
+        env,
        cmd,
        [
          "database",
@@ -631,7 +634,7 @@ export async function getCodeQLForCmd(
      }
    },
    async runAutobuild(config: Config, language: Language) {
-      applyAutobuildAzurePipelinesTimeoutFix();
+      applyAutobuildAzurePipelinesTimeoutFix(env);

      const autobuildCmd = path.join(
        await this.resolveExtractor(language),
@@ -641,8 +644,11 @@ export async function getCodeQLForCmd(

      // Bump the verbosity of the autobuild command if we're in debug mode
      if (config.debugMode) {
-        process.env[EnvVar.CLI_VERBOSITY] =
-          process.env[EnvVar.CLI_VERBOSITY] || EXTRACTION_DEBUG_MODE_VERBOSITY;
+        env.set(
+          EnvVar.CLI_VERBOSITY,
+          env.getOptional(EnvVar.CLI_VERBOSITY) ??
+            EXTRACTION_DEBUG_MODE_VERBOSITY,
+        );
      }

      // On macOS, System Integrity Protection (SIP) typically interferes with
@@ -659,10 +665,10 @@ export async function getCodeQLForCmd(
      // When `DYLD_INSERT_LIBRARIES` is set in the environment for a step,
      // the Actions runtime introduces its own workaround for SIP
      // (https://github.com/actions/runner/pull/416).
-      await runCli(autobuildCmd);
+      await runCli(env, autobuildCmd);
    },
    async extractScannedLanguage(config: Config, language: Language) {
-      await runCli(cmd, [
+      await runCli(env, cmd, [
        "database",
        "trace-command",
        "--index-traceless-dbs",
@@ -674,10 +680,10 @@ export async function getCodeQLForCmd(
    },
    async extractUsingBuildMode(config: Config, language: Language) {
      if (config.buildMode === BuildMode.Autobuild) {
-        applyAutobuildAzurePipelinesTimeoutFix();
+        applyAutobuildAzurePipelinesTimeoutFix(env);
      }
      try {
-        await runCli(cmd, [
+        await runCli(env, cmd, [
          "database",
          "trace-command",
          "--use-build-mode",
@@ -716,7 +722,7 @@ export async function getCodeQLForCmd(
        ...getExtraOptionsFromEnv(["database", "finalize"]),
        databasePath,
      ];
-      await runCli(cmd, args);
+      await runCli(env, cmd, args);
    },
    async resolveLanguages(
      {
@@ -725,7 +731,7 @@ export async function getCodeQLForCmd(
        filterToLanguagesWithQueries: boolean;
      } = { filterToLanguagesWithQueries: false },
    ) {
-      return runCliJson<ResolveLanguagesOutput>(cmd, [
+      return runCliJson<ResolveLanguagesOutput>(env, cmd, [
        "resolve",
        "languages",
        "--format=betterjson",
@@ -754,7 +760,11 @@ export async function getCodeQLForCmd(
      if (workingDir !== undefined) {
        codeqlArgs.push("--working-dir", workingDir);
      }
-      return await runCliJson<ResolveBuildEnvironmentOutput>(cmd, codeqlArgs);
+      return await runCliJson<ResolveBuildEnvironmentOutput>(
+        env,
+        cmd,
+        codeqlArgs,
+      );
    },
    async databaseRunQueries(
      databasePath: string,
@@ -773,7 +783,7 @@ export async function getCodeQLForCmd(
          ignoringOptions: ["--expect-discarded-cache"],
        }),
      ];
-      await runCli(cmd, codeqlArgs);
+      await runCli(env, cmd, codeqlArgs);
    },
    async databaseInterpretResults(
      databasePath: string,
@@ -806,7 +816,7 @@ export async function getCodeQLForCmd(
        "--sarif-group-rules-by-pack",
        "--sarif-include-query-help=always",
        "--sublanguage-file-coverage",
-        ...(await getJobRunUuidSarifOptions()),
+        ...(await getJobRunUuidSarifOptions(env)),
        ...getExtraOptionsFromEnv(["database", "interpret-results"]),
      ];
      if (sarifRunPropertyFlag !== undefined) {
@@ -826,7 +836,7 @@ export async function getCodeQLForCmd(
      }
      // Capture the stdout, which contains the analysis summary. Don't stream it to the Actions
      // logs to avoid printing it twice.
-      return await runCli(cmd, codeqlArgs, {
+      return await runCli(env, cmd, codeqlArgs, {
        noStreamStdout: true,
      });
    },
@@ -843,7 +853,7 @@ export async function getCodeQLForCmd(
          `--cache-cleanup=${cleanupLevel}`,
          ...getExtraOptionsFromEnv(["database", "cleanup"]),
        ];
-        await runCli(cmd, codeqlArgs);
+        await runCli(env, cmd, codeqlArgs);
      }
    },
    async databaseBundle(
@@ -877,7 +887,9 @@ export async function getCodeQLForCmd(
          ]),
        );
      }
-      await new toolrunner.ToolRunner(cmd, args).exec();
+      await new toolrunner.ToolRunner(cmd, args, {
+        env: env.getDefined(),
+      }).exec();
    },
    async databaseExportDiagnostics(
      databasePath: string,
@@ -898,7 +910,9 @@ export async function getCodeQLForCmd(
      if (automationDetailsId !== undefined) {
        args.push("--sarif-category", automationDetailsId);
      }
-      await new toolrunner.ToolRunner(cmd, args).exec();
+      await new toolrunner.ToolRunner(cmd, args, {
+        env: env.getDefined(),
+      }).exec();
    },
    async diagnosticsExport(
      sarifFile: string,
@@ -946,7 +960,9 @@ export async function getCodeQLForCmd(
      if (automationDetailsId !== undefined) {
        args.push("--sarif-category", automationDetailsId);
      }
-      await new toolrunner.ToolRunner(cmd, args).exec();
+      await new toolrunner.ToolRunner(cmd, args, {
+        env: env.getDefined(),
+      }).exec();
    },
    async resolveExtractor(language: Language): Promise<string> {
      // Request it using `format=json` so we don't need to strip the trailing new line generated by
@@ -964,6 +980,7 @@ export async function getCodeQLForCmd(
          ...getExtraOptionsFromEnv(["resolve", "extractor"]),
        ],
        {
+          env: env.getDefined(),
          silent: true,
          listeners: {
            stdout: (data) => {
@@ -991,7 +1008,7 @@ export async function getCodeQLForCmd(
        ...getExtraOptionsFromEnv(["resolve", "queries"]),
        ...queries,
      ];
-      return await runCliJson<string[]>(cmd, codeqlArgs, {
+      return await runCliJson<string[]>(env, cmd, codeqlArgs, {
        noStreamStdout: true,
      });
    },
@@ -1005,7 +1022,7 @@ export async function getCodeQLForCmd(
        "--format=json",
        ...getExtraOptionsFromEnv(["resolve", "database"]),
      ];
-      return await runCliJson<ResolveDatabaseOutput>(cmd, codeqlArgs, {
+      return await runCliJson<ResolveDatabaseOutput>(env, cmd, codeqlArgs, {
        noStreamStdout: true,
      });
    },
@@ -1032,7 +1049,7 @@ export async function getCodeQLForCmd(
        args.push("--sarif-merge-runs-from-equal-category");
      }

-      await runCli(cmd, args);
+      await runCli(env, cmd, args);
    },
  };
  // To ensure that status reports include the CodeQL CLI version wherever
@@ -1054,7 +1071,7 @@ export async function getCodeQLForCmd(
    );
  } else if (
    checkVersion &&
-    process.env[EnvVar.SUPPRESS_DEPRECATED_SOON_WARNING] !== "true" &&
+    env.getOptional(EnvVar.SUPPRESS_DEPRECATED_SOON_WARNING) !== "true" &&
    !(await util.codeQlVersionAtLeast(codeql, CODEQL_NEXT_MINIMUM_VERSION))
  ) {
    const result = await codeql.getVersion();
@@ -1072,7 +1089,7 @@ export async function getCodeQLForCmd(
        }' by 'github/codeql-action/*@v${getActionVersion()}' in your code scanning workflow to ` +
        "continue using this version of the CodeQL Action.",
    );
-    exportEnvVar(EnvVar.SUPPRESS_DEPRECATED_SOON_WARNING, "true");
+    env.export(EnvVar.SUPPRESS_DEPRECATED_SOON_WARNING, "true");
  }
  return codeql;
 }
@@ -1149,12 +1166,13 @@ export function getExtraOptions(
 }

 async function runCli(
+  env: Env,
  cmd: string,
  args: string[] = [],
  opts: { stdin?: string; noStreamStdout?: boolean } = {},
 ): Promise<string> {
  try {
-    return await runTool(cmd, args, opts);
+    return await runTool(env, cmd, args, opts);
  } catch (e) {
    if (e instanceof CommandInvocationError) {
      throw wrapCliConfigurationError(new CliError(e));
@@ -1165,6 +1183,8 @@ async function runCli(

 /**
 * Wraps the command executor {@link runCli} and tries to parse the output as JSON.
+ *
+ * @param env The environment variables.
 * @param cmd The command to run.
 * @param args The arguments to pass to the command.
 * @param opts The options for running the command.
@@ -1173,11 +1193,12 @@ async function runCli(
 * @returns The parsed JSON output from the command.
 */
 async function runCliJson<T>(
+  env: Env,
  cmd: string,
  args: string[] = [],
  opts: { stdin?: string; noStreamStdout?: boolean } = {},
 ): Promise<T> {
-  const output = await runCli(cmd, args, opts);
+  const output = await runCli(env, cmd, args, opts);
  try {
    return JSON.parse(output) as T;
  } catch (e) {
@@ -1276,17 +1297,20 @@ function getExtractionVerbosityArguments(
 * Without the fix, long build processes will timeout when pulling down Java packages
 * https://developercommunity.visualstudio.com/content/problem/292284/maven-hosted-agent-connection-timeout.html
 */
-function applyAutobuildAzurePipelinesTimeoutFix() {
-  const javaToolOptions = process.env["JAVA_TOOL_OPTIONS"] || "";
-  process.env["JAVA_TOOL_OPTIONS"] = [
-    ...javaToolOptions.split(/\s+/),
-    "-Dhttp.keepAlive=false",
-    "-Dmaven.wagon.http.pool=false",
-  ].join(" ");
+function applyAutobuildAzurePipelinesTimeoutFix(env: Env) {
+  const javaToolOptions = env.getOptional("JAVA_TOOL_OPTIONS") ?? "";
+  env.set(
+    "JAVA_TOOL_OPTIONS",
+    [
+      ...javaToolOptions.split(/\s+/),
+      "-Dhttp.keepAlive=false",
+      "-Dmaven.wagon.http.pool=false",
+    ].join(" "),
+  );
 }

-async function getJobRunUuidSarifOptions() {
-  const jobRunUuid = process.env[EnvVar.JOB_RUN_UUID];
+async function getJobRunUuidSarifOptions(env: ReadOnlyEnv) {
+  const jobRunUuid = env.getOptional(EnvVar.JOB_RUN_UUID);

  return jobRunUuid ? [`--sarif-run-property=jobRunUuid=${jobRunUuid}`] : [];
 }
@@ -3,7 +3,7 @@ import path from "path";

 import type { ActionState } from "./action-common";
 import { getTemporaryDirectory } from "./actions-util";
-import type { Config } from "./config-utils";
+import type { ActionConfig } from "./config/action-config";
 import { Language } from "./languages";
 import { getActionsLogger, type Logger } from "./logging";
 import {
@@ -177,7 +177,10 @@ export function getTempLanguageDiagnosticsPath(
 }

 /** Gets the path where diagnostics for {@link language} should be stored in the database. */
-export function getDatabaseDiagnosticsPath(config: Config, language: Language) {
+export function getDatabaseDiagnosticsPath(
+  config: ActionConfig<"dbLocation">,
+  language: Language,
+) {
  return getLanguageDiagnosticsPath(config.dbLocation, language);
 }

@@ -190,7 +193,7 @@ export function getDatabaseDiagnosticsPath(config: Config, language: Language) {
 * @param diagnostic The diagnostic message to add to the database.
 */
 export function addDiagnostic(
-  config: Config,
+  config: ActionConfig<"dbLocation" | "tempDir">,
  language: Language,
  diagnostic: DiagnosticMessage,
  logger: Logger = getActionsLogger(),
@@ -215,7 +218,7 @@ export function addDiagnostic(

 /** Adds a diagnostic that is not specific to any language. */
 export function addNoLanguageDiagnostic(
-  config: Config | undefined,
+  config: ActionConfig<"dbLocation" | "languages" | "tempDir"> | undefined,
  diagnostic: DiagnosticMessage,
  logger: Logger = getActionsLogger(),
 ) {
@@ -305,7 +308,7 @@ function writeDiagnosticFile(
 */
 function writeDiagnostic(
  action: ActionState<["Logger"]>,
-  config: Config,
+  config: ActionConfig<"dbLocation">,
  language: Language,
  diagnostic: DiagnosticMessage,
 ) {
@@ -348,7 +351,7 @@ export function logTemporaryDiagnostics(action: ActionState<["Logger"]>) {
 /** Relocates all temporary diagnostics to the respective databases. */
 export function flushDiagnostics(
  action: ActionState<["Logger"]>,
-  config: Config,
+  config: ActionConfig<"dbLocation" | "languages">,
 ) {
  const diagnosticsCount = temporaryDiagnostics.length;
  action.logger.debug(
@@ -293,8 +293,8 @@ export function getOptionalEnvVar(paramName: string): string | undefined {
 * in tests, while clearly signalling in regular code that the consumer of the `ReadOnlyEnv` instance
 * will only read from it.
 */
-export class ReadOnlyEnv<T extends string | undefined = string | undefined> {
-  constructor(protected readonly vars: Record<string, T>) {}
+export class ReadOnlyEnv {
+  constructor(protected readonly vars: Record<string, string | undefined>) {}

  /** Clones the object while detaching the underlying environment from the original. */
  public clone(): this {
@@ -302,10 +302,24 @@ export class ReadOnlyEnv<T extends string | undefined = string | undefined> {
  }

  /** Gets a copy of the underlying environment. */
-  public get(): Record<string, T> {
+  public get(): Record<string, string | undefined> {
    return { ...this.vars };
  }

+  /** Gets a copy of the underlying environment, where the values are not `undefined`. */
+  public getDefined(): Record<string, string> {
+    const result: Record<string, string> = {};
+
+    for (const [key, val] of Object.entries(this.vars)) {
+      if (val === undefined) {
+        continue;
+      }
+      result[key] = val;
+    }
+
+    return result;
+  }
+
  /** Tries to get the value for `name` and throws if there isn't one. */
  public getRequired(name: string): string {
    return getRequiredEnvVar(this.vars, name);
@@ -317,7 +331,7 @@ export class ReadOnlyEnv<T extends string | undefined = string | undefined> {
  }

  /** Gets the entries of the underlying `ProcessEnv`. */
-  public entries(): Array<[string, T]> {
+  public entries(): Array<[string, string | undefined]> {
    return Object.entries(this.vars);
  }

@@ -347,19 +361,17 @@ export class ReadOnlyEnv<T extends string | undefined = string | undefined> {
 * Use `ReadOnlyEnv` instead if you only plan to read from the environment.
 * This type allows writing to the environment.
 */
-export class Env<
-  T extends string | undefined = string | undefined,
-> extends ReadOnlyEnv<T> {
+export class Env extends ReadOnlyEnv {
  private changed: boolean = false;

  /** Sets an environment variable. */
-  public set(name: string, value: T): void {
+  public set(name: string, value: string | undefined): void {
    this.vars[name] = value;
    this.changed = true;
  }

  /** Sets all environment variables given by `vars`. */
-  public setAll(vars: Record<string, T>): void {
+  public setAll(vars: Record<string, string | undefined>): void {
    for (const [key, val] of Object.entries(vars)) {
      this.set(key, val);
    }
@@ -373,7 +385,7 @@ export class Env<
   * @param name The name of the environment variable to set and export.
   * @param val The value to set and export for the environment variable.
   */
-  public export(name: string, val: T): void {
+  public export(name: string, val: string): void {
    // Setting the environment variable for this instance is always OK, including
    // in tests, since we use fresh `Env` instances whenever needed. This allows
    // tests to pass that rely on that part of the `core.exportVariable` behaviour.
@@ -62,6 +62,7 @@ import {
  runDatabaseInitCluster,
 } from "./init";
 import { JavaEnvVars, BuiltInLanguage } from "./languages";
+import { checkSwiftCompatibility } from "./languages/swift";
 import { Logger, withGroupAsync } from "./logging";
 import {
  downloadOverlayBaseDatabaseFromCache,
@@ -418,14 +419,7 @@ async function run(
      logger,
    });

-    if (
-      config.languages.includes(BuiltInLanguage.swift) &&
-      process.platform !== "darwin"
-    ) {
-      throw new ConfigurationError(
-        `Swift analysis is only supported on macOS runner images. Please migrate to a macOS runner.`,
-      );
-    }
+    checkSwiftCompatibility(actionState, config);

    if (repositoryPropertiesResult.isFailure()) {
      addNoLanguageDiagnostic(
@@ -0,0 +1,70 @@
+import test from "ava";
+import sinon from "sinon";
+
+import { ActionsEnvVars } from "../environment";
+import {
+  createTestConfig,
+  getCodeQLForTesting,
+  getTestEnv,
+  initAllState,
+  makeVersionInfo,
+  RecordingLogger,
+} from "../testing-utils";
+import { ConfigurationError, withTmpDir } from "../util";
+
+import { checkSwiftCompatibility } from "./swift";
+
+import { BuiltInLanguage } from ".";
+
+test("checkSwiftCompatibility doesn't throw for non-Swift languages", (t) => {
+  for (const language of Object.values(BuiltInLanguage)) {
+    if (language === BuiltInLanguage.swift) {
+      continue;
+    }
+
+    t.notThrows(() =>
+      checkSwiftCompatibility(
+        initAllState(),
+        createTestConfig({ languages: [language] }),
+      ),
+    );
+  }
+});
+
+test("checkSwiftCompatibility doesn't throw for Swift on darwin", async (t) =>
+  withTmpDir(async (tmpDir) => {
+    const logger = new RecordingLogger();
+    const env = getTestEnv();
+    env.set(ActionsEnvVars.RUNNER_TEMP, tmpDir);
+
+    const codeql = await getCodeQLForTesting("codeql-for-testing", logger, env);
+    sinon.stub(codeql, "getVersion").resolves(makeVersionInfo("2.27.0"));
+
+    t.notThrows(() =>
+      checkSwiftCompatibility(
+        initAllState({ platform: "darwin", env, logger }),
+        createTestConfig({
+          tempDir: tmpDir,
+          languages: [BuiltInLanguage.swift],
+        }),
+      ),
+    );
+  }));
+
+const nonDarwinPlatforms: NodeJS.Platform[] = ["linux", "win32"];
+for (const nonDarwinPlatform of nonDarwinPlatforms) {
+  test(`checkSwiftCompatibility throws for Swift on ${nonDarwinPlatform}`, (t) => {
+    t.throws(
+      () => {
+        checkSwiftCompatibility(
+          initAllState({ platform: nonDarwinPlatform }),
+          createTestConfig({ languages: [BuiltInLanguage.swift] }),
+        );
+      },
+      {
+        instanceOf: ConfigurationError,
+        message: /^Swift analysis is only supported on macOS runner images/,
+      },
+    );
+  });
+}
@@ -0,0 +1,27 @@
+import { ActionState } from "../action-common";
+import { Config } from "../config-utils";
+import { ConfigurationError } from "../util";
+
+import { BuiltInLanguage } from ".";
+
+/**
+ * Determines whether we can run a Swift analysis on the current runner.
+ *
+ * @param action The Action state.
+ * @param config The Action configuration.
+ *
+ * @throws {ConfigurationError} If Swift analysis is not possible on the current runner.
+ */
+export function checkSwiftCompatibility(
+  action: ActionState<["Base"]>,
+  config: Config,
+) {
+  if (
+    config.languages.includes(BuiltInLanguage.swift) &&
+    action.platform !== "darwin"
+  ) {
+    throw new ConfigurationError(
+      `Swift analysis is only supported on macOS runner images. Please migrate to a macOS runner.`,
+    );
+  }
+}
@@ -1052,6 +1052,7 @@ export function makeTestToken(length: number = 36) {
 export async function getCodeQLForTesting(
  cmd = "codeql-for-testing",
  logger: Logger = new RecordingLogger(),
+  env: Env = getEnv(),
 ): Promise<codeql.CodeQL> {
-  return codeql.getCodeQLForCmd(logger, cmd, false);
+  return codeql.getCodeQLForCmd(logger, cmd, false, env);
 }
@@ -0,0 +1 @@
+- _Upcoming breaking change_: CodeQL version 2.22.3 and earlier were discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. [#4266](https://github.com/github/codeql-action/pull/4266)
Author	SHA1	Message	Date
Michael B. Gale	354d3a23c0	Merge pull request #4262 from github/mbg/cherry-picks/macos-deprecation Minor improvements to prepare for #4221	2026-10-28 11:31:43 +00:00
Michael B. Gale	166cc10f7e	Merge pull request #4270 from github/dependabot/github_actions/dot-github/workflows/actions-minor-4af230c318 Bump actions/download-artifact from 8.0.1 to 8.0.2 in /.github/workflows in the actions-minor group across 1 directory	2026-10-27 14:06:42 +00:00
Michael B. Gale	2dc8ba8ac0	Merge remote-tracking branch 'origin/main' into mbg/cherry-picks/macos-deprecation	2026-10-27 13:49:01 +00:00
Michael B. Gale	16555031e0	Merge pull request #4271 from github/dependabot/github_actions/dot-github/actions/release-initialise/actions/setup-node-7.1.0 Bump actions/setup-node from 6.4.0 to 7.1.0 in /.github/actions/release-initialise	2026-10-27 13:37:01 +00:00
Michael B. Gale	5fc537340c	Merge branch 'main' into dependabot/github_actions/dot-github/workflows/actions-minor-4af230c318	2026-10-27 13:28:02 +00:00
Henry Mercer	9be075c646	Merge pull request #4273 from github/henrymercer/fix-debug-artifacts-failure-check Fix "Debug artifacts after failure" PR check not checking any artifacts	2026-10-27 13:25:27 +00:00
Michael B. Gale	844a4fa9f9	Merge branch 'main' into dependabot/github_actions/dot-github/actions/release-initialise/actions/setup-node-7.1.0	2026-10-27 13:20:35 +00:00
Henry Mercer	0a3c5e5f2e	Merge pull request #4269 from github/dependabot/npm_and_yarn/npm-minor-b59f2173c9 Bump the npm-minor group across 1 directory with 3 updates	2026-10-27 13:20:01 +00:00
Michael B. Gale	18f7f5c848	Merge branch 'main' into mbg/cherry-picks/macos-deprecation	2026-10-27 13:15:10 +00:00
Michael B. Gale	c9d42955da	Merge pull request #4268 from github/mbg/deps/undici-7 Bump `undici` override to the latest `7.x` version	2026-10-27 13:14:37 +00:00
Henry Mercer	89dbac699b	Merge branch 'main' into dependabot/npm_and_yarn/npm-minor-b59f2173c9	2026-10-27 13:07:20 +00:00
Henry Mercer	8a992c68e8	Merge pull request #4265 from github/henrymercer/notify-enqueuer-on-dequeue Ping the user who enqueued a PR when it's removed from the merge queue	2026-10-27 12:18:27 +00:00
Henry Mercer	c9ae8b94e1	Merge pull request #4266 from github/update-supported-enterprise-server-versions Update supported GitHub Enterprise Server versions	2026-10-27 12:13:51 +00:00
Michael B. Gale	9ff762d747	Merge branch 'main' into henrymercer/notify-enqueuer-on-dequeue	2026-10-27 12:06:11 +00:00
Michael B. Gale	d59d891623	Merge branch 'main' into mbg/deps/undici-7	2026-10-27 12:02:48 +00:00
github-actions[bot]	d1617c5ce4	Rebuild	2026-10-27 11:59:57 +00:00
Henry MercerandCopilot App	05650bc71b	Fix "Debug artifacts after failure" PR check not checking any artifacts Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>	2026-10-27 11:58:02 +00:00
dependabot[bot]	2d923f7a7e	Bump actions/setup-node in /.github/actions/release-initialise Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6.4.0 to 7.1.0. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e...949feb2413d6458794dcd2491c4babbbce0c15c1) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	2026-10-27 11:57:40 +00:00
dependabot[bot]	179d51bf56	Bump actions/download-artifact Bumps the actions-minor group with 1 update in the /.github/workflows directory: [actions/download-artifact](https://github.com/actions/download-artifact). Updates `actions/download-artifact` from 8.0.1 to 8.0.2 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/v8.0.1...9000827ccba6bdab643e8b6fd33ac0654aef8333) --- updated-dependencies: - dependency-name: actions/download-artifact dependency-version: 8.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-minor ... Signed-off-by: dependabot[bot] <support@github.com>	2026-10-27 11:57:33 +00:00
Henry Mercer	1108171143	Merge branch 'main' into update-supported-enterprise-server-versions	2026-10-27 11:57:20 +00:00
github-actions[bot]	483db645df	Rebuild	2026-10-27 11:56:28 +00:00
dependabot[bot]	edc50a623c	Bump the npm-minor group across 1 directory with 3 updates Bumps the npm-minor group with 3 updates in the / directory: [js-yaml](https://github.com/nodeca/js-yaml), [eslint-plugin-jsdoc](https://github.com/gajus/eslint-plugin-jsdoc) and [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint). Updates `js-yaml` from 5.4.3 to 5.5.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/compare/5.4.3...5.5.0) Updates `eslint-plugin-jsdoc` from 65.3.4 to 65.3.15 - [Release notes](https://github.com/gajus/eslint-plugin-jsdoc/releases) - [Commits](https://github.com/gajus/eslint-plugin-jsdoc/compare/v65.3.4...v65.3.15) Updates `typescript-eslint` from 8.71.2 to 8.72.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.72.0/packages/typescript-eslint) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 5.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor - dependency-name: eslint-plugin-jsdoc dependency-version: 65.3.15 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor - dependency-name: typescript-eslint dependency-version: 8.72.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor ... Signed-off-by: dependabot[bot] <support@github.com>	2026-10-27 11:54:12 +00:00
Michael B. Gale	bc9bb20aed	Merge pull request #4267 from github/mbg/deps/setup-kotlin Address `ubuntu-26.04`-related CI failures	2026-10-27 11:39:17 +00:00
Michael B. Gale	2908c78a82	Remove Rubocop from deflake workflow	2026-10-27 11:19:11 +00:00
Michael B. Gale	bcc1fbe153	Add comment to `debug-artifacts` workflows	2026-10-27 11:18:33 +00:00
Michael B. Gale	0b8f4560ec	Add comment for the Kotlin version	2026-10-27 10:23:02 +00:00
Michael B. Gale	8fb8b475a9	Consistently use JSDocs in `sync.ts`	2026-10-27 10:20:12 +00:00
Henry MercerandCopilot App	4a890e46e0	Remove GHES 3.18 from compatibility table Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>	2026-10-26 16:43:21 +00:00
Henry MercerandCopilot App	bfac910f06	Update CodeQL deprecation warning for GHES 3.18 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>	2026-10-26 16:43:13 +00:00
Michael B. Gale	63b184d4bc	Improve `sync.ts` version typing so that check constant becomes an error once removed	2026-10-26 14:33:26 +00:00
Michael B. Gale	34b4917832	Add comment to `sync.ts`	2026-10-26 14:26:53 +00:00
Michael B. Gale	171607b66f	Remove Rubocop workflow	2026-10-26 13:45:49 +00:00
Michael B. Gale	ab743b6301	Install newer version of `code-scanning-rubocop`	2026-10-26 13:29:56 +00:00
Michael B. Gale	eac0005d0c	Temporarily switch old CLI checks to older Ubuntu runner	2026-10-26 13:23:29 +00:00
Michael B. Gale	dd68f130c6	Install a newer Ruby version	2026-10-26 13:23:29 +00:00
Michael B. Gale	ce7d3f7738	Install newer Kotlin version	2026-10-26 13:23:28 +00:00
Michael B. Gale	515fac0ed0	Configure Dependabot to ignore `undici` for the moment	2026-10-26 13:00:49 +00:00
Michael B. Gale	39119659f3	Bump `undici` override to the latest `7.x` version	2026-10-26 13:00:39 +00:00
Michael B. Gale	b913bf6353	Point Dependabot at subdirectories in `.github/actions`	2026-10-26 12:51:54 +00:00
Michael B. Gale	b63386c3d8	Update `setup-kotlin` to the latest version	2026-10-26 12:49:37 +00:00
Michael B. Gale	516bd7cc48	Pass `env` to all `ToolRunner`s in `codeql.ts`	2026-10-26 10:50:07 +00:00
Michael B. Gale	49de08391c	Fix JSDoc	2026-10-26 10:46:59 +00:00
github-actions[bot]	fc9487df66	Update supported GitHub Enterprise Server versions	2026-10-24 00:23:30 +00:00
Henry MercerandCopilot App	49bbf2b590	Ping the user who enqueued a PR when it's removed from the merge queue Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>	2026-10-23 13:30:18 +01:00
Michael B. Gale	6d448e0c5f	Allow `runTool` to inherit `env`	2026-10-23 13:09:20 +01:00
Michael B. Gale	7cd2203aed	Use `env.export` in `getCodeQLForCmd`	2026-10-23 12:59:45 +01:00
Michael B. Gale	d7e4421be7	Remove unused type parameters from `Env` classes	2026-10-23 12:54:44 +01:00
Michael B. Gale	5a097f3eea	Merge remote-tracking branch 'origin/main' into mbg/cherry-picks/macos-deprecation	2026-10-23 12:52:18 +01:00
Michael B. Gale	2d3b6d4530	Check that a `ConfigurationError` is thrown	2026-10-23 12:11:00 +01:00
Michael B. Gale	fbf3125415	Rename `isSwiftCompatible`	2026-10-23 12:07:19 +01:00
Michael B. Gale	0c057be418	Merge branch 'main' into mbg/cherry-picks/macos-deprecation	2026-10-22 17:33:16 +01:00
Michael B. Gale	7a0df8fe5b	Improve `globSync` call	2026-10-22 14:57:07 +01:00
Michael B. Gale	5a546846a4	Allow `check-diagnostics.ts` to check multiple SARIF files	2026-10-22 14:39:51 +01:00
Michael B. Gale	00d7ef8570	Refactor top-level code into `checkSarif`	2026-10-22 14:39:51 +01:00
Michael B. Gale	bc1b5da783	Use `ActionConfig` in `diagnostics.ts`	2026-10-22 14:39:51 +01:00
Michael B. Gale	1b037def00	Refactor swift check out of `init-action.ts`	2026-10-22 14:39:50 +01:00
Michael B. Gale	7e3e4f23b1	Make `getCodeQLForCmd` use `Env`	2026-10-22 14:30:46 +01:00
				`@@ -0,0 +1 @@`
				`- _Upcoming breaking change_: CodeQL version 2.22.3 and earlier were discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. [#4266](https://github.com/github/codeql-action/pull/4266)`