diff --git a/.github/actions/release-branches/action.yml b/.github/actions/release-branches/action.yml
index 26be726205..7734411c73 100644
--- a/.github/actions/release-branches/action.yml
+++ b/.github/actions/release-branches/action.yml
@@ -22,7 +22,6 @@ runs:
         MAJOR_VERSION: ${{ inputs.major_version }}
         LATEST_TAG: ${{ inputs.latest_tag }}
       run: |
-        npm ci
         npx tsx ./pr-checks/release-branches.ts \
             --major-version "$MAJOR_VERSION" \
             --latest-tag "$LATEST_TAG"
diff --git a/.github/actions/release-initialise/action.yml b/.github/actions/release-initialise/action.yml
index 057d5a5b6d..239dfa9428 100644
--- a/.github/actions/release-initialise/action.yml
+++ b/.github/actions/release-initialise/action.yml
@@ -21,16 +21,9 @@ runs:
         node-version: 24
         cache: 'npm'
 
-    - name: Set up Python
-      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
-      with:
-        python-version: '3.12'
-
-    - name: Install dependencies
-      run: |
-        python -m pip install --upgrade pip
-        pip install PyGithub==2.3.0 requests
+    - name: Install JavaScript dependencies
       shell: bash
+      run: npm ci
 
     - name: Update git config
       run: |
diff --git a/.github/update-release-branch.py b/.github/update-release-branch.py
deleted file mode 100644
index 2635126827..0000000000
--- a/.github/update-release-branch.py
+++ /dev/null
@@ -1,474 +0,0 @@
-import argparse
-import datetime
-import fileinput
-import re
-from github import Github
-import json
-import os
-import subprocess
-
-EMPTY_CHANGELOG = """# CodeQL Action Changelog
-
-## [UNRELEASED]
-
-No user facing changes.
-
-"""
-
-# NB: This exact commit message is used to find commits for reverting during backports.
-# Changing it requires a transition period where both old and new versions are supported.
-BACKPORT_COMMIT_MESSAGE = 'Update version and changelog for v'
-
-# Commit message used for rebuild commits, both those produced by this script and those produced
-# by the `Rebuild Action` workflow (`.github/workflows/rebuild.yml`).
-REBUILD_COMMIT_MESSAGE = 'Rebuild'
-
-# Name of the remote
-ORIGIN = 'origin'
-
-# Environment variables to check for a GitHub API token.
-TOKEN_ENVIRONMENT_VARIABLES = ('GH_TOKEN', 'GITHUB_TOKEN')
-
-# Gets a GitHub API token from one of the supported environment variables.
-def get_github_token():
-  for variable_name in TOKEN_ENVIRONMENT_VARIABLES:
-    token = os.environ.get(variable_name, '').strip()
-    if token:
-      return token
-  raise Exception('Missing GitHub token. Set GITHUB_TOKEN or GH_TOKEN.')
-
-# Runs git with the given args and returns the stdout.
-# Raises an error if git does not exit successfully (unless passed
-# allow_non_zero_exit_code=True).
-def run_git(*args, allow_non_zero_exit_code=False):
-  cmd = ['git', *args]
-  p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
-  if not allow_non_zero_exit_code and p.returncode != 0:
-    raise Exception(f'Call to {" ".join(cmd)} exited with code {p.returncode} stderr: {p.stderr.decode("ascii")}.')
-  return p.stdout.decode('ascii')
-
-# Runs the given command, streaming output to the console.
-# Raises an error if the command does not exit successfully.
-def run_command(*args):
-  cmd = list(args)
-  print(f'Running `{" ".join(cmd)}`.')
-  subprocess.run(cmd, check=True)
-
-# Rebuilds the action and commits any changes.
-def rebuild_action():
-  # For backports, the only source-level change vs the source branch is the new version number,
-  # so we just need to refresh the version embedded in `lib/`.
-  run_command('npm', 'ci')
-  run_command('npm', 'run', 'build')
-
-  run_git('add', '--all')
-  # `git diff --cached --quiet` exits 0 if there are no staged changes, 1 if there are.
-  if subprocess.run(['git', 'diff', '--cached', '--quiet']).returncode == 0:
-    print('Rebuild produced no changes; skipping Rebuild commit.')
-  else:
-    run_git('commit', '-m', REBUILD_COMMIT_MESSAGE)
-    print('Created Rebuild commit.')
-
-# Returns true if the given branch exists on the origin remote
-def branch_exists_on_remote(branch_name):
-  return run_git('ls-remote', '--heads', ORIGIN, branch_name).strip() != ''
-
-# Opens a PR from the given branch to the target branch
-def open_pr(
-  repo, all_commits, source_branch_short_sha, new_branch_name, source_branch, target_branch,
-  conductor, is_primary_release, conflicted_files):
-  # Sort the commits into the pull requests that introduced them,
-  # and any commits that don't have a pull request
-  pull_requests = []
-  commits_without_pull_requests = []
-  for commit in all_commits:
-    pr = get_pr_for_commit(commit)
-
-    if pr is None:
-      commits_without_pull_requests.append(commit)
-    elif not any(p for p in pull_requests if p.number == pr.number):
-      pull_requests.append(pr)
-
-  print(f'Found {len(pull_requests)} pull requests.')
-  print(f'Found {len(commits_without_pull_requests)} commits not in a pull request.')
-
-  # Sort PRs and commits by age
-  pull_requests = sorted(pull_requests, key=lambda pr: pr.number)
-  commits_without_pull_requests = sorted(commits_without_pull_requests, key=lambda c: c.commit.author.date)
-
-  # Start constructing the body text
-  body = []
-  body.append(f'Merging {source_branch_short_sha} into `{target_branch}`.')
-
-  body.append('')
-  body.append(f'Conductor for this PR is @{conductor}.')
-
-  # List all PRs merged
-  if len(pull_requests) > 0:
-    body.append('')
-    body.append('Contains the following pull requests:')
-    for pr in pull_requests:
-      # Use PR author if they are GitHub staff, otherwise use the merger
-      display_user = get_pr_author_if_staff(pr) or get_merger_of_pr(repo, pr)
-      body.append(f'- #{pr.number} (@{display_user})')
-
-  # List all commits not part of a PR
-  if len(commits_without_pull_requests) > 0:
-    body.append('')
-    body.append('Contains the following commits not from a pull request:')
-    for commit in commits_without_pull_requests:
-      author_description = f' (@{commit.author.login})' if commit.author is not None else ''
-      body.append(f'- {commit.sha} - {get_truncated_commit_message(commit)}{author_description}')
-
-  body.append('')
-  body.append('Please do the following:')
-  if len(conflicted_files) > 0:
-    body.append(' - [ ] Ensure `package.json` file contains the correct version.')
-    body.append(' - [ ] Add a commit to this branch to resolve the merge conflicts ' +
-      'in the following files:')
-    body.extend([f'    - `{file}`' for file in conflicted_files])
-    body.append(' - [ ] Rebuild the Action locally (`npm run build`) and push any changes to the ' +
-      f'built output in `lib` as a separate commit named exactly `{REBUILD_COMMIT_MESSAGE}`.')
-    body.append(' - [ ] Ensure another maintainer has reviewed the additional commits you added to this ' +
-      'branch to resolve the merge conflicts.')
-  body.append(' - [ ] Ensure the CHANGELOG displays the correct version and date.')
-  body.append(' - [ ] Ensure the CHANGELOG includes all relevant, user-facing changes since the last release.')
-  body.append(f' - [ ] Check that there are not any unexpected commits being merged into the `{target_branch}` branch.')
-  body.append(' - [ ] Ensure the docs team is aware of any documentation changes that need to be released.')
-
-  body.append(' - [ ] Approve running the full set of PR checks if you have not pushed any changes.')
-  body.append(' - [ ] Approve and merge this PR. Make sure `Create a merge commit` is selected rather than `Squash and merge` or `Rebase and merge`.')
-
-  if is_primary_release:
-    body.append(' - [ ] Merge the mergeback PR that will automatically be created once this PR is merged.')
-    body.append(' - [ ] Merge all backport PRs to older release branches, that will automatically be created once this PR is merged.')
-
-  title = f'Merge {source_branch} into {target_branch}'
-
-  # Create the pull request
-  pr = repo.create_pull(title=title, body='\n'.join(body), head=new_branch_name, base=target_branch)
-  print(f'Created PR #{str(pr.number)}')
-
-  # Assign the conductor
-  pr.add_to_assignees(conductor)
-  print(f'Assigned PR to {conductor}')
-
-# Gets a list of the SHAs of all commits that have happened on the source branch
-# since the last release to the target branch.
-# This will not include any commits that exist on the target branch
-# that aren't on the source branch.
-def get_commit_difference(repo, source_branch, target_branch):
-  # Passing split nothing means that the empty string splits to nothing: compare `''.split() == []`
-  # to `''.split('\n') == ['']`.
-  commits = run_git('log', '--pretty=format:%H', f'{ORIGIN}/{target_branch}..{ORIGIN}/{source_branch}').strip().split()
-
-  # Convert to full-fledged commit objects
-  commits = [repo.get_commit(c) for c in commits]
-
-  # Filter out merge commits for PRs
-  return list(filter(lambda c: not is_pr_merge_commit(c), commits))
-
-# Is the given commit the automatic merge commit from when merging a PR
-def is_pr_merge_commit(commit):
-  return commit.committer is not None and commit.committer.login == 'web-flow' and len(commit.parents) > 1
-
-# Gets a copy of the commit message that should display nicely
-def get_truncated_commit_message(commit):
-  message = commit.commit.message.split('\n')[0]
-  if len(message) > 60:
-    return f'{message[:57]}...'
-  else:
-    return message
-
-# Converts a commit into the PR that introduced it to the source branch.
-# Returns the PR object, or None if no PR could be found.
-def get_pr_for_commit(commit):
-  prs = commit.get_pulls()
-
-  if prs.totalCount > 0:
-    # In the case that there are multiple PRs, return the earliest one
-    prs = list(prs)
-    sorted_prs = sorted(prs, key=lambda pr: int(pr.number))
-    return sorted_prs[0]
-  else:
-    return None
-
-# Get the person who merged the pull request.
-# For most cases this will be the same as the author, but for PRs opened
-# by external contributors getting the merger will get us the GitHub
-# employee who reviewed and merged the PR.
-def get_merger_of_pr(repo, pr):
-  return repo.get_commit(pr.merge_commit_sha).author.login
-
-# Get the PR author if they are GitHub staff, otherwise None.
-def get_pr_author_if_staff(pr):
-  if pr.user is None:
-    return None
-  if getattr(pr.user, 'site_admin', False):
-    return pr.user.login
-  return None
-
-def get_current_version():
-  with open('package.json', 'r') as f:
-    return json.load(f)['version']
-
-# `npm version` doesn't always work because of merge conflicts, so we
-# replace the version in package.json textually.
-def replace_version_package_json(prev_version, new_version):
-  prev_line_is_codeql = False
-  for line in fileinput.input('package.json', inplace = True, encoding='utf-8'):
-    if prev_line_is_codeql and f'\"version\": \"{prev_version}\"' in line:
-      print(line.replace(prev_version, new_version), end='')
-    else:
-      prev_line_is_codeql = False
-      print(line, end='')
-    if '\"name\": \"codeql\",' in line:
-        prev_line_is_codeql = True
-
-def get_today_string():
-  today = datetime.datetime.today()
-  return '{:%d %b %Y}'.format(today)
-
-def process_changelog_for_backports(source_branch_major_version, target_branch_major_version):
-
-  # changelog entries can use the following format to indicate
-  # that they only apply to newer versions
-  some_versions_only_regex = re.compile(r'\[v(\d+)\+ only\]')
-
-  output = ''
-
-  with open('CHANGELOG.md', 'r') as f:
-
-    # until we find the first section, just duplicate all lines
-    found_first_section = False
-    while not found_first_section:
-      line = f.readline()
-      if not line:
-        raise Exception('Could not find any change sections in CHANGELOG.md') # EOF
-
-      if line.startswith('## '):
-        line = line.replace(f'## {source_branch_major_version}', f'## {target_branch_major_version}')
-        found_first_section = True
-
-      output += line
-
-    # found_content tracks whether we hit two headings in a row
-    found_content = False
-    output += '\n'
-    while True:
-      line = f.readline()
-      if not line:
-        break # EOF
-      line = line.rstrip('\n')
-
-      # filter out changenote entries that apply only to newer versions
-      match = some_versions_only_regex.search(line)
-      if match:
-        if int(target_branch_major_version) < int(match.group(1)):
-          continue
-
-      if line.startswith('## '):
-        line = line.replace(f'## {source_branch_major_version}', f'## {target_branch_major_version}')
-        if found_content == False:
-          # we have found two headings in a row, so we need to add the placeholder message.
-          output += 'No user facing changes.\n'
-        found_content = False
-        output += f'\n{line}\n\n'
-      else:
-        if line.strip() != '':
-          found_content = True
-          # we use the original line here, rather than the stripped version
-          # so that we preserve indentation
-          output += line + '\n'
-
-    with open('CHANGELOG.md', 'w') as f:
-      f.write(output)
-
-def update_changelog(version):
-  if (os.path.exists('CHANGELOG.md')):
-    content = ''
-    with open('CHANGELOG.md', 'r') as f:
-      content = f.read()
-  else:
-    content = EMPTY_CHANGELOG
-
-  newContent = content.replace('[UNRELEASED]', f'{version} - {get_today_string()}', 1)
-
-  with open('CHANGELOG.md', 'w') as f:
-    f.write(newContent)
-
-
-def main():
-  parser = argparse.ArgumentParser('update-release-branch.py')
-
-  parser.add_argument(
-    '--repository-nwo',
-    type=str,
-    required=True,
-    help='The nwo of the repository, for example github/codeql-action.'
-  )
-  parser.add_argument(
-    '--source-branch',
-    type=str,
-    required=True,
-    help='Source branch for release branch update.'
-  )
-  parser.add_argument(
-    '--target-branch',
-    type=str,
-    required=True,
-    help='Target branch for release branch update.'
-  )
-  parser.add_argument(
-    '--is-primary-release',
-    action='store_true',
-    default=False,
-    help='Whether this update is the primary release for the current major version.'
-  )
-  parser.add_argument(
-    '--conductor',
-    type=str,
-    required=True,
-    help='The GitHub handle of the person who is conducting the release process.'
-  )
-
-  args = parser.parse_args()
-
-  source_branch = args.source_branch
-  target_branch = args.target_branch
-  is_primary_release = args.is_primary_release
-
-  repo = Github(get_github_token()).get_repo(args.repository_nwo)
-
-  # the target branch will be of the form releases/vN, where N is the major version number
-  target_branch_major_version = target_branch.strip('releases/v')
-
-  # split version into major, minor, patch
-  _, v_minor, v_patch = get_current_version().split('.')
-
-  version = f"{target_branch_major_version}.{v_minor}.{v_patch}"
-
-  # Print what we intend to go
-  print(f'Considering difference between {source_branch} and {target_branch}...')
-  source_branch_short_sha = run_git('rev-parse', '--short', f'{ORIGIN}/{source_branch}').strip()
-  print(f'Current head of {source_branch} is {source_branch_short_sha}.')
-
-  # See if there are any commits to merge in
-  commits = get_commit_difference(repo=repo, source_branch=source_branch, target_branch=target_branch)
-  if len(commits) == 0:
-    print(f'No commits to merge from {source_branch} to {target_branch}.')
-    return
-
-  # define distinct prefix in order to support specific pr checks on backports
-  branch_prefix = 'update' if is_primary_release else 'backport'
-
-  # The branch name is based off of the name of branch being merged into
-  # and the SHA of the branch being merged from. Thus if the branch already
-  # exists we can assume we don't need to recreate it.
-  new_branch_name = f'{branch_prefix}-v{version}-{source_branch_short_sha}'
-  print(f'Branch name is {new_branch_name}.')
-
-  # Check if the branch already exists. If so we can abort as this script
-  # has already run on this combination of branches.
-  if branch_exists_on_remote(new_branch_name):
-    print(f'Branch {new_branch_name} already exists. Nothing to do.')
-    return
-
-  # Create the new branch and push it to the remote
-  print(f'Creating branch {new_branch_name}.')
-
-  # The process of creating the v{Older} release can run into merge conflicts. We commit the unresolved
-  # conflicts so a maintainer can easily resolve them (vs erroring and requiring maintainers to
-  # reconstruct the release manually)
-  conflicted_files = []
-
-  if not is_primary_release:
-
-    # the source branch will be of the form releases/vN, where N is the major version number
-    source_branch_major_version = source_branch.strip('releases/v')
-
-    # If we're performing a backport, start from the target branch
-    print(f'Creating {new_branch_name} from the {ORIGIN}/{target_branch} branch')
-    run_git('checkout', '-b', new_branch_name, f'{ORIGIN}/{target_branch}')
-
-    # Revert the commit that we made as part of the last release that updated the version number and
-    # changelog to refer to {older}.x.x variants. This avoids merge conflicts in the changelog and
-    # package.json files when we merge in the v{latest} branch.
-    # This commit will not exist the first time we release the v{N-1} branch from the v{N} branch, so we
-    # use `git log --grep` to conditionally revert the commit.
-    print('Reverting the version number and changelog updates from the last release to avoid conflicts')
-    vOlder_update_commits = run_git('log', '--grep', f'^{BACKPORT_COMMIT_MESSAGE}', '--format=%H').split()
-
-    if len(vOlder_update_commits) > 0:
-      print(f'  Reverting {vOlder_update_commits[0]}')
-      # Only revert the newest commit as older ones will already have been reverted in previous
-      # releases.
-      run_git('revert', vOlder_update_commits[0], '--no-edit')
-
-      # Also revert the "Rebuild" commit, whether created by this script or by the
-      # `Rebuild Action` workflow.
-      rebuild_commit = run_git('log', '--grep', f'^{REBUILD_COMMIT_MESSAGE}$', '--format=%H').split()[0]
-      print(f'  Reverting {rebuild_commit}')
-      run_git('revert', rebuild_commit, '--no-edit')
-
-    else:
-      print('  Nothing to revert.')
-
-    print(f'Merging {ORIGIN}/{source_branch} into the release prep branch')
-    # Commit any conflicts (see the comment for `conflicted_files`)
-    run_git('merge', f'{ORIGIN}/{source_branch}', allow_non_zero_exit_code=True)
-    conflicted_files = run_git('diff', '--name-only', '--diff-filter', 'U').splitlines()
-    if len(conflicted_files) > 0:
-      run_git('add', '.')
-      run_git('commit', '--no-edit')
-
-    # Migrate the package version number from a vLatest version number to a vOlder version number.
-    # `package-lock.json` is updated as part of the subsequent rebuild step (see `rebuild_action`).
-    print(f'Setting version number to {version} in package.json')
-    replace_version_package_json(get_current_version(), version)
-    run_git('add', 'package.json')
-
-    # Migrate the changelog notes from vLatest version numbers to vOlder version numbers
-    print(f'Migrating changelog notes from v{source_branch_major_version} to v{target_branch_major_version}')
-    process_changelog_for_backports(source_branch_major_version, target_branch_major_version)
-
-    # Amend the commit generated by `npm version` to update the CHANGELOG
-    run_git('add', 'CHANGELOG.md')
-    run_git('commit', '-m', f'{BACKPORT_COMMIT_MESSAGE}{version}')
-  else:
-    # If we're performing a standard release, there won't be any new commits on the target branch,
-    # as these will have already been merged back into the source branch. Therefore we can just
-    # start from the source branch.
-    run_git('checkout', '-b', new_branch_name, f'{ORIGIN}/{source_branch}')
-
-    print('Updating changelog')
-    update_changelog(version)
-
-    # Create a commit that updates the CHANGELOG
-    run_git('add', 'CHANGELOG.md')
-    run_git('commit', '-m', f'Update changelog for v{version}')
-
-  if not is_primary_release:
-    if len(conflicted_files) == 0:
-      print('Rebuilding the Action.')
-      rebuild_action()
-    else:
-      print(f'Skipping automatic rebuild because the merge produced conflicts in {conflicted_files}.')
-
-  run_git('push', ORIGIN, new_branch_name)
-
-  # Open a PR to update the branch
-  open_pr(
-    repo,
-    commits,
-    source_branch_short_sha,
-    new_branch_name,
-    source_branch=source_branch,
-    target_branch=target_branch,
-    conductor=args.conductor,
-    is_primary_release=is_primary_release,
-    conflicted_files=conflicted_files
-  )
-
-if __name__ == '__main__':
-  main()
diff --git a/.github/workflows/__all-platform-bundle.yml b/.github/workflows/__all-platform-bundle.yml
index d4daf95d8b..c3cf8d63f3 100644
--- a/.github/workflows/__all-platform-bundle.yml
+++ b/.github/workflows/__all-platform-bundle.yml
@@ -69,13 +69,13 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
diff --git a/.github/workflows/__analysis-kinds.yml b/.github/workflows/__analysis-kinds.yml
index 53c8834eea..5d0576e2f6 100644
--- a/.github/workflows/__analysis-kinds.yml
+++ b/.github/workflows/__analysis-kinds.yml
@@ -67,7 +67,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
diff --git a/.github/workflows/__analyze-ref-input.yml b/.github/workflows/__analyze-ref-input.yml
index da40def244..7341a41740 100644
--- a/.github/workflows/__analyze-ref-input.yml
+++ b/.github/workflows/__analyze-ref-input.yml
@@ -65,13 +65,13 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
diff --git a/.github/workflows/__autobuild-action.yml b/.github/workflows/__autobuild-action.yml
index 2d655b2eef..730a387f90 100644
--- a/.github/workflows/__autobuild-action.yml
+++ b/.github/workflows/__autobuild-action.yml
@@ -59,9 +59,9 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Prepare test
diff --git a/.github/workflows/__autobuild-direct-tracing-with-working-dir.yml b/.github/workflows/__autobuild-direct-tracing-with-working-dir.yml
index c5856df047..f3bc58c691 100644
--- a/.github/workflows/__autobuild-direct-tracing-with-working-dir.yml
+++ b/.github/workflows/__autobuild-direct-tracing-with-working-dir.yml
@@ -61,9 +61,9 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Java
-        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
         with:
           java-version: ${{ inputs.java-version || '17' }}
           distribution: temurin
diff --git a/.github/workflows/__autobuild-working-dir.yml b/.github/workflows/__autobuild-working-dir.yml
index 71dd9d1df8..fac4ef9f54 100644
--- a/.github/workflows/__autobuild-working-dir.yml
+++ b/.github/workflows/__autobuild-working-dir.yml
@@ -45,7 +45,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
diff --git a/.github/workflows/__build-mode-autobuild.yml b/.github/workflows/__build-mode-autobuild.yml
index 1ecceee86f..280dbf569c 100644
--- a/.github/workflows/__build-mode-autobuild.yml
+++ b/.github/workflows/__build-mode-autobuild.yml
@@ -61,9 +61,9 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Java
-        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
         with:
           java-version: ${{ inputs.java-version || '17' }}
           distribution: temurin
diff --git a/.github/workflows/__build-mode-manual.yml b/.github/workflows/__build-mode-manual.yml
index efc63b6405..bfe92c55ea 100644
--- a/.github/workflows/__build-mode-manual.yml
+++ b/.github/workflows/__build-mode-manual.yml
@@ -65,13 +65,13 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
diff --git a/.github/workflows/__build-mode-none.yml b/.github/workflows/__build-mode-none.yml
index dc97aa3d99..da7aa76383 100644
--- a/.github/workflows/__build-mode-none.yml
+++ b/.github/workflows/__build-mode-none.yml
@@ -47,7 +47,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
diff --git a/.github/workflows/__build-mode-rollback.yml b/.github/workflows/__build-mode-rollback.yml
index 4383024f3b..fcc77ea36e 100644
--- a/.github/workflows/__build-mode-rollback.yml
+++ b/.github/workflows/__build-mode-rollback.yml
@@ -45,7 +45,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
diff --git a/.github/workflows/__bundle-from-nightly.yml b/.github/workflows/__bundle-from-nightly.yml
index 9ccb507866..6c414fb67e 100644
--- a/.github/workflows/__bundle-from-nightly.yml
+++ b/.github/workflows/__bundle-from-nightly.yml
@@ -45,7 +45,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
diff --git a/.github/workflows/__bundle-from-toolcache.yml b/.github/workflows/__bundle-from-toolcache.yml
index 036262395e..a1c1fade09 100644
--- a/.github/workflows/__bundle-from-toolcache.yml
+++ b/.github/workflows/__bundle-from-toolcache.yml
@@ -45,7 +45,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
diff --git a/.github/workflows/__bundle-toolcache.yml b/.github/workflows/__bundle-toolcache.yml
index 0bdfd45082..9cc983a843 100644
--- a/.github/workflows/__bundle-toolcache.yml
+++ b/.github/workflows/__bundle-toolcache.yml
@@ -49,7 +49,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
diff --git a/.github/workflows/__bundle-zstd.yml b/.github/workflows/__bundle-zstd.yml
deleted file mode 100644
index 7c1f89cfbd..0000000000
--- a/.github/workflows/__bundle-zstd.yml
+++ /dev/null
@@ -1,120 +0,0 @@
-# Warning: This file is generated automatically, and should not be modified.
-# Instead, please modify the template in the pr-checks directory and run:
-#     pr-checks/sync.sh
-# to regenerate this file.
-
-name: 'PR Check - Bundle: Zstandard checks'
-env:
-  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-  GO111MODULE: auto
-on:
-  push:
-    branches:
-      - main
-      - releases/v*
-  pull_request: {}
-  merge_group:
-    types:
-      - checks_requested
-  schedule:
-    - cron: '0 5 * * *'
-  workflow_dispatch:
-    inputs: {}
-  workflow_call:
-    inputs: {}
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: bundle-zstd-${{github.ref}}
-jobs:
-  bundle-zstd:
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - os: ubuntu-latest
-            version: linked
-          - os: macos-latest
-            version: linked
-          - os: windows-latest
-            version: linked
-    name: 'Bundle: Zstandard checks'
-    if: github.triggering_actor != 'dependabot[bot]'
-    permissions:
-      contents: read
-      security-events: read
-    timeout-minutes: 45
-    runs-on: ${{ matrix.os }}
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - name: Prepare test
-        id: prepare-test
-        uses: ./.github/actions/prepare-test
-        with:
-          version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
-      - name: Remove CodeQL from toolcache
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        with:
-          script: |
-            const fs = require('fs');
-            const path = require('path');
-            const codeqlPath = path.join(process.env['RUNNER_TOOL_CACHE'], 'CodeQL');
-            if (codeqlPath !== undefined) {
-              fs.rmdirSync(codeqlPath, { recursive: true });
-            }
-      - id: init
-        uses: ./../action/init
-        with:
-          languages: javascript
-          tools: ${{ steps.prepare-test.outputs.tools-url }}
-      - uses: ./../action/analyze
-        with:
-          output: ${{ runner.temp }}/results
-          upload-database: false
-      - name: Upload SARIF
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: ${{ matrix.os }}-zstd-bundle.sarif
-          path: ${{ runner.temp }}/results/javascript.sarif
-          retention-days: 7
-      - name: Check diagnostic with expected tools URL appears in SARIF
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        env:
-          SARIF_PATH: ${{ runner.temp }}/results/javascript.sarif
-        with:
-          script: |
-            const fs = require('fs');
-
-            const sarif = JSON.parse(fs.readFileSync(process.env['SARIF_PATH'], 'utf8'));
-            const run = sarif.runs[0];
-
-            const toolExecutionNotifications = run.invocations[0].toolExecutionNotifications;
-            const downloadTelemetryNotifications = toolExecutionNotifications.filter(n =>
-              n.descriptor.id === 'codeql-action/bundle-download-telemetry'
-            );
-            if (downloadTelemetryNotifications.length !== 1) {
-              core.setFailed(
-                'Expected exactly one reporting descriptor in the ' +
-                  `'runs[].invocations[].toolExecutionNotifications[]' SARIF property, but found ` +
-                  `${downloadTelemetryNotifications.length}. All notification reporting descriptors: ` +
-                  `${JSON.stringify(toolExecutionNotifications)}.`
-              );
-            }
-
-            const toolsUrl = downloadTelemetryNotifications[0].properties.attributes.toolsUrl;
-            console.log(`Found tools URL: ${toolsUrl}`);
-
-            const expectedExtension = process.env['RUNNER_OS'] === 'Windows' ? '.tar.gz' : '.tar.zst';
-
-            if (!toolsUrl.endsWith(expectedExtension)) {
-              core.setFailed(
-                `Expected the tools URL to be a ${expectedExtension} file, but found ${toolsUrl}.`
-              );
-            }
-    env:
-      CODEQL_ACTION_TEST_MODE: true
diff --git a/.github/workflows/__cleanup-db-cluster-dir.yml b/.github/workflows/__cleanup-db-cluster-dir.yml
index 921228910e..3153041401 100644
--- a/.github/workflows/__cleanup-db-cluster-dir.yml
+++ b/.github/workflows/__cleanup-db-cluster-dir.yml
@@ -45,7 +45,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
diff --git a/.github/workflows/__config-export.yml b/.github/workflows/__config-export.yml
index dedf559719..0c7a2cc151 100644
--- a/.github/workflows/__config-export.yml
+++ b/.github/workflows/__config-export.yml
@@ -47,7 +47,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
diff --git a/.github/workflows/__config-input.yml b/.github/workflows/__config-input.yml
index a5da2050ad..4267e00584 100644
--- a/.github/workflows/__config-input.yml
+++ b/.github/workflows/__config-input.yml
@@ -45,9 +45,9 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 20.x
           cache: npm
diff --git a/.github/workflows/__cpp-deptrace-disabled.yml b/.github/workflows/__cpp-deptrace-disabled.yml
index 5eba27ed63..e2434f4256 100644
--- a/.github/workflows/__cpp-deptrace-disabled.yml
+++ b/.github/workflows/__cpp-deptrace-disabled.yml
@@ -49,7 +49,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
diff --git a/.github/workflows/__cpp-deptrace-enabled-on-macos.yml b/.github/workflows/__cpp-deptrace-enabled-on-macos.yml
index d26cd7dca7..344ed8d1ea 100644
--- a/.github/workflows/__cpp-deptrace-enabled-on-macos.yml
+++ b/.github/workflows/__cpp-deptrace-enabled-on-macos.yml
@@ -47,7 +47,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
diff --git a/.github/workflows/__cpp-deptrace-enabled.yml b/.github/workflows/__cpp-deptrace-enabled.yml
index d3b04db26d..ab1a70584b 100644
--- a/.github/workflows/__cpp-deptrace-enabled.yml
+++ b/.github/workflows/__cpp-deptrace-enabled.yml
@@ -49,7 +49,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
diff --git a/.github/workflows/__diagnostics-export.yml b/.github/workflows/__diagnostics-export.yml
index 7f788ef0a2..c55f3de9b8 100644
--- a/.github/workflows/__diagnostics-export.yml
+++ b/.github/workflows/__diagnostics-export.yml
@@ -47,7 +47,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
diff --git a/.github/workflows/__export-file-baseline-information.yml b/.github/workflows/__export-file-baseline-information.yml
index 8d4cfc8f8e..4ce8b40285 100644
--- a/.github/workflows/__export-file-baseline-information.yml
+++ b/.github/workflows/__export-file-baseline-information.yml
@@ -69,13 +69,13 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
diff --git a/.github/workflows/__extractor-ram-threads.yml b/.github/workflows/__extractor-ram-threads.yml
index 28487388df..5bd5c8b940 100644
--- a/.github/workflows/__extractor-ram-threads.yml
+++ b/.github/workflows/__extractor-ram-threads.yml
@@ -45,7 +45,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
diff --git a/.github/workflows/__global-proxy.yml b/.github/workflows/__global-proxy.yml
index e3ba6ff101..9244d1fc8f 100644
--- a/.github/workflows/__global-proxy.yml
+++ b/.github/workflows/__global-proxy.yml
@@ -47,7 +47,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -55,17 +55,45 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'false'
+      - name: Block direct internet access to force proxy usage
+        run: |
+          apt-get update -qq && apt-get install -y -qq iptables >/dev/null 2>&1
+          PROXY_IP=$(getent hosts squid-proxy | awk '{ print $1 }')
+          echo "Squid proxy IP: $PROXY_IP"
+          # Allow all traffic to the proxy container
+          iptables -A OUTPUT -d "$PROXY_IP" -j ACCEPT
+          # Allow DNS resolution
+          iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
+          iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT
+          # Allow loopback
+          iptables -A OUTPUT -o lo -j ACCEPT
+          # Allow already-established connections (from checkout/prepare-test)
+          iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+          # Block all other outbound HTTP and HTTPS, ensuring direct access fails
+          iptables -A OUTPUT -p tcp --dport 80 -j REJECT --reject-with tcp-reset
+          iptables -A OUTPUT -p tcp --dport 443 -j REJECT --reject-with tcp-reset
+          echo "Direct HTTP/HTTPS access is now blocked - all traffic must go through the proxy"
+
+      - name: Set proxy environment variables
+        shell: bash
+        run: |
+          echo "http_proxy=http://squid-proxy:3128" >> $GITHUB_ENV
+          echo "HTTP_PROXY=http://squid-proxy:3128" >> $GITHUB_ENV
+          echo "https_proxy=http://squid-proxy:3128" >> $GITHUB_ENV
+          echo "HTTPS_PROXY=http://squid-proxy:3128" >> $GITHUB_ENV
+
       - uses: ./../action/init
         with:
           languages: javascript
           tools: ${{ steps.prepare-test.outputs.tools-url }}
+
       - uses: ./../action/analyze
     env:
-      https_proxy: http://squid-proxy:3128
       CODEQL_ACTION_TOLERATE_MISSING_GIT_VERSION: true
       CODEQL_ACTION_TEST_MODE: true
     container:
       image: ubuntu:22.04
+      options: --cap-add=NET_ADMIN
     services:
       squid-proxy:
         image: ubuntu/squid:latest
diff --git a/.github/workflows/__go-custom-queries.yml b/.github/workflows/__go-custom-queries.yml
index a522b602f4..7b4cd1305b 100644
--- a/.github/workflows/__go-custom-queries.yml
+++ b/.github/workflows/__go-custom-queries.yml
@@ -67,13 +67,13 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
diff --git a/.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml b/.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml
index ced2df5982..968caf1e69 100644
--- a/.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml
+++ b/.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml
@@ -55,9 +55,9 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
@@ -73,7 +73,7 @@ jobs:
           languages: go
           tools: ${{ steps.prepare-test.outputs.tools-url }}
       # Deliberately change Go after the `init` step
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: '1.20'
       - name: Build code
diff --git a/.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml b/.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml
index 32ebaee34a..0f13b1e663 100644
--- a/.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml
+++ b/.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml
@@ -55,9 +55,9 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
diff --git a/.github/workflows/__go-indirect-tracing-workaround.yml b/.github/workflows/__go-indirect-tracing-workaround.yml
index 8696063265..915835c2ab 100644
--- a/.github/workflows/__go-indirect-tracing-workaround.yml
+++ b/.github/workflows/__go-indirect-tracing-workaround.yml
@@ -55,9 +55,9 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
diff --git a/.github/workflows/__go-tracing-autobuilder.yml b/.github/workflows/__go-tracing-autobuilder.yml
index d8ef15b5a9..ccbb1b5a6e 100644
--- a/.github/workflows/__go-tracing-autobuilder.yml
+++ b/.github/workflows/__go-tracing-autobuilder.yml
@@ -75,9 +75,9 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
diff --git a/.github/workflows/__go-tracing-custom-build-steps.yml b/.github/workflows/__go-tracing-custom-build-steps.yml
index 077382459f..2acc617cb1 100644
--- a/.github/workflows/__go-tracing-custom-build-steps.yml
+++ b/.github/workflows/__go-tracing-custom-build-steps.yml
@@ -75,9 +75,9 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
diff --git a/.github/workflows/__go-tracing-legacy-workflow.yml b/.github/workflows/__go-tracing-legacy-workflow.yml
index 2c4031b388..a43705b703 100644
--- a/.github/workflows/__go-tracing-legacy-workflow.yml
+++ b/.github/workflows/__go-tracing-legacy-workflow.yml
@@ -75,9 +75,9 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
diff --git a/.github/workflows/__init-with-registries.yml b/.github/workflows/__init-with-registries.yml
index 623afdee97..9293dcc196 100644
--- a/.github/workflows/__init-with-registries.yml
+++ b/.github/workflows/__init-with-registries.yml
@@ -49,7 +49,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
diff --git a/.github/workflows/__javascript-source-root.yml b/.github/workflows/__javascript-source-root.yml
index 622156ce4d..1dcbd38a85 100644
--- a/.github/workflows/__javascript-source-root.yml
+++ b/.github/workflows/__javascript-source-root.yml
@@ -49,7 +49,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
diff --git a/.github/workflows/__job-run-uuid-sarif.yml b/.github/workflows/__job-run-uuid-sarif.yml
index 989b28fc53..429a694947 100644
--- a/.github/workflows/__job-run-uuid-sarif.yml
+++ b/.github/workflows/__job-run-uuid-sarif.yml
@@ -45,7 +45,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -71,8 +71,8 @@ jobs:
         run: |
           cd "$RUNNER_TEMP/results"
           actual=$(jq -r '.runs[0].properties.jobRunUuid' javascript.sarif)
-          if [[ "$actual" != "$JOB_RUN_UUID" ]]; then
-            echo "Expected SARIF output to contain job run UUID '$JOB_RUN_UUID', but found '$actual'."
+          if [[ "$actual" != "$CODEQL_ACTION_JOB_RUN_UUID" ]]; then
+            echo "Expected SARIF output to contain job run UUID '$CODEQL_ACTION_JOB_RUN_UUID', but found '$actual'."
             exit 1
           else
             echo "Found job run UUID '$actual'."
diff --git a/.github/workflows/__language-aliases.yml b/.github/workflows/__language-aliases.yml
index 3a1656eef7..731d975ce3 100644
--- a/.github/workflows/__language-aliases.yml
+++ b/.github/workflows/__language-aliases.yml
@@ -45,7 +45,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
diff --git a/.github/workflows/__local-bundle.yml b/.github/workflows/__local-bundle.yml
index 98d56aa7ef..8e448080f3 100644
--- a/.github/workflows/__local-bundle.yml
+++ b/.github/workflows/__local-bundle.yml
@@ -65,13 +65,13 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
diff --git a/.github/workflows/__multi-language-autodetect.yml b/.github/workflows/__multi-language-autodetect.yml
index e211d0bcd8..55023cd916 100644
--- a/.github/workflows/__multi-language-autodetect.yml
+++ b/.github/workflows/__multi-language-autodetect.yml
@@ -99,13 +99,13 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
@@ -120,7 +120,7 @@ jobs:
         # We need Python 3.13 for older CLI versions because they are not compatible with Python 3.14 or newer.
         # See https://github.com/github/codeql-action/pull/3212
         if: matrix.version != 'nightly-latest' && matrix.version != 'linked'
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.13'
 
diff --git a/.github/workflows/__overlay-init-fallback.yml b/.github/workflows/__overlay-init-fallback.yml
index 9a4ffa71f2..b6c99efcef 100644
--- a/.github/workflows/__overlay-init-fallback.yml
+++ b/.github/workflows/__overlay-init-fallback.yml
@@ -47,7 +47,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
diff --git a/.github/workflows/__packaging-codescanning-config-inputs-js.yml b/.github/workflows/__packaging-codescanning-config-inputs-js.yml
index adfbf27df7..409e0a1a65 100644
--- a/.github/workflows/__packaging-codescanning-config-inputs-js.yml
+++ b/.github/workflows/__packaging-codescanning-config-inputs-js.yml
@@ -69,18 +69,18 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
       - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 20.x
           cache: npm
diff --git a/.github/workflows/__packaging-config-inputs-js.yml b/.github/workflows/__packaging-config-inputs-js.yml
index 0e3c0a19fe..34d4ae1bca 100644
--- a/.github/workflows/__packaging-config-inputs-js.yml
+++ b/.github/workflows/__packaging-config-inputs-js.yml
@@ -69,18 +69,18 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
       - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 20.x
           cache: npm
diff --git a/.github/workflows/__packaging-config-js.yml b/.github/workflows/__packaging-config-js.yml
index 0d78c47278..88426cd684 100644
--- a/.github/workflows/__packaging-config-js.yml
+++ b/.github/workflows/__packaging-config-js.yml
@@ -69,18 +69,18 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
       - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 20.x
           cache: npm
diff --git a/.github/workflows/__packaging-inputs-js.yml b/.github/workflows/__packaging-inputs-js.yml
index 981d3606ba..2461944dbd 100644
--- a/.github/workflows/__packaging-inputs-js.yml
+++ b/.github/workflows/__packaging-inputs-js.yml
@@ -69,18 +69,18 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
       - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 20.x
           cache: npm
diff --git a/.github/workflows/__remote-config.yml b/.github/workflows/__remote-config.yml
index 853a3909e6..e1c3785f6a 100644
--- a/.github/workflows/__remote-config.yml
+++ b/.github/workflows/__remote-config.yml
@@ -67,13 +67,13 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
diff --git a/.github/workflows/__resolve-environment-action.yml b/.github/workflows/__resolve-environment-action.yml
index 29a042ae2b..11a31fdabc 100644
--- a/.github/workflows/__resolve-environment-action.yml
+++ b/.github/workflows/__resolve-environment-action.yml
@@ -49,7 +49,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
diff --git a/.github/workflows/__rubocop-multi-language.yml b/.github/workflows/__rubocop-multi-language.yml
index bc8499d606..c405b44fed 100644
--- a/.github/workflows/__rubocop-multi-language.yml
+++ b/.github/workflows/__rubocop-multi-language.yml
@@ -45,7 +45,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -54,7 +54,7 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Set up Ruby
-        uses: ruby/setup-ruby@9eb537ca036ebaed86729dcb9309076e4c5c3b74 # v1.314.0
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: 2.6
       - name: Install Code Scanning integration
diff --git a/.github/workflows/__ruby.yml b/.github/workflows/__ruby.yml
index 3558be85e4..98f8ec6a2a 100644
--- a/.github/workflows/__ruby.yml
+++ b/.github/workflows/__ruby.yml
@@ -55,7 +55,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
diff --git a/.github/workflows/__rust.yml b/.github/workflows/__rust.yml
index e74daa4e4a..b3638ca6df 100644
--- a/.github/workflows/__rust.yml
+++ b/.github/workflows/__rust.yml
@@ -53,7 +53,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
diff --git a/.github/workflows/__split-workflow.yml b/.github/workflows/__split-workflow.yml
index 9b49aeceb8..512058a598 100644
--- a/.github/workflows/__split-workflow.yml
+++ b/.github/workflows/__split-workflow.yml
@@ -75,13 +75,13 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
diff --git a/.github/workflows/__start-proxy.yml b/.github/workflows/__start-proxy.yml
index 7ac2dede30..edc6aa1cc5 100644
--- a/.github/workflows/__start-proxy.yml
+++ b/.github/workflows/__start-proxy.yml
@@ -49,7 +49,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -57,15 +57,11 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - uses: ./../action/init
-        with:
-          languages: csharp
-          tools: ${{ steps.prepare-test.outputs.tools-url }}
-
       - name: Setup proxy for registries
         id: proxy
         uses: ./../action/start-proxy
         with:
+          language: java
           registry_secrets: |
             [
               {
@@ -94,5 +90,16 @@ jobs:
           || !contains(steps.proxy.outputs.proxy_urls, 'https://repo.maven.apache.org/maven2/')
           || !contains(steps.proxy.outputs.proxy_urls, 'https://repo1.maven.org/maven2')
         run: exit 1
+
+      - uses: ./../action/init
+        env:
+          CODEQL_PROXY_HOST: ${{ steps.proxy.outputs.proxy_host }}
+          CODEQL_PROXY_PORT: ${{ steps.proxy.outputs.proxy_port }}
+          CODEQL_PROXY_CA_CERTIFICATE: ${{ steps.proxy.outputs.proxy_ca_certificate }}
+        with:
+          languages: java
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
+          config-file: codeql-action@main:tests/multi-language-repo/.github/codeql/custom-queries.yml
     env:
+      CODEQL_ACTION_PROXY_API_REQUESTS: 'true'
       CODEQL_ACTION_TEST_MODE: true
diff --git a/.github/workflows/__submit-sarif-failure.yml b/.github/workflows/__submit-sarif-failure.yml
index 339d6a07cb..099e93001f 100644
--- a/.github/workflows/__submit-sarif-failure.yml
+++ b/.github/workflows/__submit-sarif-failure.yml
@@ -49,7 +49,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
@@ -57,7 +57,7 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./init
         with:
           languages: javascript
diff --git a/.github/workflows/__swift-autobuild.yml b/.github/workflows/__swift-autobuild.yml
index e59a87e3aa..52c189f3a8 100644
--- a/.github/workflows/__swift-autobuild.yml
+++ b/.github/workflows/__swift-autobuild.yml
@@ -45,7 +45,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
diff --git a/.github/workflows/__swift-custom-build.yml b/.github/workflows/__swift-custom-build.yml
index 638e2c58fc..99fbf7a897 100644
--- a/.github/workflows/__swift-custom-build.yml
+++ b/.github/workflows/__swift-custom-build.yml
@@ -69,13 +69,13 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
diff --git a/.github/workflows/__unset-environment.yml b/.github/workflows/__unset-environment.yml
index 263139dc89..8a8796d9a7 100644
--- a/.github/workflows/__unset-environment.yml
+++ b/.github/workflows/__unset-environment.yml
@@ -67,13 +67,13 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
diff --git a/.github/workflows/__upload-ref-sha-input.yml b/.github/workflows/__upload-ref-sha-input.yml
index e7f942df1d..76e8f4e3c0 100644
--- a/.github/workflows/__upload-ref-sha-input.yml
+++ b/.github/workflows/__upload-ref-sha-input.yml
@@ -65,13 +65,13 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
diff --git a/.github/workflows/__upload-sarif.yml b/.github/workflows/__upload-sarif.yml
index 36e5d9f053..77fa0264e5 100644
--- a/.github/workflows/__upload-sarif.yml
+++ b/.github/workflows/__upload-sarif.yml
@@ -72,13 +72,13 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
diff --git a/.github/workflows/__with-checkout-path.yml b/.github/workflows/__with-checkout-path.yml
index c4a0c9218c..59a8edc9d1 100644
--- a/.github/workflows/__with-checkout-path.yml
+++ b/.github/workflows/__with-checkout-path.yml
@@ -66,13 +66,13 @@ jobs:
     steps:
       # This ensures we don't accidentally use the original checkout for any part of the test.
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: ${{ inputs.dotnet-version || '9.x' }}
       - name: Install Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ inputs.go-version || '>=1.21.0' }}
           cache: false
@@ -91,7 +91,7 @@ jobs:
           rm -rf ./* .github .git
       # Check out the actions repo again, but at a different location.
       # choose an arbitrary SHA so that we can later test that the commit_oid is not from main
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: 474bbf07f9247ffe1856c6a0f94aeeb10e7afee6
           path: x/y/z/some-path
diff --git a/.github/workflows/check-expected-release-files.yml b/.github/workflows/check-expected-release-files.yml
index 670f146566..6cabd0454b 100644
--- a/.github/workflows/check-expected-release-files.yml
+++ b/.github/workflows/check-expected-release-files.yml
@@ -23,7 +23,7 @@ jobs:
 
     steps:
       - name: Checkout CodeQL Action
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Check Expected Release Files
         run: |
           bundle_version="$(cat "./src/defaults.json" | jq -r ".bundleVersion")"
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index c5efa1731a..f27de17fd8 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -32,7 +32,7 @@ jobs:
       security-events: read
 
     steps:
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Set up default CodeQL bundle
       id: setup-default
       uses: ./setup-codeql
@@ -84,7 +84,7 @@ jobs:
 
     steps:
     - name: Checkout
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Initialize CodeQL
       uses: ./init
       id: init
@@ -113,7 +113,6 @@ jobs:
       matrix:
         include:
           - language: actions
-          - language: python
 
     permissions:
       contents: read
@@ -121,7 +120,7 @@ jobs:
 
     steps:
     - name: Checkout
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Initialize CodeQL
       uses: ./init
       with:
diff --git a/.github/workflows/codescanning-config-cli.yml b/.github/workflows/codescanning-config-cli.yml
index 693be12392..7bc6718e35 100644
--- a/.github/workflows/codescanning-config-cli.yml
+++ b/.github/workflows/codescanning-config-cli.yml
@@ -54,10 +54,10 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Check out repository
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Set up Node.js
-      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
         node-version: 24
         cache: 'npm'
diff --git a/.github/workflows/debug-artifacts-failure-safe.yml b/.github/workflows/debug-artifacts-failure-safe.yml
index 665d0799de..f67cef5c75 100644
--- a/.github/workflows/debug-artifacts-failure-safe.yml
+++ b/.github/workflows/debug-artifacts-failure-safe.yml
@@ -48,17 +48,17 @@ jobs:
       - name: Dump GitHub event
         run: cat "${GITHUB_EVENT_PATH}"
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ^1.13.1
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: '9.x'
       - name: Assert best-effort artifact scan completed
diff --git a/.github/workflows/debug-artifacts-safe.yml b/.github/workflows/debug-artifacts-safe.yml
index 997cfe623a..c27f195113 100644
--- a/.github/workflows/debug-artifacts-safe.yml
+++ b/.github/workflows/debug-artifacts-safe.yml
@@ -44,17 +44,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Prepare test
         id: prepare-test
         uses: ./.github/actions/prepare-test
         with:
           version: ${{ matrix.version }}
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ^1.13.1
       - name: Install .NET
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: '9.x'
       - name: Assert best-effort artifact scan completed
diff --git a/.github/workflows/post-release-mergeback.yml b/.github/workflows/post-release-mergeback.yml
index b0eed4b71b..c493c2a382 100644
--- a/.github/workflows/post-release-mergeback.yml
+++ b/.github/workflows/post-release-mergeback.yml
@@ -44,16 +44,16 @@ jobs:
           GITHUB_CONTEXT: '${{ toJson(github) }}'
         run: echo "${GITHUB_CONTEXT}"
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0  # ensure we have all tags and can push commits
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
           cache: 'npm'
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
-        with:
-          python-version: '3.12'
+
+      - name: Install JavaScript dependencies
+        run: npm ci
 
       - name: Update git config
         run: |
@@ -127,7 +127,7 @@ jobs:
         env:
           PARTIAL_CHANGELOG: "${{ runner.temp }}/partial_changelog.md"
         run: |
-          python .github/workflows/script/prepare_changelog.py CHANGELOG.md > $PARTIAL_CHANGELOG
+          npx tsx pr-checks/prepare-changelog.ts --output="$PARTIAL_CHANGELOG"
 
           echo "::group::Partial CHANGELOG"
           cat $PARTIAL_CHANGELOG
diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml
index 45d38d3459..ac61475d62 100644
--- a/.github/workflows/pr-checks.yml
+++ b/.github/workflows/pr-checks.yml
@@ -39,10 +39,10 @@ jobs:
         if: runner.os == 'Windows'
         run: git config --global core.autocrlf false
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ matrix.node-version }}
           cache: 'npm'
@@ -88,10 +88,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
           cache: 'npm'
@@ -161,7 +161,7 @@ jobs:
       - name: 'Backport: Check out base ref'
         id: checkout-base
         if: ${{ startsWith(github.head_ref, 'backport-') }}
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.base_ref }}
 
diff --git a/.github/workflows/prepare-release.yml b/.github/workflows/prepare-release.yml
index 8bab54557a..4eb300704d 100644
--- a/.github/workflows/prepare-release.yml
+++ b/.github/workflows/prepare-release.yml
@@ -44,7 +44,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0 # Need full history for calculation of diffs
 
diff --git a/.github/workflows/publish-immutable-action.yml b/.github/workflows/publish-immutable-action.yml
index ec9a6518aa..5e5623bb07 100644
--- a/.github/workflows/publish-immutable-action.yml
+++ b/.github/workflows/publish-immutable-action.yml
@@ -20,7 +20,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Publish immutable release
         id: publish
diff --git a/.github/workflows/python312-windows.yml b/.github/workflows/python312-windows.yml
index 5722289fad..ab169499e2 100644
--- a/.github/workflows/python312-windows.yml
+++ b/.github/workflows/python312-windows.yml
@@ -32,11 +32,11 @@ jobs:
     runs-on: windows-latest
 
     steps:
-    - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+    - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
       with:
         python-version: 3.12
 
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Prepare test
       uses: ./.github/actions/prepare-test
diff --git a/.github/workflows/query-filters.yml b/.github/workflows/query-filters.yml
index 0343ce2e69..87b934eb6b 100644
--- a/.github/workflows/query-filters.yml
+++ b/.github/workflows/query-filters.yml
@@ -30,10 +30,10 @@ jobs:
       contents: read # This permission is needed to allow the GitHub Actions workflow to read the contents of the repository.
     steps:
     - name: Check out repository
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Install Node.js
-      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
         node-version: 24
         cache: npm
diff --git a/.github/workflows/rebuild.yml b/.github/workflows/rebuild.yml
index 39b42d8a02..faa32c65d9 100644
--- a/.github/workflows/rebuild.yml
+++ b/.github/workflows/rebuild.yml
@@ -24,13 +24,13 @@ jobs:
       pull-requests: write # needed to comment on the PR
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           ref: ${{ env.HEAD_REF }}
 
       - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
           cache: 'npm'
diff --git a/.github/workflows/rollback-release.yml b/.github/workflows/rollback-release.yml
index b830a827dd..c37f8a79ae 100644
--- a/.github/workflows/rollback-release.yml
+++ b/.github/workflows/rollback-release.yml
@@ -52,7 +52,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0 # Need full history for calculation of diffs
 
@@ -93,7 +93,7 @@ jobs:
           LATEST_TAG: ${{ needs.prepare.outputs.latest_tag }}
           VERSION: "${{ needs.prepare.outputs.version }}"
         run: |
-          python .github/workflows/script/rollback_changelog.py \
+          npx tsx pr-checks/rollback-changelog.ts \
             --target-version "${ROLLBACK_TAG:1}" \
             --rollback-version "${LATEST_TAG:1}" \
             --new-version "$VERSION" > $NEW_CHANGELOG
@@ -128,7 +128,9 @@ jobs:
           NEW_CHANGELOG: "${{ runner.temp }}/new_changelog.md"
           PARTIAL_CHANGELOG: "${{ runner.temp }}/partial_changelog.md"
         run: |
-          python .github/workflows/script/prepare_changelog.py $NEW_CHANGELOG > $PARTIAL_CHANGELOG
+          npx tsx pr-checks/prepare-changelog.ts \
+            --changelog="$NEW_CHANGELOG" \
+            --output="$PARTIAL_CHANGELOG"
 
           echo "::group::Partial CHANGELOG"
           cat $PARTIAL_CHANGELOG
diff --git a/.github/workflows/script/bundle_changelog.py b/.github/workflows/script/bundle_changelog.py
deleted file mode 100755
index d8ced87d8d..0000000000
--- a/.github/workflows/script/bundle_changelog.py
+++ /dev/null
@@ -1,23 +0,0 @@
-#!/usr/bin/env python3
-import os
-import re
-
-cli_version = os.environ['CLI_VERSION']
-
-# The GitHub Release for the new bundle version.
-bundle_release_url = f"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v{cli_version}"
-# Get the PR number from the PR URL.
-pr_number = os.environ['PR_URL'].split('/')[-1]
-changelog_note = f"- Update default CodeQL bundle version to [{cli_version}]({bundle_release_url}). [#{pr_number}]({os.environ['PR_URL']})"
-
-# If the "[UNRELEASED]" section starts with "no user facing changes", remove that line.
-with open('CHANGELOG.md', 'r') as f:
-    changelog = f.read()
-
-changelog = changelog.replace('## [UNRELEASED]\n\nNo user facing changes.', '## [UNRELEASED]\n')
-
-# Add the changelog note to the bottom of the "[UNRELEASED]" section.
-changelog = re.sub(r'\n## (\d+\.\d+\.\d+)', f'{changelog_note}\n\n## \\1', changelog, count=1)
-
-with open('CHANGELOG.md', 'w') as f:
-    f.write(changelog)
diff --git a/.github/workflows/script/prepare_changelog.py b/.github/workflows/script/prepare_changelog.py
deleted file mode 100755
index dafb84b39c..0000000000
--- a/.github/workflows/script/prepare_changelog.py
+++ /dev/null
@@ -1,35 +0,0 @@
-#!/usr/bin/env python3
-import os
-import sys
-
-EMPTY_CHANGELOG = 'No changes.\n\n'
-
-# Prepare the changelog for the new release
-# This function will extract the part of the changelog that
-# we want to include in the new release.
-def extract_changelog_snippet(changelog_file):
-  output = ''
-  if (not os.path.exists(changelog_file)):
-    output = EMPTY_CHANGELOG
-
-  else:
-    with open(changelog_file, 'r') as f:
-      lines = f.readlines()
-
-      # Include only the contents of the first section
-      found_first_section = False
-      for line in lines:
-        if line.startswith('## '):
-          if found_first_section:
-            break
-          found_first_section = True
-        elif found_first_section:
-          output += line
-
-  return output.strip()
-
-
-if len(sys.argv) < 2:
-  raise Exception('Expecting argument: changelog_file')
-changelog_file = sys.argv[1]
-print(extract_changelog_snippet(changelog_file))
diff --git a/.github/workflows/script/rollback_changelog.py b/.github/workflows/script/rollback_changelog.py
deleted file mode 100644
index 5e06f83455..0000000000
--- a/.github/workflows/script/rollback_changelog.py
+++ /dev/null
@@ -1,62 +0,0 @@
-import datetime
-import os
-import argparse
-
-EMPTY_CHANGELOG = """# CodeQL Action Changelog
-
-"""
-
-def get_today_string():
-  today = datetime.datetime.today()
-  return '{:%d %b %Y}'.format(today)
-
-# Include everything up to and after the first heading,
-# but not the first heading and body.
-def drop_unreleased_section(lines: list[str]):
-  before_first_section = ''
-  after_first_section = ''
-  found_first_section = False
-  skipped_first_section = False
-
-  for i, line in enumerate(lines):
-    if line.startswith('## ') and not found_first_section:
-      found_first_section = True
-    elif line.startswith('## ') and found_first_section:
-      skipped_first_section = True
-
-    if not found_first_section:
-      before_first_section += line
-    if skipped_first_section:
-      after_first_section += line
-
-  return (before_first_section, after_first_section)
-
-def update_changelog(target_version, rollback_version, new_version):
-  before_first_section = EMPTY_CHANGELOG
-  after_first_section = ''
-
-  if (os.path.exists('CHANGELOG.md')):
-    with open('CHANGELOG.md', 'r') as f:
-      (before_first_section, after_first_section) = drop_unreleased_section(f.readlines())
-
-  newHeader = f'## {new_version} - {get_today_string()}\n'
-
-  print(before_first_section, end="")
-  print(newHeader)
-  print(f"This release rolls back {rollback_version} due to issues with that release. It is identical to {target_version}.\n")
-  print(after_first_section)
-
-# We expect three version strings as input:
-#
-# - target_version: the version that we are re-releasing as `new_version`
-# - rollback_version: the version that we are rolling back, typically the one that followed `target_version`
-# - new_version: the new version that we are releasing `target_version` as, typically the one that follows `rollback_version`
-#
-# Example: python3 .github/workflows/script/rollback_changelog.py --target-version "1.2.3" --rollback-version "1.2.4" --new-version "1.2.5"
-parser = argparse.ArgumentParser(description="Update CHANGELOG.md for a rollback release.")
-parser.add_argument("--target-version", "-t", required=True, help="Version to re-release as new_version.")
-parser.add_argument("--rollback-version", "-r", required=True, help="Version being rolled back.")
-parser.add_argument("--new-version", "-n", required=True, help="New version to publish for target_version.")
-args = parser.parse_args()
-
-update_changelog(args.target_version, args.rollback_version, args.new_version)
diff --git a/.github/workflows/test-codeql-bundle-all.yml b/.github/workflows/test-codeql-bundle-all.yml
index e7cd9aab15..477fdf0524 100644
--- a/.github/workflows/test-codeql-bundle-all.yml
+++ b/.github/workflows/test-codeql-bundle-all.yml
@@ -38,7 +38,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Check out repository
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Prepare test
       id: prepare-test
       uses: ./.github/actions/prepare-test
@@ -46,7 +46,7 @@ jobs:
         version: ${{ matrix.version }}
         use-all-platform-bundle: true
     - name: Install .NET
-      uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+      uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
       with:
         dotnet-version: '9.x'
     - id: init
diff --git a/.github/workflows/update-bundle.yml b/.github/workflows/update-bundle.yml
index 04402f6dbe..d3ee924e59 100644
--- a/.github/workflows/update-bundle.yml
+++ b/.github/workflows/update-bundle.yml
@@ -33,20 +33,15 @@ jobs:
           GITHUB_CONTEXT: '${{ toJson(github) }}'
         run: echo "$GITHUB_CONTEXT"
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Update git config
         run: |
           git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
           git config --global user.name "github-actions[bot]"
 
-      - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
-        with:
-          python-version: '3.12'
-
       - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
           cache: 'npm'
@@ -120,7 +115,7 @@ jobs:
 
       - name: Create changelog note
         run: |
-          python .github/workflows/script/bundle_changelog.py
+          npx tsx pr-checks/bundle-changelog.ts
 
       - name: Push changelog note
         run: |
diff --git a/.github/workflows/update-release-branch.yml b/.github/workflows/update-release-branch.yml
index 11e97eeca0..9f38f0f0b4 100644
--- a/.github/workflows/update-release-branch.yml
+++ b/.github/workflows/update-release-branch.yml
@@ -38,7 +38,7 @@ jobs:
       contents: write # needed to push commits
       pull-requests: write # needed to create pull request
     steps:
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         fetch-depth: 0  # Need full history for calculation of diffs
     - uses: ./.github/actions/release-initialise
@@ -69,7 +69,7 @@ jobs:
       run: |
         echo SOURCE_BRANCH=${REF_NAME}
         echo TARGET_BRANCH=releases/${MAJOR_VERSION}
-        python .github/update-release-branch.py \
+        npx tsx ./pr-checks/update-release-branch.ts \
           --repository-nwo ${{ github.repository }} \
           --source-branch '${{ env.REF_NAME }}' \
           --target-branch 'releases/${{ env.MAJOR_VERSION }}' \
@@ -101,7 +101,7 @@ jobs:
         private-key: ${{ secrets.AUTOMATION_PRIVATE_KEY }}
 
     - name: Checkout
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         fetch-depth: 0  # Need full history for calculation of diffs
         token: ${{ steps.app-token.outputs.token }}
@@ -113,7 +113,7 @@ jobs:
       run: |
         echo SOURCE_BRANCH=${SOURCE_BRANCH}
         echo TARGET_BRANCH=${TARGET_BRANCH}
-        python .github/update-release-branch.py \
+        npx tsx ./pr-checks/update-release-branch.ts \
           --repository-nwo ${{ github.repository }} \
           --source-branch ${SOURCE_BRANCH} \
           --target-branch ${TARGET_BRANCH} \
diff --git a/.github/workflows/update-supported-enterprise-server-versions.yml b/.github/workflows/update-supported-enterprise-server-versions.yml
index ed35ff9cab..ee2649ad0e 100644
--- a/.github/workflows/update-supported-enterprise-server-versions.yml
+++ b/.github/workflows/update-supported-enterprise-server-versions.yml
@@ -22,16 +22,11 @@ jobs:
       pull-requests: write # needed to create pull request
 
     steps:
-      - name: Setup Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
-        with:
-          python-version: "3.13"
-
       - name: Checkout CodeQL Action
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
           cache: 'npm'
@@ -40,10 +35,10 @@ jobs:
         run: npm ci
 
       - name: Checkout Enterprise Releases
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: github/enterprise-releases
-          token: ${{ secrets.ENTERPRISE_RELEASE_TOKEN }}
+          token: ${{ secrets.CODEQL_CI_ENTERPRISE_RELEASE_PAT }}
           path: ${{ github.workspace }}/enterprise-releases/
           sparse-checkout: releases.json
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 02f01b7c9d..bbe7e65e68 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,33 @@
 
 See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs.
 
+## 4.37.6 - 04 Aug 2026
+
+- Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to `.github/codeql-config.yml` to align it with the suggested path that is used elsewhere. [#4070](https://github.com/github/codeql-action/pull/4070)
+
+## 4.37.5 - 03 Aug 2026
+
+- Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the `init` Action instead of falling back to downloading the bundle before extracting it. [#4061](https://github.com/github/codeql-action/pull/4061)
+
+## 4.37.4 - 29 Jul 2026
+
+- This version of the CodeQL Action adds support for the `tools` input for the `codeql-action/init` step to be specified using a `github-codeql-tools` [repository property](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization). This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to `toolcache` to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for `tools` in the workflow definition always takes precedence unless the value of the repository property starts with `!`. [#4037](https://github.com/github/codeql-action/pull/4037)
+- Update default CodeQL bundle version to [2.26.2](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2). [#4051](https://github.com/github/codeql-action/pull/4051)
+
+## 4.37.3 - 22 Jul 2026
+
+No user facing changes.
+
+## 4.37.2 - 21 Jul 2026
+
+- The new address format for the `config-file` input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the `remote=` prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. [#4023](https://github.com/github/codeql-action/pull/4023)
+- The CodeQL Action can now make use of [configured private registries](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries) in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. [#4007](https://github.com/github/codeql-action/pull/4007)
+
+## 4.37.1 - 16 Jul 2026
+
+- _Upcoming breaking change_: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. [#3956](https://github.com/github/codeql-action/pull/3956)
+- Update default CodeQL bundle version to [2.26.1](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1). [#4019](https://github.com/github/codeql-action/pull/4019)
+
 ## 4.37.0 - 08 Jul 2026
 
 - Update default CodeQL bundle version to [2.26.0](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0). [#3995](https://github.com/github/codeql-action/pull/3995)
diff --git a/lib/defaults.json b/lib/defaults.json
index 660296139f..558dce6e24 100644
--- a/lib/defaults.json
+++ b/lib/defaults.json
@@ -1,6 +1,6 @@
 {
-  "bundleVersion": "codeql-bundle-v2.26.0",
-  "cliVersion": "2.26.0",
-  "priorBundleVersion": "codeql-bundle-v2.25.6",
-  "priorCliVersion": "2.25.6"
+  "bundleVersion": "codeql-bundle-v2.26.2",
+  "cliVersion": "2.26.2",
+  "priorBundleVersion": "codeql-bundle-v2.26.1",
+  "priorCliVersion": "2.26.1"
 }
diff --git a/lib/entry-points.js b/lib/entry-points.js
index e8ee3fc281..cdd0db217d 100644
--- a/lib/entry-points.js
+++ b/lib/entry-points.js
@@ -1301,16 +1301,16 @@ var require_util = __commonJS({
     function isStream2(obj) {
       return obj && typeof obj === "object" && typeof obj.pipe === "function" && typeof obj.on === "function";
     }
-    function isBlobLike(object) {
-      if (object === null) {
+    function isBlobLike(object2) {
+      if (object2 === null) {
         return false;
-      } else if (object instanceof Blob2) {
+      } else if (object2 instanceof Blob2) {
         return true;
-      } else if (typeof object !== "object") {
+      } else if (typeof object2 !== "object") {
         return false;
       } else {
-        const sTag = object[Symbol.toStringTag];
-        return (sTag === "Blob" || sTag === "File") && ("stream" in object && typeof object.stream === "function" || "arrayBuffer" in object && typeof object.arrayBuffer === "function");
+        const sTag = object2[Symbol.toStringTag];
+        return (sTag === "Blob" || sTag === "File") && ("stream" in object2 && typeof object2.stream === "function" || "arrayBuffer" in object2 && typeof object2.arrayBuffer === "function");
       }
     }
     function buildURL(url2, queryParams) {
@@ -1592,8 +1592,8 @@ var require_util = __commonJS({
         }
       );
     }
-    function isFormDataLike(object) {
-      return object && typeof object === "object" && typeof object.append === "function" && typeof object.delete === "function" && typeof object.get === "function" && typeof object.getAll === "function" && typeof object.has === "function" && typeof object.set === "function" && object[Symbol.toStringTag] === "FormData";
+    function isFormDataLike(object2) {
+      return object2 && typeof object2 === "object" && typeof object2.append === "function" && typeof object2.delete === "function" && typeof object2.get === "function" && typeof object2.getAll === "function" && typeof object2.has === "function" && typeof object2.set === "function" && object2[Symbol.toStringTag] === "FormData";
     }
     function addAbortListener(signal, listener) {
       if ("addEventListener" in signal) {
@@ -2339,13 +2339,21 @@ var require_dispatcher_base = __commonJS({
     var kOnDestroyed = /* @__PURE__ */ Symbol("onDestroyed");
     var kOnClosed = /* @__PURE__ */ Symbol("onClosed");
     var kInterceptedDispatch = /* @__PURE__ */ Symbol("Intercepted Dispatch");
+    var kWebSocketOptions = /* @__PURE__ */ Symbol("webSocketOptions");
     var DispatcherBase = class extends Dispatcher {
-      constructor() {
+      constructor(opts) {
         super();
         this[kDestroyed] = false;
         this[kOnDestroyed] = null;
         this[kClosed] = false;
         this[kOnClosed] = [];
+        this[kWebSocketOptions] = opts?.webSocket ?? {};
+      }
+      get webSocketOptions() {
+        return {
+          maxFragments: this[kWebSocketOptions].maxFragments ?? 131072,
+          maxPayloadSize: this[kWebSocketOptions].maxPayloadSize ?? 128 * 1024 * 1024
+        };
       }
       get destroyed() {
         return this[kDestroyed];
@@ -4347,8 +4355,8 @@ var require_util2 = __commonJS({
       }
       return "allowed";
     }
-    function isErrorLike(object) {
-      return object instanceof Error || (object?.constructor?.name === "Error" || object?.constructor?.name === "DOMException");
+    function isErrorLike(object2) {
+      return object2 instanceof Error || (object2?.constructor?.name === "Error" || object2?.constructor?.name === "DOMException");
     }
     function isValidReasonPhrase(statusText) {
       for (let i = 0; i < statusText.length; ++i) {
@@ -4773,7 +4781,7 @@ var require_util2 = __commonJS({
         return new FastIterableIterator(target, kind);
       };
     }
-    function iteratorMixin(name, object, kInternalIterator, keyIndex = 0, valueIndex = 1) {
+    function iteratorMixin(name, object2, kInternalIterator, keyIndex = 0, valueIndex = 1) {
       const makeIterator = createIterator(name, kInternalIterator, keyIndex, valueIndex);
       const properties = {
         keys: {
@@ -4781,7 +4789,7 @@ var require_util2 = __commonJS({
           enumerable: true,
           configurable: true,
           value: function keys() {
-            webidl.brandCheck(this, object);
+            webidl.brandCheck(this, object2);
             return makeIterator(this, "key");
           }
         },
@@ -4790,7 +4798,7 @@ var require_util2 = __commonJS({
           enumerable: true,
           configurable: true,
           value: function values() {
-            webidl.brandCheck(this, object);
+            webidl.brandCheck(this, object2);
             return makeIterator(this, "value");
           }
         },
@@ -4799,7 +4807,7 @@ var require_util2 = __commonJS({
           enumerable: true,
           configurable: true,
           value: function entries() {
-            webidl.brandCheck(this, object);
+            webidl.brandCheck(this, object2);
             return makeIterator(this, "key+value");
           }
         },
@@ -4808,7 +4816,7 @@ var require_util2 = __commonJS({
           enumerable: true,
           configurable: true,
           value: function forEach(callbackfn, thisArg = globalThis) {
-            webidl.brandCheck(this, object);
+            webidl.brandCheck(this, object2);
             webidl.argumentLengthCheck(arguments, 1, `${name}.forEach`);
             if (typeof callbackfn !== "function") {
               throw new TypeError(
@@ -4821,7 +4829,7 @@ var require_util2 = __commonJS({
           }
         }
       };
-      return Object.defineProperties(object.prototype, {
+      return Object.defineProperties(object2.prototype, {
         ...properties,
         [Symbol.iterator]: {
           writable: true,
@@ -5221,8 +5229,8 @@ var require_file = __commonJS({
       }
     };
     webidl.converters.Blob = webidl.interfaceConverter(Blob2);
-    function isFileLike(object) {
-      return object instanceof File2 || object && (typeof object.stream === "function" || typeof object.arrayBuffer === "function") && object[Symbol.toStringTag] === "File";
+    function isFileLike(object2) {
+      return object2 instanceof File2 || object2 && (typeof object2.stream === "function" || typeof object2.arrayBuffer === "function") && object2[Symbol.toStringTag] === "File";
     }
     module2.exports = { FileLike, isFileLike };
   }
@@ -5670,12 +5678,12 @@ var require_body = __commonJS({
         }
       });
     }
-    function extractBody(object, keepalive = false) {
+    function extractBody(object2, keepalive = false) {
       let stream2 = null;
-      if (object instanceof ReadableStream) {
-        stream2 = object;
-      } else if (isBlobLike(object)) {
-        stream2 = object.stream();
+      if (object2 instanceof ReadableStream) {
+        stream2 = object2;
+      } else if (isBlobLike(object2)) {
+        stream2 = object2.stream();
       } else {
         stream2 = new ReadableStream({
           async pull(controller) {
@@ -5695,17 +5703,17 @@ var require_body = __commonJS({
       let source = null;
       let length = null;
       let type = null;
-      if (typeof object === "string") {
-        source = object;
+      if (typeof object2 === "string") {
+        source = object2;
         type = "text/plain;charset=UTF-8";
-      } else if (object instanceof URLSearchParams) {
-        source = object.toString();
+      } else if (object2 instanceof URLSearchParams) {
+        source = object2.toString();
         type = "application/x-www-form-urlencoded;charset=UTF-8";
-      } else if (isArrayBuffer(object)) {
-        source = new Uint8Array(object.slice());
-      } else if (ArrayBuffer.isView(object)) {
-        source = new Uint8Array(object.buffer.slice(object.byteOffset, object.byteOffset + object.byteLength));
-      } else if (util3.isFormDataLike(object)) {
+      } else if (isArrayBuffer(object2)) {
+        source = new Uint8Array(object2.slice());
+      } else if (ArrayBuffer.isView(object2)) {
+        source = new Uint8Array(object2.buffer.slice(object2.byteOffset, object2.byteOffset + object2.byteLength));
+      } else if (util3.isFormDataLike(object2)) {
         const boundary = `----formdata-undici-0${`${random(1e11)}`.padStart(11, "0")}`;
         const prefix = `--${boundary}\r
 Content-Disposition: form-data`;
@@ -5715,7 +5723,7 @@ Content-Disposition: form-data`;
         const rn = new Uint8Array([13, 10]);
         length = 0;
         let hasUnknownSizeValue = false;
-        for (const [name, value] of object) {
+        for (const [name, value] of object2) {
           if (typeof value === "string") {
             const chunk2 = textEncoder.encode(prefix + `; name="${escape3(normalizeLinefeeds(name))}"\r
 \r
@@ -5743,7 +5751,7 @@ Content-Type: ${value.type || "application/octet-stream"}\r
         if (hasUnknownSizeValue) {
           length = null;
         }
-        source = object;
+        source = object2;
         action = async function* () {
           for (const part of blobParts) {
             if (part.stream) {
@@ -5754,22 +5762,22 @@ Content-Type: ${value.type || "application/octet-stream"}\r
           }
         };
         type = `multipart/form-data; boundary=${boundary}`;
-      } else if (isBlobLike(object)) {
-        source = object;
-        length = object.size;
-        if (object.type) {
-          type = object.type;
+      } else if (isBlobLike(object2)) {
+        source = object2;
+        length = object2.size;
+        if (object2.type) {
+          type = object2.type;
         }
-      } else if (typeof object[Symbol.asyncIterator] === "function") {
+      } else if (typeof object2[Symbol.asyncIterator] === "function") {
         if (keepalive) {
           throw new TypeError("keepalive");
         }
-        if (util3.isDisturbed(object) || object.locked) {
+        if (util3.isDisturbed(object2) || object2.locked) {
           throw new TypeError(
             "Response body object should not be disturbed or locked"
           );
         }
-        stream2 = object instanceof ReadableStream ? object : ReadableStreamFrom(object);
+        stream2 = object2 instanceof ReadableStream ? object2 : ReadableStreamFrom(object2);
       }
       if (typeof source === "string" || util3.isBuffer(source)) {
         length = Buffer.byteLength(source);
@@ -5778,7 +5786,7 @@ Content-Type: ${value.type || "application/octet-stream"}\r
         let iterator2;
         stream2 = new ReadableStream({
           async start() {
-            iterator2 = action(object)[Symbol.asyncIterator]();
+            iterator2 = action(object2)[Symbol.asyncIterator]();
           },
           async pull(controller) {
             const { value, done } = await iterator2.next();
@@ -5806,12 +5814,12 @@ Content-Type: ${value.type || "application/octet-stream"}\r
       const body = { stream: stream2, source, length };
       return [body, type];
     }
-    function safelyExtractBody(object, keepalive = false) {
-      if (object instanceof ReadableStream) {
-        assert(!util3.isDisturbed(object), "The body has already been consumed.");
-        assert(!object.locked, "The stream is locked.");
+    function safelyExtractBody(object2, keepalive = false) {
+      if (object2 instanceof ReadableStream) {
+        assert(!util3.isDisturbed(object2), "The body has already been consumed.");
+        assert(!object2.locked, "The stream is locked.");
       }
-      return extractBody(object, keepalive);
+      return extractBody(object2, keepalive);
     }
     function cloneBody(instance, body) {
       const [out1, out2] = body.stream.tee();
@@ -5891,12 +5899,12 @@ Content-Type: ${value.type || "application/octet-stream"}\r
     function mixinBody(prototype) {
       Object.assign(prototype.prototype, bodyMixinMethods(prototype));
     }
-    async function consumeBody(object, convertBytesToJSValue, instance) {
-      webidl.brandCheck(object, instance);
-      if (bodyUnusable(object)) {
+    async function consumeBody(object2, convertBytesToJSValue, instance) {
+      webidl.brandCheck(object2, instance);
+      if (bodyUnusable(object2)) {
         throw new TypeError("Body is unusable: Body has already been read");
       }
-      throwIfAborted(object[kState]);
+      throwIfAborted(object2[kState]);
       const promise = createDeferredPromise();
       const errorSteps = (error3) => promise.reject(error3);
       const successSteps = (data) => {
@@ -5906,15 +5914,15 @@ Content-Type: ${value.type || "application/octet-stream"}\r
           errorSteps(e);
         }
       };
-      if (object[kState].body == null) {
+      if (object2[kState].body == null) {
         successSteps(Buffer.allocUnsafe(0));
         return promise.promise;
       }
-      await fullyReadBody(object[kState].body, successSteps, errorSteps);
+      await fullyReadBody(object2[kState].body, successSteps, errorSteps);
       return promise.promise;
     }
-    function bodyUnusable(object) {
-      const body = object[kState].body;
+    function bodyUnusable(object2) {
+      const body = object2[kState].body;
       return body != null && (body.stream.locked || util3.isDisturbed(body.stream));
     }
     function parseJSONFromBytes(bytes) {
@@ -5998,6 +6006,9 @@ var require_client_h1 = __commonJS({
     var FastBuffer = Buffer[Symbol.species];
     var addListener = util3.addListener;
     var removeAllListeners = util3.removeAllListeners;
+    var kIdleSocketValidation = /* @__PURE__ */ Symbol("kIdleSocketValidation");
+    var kIdleSocketValidationTimeout = /* @__PURE__ */ Symbol("kIdleSocketValidationTimeout");
+    var kSocketUsed = /* @__PURE__ */ Symbol("kSocketUsed");
     var extractBody;
     async function lazyllhttp() {
       const llhttpWasmData = process.env.JEST_WORKER_ID ? require_llhttp_wasm() : void 0;
@@ -6160,24 +6171,55 @@ var require_client_h1 = __commonJS({
             currentBufferRef = null;
           }
           const offset = llhttp.llhttp_get_error_pos(this.ptr) - currentBufferPtr;
-          if (ret === constants.ERROR.PAUSED_UPGRADE) {
-            this.onUpgrade(data.slice(offset));
-          } else if (ret === constants.ERROR.PAUSED) {
-            this.paused = true;
-            socket.unshift(data.slice(offset));
-          } else if (ret !== constants.ERROR.OK) {
-            const ptr = llhttp.llhttp_get_error_reason(this.ptr);
-            let message = "";
-            if (ptr) {
-              const len = new Uint8Array(llhttp.memory.buffer, ptr).indexOf(0);
-              message = "Response does not match the HTTP/1.1 protocol (" + Buffer.from(llhttp.memory.buffer, ptr, len).toString() + ")";
-            }
-            throw new HTTPParserError(message, constants.ERROR[ret], data.slice(offset));
+          if (ret !== constants.ERROR.OK) {
+            const body = data.subarray(offset);
+            if (ret === constants.ERROR.PAUSED_UPGRADE) {
+              this.onUpgrade(body);
+            } else if (ret === constants.ERROR.PAUSED) {
+              this.paused = true;
+              socket.unshift(body);
+            } else {
+              throw this.createError(ret, body);
+            }
           }
         } catch (err) {
           util3.destroy(socket, err);
         }
       }
+      finish() {
+        assert(currentParser === null);
+        assert(this.ptr != null);
+        assert(!this.paused);
+        const { llhttp } = this;
+        let ret;
+        try {
+          currentParser = this;
+          ret = llhttp.llhttp_finish(this.ptr);
+        } finally {
+          currentParser = null;
+        }
+        if (ret === constants.ERROR.OK) {
+          return null;
+        }
+        if (ret === constants.ERROR.PAUSED || ret === constants.ERROR.PAUSED_UPGRADE) {
+          this.paused = true;
+          return null;
+        }
+        return this.createError(ret, EMPTY_BUF);
+      }
+      createError(ret, data) {
+        const { llhttp, contentLength, bytesRead } = this;
+        if (contentLength && bytesRead !== parseInt(contentLength, 10)) {
+          return new ResponseContentLengthMismatchError();
+        }
+        const ptr = llhttp.llhttp_get_error_reason(this.ptr);
+        let message = "";
+        if (ptr) {
+          const len = new Uint8Array(llhttp.memory.buffer, ptr).indexOf(0);
+          message = "Response does not match the HTTP/1.1 protocol (" + Buffer.from(llhttp.memory.buffer, ptr, len).toString() + ")";
+        }
+        return new HTTPParserError(message, constants.ERROR[ret], data);
+      }
       destroy() {
         assert(this.ptr != null);
         assert(currentParser == null);
@@ -6197,6 +6239,10 @@ var require_client_h1 = __commonJS({
         if (socket.destroyed) {
           return -1;
         }
+        if (client[kRunning] === 0) {
+          util3.destroy(socket, new SocketError("bad response", util3.getSocketInfo(socket)));
+          return -1;
+        }
         const request3 = client[kQueue][client[kRunningIdx]];
         if (!request3) {
           return -1;
@@ -6276,6 +6322,10 @@ var require_client_h1 = __commonJS({
         if (socket.destroyed) {
           return -1;
         }
+        if (client[kRunning] === 0) {
+          util3.destroy(socket, new SocketError("bad response", util3.getSocketInfo(socket)));
+          return -1;
+        }
         const request3 = client[kQueue][client[kRunningIdx]];
         if (!request3) {
           return -1;
@@ -6401,6 +6451,7 @@ var require_client_h1 = __commonJS({
         }
         request3.onComplete(headers);
         client[kQueue][client[kRunningIdx]++] = null;
+        socket[kSocketUsed] = true;
         if (socket[kWriting]) {
           assert(client[kRunning] === 0);
           util3.destroy(socket, new InformationalError("reset"));
@@ -6444,12 +6495,19 @@ var require_client_h1 = __commonJS({
       socket[kWriting] = false;
       socket[kReset] = false;
       socket[kBlocking] = false;
+      socket[kIdleSocketValidation] = 0;
+      socket[kIdleSocketValidationTimeout] = null;
+      socket[kSocketUsed] = false;
       socket[kParser] = new Parser(client, socket, llhttpInstance);
       addListener(socket, "error", function(err) {
         assert(err.code !== "ERR_TLS_CERT_ALTNAME_INVALID");
         const parser = this[kParser];
         if (err.code === "ECONNRESET" && parser.statusCode && !parser.shouldKeepAlive) {
-          parser.onMessageComplete();
+          const parserErr = parser.finish();
+          if (parserErr) {
+            this[kError] = parserErr;
+            this[kClient][kOnError](parserErr);
+          }
           return;
         }
         this[kError] = err;
@@ -6464,7 +6522,10 @@ var require_client_h1 = __commonJS({
       addListener(socket, "end", function() {
         const parser = this[kParser];
         if (parser.statusCode && !parser.shouldKeepAlive) {
-          parser.onMessageComplete();
+          const parserErr = parser.finish();
+          if (parserErr) {
+            util3.destroy(this, parserErr);
+          }
           return;
         }
         util3.destroy(this, new SocketError("other side closed", util3.getSocketInfo(this)));
@@ -6472,9 +6533,10 @@ var require_client_h1 = __commonJS({
       addListener(socket, "close", function() {
         const client2 = this[kClient];
         const parser = this[kParser];
+        clearIdleSocketValidation(this);
         if (parser) {
           if (!this[kError] && parser.statusCode && !parser.shouldKeepAlive) {
-            parser.onMessageComplete();
+            this[kError] = parser.finish() || this[kError];
           }
           this[kParser].destroy();
           this[kParser] = null;
@@ -6523,7 +6585,7 @@ var require_client_h1 = __commonJS({
           return socket.destroyed;
         },
         busy(request3) {
-          if (socket[kWriting] || socket[kReset] || socket[kBlocking]) {
+          if (socket[kWriting] || socket[kReset] || socket[kBlocking] || socket[kIdleSocketValidation] === 1) {
             return true;
           }
           if (request3) {
@@ -6541,6 +6603,24 @@ var require_client_h1 = __commonJS({
         }
       };
     }
+    function clearIdleSocketValidation(socket) {
+      if (socket[kIdleSocketValidationTimeout]) {
+        clearTimeout(socket[kIdleSocketValidationTimeout]);
+        socket[kIdleSocketValidationTimeout] = null;
+      }
+      socket[kIdleSocketValidation] = 0;
+    }
+    function scheduleIdleSocketValidation(client, socket) {
+      socket[kIdleSocketValidation] = 1;
+      socket[kIdleSocketValidationTimeout] = setTimeout(() => {
+        socket[kIdleSocketValidationTimeout] = null;
+        socket[kIdleSocketValidation] = 2;
+        if (client[kSocket] === socket && !socket.destroyed) {
+          client[kResume]();
+        }
+      }, 0);
+      socket[kIdleSocketValidationTimeout].unref?.();
+    }
     function resumeH1(client) {
       const socket = client[kSocket];
       if (socket && !socket.destroyed) {
@@ -6553,6 +6633,29 @@ var require_client_h1 = __commonJS({
           socket.ref();
           socket[kNoRef] = false;
         }
+        if (client[kRunning] === 0 && client[kPending] > 0 && socket[kSocketUsed]) {
+          if (socket[kIdleSocketValidation] === 0) {
+            scheduleIdleSocketValidation(client, socket);
+            socket[kParser].readMore();
+            if (socket.destroyed) {
+              return;
+            }
+            return;
+          }
+          if (socket[kIdleSocketValidation] === 1) {
+            socket[kParser].readMore();
+            if (socket.destroyed) {
+              return;
+            }
+            return;
+          }
+        }
+        if (client[kRunning] === 0) {
+          socket[kParser].readMore();
+          if (socket.destroyed) {
+            return;
+          }
+        }
         if (client[kSize] === 0) {
           if (socket[kParser].timeoutType !== TIMEOUT_KEEP_ALIVE) {
             socket[kParser].setTimeout(client[kKeepAliveTimeoutValue], TIMEOUT_KEEP_ALIVE);
@@ -6605,6 +6708,7 @@ var require_client_h1 = __commonJS({
         process.emitWarning(new RequestContentLengthMismatchError());
       }
       const socket = client[kSocket];
+      clearIdleSocketValidation(socket);
       const abort = (err) => {
         if (request3.aborted || request3.completed) {
           return;
@@ -6965,7 +7069,7 @@ var require_client_h2 = __commonJS({
   "node_modules/undici/lib/dispatcher/client-h2.js"(exports2, module2) {
     "use strict";
     var assert = require("node:assert");
-    var { pipeline } = require("node:stream");
+    var { pipeline: pipeline2 } = require("node:stream");
     var util3 = require_util();
     var {
       RequestContentLengthMismatchError,
@@ -7412,7 +7516,7 @@ var require_client_h2 = __commonJS({
     }
     function writeStream(abort, socket, expectsPayload, h2stream, body, client, request3, contentLength) {
       assert(contentLength !== 0 || client[kRunning] === 0, "stream body cannot be pipelined");
-      const pipe = pipeline(
+      const pipe = pipeline2(
         body,
         h2stream,
         (err) => {
@@ -7784,9 +7888,10 @@ var require_client = __commonJS({
         autoSelectFamilyAttemptTimeout,
         // h2
         maxConcurrentStreams,
-        allowH2
+        allowH2,
+        webSocket
       } = {}) {
-        super();
+        super({ webSocket });
         if (keepAlive !== void 0) {
           throw new InvalidArgumentError("unsupported keepAlive, use pipelining=0 instead");
         }
@@ -8292,8 +8397,8 @@ var require_pool_base = __commonJS({
     var kRemoveClient = /* @__PURE__ */ Symbol("remove client");
     var kStats = /* @__PURE__ */ Symbol("stats");
     var PoolBase = class extends DispatcherBase {
-      constructor() {
-        super();
+      constructor(opts) {
+        super(opts);
         this[kQueue] = new FixedQueue();
         this[kClients] = [];
         this[kQueued] = 0;
@@ -8464,7 +8569,6 @@ var require_pool = __commonJS({
         allowH2,
         ...options
       } = {}) {
-        super();
         if (connections != null && (!Number.isFinite(connections) || connections < 0)) {
           throw new InvalidArgumentError("invalid connections");
         }
@@ -8485,6 +8589,7 @@ var require_pool = __commonJS({
             ...connect
           });
         }
+        super(options);
         this[kInterceptors] = options.interceptors?.Pool && Array.isArray(options.interceptors.Pool) ? options.interceptors.Pool : [];
         this[kConnections] = connections || null;
         this[kUrl] = util3.parseOrigin(origin);
@@ -8684,7 +8789,6 @@ var require_agent = __commonJS({
     }
     var Agent = class extends DispatcherBase {
       constructor({ factory = defaultFactory, maxRedirections = 0, connect, ...options } = {}) {
-        super();
         if (typeof factory !== "function") {
           throw new InvalidArgumentError("factory must be a function.");
         }
@@ -8694,6 +8798,7 @@ var require_agent = __commonJS({
         if (!Number.isInteger(maxRedirections) || maxRedirections < 0) {
           throw new InvalidArgumentError("maxRedirections must be a positive number");
         }
+        super(options);
         if (connect && typeof connect !== "function") {
           connect = { ...connect };
         }
@@ -8836,7 +8941,7 @@ var require_proxy_agent = __commonJS({
         return this.#client.destroy(err);
       }
     };
-    var ProxyAgent = class extends DispatcherBase {
+    var ProxyAgent2 = class extends DispatcherBase {
       constructor(opts) {
         super();
         if (!opts || typeof opts === "object" && !(opts instanceof URL2) && !opts.uri) {
@@ -8977,7 +9082,7 @@ var require_proxy_agent = __commonJS({
         throw new InvalidArgumentError("Proxy-Authorization should be sent in ProxyAgent constructor");
       }
     }
-    module2.exports = ProxyAgent;
+    module2.exports = ProxyAgent2;
   }
 });
 
@@ -8987,7 +9092,7 @@ var require_env_http_proxy_agent = __commonJS({
     "use strict";
     var DispatcherBase = require_dispatcher_base();
     var { kClose, kDestroy, kClosed, kDestroyed, kDispatch, kNoProxyAgent, kHttpProxyAgent, kHttpsProxyAgent } = require_symbols();
-    var ProxyAgent = require_proxy_agent();
+    var ProxyAgent2 = require_proxy_agent();
     var Agent = require_agent();
     var DEFAULT_PORTS = {
       "http:": 80,
@@ -9011,13 +9116,13 @@ var require_env_http_proxy_agent = __commonJS({
         this[kNoProxyAgent] = new Agent(agentOpts);
         const HTTP_PROXY = httpProxy ?? process.env.http_proxy ?? process.env.HTTP_PROXY;
         if (HTTP_PROXY) {
-          this[kHttpProxyAgent] = new ProxyAgent({ ...agentOpts, uri: HTTP_PROXY });
+          this[kHttpProxyAgent] = new ProxyAgent2({ ...agentOpts, uri: HTTP_PROXY });
         } else {
           this[kHttpProxyAgent] = this[kNoProxyAgent];
         }
         const HTTPS_PROXY = httpsProxy ?? process.env.https_proxy ?? process.env.HTTPS_PROXY;
         if (HTTPS_PROXY) {
-          this[kHttpsProxyAgent] = new ProxyAgent({ ...agentOpts, uri: HTTPS_PROXY });
+          this[kHttpsProxyAgent] = new ProxyAgent2({ ...agentOpts, uri: HTTPS_PROXY });
         } else {
           this[kHttpsProxyAgent] = this[kHttpProxyAgent];
         }
@@ -10401,7 +10506,7 @@ var require_api_pipeline = __commonJS({
         util3.destroy(ret, err);
       }
     };
-    function pipeline(opts, handler2) {
+    function pipeline2(opts, handler2) {
       try {
         const pipelineHandler = new PipelineHandler(opts, handler2);
         this.dispatch({ ...opts, body: pipelineHandler.req }, pipelineHandler);
@@ -10410,7 +10515,7 @@ var require_api_pipeline = __commonJS({
         return new PassThrough3().destroy(err);
       }
     }
-    module2.exports = pipeline;
+    module2.exports = pipeline2;
   }
 });
 
@@ -11961,10 +12066,10 @@ var require_headers = __commonJS({
       while (j > i && isHTTPWhiteSpaceCharCode(potentialValue.charCodeAt(i))) ++i;
       return i === 0 && j === potentialValue.length ? potentialValue : potentialValue.substring(i, j);
     }
-    function fill(headers, object) {
-      if (Array.isArray(object)) {
-        for (let i = 0; i < object.length; ++i) {
-          const header = object[i];
+    function fill(headers, object2) {
+      if (Array.isArray(object2)) {
+        for (let i = 0; i < object2.length; ++i) {
+          const header = object2[i];
           if (header.length !== 2) {
             throw webidl.errors.exception({
               header: "Headers constructor",
@@ -11973,10 +12078,10 @@ var require_headers = __commonJS({
           }
           appendHeader(headers, header[0], header[1]);
         }
-      } else if (typeof object === "object" && object !== null) {
-        const keys = Object.keys(object);
+      } else if (typeof object2 === "object" && object2 !== null) {
+        const keys = Object.keys(object2);
         for (let i = 0; i < keys.length; ++i) {
-          appendHeader(headers, keys[i], object[keys[i]]);
+          appendHeader(headers, keys[i], object2[keys[i]]);
         }
       } else {
         throw webidl.errors.conversionFailed({
@@ -12129,24 +12234,24 @@ var require_headers = __commonJS({
       // https://fetch.spec.whatwg.org/#convert-header-names-to-a-sorted-lowercase-set
       toSortedArray() {
         const size = this[kHeadersMap].size;
-        const array = new Array(size);
+        const array2 = new Array(size);
         if (size <= 32) {
           if (size === 0) {
-            return array;
+            return array2;
           }
           const iterator2 = this[kHeadersMap][Symbol.iterator]();
           const firstValue = iterator2.next().value;
-          array[0] = [firstValue[0], firstValue[1].value];
+          array2[0] = [firstValue[0], firstValue[1].value];
           assert(firstValue[1].value !== null);
           for (let i = 1, j = 0, right = 0, left = 0, pivot = 0, x, value; i < size; ++i) {
             value = iterator2.next().value;
-            x = array[i] = [value[0], value[1].value];
+            x = array2[i] = [value[0], value[1].value];
             assert(x[1] !== null);
             left = 0;
             right = i;
             while (left < right) {
               pivot = left + (right - left >> 1);
-              if (array[pivot][0] <= x[0]) {
+              if (array2[pivot][0] <= x[0]) {
                 left = pivot + 1;
               } else {
                 right = pivot;
@@ -12155,22 +12260,22 @@ var require_headers = __commonJS({
             if (i !== pivot) {
               j = i;
               while (j > left) {
-                array[j] = array[--j];
+                array2[j] = array2[--j];
               }
-              array[left] = x;
+              array2[left] = x;
             }
           }
           if (!iterator2.next().done) {
             throw new TypeError("Unreachable");
           }
-          return array;
+          return array2;
         } else {
           let i = 0;
           for (const { 0: name, 1: { value } } of this[kHeadersMap]) {
-            array[i++] = [name, value];
+            array2[i++] = [name, value];
             assert(value !== null);
           }
-          return array.sort(compareHeaderName);
+          return array2.sort(compareHeaderName);
         }
       }
     };
@@ -13575,7 +13680,7 @@ var require_fetch = __commonJS({
       subresourceSet
     } = require_constants3();
     var EE = require("node:events");
-    var { Readable: Readable3, pipeline, finished } = require("node:stream");
+    var { Readable: Readable3, pipeline: pipeline2, finished } = require("node:stream");
     var { addAbortListener, isErrored, isReadable, bufferToLowerCasedHeaderName } = require_util();
     var { dataURLProcessor, serializeAMimeType, minimizeSupportedMimeType } = require_data_url();
     var { getGlobalDispatcher } = require_global2();
@@ -14519,7 +14624,7 @@ var require_fetch = __commonJS({
                 status,
                 statusText,
                 headersList,
-                body: decoders.length ? pipeline(this.body, ...decoders, (err) => {
+                body: decoders.length ? pipeline2(this.body, ...decoders, (err) => {
                   if (err) {
                     this.onError(err);
                   }
@@ -16388,18 +16493,14 @@ var require_parse = __commonJS({
       } else if (attributeNameLowercase === "httponly") {
         cookieAttributeList.httpOnly = true;
       } else if (attributeNameLowercase === "samesite") {
-        let enforcement = "Default";
         const attributeValueLowercase = attributeValue.toLowerCase();
-        if (attributeValueLowercase.includes("none")) {
-          enforcement = "None";
-        }
-        if (attributeValueLowercase.includes("strict")) {
-          enforcement = "Strict";
+        if (attributeValueLowercase === "none") {
+          cookieAttributeList.sameSite = "None";
+        } else if (attributeValueLowercase === "strict") {
+          cookieAttributeList.sameSite = "Strict";
+        } else if (attributeValueLowercase === "lax") {
+          cookieAttributeList.sameSite = "Lax";
         }
-        if (attributeValueLowercase.includes("lax")) {
-          enforcement = "Lax";
-        }
-        cookieAttributeList.sameSite = enforcement;
       } else {
         cookieAttributeList.unparsed ??= [];
         cookieAttributeList.unparsed.push(`${attributeName}=${attributeValue}`);
@@ -17327,27 +17428,26 @@ var require_permessage_deflate = __commonJS({
     var tail = Buffer.from([0, 0, 255, 255]);
     var kBuffer = /* @__PURE__ */ Symbol("kBuffer");
     var kLength = /* @__PURE__ */ Symbol("kLength");
-    var kDefaultMaxDecompressedSize = 4 * 1024 * 1024;
     var PerMessageDeflate = class {
       /** @type {import('node:zlib').InflateRaw} */
       #inflate;
       #options = {};
-      /** @type {boolean} */
-      #aborted = false;
-      /** @type {Function|null} */
-      #currentCallback = null;
+      #maxPayloadSize = 0;
       /**
        * @param {Map<string, string>} extensions
        */
-      constructor(extensions) {
+      constructor(extensions, options) {
         this.#options.serverNoContextTakeover = extensions.has("server_no_context_takeover");
         this.#options.serverMaxWindowBits = extensions.get("server_max_window_bits");
+        this.#maxPayloadSize = options.maxPayloadSize;
       }
+      /**
+       * Decompress a compressed payload.
+       * @param {Buffer} chunk Compressed data
+       * @param {boolean} fin Final fragment flag
+       * @param {Function} callback Callback function
+       */
       decompress(chunk, fin, callback) {
-        if (this.#aborted) {
-          callback(new MessageSizeExceededError());
-          return;
-        }
         if (!this.#inflate) {
           let windowBits = Z_DEFAULT_WINDOWBITS;
           if (this.#options.serverMaxWindowBits) {
@@ -17366,20 +17466,11 @@ var require_permessage_deflate = __commonJS({
           this.#inflate[kBuffer] = [];
           this.#inflate[kLength] = 0;
           this.#inflate.on("data", (data) => {
-            if (this.#aborted) {
-              return;
-            }
             this.#inflate[kLength] += data.length;
-            if (this.#inflate[kLength] > kDefaultMaxDecompressedSize) {
-              this.#aborted = true;
+            if (this.#maxPayloadSize > 0 && this.#inflate[kLength] > this.#maxPayloadSize) {
+              callback(new MessageSizeExceededError());
               this.#inflate.removeAllListeners();
-              this.#inflate.destroy();
               this.#inflate = null;
-              if (this.#currentCallback) {
-                const cb = this.#currentCallback;
-                this.#currentCallback = null;
-                cb(new MessageSizeExceededError());
-              }
               return;
             }
             this.#inflate[kBuffer].push(data);
@@ -17389,19 +17480,17 @@ var require_permessage_deflate = __commonJS({
             callback(err);
           });
         }
-        this.#currentCallback = callback;
         this.#inflate.write(chunk);
         if (fin) {
           this.#inflate.write(tail);
         }
         this.#inflate.flush(() => {
-          if (this.#aborted || !this.#inflate) {
+          if (!this.#inflate) {
             return;
           }
           const full = Buffer.concat(this.#inflate[kBuffer], this.#inflate[kLength]);
           this.#inflate[kBuffer].length = 0;
           this.#inflate[kLength] = 0;
-          this.#currentCallback = null;
           callback(null, full);
         });
       }
@@ -17432,8 +17521,14 @@ var require_receiver = __commonJS({
     var { WebsocketFrameSend } = require_frame();
     var { closeWebSocketConnection } = require_connection();
     var { PerMessageDeflate } = require_permessage_deflate();
+    var { MessageSizeExceededError } = require_errors();
+    function failWebsocketConnectionWithCode(ws, code, reason) {
+      closeWebSocketConnection(ws, code, reason, Buffer.byteLength(reason));
+      failWebsocketConnection(ws, reason);
+    }
     var ByteParser = class extends Writable {
       #buffers = [];
+      #fragmentsBytes = 0;
       #byteOffset = 0;
       #loop = false;
       #state = parserStates.INFO;
@@ -17441,16 +17536,23 @@ var require_receiver = __commonJS({
       #fragments = [];
       /** @type {Map<string, PerMessageDeflate>} */
       #extensions;
+      /** @type {number} */
+      #maxFragments;
+      /** @type {number} */
+      #maxPayloadSize;
       /**
        * @param {import('./websocket').WebSocket} ws
        * @param {Map<string, string>|null} extensions
+       * @param {{ maxFragments?: number, maxPayloadSize?: number }} [options]
        */
-      constructor(ws, extensions) {
+      constructor(ws, extensions, options = {}) {
         super();
         this.ws = ws;
         this.#extensions = extensions == null ? /* @__PURE__ */ new Map() : extensions;
+        this.#maxFragments = options.maxFragments ?? 0;
+        this.#maxPayloadSize = options.maxPayloadSize ?? 0;
         if (this.#extensions.has("permessage-deflate")) {
-          this.#extensions.set("permessage-deflate", new PerMessageDeflate(extensions));
+          this.#extensions.set("permessage-deflate", new PerMessageDeflate(extensions, options));
         }
       }
       /**
@@ -17463,6 +17565,13 @@ var require_receiver = __commonJS({
         this.#loop = true;
         this.run(callback);
       }
+      #validatePayloadLength() {
+        if (this.#maxPayloadSize > 0 && !isControlFrame(this.#info.opcode) && this.#info.payloadLength + this.#fragmentsBytes > this.#maxPayloadSize) {
+          failWebsocketConnectionWithCode(this.ws, 1009, "Payload size exceeds maximum allowed size");
+          return false;
+        }
+        return true;
+      }
       /**
        * Runs whenever a new chunk is received.
        * Callback is called whenever there are no more chunks buffering,
@@ -17522,6 +17631,9 @@ var require_receiver = __commonJS({
             if (payloadLength <= 125) {
               this.#info.payloadLength = payloadLength;
               this.#state = parserStates.READ_DATA;
+              if (!this.#validatePayloadLength()) {
+                return;
+              }
             } else if (payloadLength === 126) {
               this.#state = parserStates.PAYLOADLENGTH_16;
             } else if (payloadLength === 127) {
@@ -17542,6 +17654,9 @@ var require_receiver = __commonJS({
             const buffer = this.consume(2);
             this.#info.payloadLength = buffer.readUInt16BE(0);
             this.#state = parserStates.READ_DATA;
+            if (!this.#validatePayloadLength()) {
+              return;
+            }
           } else if (this.#state === parserStates.PAYLOADLENGTH_64) {
             if (this.#byteOffset < 8) {
               return callback();
@@ -17555,6 +17670,9 @@ var require_receiver = __commonJS({
             }
             this.#info.payloadLength = lower;
             this.#state = parserStates.READ_DATA;
+            if (!this.#validatePayloadLength()) {
+              return;
+            }
           } else if (this.#state === parserStates.READ_DATA) {
             if (this.#byteOffset < this.#info.payloadLength) {
               return callback();
@@ -17565,32 +17683,46 @@ var require_receiver = __commonJS({
               this.#state = parserStates.INFO;
             } else {
               if (!this.#info.compressed) {
-                this.#fragments.push(body);
+                if (!this.writeFragments(body)) {
+                  return;
+                }
+                if (this.#maxPayloadSize > 0 && this.#fragmentsBytes > this.#maxPayloadSize) {
+                  failWebsocketConnectionWithCode(this.ws, 1009, new MessageSizeExceededError().message);
+                  return;
+                }
                 if (!this.#info.fragmented && this.#info.fin) {
-                  const fullMessage = Buffer.concat(this.#fragments);
-                  websocketMessageReceived(this.ws, this.#info.binaryType, fullMessage);
-                  this.#fragments.length = 0;
+                  websocketMessageReceived(this.ws, this.#info.binaryType, this.consumeFragments());
                 }
                 this.#state = parserStates.INFO;
               } else {
-                this.#extensions.get("permessage-deflate").decompress(body, this.#info.fin, (error3, data) => {
-                  if (error3) {
-                    failWebsocketConnection(this.ws, error3.message);
-                    return;
-                  }
-                  this.#fragments.push(data);
-                  if (!this.#info.fin) {
-                    this.#state = parserStates.INFO;
+                this.#extensions.get("permessage-deflate").decompress(
+                  body,
+                  this.#info.fin,
+                  (error3, data) => {
+                    if (error3) {
+                      const code = error3 instanceof MessageSizeExceededError ? 1009 : 1007;
+                      failWebsocketConnectionWithCode(this.ws, code, error3.message);
+                      return;
+                    }
+                    if (!this.writeFragments(data)) {
+                      return;
+                    }
+                    if (this.#maxPayloadSize > 0 && this.#fragmentsBytes > this.#maxPayloadSize) {
+                      failWebsocketConnectionWithCode(this.ws, 1009, new MessageSizeExceededError().message);
+                      return;
+                    }
+                    if (!this.#info.fin) {
+                      this.#state = parserStates.INFO;
+                      this.#loop = true;
+                      this.run(callback);
+                      return;
+                    }
+                    websocketMessageReceived(this.ws, this.#info.binaryType, this.consumeFragments());
                     this.#loop = true;
+                    this.#state = parserStates.INFO;
                     this.run(callback);
-                    return;
                   }
-                  websocketMessageReceived(this.ws, this.#info.binaryType, Buffer.concat(this.#fragments));
-                  this.#loop = true;
-                  this.#state = parserStates.INFO;
-                  this.#fragments.length = 0;
-                  this.run(callback);
-                });
+                );
                 this.#loop = false;
                 break;
               }
@@ -17633,6 +17765,26 @@ var require_receiver = __commonJS({
         this.#byteOffset -= n;
         return buffer;
       }
+      writeFragments(fragment) {
+        if (this.#maxFragments > 0 && this.#fragments.length === this.#maxFragments) {
+          failWebsocketConnectionWithCode(this.ws, 1008, "Too many message fragments");
+          return false;
+        }
+        this.#fragmentsBytes += fragment.length;
+        this.#fragments.push(fragment);
+        return true;
+      }
+      consumeFragments() {
+        const fragments = this.#fragments;
+        if (fragments.length === 1) {
+          this.#fragmentsBytes = 0;
+          return fragments.shift();
+        }
+        const output = Buffer.concat(fragments, this.#fragmentsBytes);
+        this.#fragments = [];
+        this.#fragmentsBytes = 0;
+        return output;
+      }
       parseCloseBody(data) {
         assert(data.length !== 1);
         let code;
@@ -18070,7 +18222,13 @@ var require_websocket = __commonJS({
        */
       #onConnectionEstablished(response, parsedExtensions) {
         this[kResponse] = response;
-        const parser = new ByteParser(this, parsedExtensions);
+        const webSocketOptions = this[kController]?.dispatcher?.webSocketOptions;
+        const maxFragments = webSocketOptions?.maxFragments;
+        const maxPayloadSize = webSocketOptions?.maxPayloadSize;
+        const parser = new ByteParser(this, parsedExtensions, {
+          maxFragments,
+          maxPayloadSize
+        });
         parser.on("drain", onParserDrain);
         parser.on("error", onParserError.bind(this));
         response.socket.ws = this;
@@ -18446,7 +18604,7 @@ ${value}`;
 var require_eventsource = __commonJS({
   "node_modules/undici/lib/web/eventsource/eventsource.js"(exports2, module2) {
     "use strict";
-    var { pipeline } = require("node:stream");
+    var { pipeline: pipeline2 } = require("node:stream");
     var { fetching } = require_fetch();
     var { makeRequest } = require_request2();
     var { webidl } = require_webidl();
@@ -18604,7 +18762,7 @@ var require_eventsource = __commonJS({
               ));
             }
           });
-          pipeline(
+          pipeline2(
             response.body.stream,
             eventSourceStream,
             (error3) => {
@@ -18748,7 +18906,7 @@ var require_undici = __commonJS({
     var Pool = require_pool();
     var BalancedPool = require_balanced_pool();
     var Agent = require_agent();
-    var ProxyAgent = require_proxy_agent();
+    var ProxyAgent2 = require_proxy_agent();
     var EnvHttpProxyAgent = require_env_http_proxy_agent();
     var RetryAgent = require_retry_agent();
     var errors = require_errors();
@@ -18771,7 +18929,7 @@ var require_undici = __commonJS({
     module2.exports.Pool = Pool;
     module2.exports.BalancedPool = BalancedPool;
     module2.exports.Agent = Agent;
-    module2.exports.ProxyAgent = ProxyAgent;
+    module2.exports.ProxyAgent = ProxyAgent2;
     module2.exports.EnvHttpProxyAgent = EnvHttpProxyAgent;
     module2.exports.RetryAgent = RetryAgent;
     module2.exports.RetryHandler = RetryHandler;
@@ -21401,7 +21559,7 @@ var require_core = __commonJS({
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.platform = exports2.toPlatformPath = exports2.toWin32Path = exports2.toPosixPath = exports2.markdownSummary = exports2.summary = exports2.ExitCode = void 0;
-    exports2.exportVariable = exportVariable15;
+    exports2.exportVariable = exportVariable16;
     exports2.setSecret = setSecret2;
     exports2.addPath = addPath2;
     exports2.getInput = getInput2;
@@ -21409,7 +21567,7 @@ var require_core = __commonJS({
     exports2.getBooleanInput = getBooleanInput;
     exports2.setOutput = setOutput7;
     exports2.setCommandEcho = setCommandEcho;
-    exports2.setFailed = setFailed13;
+    exports2.setFailed = setFailed12;
     exports2.isDebug = isDebug5;
     exports2.debug = debug6;
     exports2.error = error3;
@@ -21433,7 +21591,7 @@ var require_core = __commonJS({
       ExitCode2[ExitCode2["Success"] = 0] = "Success";
       ExitCode2[ExitCode2["Failure"] = 1] = "Failure";
     })(ExitCode || (exports2.ExitCode = ExitCode = {}));
-    function exportVariable15(name, val) {
+    function exportVariable16(name, val) {
       const convertedVal = (0, utils_1.toCommandValue)(val);
       process.env[name] = convertedVal;
       const filePath = process.env["GITHUB_ENV"] || "";
@@ -21493,7 +21651,7 @@ Support boolean input list: \`true | True | TRUE | false | False | FALSE\``);
     function setCommandEcho(enabled) {
       (0, command_1.issue)("echo", enabled ? "on" : "off");
     }
-    function setFailed13(message) {
+    function setFailed12(message) {
       process.exitCode = ExitCode.Failure;
       error3(message);
     }
@@ -21891,12 +22049,12 @@ var init_universal_user_agent2 = __esm({
 });
 
 // node_modules/@octokit/endpoint/dist-bundle/index.js
-function lowercaseKeys(object) {
-  if (!object) {
+function lowercaseKeys(object2) {
+  if (!object2) {
     return {};
   }
-  return Object.keys(object).reduce((newObj, key) => {
-    newObj[key.toLowerCase()] = object[key];
+  return Object.keys(object2).reduce((newObj, key) => {
+    newObj[key.toLowerCase()] = object2[key];
     return newObj;
   }, {});
 }
@@ -21908,12 +22066,12 @@ function isPlainObject(value) {
   const Ctor = Object.prototype.hasOwnProperty.call(proto, "constructor") && proto.constructor;
   return typeof Ctor === "function" && Ctor instanceof Ctor && Function.prototype.call(Ctor) === Function.prototype.call(value);
 }
-function mergeDeep(defaults2, options) {
-  const result = Object.assign({}, defaults2);
+function mergeDeep(defaults3, options) {
+  const result = Object.assign({}, defaults3);
   Object.keys(options).forEach((key) => {
     if (isPlainObject(options[key])) {
-      if (!(key in defaults2)) Object.assign(result, { [key]: options[key] });
-      else result[key] = mergeDeep(defaults2[key], options[key]);
+      if (!(key in defaults3)) Object.assign(result, { [key]: options[key] });
+      else result[key] = mergeDeep(defaults3[key], options[key]);
     } else {
       Object.assign(result, { [key]: options[key] });
     }
@@ -21928,7 +22086,7 @@ function removeUndefinedProperties(obj) {
   }
   return obj;
 }
-function merge(defaults2, route, options) {
+function merge(defaults3, route, options) {
   if (typeof route === "string") {
     let [method, url2] = route.split(" ");
     options = Object.assign(url2 ? { method, url: url2 } : { url: method }, options);
@@ -21938,10 +22096,10 @@ function merge(defaults2, route, options) {
   options.headers = lowercaseKeys(options.headers);
   removeUndefinedProperties(options);
   removeUndefinedProperties(options.headers);
-  const mergedOptions = mergeDeep(defaults2 || {}, options);
+  const mergedOptions = mergeDeep(defaults3 || {}, options);
   if (options.url === "/graphql") {
-    if (defaults2 && defaults2.mediaType.previews?.length) {
-      mergedOptions.mediaType.previews = defaults2.mediaType.previews.filter(
+    if (defaults3 && defaults3.mediaType.previews?.length) {
+      mergedOptions.mediaType.previews = defaults3.mediaType.previews.filter(
         (preview) => !mergedOptions.mediaType.previews.includes(preview)
       ).concat(mergedOptions.mediaType.previews);
     }
@@ -21972,11 +22130,11 @@ function extractUrlVariableNames(url2) {
   }
   return matches.map(removeNonChars).reduce((a, b) => a.concat(b), []);
 }
-function omit(object, keysToOmit) {
+function omit(object2, keysToOmit) {
   const result = { __proto__: null };
-  for (const key of Object.keys(object)) {
+  for (const key of Object.keys(object2)) {
     if (keysToOmit.indexOf(key) === -1) {
-      result[key] = object[key];
+      result[key] = object2[key];
     }
   }
   return result;
@@ -22174,8 +22332,8 @@ function parse(options) {
     options.request ? { request: options.request } : null
   );
 }
-function endpointWithDefaults(defaults2, route, options) {
-  return parse(merge(defaults2, route, options));
+function endpointWithDefaults(defaults3, route, options) {
+  return parse(merge(defaults3, route, options));
 }
 function withDefaults(oldDefaults, newDefaults) {
   const DEFAULTS2 = merge(oldDefaults, newDefaults);
@@ -22774,21 +22932,21 @@ var init_dist_src2 = __esm({
     userAgentTrail = `octokit-core.js/${VERSION4} ${getUserAgent()}`;
     Octokit = class {
       static VERSION = VERSION4;
-      static defaults(defaults2) {
+      static defaults(defaults3) {
         const OctokitWithDefaults = class extends this {
           constructor(...args) {
             const options = args[0] || {};
-            if (typeof defaults2 === "function") {
-              super(defaults2(options));
+            if (typeof defaults3 === "function") {
+              super(defaults3(options));
               return;
             }
             super(
               Object.assign(
                 {},
-                defaults2,
+                defaults3,
                 options,
-                options.userAgent && defaults2.userAgent ? {
-                  userAgent: `${options.userAgent} ${defaults2.userAgent}`
+                options.userAgent && defaults3.userAgent ? {
+                  userAgent: `${options.userAgent} ${defaults3.userAgent}`
                 } : null
               )
             );
@@ -25200,8 +25358,8 @@ function endpointsToMethods(octokit) {
   }
   return newMethods;
 }
-function decorate(octokit, scope, methodName, defaults2, decorations) {
-  const requestWithDefaults = octokit.request.defaults(defaults2);
+function decorate(octokit, scope, methodName, defaults3, decorations) {
+  const requestWithDefaults = octokit.request.defaults(defaults3);
   function withDecorations(...args) {
     let options = requestWithDefaults.endpoint.merge(...args);
     if (decorations.mapToData) {
@@ -25248,14 +25406,14 @@ var init_endpoints_to_methods = __esm({
     endpointMethodsMap = /* @__PURE__ */ new Map();
     for (const [scope, endpoints] of Object.entries(endpoints_default)) {
       for (const [methodName, endpoint2] of Object.entries(endpoints)) {
-        const [route, defaults2, decorations] = endpoint2;
+        const [route, defaults3, decorations] = endpoint2;
         const [method, url2] = route.split(/ /);
         const endpointDefaults = Object.assign(
           {
             method,
             url: url2
           },
-          defaults2
+          defaults3
         );
         if (!endpointMethodsMap.has(scope)) {
           endpointMethodsMap.set(scope, /* @__PURE__ */ new Map());
@@ -27886,19 +28044,19 @@ var require_light = __commonJS({
       function getCjsExportFromNamespace(n) {
         return n && n["default"] || n;
       }
-      var load2 = function(received, defaults2, onto = {}) {
+      var load2 = function(received, defaults3, onto = {}) {
         var k, ref, v;
-        for (k in defaults2) {
-          v = defaults2[k];
+        for (k in defaults3) {
+          v = defaults3[k];
           onto[k] = (ref = received[k]) != null ? ref : v;
         }
         return onto;
       };
-      var overwrite = function(received, defaults2, onto = {}) {
+      var overwrite = function(received, defaults3, onto = {}) {
         var k, v;
         for (k in received) {
           v = received[k];
-          if (defaults2[k] !== void 0) {
+          if (defaults3[k] !== void 0) {
             onto[k] = v;
           }
         }
@@ -29458,9 +29616,9 @@ var require_helpers = __commonJS({
       }
     }
     function deepMerge(target, src) {
-      var array = Array.isArray(src);
-      var dst = array && [] || {};
-      if (array) {
+      var array2 = Array.isArray(src);
+      var dst = array2 && [] || {};
+      if (array2) {
         target = target || [];
         dst = dst.concat(target);
         src.forEach(deepMerger.bind(null, target, dst));
@@ -29489,13 +29647,13 @@ var require_helpers = __commonJS({
     exports2.encodePath = function encodePointer(a) {
       return a.map(pathEncoder).join("");
     };
-    exports2.getDecimalPlaces = function getDecimalPlaces(number) {
+    exports2.getDecimalPlaces = function getDecimalPlaces(number2) {
       var decimalPlaces = 0;
-      if (isNaN(number)) return decimalPlaces;
-      if (typeof number !== "number") {
-        number = Number(number);
+      if (isNaN(number2)) return decimalPlaces;
+      if (typeof number2 !== "number") {
+        number2 = Number(number2);
       }
-      var parts = number.toString().split("e");
+      var parts = number2.toString().split("e");
       if (parts.length === 2) {
         if (parts[1][0] !== "-") {
           return decimalPlaces;
@@ -29695,11 +29853,11 @@ var require_attribute = __commonJS({
       }
       return result;
     };
-    function getEnumerableProperty(object, key) {
-      if (Object.hasOwnProperty.call(object, key)) return object[key];
-      if (!(key in object)) return;
-      while (object = Object.getPrototypeOf(object)) {
-        if (Object.propertyIsEnumerable.call(object, key)) return object[key];
+    function getEnumerableProperty(object2, key) {
+      if (Object.hasOwnProperty.call(object2, key)) return object2[key];
+      if (!(key in object2)) return;
+      while (object2 = Object.getPrototypeOf(object2)) {
+        if (Object.propertyIsEnumerable.call(object2, key)) return object2[key];
       }
     }
     validators.propertyNames = function validatePropertyNames(instance, schema, options, ctx) {
@@ -30319,7 +30477,7 @@ var require_validator = __commonJS({
     Validator3.prototype.getSchema = function getSchema(urn) {
       return this.schemas[urn];
     };
-    Validator3.prototype.validate = function validate(instance, schema, options, ctx) {
+    Validator3.prototype.validate = function validate2(instance, schema, options, ctx) {
       if (typeof schema !== "boolean" && typeof schema !== "object" || schema === null) {
         throw new SchemaError("Expected `schema` to be an object or boolean");
       }
@@ -31122,84 +31280,87 @@ var require_brace_expansion = __commonJS({
     }
     function expand3(str, max, isTop) {
       var expansions = [];
-      var m = balanced2("{", "}", str);
-      if (!m || /\$$/.test(m.pre)) return [str];
-      var isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body);
-      var isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body);
-      var isSequence = isNumericSequence || isAlphaSequence;
-      var isOptions = m.body.indexOf(",") >= 0;
-      if (!isSequence && !isOptions) {
-        if (m.post.match(/,(?!,).*\}/)) {
-          str = m.pre + "{" + m.body + escClose2 + m.post;
-          return expand3(str, max, true);
-        }
-        return [str];
-      }
-      var n;
-      if (isSequence) {
-        n = m.body.split(/\.\./);
-      } else {
-        n = parseCommaParts2(m.body);
-        if (n.length === 1) {
-          n = expand3(n[0], max, false).map(embrace2);
+      for (; ; ) {
+        var m = balanced2("{", "}", str);
+        if (!m || /\$$/.test(m.pre)) return [str];
+        var isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body);
+        var isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body);
+        var isSequence = isNumericSequence || isAlphaSequence;
+        var isOptions = m.body.indexOf(",") >= 0;
+        if (!isSequence && !isOptions) {
+          if (m.post.match(/,(?!,).*\}/)) {
+            str = m.pre + "{" + m.body + escClose2 + m.post;
+            isTop = true;
+            continue;
+          }
+          return [str];
+        }
+        var n;
+        if (isSequence) {
+          n = m.body.split(/\.\./);
+        } else {
+          n = parseCommaParts2(m.body);
           if (n.length === 1) {
-            var post = m.post.length ? expand3(m.post, max, false) : [""];
-            return post.map(function(p) {
-              return m.pre + n[0] + p;
-            });
+            n = expand3(n[0], max, false).map(embrace2);
+            if (n.length === 1) {
+              var post = m.post.length ? expand3(m.post, max, false) : [""];
+              return post.map(function(p) {
+                return m.pre + n[0] + p;
+              });
+            }
           }
         }
-      }
-      var pre = m.pre;
-      var post = m.post.length ? expand3(m.post, max, false) : [""];
-      var N;
-      if (isSequence) {
-        var x = numeric2(n[0]);
-        var y = numeric2(n[1]);
-        var width = Math.max(n[0].length, n[1].length);
-        var incr = n.length == 3 ? Math.max(Math.abs(numeric2(n[2])), 1) : 1;
-        var test = lte2;
-        var reverse = y < x;
-        if (reverse) {
-          incr *= -1;
-          test = gte7;
-        }
-        var pad = n.some(isPadded2);
-        N = [];
-        for (var i = x; test(i, y); i += incr) {
-          var c;
-          if (isAlphaSequence) {
-            c = String.fromCharCode(i);
-            if (c === "\\")
-              c = "";
-          } else {
-            c = String(i);
-            if (pad) {
-              var need = width - c.length;
-              if (need > 0) {
-                var z = new Array(need + 1).join("0");
-                if (i < 0)
-                  c = "-" + z + c.slice(1);
-                else
-                  c = z + c;
+        var pre = m.pre;
+        var post = m.post.length ? expand3(m.post, max, false) : [""];
+        var N;
+        if (isSequence) {
+          var x = numeric2(n[0]);
+          var y = numeric2(n[1]);
+          var width = Math.max(n[0].length, n[1].length);
+          var incr = n.length == 3 ? Math.max(Math.abs(numeric2(n[2])), 1) : 1;
+          var test = lte2;
+          var reverse = y < x;
+          if (reverse) {
+            incr *= -1;
+            test = gte7;
+          }
+          var pad = n.some(isPadded2);
+          N = [];
+          for (var i = x; test(i, y) && N.length < max; i += incr) {
+            var c;
+            if (isAlphaSequence) {
+              c = String.fromCharCode(i);
+              if (c === "\\")
+                c = "";
+            } else {
+              c = String(i);
+              if (pad) {
+                var need = width - c.length;
+                if (need > 0) {
+                  var z = new Array(need + 1).join("0");
+                  if (i < 0)
+                    c = "-" + z + c.slice(1);
+                  else
+                    c = z + c;
+                }
               }
             }
+            N.push(c);
           }
-          N.push(c);
+        } else {
+          N = concatMap(n, function(el) {
+            return expand3(el, max, false);
+          });
         }
-      } else {
-        N = concatMap(n, function(el) {
-          return expand3(el, max, false);
-        });
-      }
-      for (var j = 0; j < N.length; j++) {
-        for (var k = 0; k < post.length && expansions.length < max; k++) {
-          var expansion = pre + N[j] + post[k];
-          if (!isTop || isSequence || expansion)
-            expansions.push(expansion);
+        for (var j = 0; j < N.length; j++) {
+          for (var k = 0; k < post.length && expansions.length < max; k++) {
+            var expansion = pre + N[j] + post[k];
+            if (!isTop || isSequence || expansion)
+              expansions.push(expansion);
+          }
         }
+        return expansions;
       }
-      return expansions;
     }
   }
 });
@@ -31268,13 +31429,13 @@ var require_minimatch = __commonJS({
       m.Minimatch = function Minimatch3(pattern, options) {
         return new orig.Minimatch(pattern, ext2(def, options));
       };
-      m.Minimatch.defaults = function defaults2(options) {
+      m.Minimatch.defaults = function defaults3(options) {
         return orig.defaults(ext2(def, options)).Minimatch;
       };
       m.filter = function filter3(pattern, options) {
         return orig.filter(pattern, ext2(def, options));
       };
-      m.defaults = function defaults2(options) {
+      m.defaults = function defaults3(options) {
         return orig.defaults(ext2(def, options));
       };
       m.makeRe = function makeRe3(pattern, options) {
@@ -32627,8 +32788,8 @@ var require_internal_hash_files = __commonJS({
               continue;
             }
             const hash2 = crypto3.createHash("sha256");
-            const pipeline = util3.promisify(stream2.pipeline);
-            yield pipeline(fs31.createReadStream(file), hash2);
+            const pipeline2 = util3.promisify(stream2.pipeline);
+            yield pipeline2(fs31.createReadStream(file), hash2);
             result.write(hash2.digest());
             count++;
             if (!hasMatch) {
@@ -33872,7 +34033,7 @@ var require_constants7 = __commonJS({
   "node_modules/@actions/cache/lib/internal/constants.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.CacheFileSizeLimit = exports2.ManifestFilename = exports2.TarFilename = exports2.SystemTarPathOnWindows = exports2.GnuTarPathOnWindows = exports2.SocketTimeout = exports2.DefaultRetryDelay = exports2.DefaultRetryAttempts = exports2.ArchiveToolType = exports2.CompressionMethod = exports2.CacheFilename = void 0;
+    exports2.CacheReadDeniedMessagePrefix = exports2.CacheFileSizeLimit = exports2.ManifestFilename = exports2.TarFilename = exports2.SystemTarPathOnWindows = exports2.GnuTarPathOnWindows = exports2.SocketTimeout = exports2.DefaultRetryDelay = exports2.DefaultRetryAttempts = exports2.ArchiveToolType = exports2.CompressionMethod = exports2.CacheFilename = void 0;
     var CacheFilename;
     (function(CacheFilename2) {
       CacheFilename2["Gzip"] = "cache.tgz";
@@ -33897,6 +34058,7 @@ var require_constants7 = __commonJS({
     exports2.TarFilename = "cache.tar";
     exports2.ManifestFilename = "manifest.txt";
     exports2.CacheFileSizeLimit = 10 * Math.pow(1024, 3);
+    exports2.CacheReadDeniedMessagePrefix = "cache read denied:";
   }
 });
 
@@ -35194,12 +35356,12 @@ var require_pipeline = __commonJS({
       }
       sendRequest(httpClient, request3) {
         const policies = this.getOrderedPolicies();
-        const pipeline = policies.reduceRight((next, policy) => {
+        const pipeline2 = policies.reduceRight((next, policy) => {
           return (req) => {
             return policy.sendRequest(req, next);
           };
         }, (req) => httpClient.sendRequest(req));
-        return pipeline(request3);
+        return pipeline2(request3);
       }
       getOrderedPolicies() {
         if (!this._orderedPolicies) {
@@ -38326,26 +38488,26 @@ var require_createPipelineFromOptions = __commonJS({
     var tlsPolicy_js_1 = require_tlsPolicy();
     var multipartPolicy_js_1 = require_multipartPolicy();
     function createPipelineFromOptions(options) {
-      const pipeline = (0, pipeline_js_1.createEmptyPipeline)();
+      const pipeline2 = (0, pipeline_js_1.createEmptyPipeline)();
       if (checkEnvironment_js_1.isNodeLike) {
         if (options.agent) {
-          pipeline.addPolicy((0, agentPolicy_js_1.agentPolicy)(options.agent));
+          pipeline2.addPolicy((0, agentPolicy_js_1.agentPolicy)(options.agent));
         }
         if (options.tlsOptions) {
-          pipeline.addPolicy((0, tlsPolicy_js_1.tlsPolicy)(options.tlsOptions));
+          pipeline2.addPolicy((0, tlsPolicy_js_1.tlsPolicy)(options.tlsOptions));
         }
-        pipeline.addPolicy((0, proxyPolicy_js_1.proxyPolicy)(options.proxyOptions));
-        pipeline.addPolicy((0, decompressResponsePolicy_js_1.decompressResponsePolicy)());
+        pipeline2.addPolicy((0, proxyPolicy_js_1.proxyPolicy)(options.proxyOptions));
+        pipeline2.addPolicy((0, decompressResponsePolicy_js_1.decompressResponsePolicy)());
       }
-      pipeline.addPolicy((0, formDataPolicy_js_1.formDataPolicy)(), { beforePolicies: [multipartPolicy_js_1.multipartPolicyName] });
-      pipeline.addPolicy((0, userAgentPolicy_js_1.userAgentPolicy)(options.userAgentOptions));
-      pipeline.addPolicy((0, multipartPolicy_js_1.multipartPolicy)(), { afterPhase: "Deserialize" });
-      pipeline.addPolicy((0, defaultRetryPolicy_js_1.defaultRetryPolicy)(options.retryOptions), { phase: "Retry" });
+      pipeline2.addPolicy((0, formDataPolicy_js_1.formDataPolicy)(), { beforePolicies: [multipartPolicy_js_1.multipartPolicyName] });
+      pipeline2.addPolicy((0, userAgentPolicy_js_1.userAgentPolicy)(options.userAgentOptions));
+      pipeline2.addPolicy((0, multipartPolicy_js_1.multipartPolicy)(), { afterPhase: "Deserialize" });
+      pipeline2.addPolicy((0, defaultRetryPolicy_js_1.defaultRetryPolicy)(options.retryOptions), { phase: "Retry" });
       if (checkEnvironment_js_1.isNodeLike) {
-        pipeline.addPolicy((0, redirectPolicy_js_1.redirectPolicy)(options.redirectOptions), { afterPhase: "Retry" });
+        pipeline2.addPolicy((0, redirectPolicy_js_1.redirectPolicy)(options.redirectOptions), { afterPhase: "Retry" });
       }
-      pipeline.addPolicy((0, logPolicy_js_1.logPolicy)(options.loggingOptions), { afterPhase: "Sign" });
-      return pipeline;
+      pipeline2.addPolicy((0, logPolicy_js_1.logPolicy)(options.loggingOptions), { afterPhase: "Sign" });
+      return pipeline2;
     }
   }
 });
@@ -38567,21 +38729,21 @@ var require_clientHelpers = __commonJS({
     var oauth2AuthenticationPolicy_js_1 = require_oauth2AuthenticationPolicy();
     var cachedHttpClient;
     function createDefaultPipeline(options = {}) {
-      const pipeline = (0, createPipelineFromOptions_js_1.createPipelineFromOptions)(options);
-      pipeline.addPolicy((0, apiVersionPolicy_js_1.apiVersionPolicy)(options));
+      const pipeline2 = (0, createPipelineFromOptions_js_1.createPipelineFromOptions)(options);
+      pipeline2.addPolicy((0, apiVersionPolicy_js_1.apiVersionPolicy)(options));
       const { credential, authSchemes, allowInsecureConnection } = options;
       if (credential) {
         if ((0, credentials_js_1.isApiKeyCredential)(credential)) {
-          pipeline.addPolicy((0, apiKeyAuthenticationPolicy_js_1.apiKeyAuthenticationPolicy)({ authSchemes, credential, allowInsecureConnection }));
+          pipeline2.addPolicy((0, apiKeyAuthenticationPolicy_js_1.apiKeyAuthenticationPolicy)({ authSchemes, credential, allowInsecureConnection }));
         } else if ((0, credentials_js_1.isBasicCredential)(credential)) {
-          pipeline.addPolicy((0, basicAuthenticationPolicy_js_1.basicAuthenticationPolicy)({ authSchemes, credential, allowInsecureConnection }));
+          pipeline2.addPolicy((0, basicAuthenticationPolicy_js_1.basicAuthenticationPolicy)({ authSchemes, credential, allowInsecureConnection }));
         } else if ((0, credentials_js_1.isBearerTokenCredential)(credential)) {
-          pipeline.addPolicy((0, bearerAuthenticationPolicy_js_1.bearerAuthenticationPolicy)({ authSchemes, credential, allowInsecureConnection }));
+          pipeline2.addPolicy((0, bearerAuthenticationPolicy_js_1.bearerAuthenticationPolicy)({ authSchemes, credential, allowInsecureConnection }));
         } else if ((0, credentials_js_1.isOAuth2TokenCredential)(credential)) {
-          pipeline.addPolicy((0, oauth2AuthenticationPolicy_js_1.oauth2AuthenticationPolicy)({ authSchemes, credential, allowInsecureConnection }));
+          pipeline2.addPolicy((0, oauth2AuthenticationPolicy_js_1.oauth2AuthenticationPolicy)({ authSchemes, credential, allowInsecureConnection }));
         }
       }
-      return pipeline;
+      return pipeline2;
     }
     function getCachedDefaultHttpsClient() {
       if (!cachedHttpClient) {
@@ -38717,11 +38879,11 @@ var require_sendRequest = __commonJS({
     var clientHelpers_js_1 = require_clientHelpers();
     var typeGuards_js_1 = require_typeGuards();
     var multipart_js_1 = require_multipart();
-    async function sendRequest(method, url2, pipeline, options = {}, customHttpClient) {
+    async function sendRequest(method, url2, pipeline2, options = {}, customHttpClient) {
       const httpClient = customHttpClient ?? (0, clientHelpers_js_1.getCachedDefaultHttpsClient)();
       const request3 = buildPipelineRequest(method, url2, options);
       try {
-        const response = await pipeline.sendRequest(httpClient, request3);
+        const response = await pipeline2.sendRequest(httpClient, request3);
         const headers = response.headers.toJSON();
         const stream2 = response.readableStreamBody ?? response.browserStreamBody;
         const parsedBody = options.responseAsStream || stream2 !== void 0 ? void 0 : getResponseBody(response);
@@ -38984,11 +39146,11 @@ var require_getClient = __commonJS({
     var urlHelpers_js_1 = require_urlHelpers();
     var checkEnvironment_js_1 = require_checkEnvironment();
     function getClient(endpoint2, clientOptions = {}) {
-      const pipeline = clientOptions.pipeline ?? (0, clientHelpers_js_1.createDefaultPipeline)(clientOptions);
+      const pipeline2 = clientOptions.pipeline ?? (0, clientHelpers_js_1.createDefaultPipeline)(clientOptions);
       if (clientOptions.additionalPolicies?.length) {
         for (const { policy, position } of clientOptions.additionalPolicies) {
           const afterPhase = position === "perRetry" ? "Sign" : void 0;
-          pipeline.addPolicy(policy, {
+          pipeline2.addPolicy(policy, {
             afterPhase
           });
         }
@@ -38999,53 +39161,53 @@ var require_getClient = __commonJS({
         const getUrl = (requestOptions) => (0, urlHelpers_js_1.buildRequestUrl)(endpointUrl, path29, args, { allowInsecureConnection, ...requestOptions });
         return {
           get: (requestOptions = {}) => {
-            return buildOperation("GET", getUrl(requestOptions), pipeline, requestOptions, allowInsecureConnection, httpClient);
+            return buildOperation("GET", getUrl(requestOptions), pipeline2, requestOptions, allowInsecureConnection, httpClient);
           },
           post: (requestOptions = {}) => {
-            return buildOperation("POST", getUrl(requestOptions), pipeline, requestOptions, allowInsecureConnection, httpClient);
+            return buildOperation("POST", getUrl(requestOptions), pipeline2, requestOptions, allowInsecureConnection, httpClient);
           },
           put: (requestOptions = {}) => {
-            return buildOperation("PUT", getUrl(requestOptions), pipeline, requestOptions, allowInsecureConnection, httpClient);
+            return buildOperation("PUT", getUrl(requestOptions), pipeline2, requestOptions, allowInsecureConnection, httpClient);
           },
           patch: (requestOptions = {}) => {
-            return buildOperation("PATCH", getUrl(requestOptions), pipeline, requestOptions, allowInsecureConnection, httpClient);
+            return buildOperation("PATCH", getUrl(requestOptions), pipeline2, requestOptions, allowInsecureConnection, httpClient);
           },
           delete: (requestOptions = {}) => {
-            return buildOperation("DELETE", getUrl(requestOptions), pipeline, requestOptions, allowInsecureConnection, httpClient);
+            return buildOperation("DELETE", getUrl(requestOptions), pipeline2, requestOptions, allowInsecureConnection, httpClient);
           },
           head: (requestOptions = {}) => {
-            return buildOperation("HEAD", getUrl(requestOptions), pipeline, requestOptions, allowInsecureConnection, httpClient);
+            return buildOperation("HEAD", getUrl(requestOptions), pipeline2, requestOptions, allowInsecureConnection, httpClient);
           },
           options: (requestOptions = {}) => {
-            return buildOperation("OPTIONS", getUrl(requestOptions), pipeline, requestOptions, allowInsecureConnection, httpClient);
+            return buildOperation("OPTIONS", getUrl(requestOptions), pipeline2, requestOptions, allowInsecureConnection, httpClient);
           },
           trace: (requestOptions = {}) => {
-            return buildOperation("TRACE", getUrl(requestOptions), pipeline, requestOptions, allowInsecureConnection, httpClient);
+            return buildOperation("TRACE", getUrl(requestOptions), pipeline2, requestOptions, allowInsecureConnection, httpClient);
           }
         };
       };
       return {
         path: client,
         pathUnchecked: client,
-        pipeline
+        pipeline: pipeline2
       };
     }
-    function buildOperation(method, url2, pipeline, options, allowInsecureConnection, httpClient) {
+    function buildOperation(method, url2, pipeline2, options, allowInsecureConnection, httpClient) {
       allowInsecureConnection = options.allowInsecureConnection ?? allowInsecureConnection;
       return {
         then: function(onFulfilled, onrejected) {
-          return (0, sendRequest_js_1.sendRequest)(method, url2, pipeline, { ...options, allowInsecureConnection }, httpClient).then(onFulfilled, onrejected);
+          return (0, sendRequest_js_1.sendRequest)(method, url2, pipeline2, { ...options, allowInsecureConnection }, httpClient).then(onFulfilled, onrejected);
         },
         async asBrowserStream() {
           if (checkEnvironment_js_1.isNodeLike) {
             throw new Error("`asBrowserStream` is supported only in the browser environment. Use `asNodeStream` instead to obtain the response body stream. If you require a Web stream of the response in Node, consider using `Readable.toWeb` on the result of `asNodeStream`.");
           } else {
-            return (0, sendRequest_js_1.sendRequest)(method, url2, pipeline, { ...options, allowInsecureConnection, responseAsStream: true }, httpClient);
+            return (0, sendRequest_js_1.sendRequest)(method, url2, pipeline2, { ...options, allowInsecureConnection, responseAsStream: true }, httpClient);
           }
         },
         async asNodeStream() {
           if (checkEnvironment_js_1.isNodeLike) {
-            return (0, sendRequest_js_1.sendRequest)(method, url2, pipeline, { ...options, allowInsecureConnection, responseAsStream: true }, httpClient);
+            return (0, sendRequest_js_1.sendRequest)(method, url2, pipeline2, { ...options, allowInsecureConnection, responseAsStream: true }, httpClient);
           } else {
             throw new Error("`isNodeStream` is not supported in the browser environment. Use `asBrowserStream` to obtain the response body stream.");
           }
@@ -40535,31 +40697,31 @@ var require_createPipelineFromOptions2 = __commonJS({
     var tracingPolicy_js_1 = require_tracingPolicy();
     var wrapAbortSignalLikePolicy_js_1 = require_wrapAbortSignalLikePolicy();
     function createPipelineFromOptions(options) {
-      const pipeline = (0, pipeline_js_1.createEmptyPipeline)();
+      const pipeline2 = (0, pipeline_js_1.createEmptyPipeline)();
       if (core_util_1.isNodeLike) {
         if (options.agent) {
-          pipeline.addPolicy((0, agentPolicy_js_1.agentPolicy)(options.agent));
+          pipeline2.addPolicy((0, agentPolicy_js_1.agentPolicy)(options.agent));
         }
         if (options.tlsOptions) {
-          pipeline.addPolicy((0, tlsPolicy_js_1.tlsPolicy)(options.tlsOptions));
-        }
-        pipeline.addPolicy((0, proxyPolicy_js_1.proxyPolicy)(options.proxyOptions));
-        pipeline.addPolicy((0, decompressResponsePolicy_js_1.decompressResponsePolicy)());
-      }
-      pipeline.addPolicy((0, wrapAbortSignalLikePolicy_js_1.wrapAbortSignalLikePolicy)());
-      pipeline.addPolicy((0, formDataPolicy_js_1.formDataPolicy)(), { beforePolicies: [multipartPolicy_js_1.multipartPolicyName] });
-      pipeline.addPolicy((0, userAgentPolicy_js_1.userAgentPolicy)(options.userAgentOptions));
-      pipeline.addPolicy((0, setClientRequestIdPolicy_js_1.setClientRequestIdPolicy)(options.telemetryOptions?.clientRequestIdHeaderName));
-      pipeline.addPolicy((0, multipartPolicy_js_1.multipartPolicy)(), { afterPhase: "Deserialize" });
-      pipeline.addPolicy((0, defaultRetryPolicy_js_1.defaultRetryPolicy)(options.retryOptions), { phase: "Retry" });
-      pipeline.addPolicy((0, tracingPolicy_js_1.tracingPolicy)({ ...options.userAgentOptions, ...options.loggingOptions }), {
+          pipeline2.addPolicy((0, tlsPolicy_js_1.tlsPolicy)(options.tlsOptions));
+        }
+        pipeline2.addPolicy((0, proxyPolicy_js_1.proxyPolicy)(options.proxyOptions));
+        pipeline2.addPolicy((0, decompressResponsePolicy_js_1.decompressResponsePolicy)());
+      }
+      pipeline2.addPolicy((0, wrapAbortSignalLikePolicy_js_1.wrapAbortSignalLikePolicy)());
+      pipeline2.addPolicy((0, formDataPolicy_js_1.formDataPolicy)(), { beforePolicies: [multipartPolicy_js_1.multipartPolicyName] });
+      pipeline2.addPolicy((0, userAgentPolicy_js_1.userAgentPolicy)(options.userAgentOptions));
+      pipeline2.addPolicy((0, setClientRequestIdPolicy_js_1.setClientRequestIdPolicy)(options.telemetryOptions?.clientRequestIdHeaderName));
+      pipeline2.addPolicy((0, multipartPolicy_js_1.multipartPolicy)(), { afterPhase: "Deserialize" });
+      pipeline2.addPolicy((0, defaultRetryPolicy_js_1.defaultRetryPolicy)(options.retryOptions), { phase: "Retry" });
+      pipeline2.addPolicy((0, tracingPolicy_js_1.tracingPolicy)({ ...options.userAgentOptions, ...options.loggingOptions }), {
         afterPhase: "Retry"
       });
       if (core_util_1.isNodeLike) {
-        pipeline.addPolicy((0, redirectPolicy_js_1.redirectPolicy)(options.redirectOptions), { afterPhase: "Retry" });
+        pipeline2.addPolicy((0, redirectPolicy_js_1.redirectPolicy)(options.redirectOptions), { afterPhase: "Retry" });
       }
-      pipeline.addPolicy((0, logPolicy_js_1.logPolicy)(options.loggingOptions), { afterPhase: "Sign" });
-      return pipeline;
+      pipeline2.addPolicy((0, logPolicy_js_1.logPolicy)(options.loggingOptions), { afterPhase: "Sign" });
+      return pipeline2;
     }
   }
 });
@@ -41473,8 +41635,8 @@ var require_disableKeepAlivePolicy = __commonJS({
         }
       };
     }
-    function pipelineContainsDisableKeepAlivePolicy(pipeline) {
-      return pipeline.getOrderedPolicies().some((policy) => policy.name === exports2.disableKeepAlivePolicyName);
+    function pipelineContainsDisableKeepAlivePolicy(pipeline2) {
+      return pipeline2.getOrderedPolicies().some((policy) => policy.name === exports2.disableKeepAlivePolicyName);
     }
   }
 });
@@ -41671,7 +41833,7 @@ var require_serializer = __commonJS({
        *
        * @returns A valid serialized Javascript object
        */
-      serialize(mapper, object, objectName, options = { xml: {} }) {
+      serialize(mapper, object2, objectName, options = { xml: {} }) {
         const updatedOptions = {
           xml: {
             rootName: options.xml.rootName ?? "",
@@ -41688,40 +41850,40 @@ var require_serializer = __commonJS({
           payload = [];
         }
         if (mapper.isConstant) {
-          object = mapper.defaultValue;
+          object2 = mapper.defaultValue;
         }
         const { required, nullable } = mapper;
-        if (required && nullable && object === void 0) {
+        if (required && nullable && object2 === void 0) {
           throw new Error(`${objectName} cannot be undefined.`);
         }
-        if (required && !nullable && (object === void 0 || object === null)) {
+        if (required && !nullable && (object2 === void 0 || object2 === null)) {
           throw new Error(`${objectName} cannot be null or undefined.`);
         }
-        if (!required && nullable === false && object === null) {
+        if (!required && nullable === false && object2 === null) {
           throw new Error(`${objectName} cannot be null.`);
         }
-        if (object === void 0 || object === null) {
-          payload = object;
+        if (object2 === void 0 || object2 === null) {
+          payload = object2;
         } else {
           if (mapperType.match(/^any$/i) !== null) {
-            payload = object;
+            payload = object2;
           } else if (mapperType.match(/^(Number|String|Boolean|Object|Stream|Uuid)$/i) !== null) {
-            payload = serializeBasicTypes(mapperType, objectName, object);
+            payload = serializeBasicTypes(mapperType, objectName, object2);
           } else if (mapperType.match(/^Enum$/i) !== null) {
             const enumMapper = mapper;
-            payload = serializeEnumType(objectName, enumMapper.type.allowedValues, object);
+            payload = serializeEnumType(objectName, enumMapper.type.allowedValues, object2);
           } else if (mapperType.match(/^(Date|DateTime|TimeSpan|DateTimeRfc1123|UnixTime)$/i) !== null) {
-            payload = serializeDateTypes(mapperType, object, objectName);
+            payload = serializeDateTypes(mapperType, object2, objectName);
           } else if (mapperType.match(/^ByteArray$/i) !== null) {
-            payload = serializeByteArrayType(objectName, object);
+            payload = serializeByteArrayType(objectName, object2);
           } else if (mapperType.match(/^Base64Url$/i) !== null) {
-            payload = serializeBase64UrlType(objectName, object);
+            payload = serializeBase64UrlType(objectName, object2);
           } else if (mapperType.match(/^Sequence$/i) !== null) {
-            payload = serializeSequenceType(this, mapper, object, objectName, Boolean(this.isXML), updatedOptions);
+            payload = serializeSequenceType(this, mapper, object2, objectName, Boolean(this.isXML), updatedOptions);
           } else if (mapperType.match(/^Dictionary$/i) !== null) {
-            payload = serializeDictionaryType(this, mapper, object, objectName, Boolean(this.isXML), updatedOptions);
+            payload = serializeDictionaryType(this, mapper, object2, objectName, Boolean(this.isXML), updatedOptions);
           } else if (mapperType.match(/^Composite$/i) !== null) {
-            payload = serializeCompositeType(this, mapper, object, objectName, Boolean(this.isXML), updatedOptions);
+            payload = serializeCompositeType(this, mapper, object2, objectName, Boolean(this.isXML), updatedOptions);
           }
         }
         return payload;
@@ -41961,8 +42123,8 @@ var require_serializer = __commonJS({
       }
       return value;
     }
-    function serializeSequenceType(serializer, mapper, object, objectName, isXml, options) {
-      if (!Array.isArray(object)) {
+    function serializeSequenceType(serializer, mapper, object2, objectName, isXml, options) {
+      if (!Array.isArray(object2)) {
         throw new Error(`${objectName} must be of type Array.`);
       }
       let elementType = mapper.type.element;
@@ -41973,8 +42135,8 @@ var require_serializer = __commonJS({
         elementType = serializer.modelMappers[elementType.type.className] ?? elementType;
       }
       const tempArray = [];
-      for (let i = 0; i < object.length; i++) {
-        const serializedValue = serializer.serialize(elementType, object[i], objectName, options);
+      for (let i = 0; i < object2.length; i++) {
+        const serializedValue = serializer.serialize(elementType, object2[i], objectName, options);
         if (isXml && elementType.xmlNamespace) {
           const xmlnsKey = elementType.xmlNamespacePrefix ? `xmlns:${elementType.xmlNamespacePrefix}` : "xmlns";
           if (elementType.type.name === "Composite") {
@@ -41991,8 +42153,8 @@ var require_serializer = __commonJS({
       }
       return tempArray;
     }
-    function serializeDictionaryType(serializer, mapper, object, objectName, isXml, options) {
-      if (typeof object !== "object") {
+    function serializeDictionaryType(serializer, mapper, object2, objectName, isXml, options) {
+      if (typeof object2 !== "object") {
         throw new Error(`${objectName} must be of type object.`);
       }
       const valueType = mapper.type.value;
@@ -42000,8 +42162,8 @@ var require_serializer = __commonJS({
         throw new Error(`"value" metadata for a Dictionary must be defined in the mapper and it must of type "object" in ${objectName}.`);
       }
       const tempDictionary = {};
-      for (const key of Object.keys(object)) {
-        const serializedValue = serializer.serialize(valueType, object[key], objectName, options);
+      for (const key of Object.keys(object2)) {
+        const serializedValue = serializer.serialize(valueType, object2[key], objectName, options);
         tempDictionary[key] = getXmlObjectValue(valueType, serializedValue, isXml, options);
       }
       if (isXml && mapper.xmlNamespace) {
@@ -42041,11 +42203,11 @@ var require_serializer = __commonJS({
       }
       return modelProps;
     }
-    function serializeCompositeType(serializer, mapper, object, objectName, isXml, options) {
+    function serializeCompositeType(serializer, mapper, object2, objectName, isXml, options) {
       if (getPolymorphicDiscriminatorRecursively(serializer, mapper)) {
-        mapper = getPolymorphicMapper(serializer, mapper, object, "clientName");
+        mapper = getPolymorphicMapper(serializer, mapper, object2, "clientName");
       }
-      if (object !== void 0 && object !== null) {
+      if (object2 !== void 0 && object2 !== null) {
         const payload = {};
         const modelProps = resolveModelProperties(serializer, mapper, objectName);
         for (const key of Object.keys(modelProps)) {
@@ -42066,7 +42228,7 @@ var require_serializer = __commonJS({
             propName = paths.pop();
             for (const pathName of paths) {
               const childObject = parentObject[pathName];
-              if ((childObject === void 0 || childObject === null) && (object[key] !== void 0 && object[key] !== null || propertyMapper.defaultValue !== void 0)) {
+              if ((childObject === void 0 || childObject === null) && (object2[key] !== void 0 && object2[key] !== null || propertyMapper.defaultValue !== void 0)) {
                 parentObject[pathName] = {};
               }
               parentObject = parentObject[pathName];
@@ -42081,7 +42243,7 @@ var require_serializer = __commonJS({
               };
             }
             const propertyObjectName = propertyMapper.serializedName !== "" ? objectName + "." + propertyMapper.serializedName : objectName;
-            let toSerialize = object[key];
+            let toSerialize = object2[key];
             const polymorphicDiscriminator = getPolymorphicDiscriminatorRecursively(serializer, mapper);
             if (polymorphicDiscriminator && polymorphicDiscriminator.clientName === key && (toSerialize === void 0 || toSerialize === null)) {
               toSerialize = mapper.serializedName;
@@ -42103,16 +42265,16 @@ var require_serializer = __commonJS({
         const additionalPropertiesMapper = resolveAdditionalProperties(serializer, mapper, objectName);
         if (additionalPropertiesMapper) {
           const propNames = Object.keys(modelProps);
-          for (const clientPropName in object) {
+          for (const clientPropName in object2) {
             const isAdditionalProperty = propNames.every((pn) => pn !== clientPropName);
             if (isAdditionalProperty) {
-              payload[clientPropName] = serializer.serialize(additionalPropertiesMapper, object[clientPropName], objectName + '["' + clientPropName + '"]', options);
+              payload[clientPropName] = serializer.serialize(additionalPropertiesMapper, object2[clientPropName], objectName + '["' + clientPropName + '"]', options);
             }
           }
         }
         return payload;
       }
-      return object;
+      return object2;
     }
     function getXmlObjectValue(propertyMapper, serializedValue, isXml, options) {
       if (!isXml || !propertyMapper.xmlNamespace) {
@@ -42296,7 +42458,7 @@ var require_serializer = __commonJS({
       }
       return void 0;
     }
-    function getPolymorphicMapper(serializer, mapper, object, polymorphicPropertyName) {
+    function getPolymorphicMapper(serializer, mapper, object2, polymorphicPropertyName) {
       const polymorphicDiscriminator = getPolymorphicDiscriminatorRecursively(serializer, mapper);
       if (polymorphicDiscriminator) {
         let discriminatorName = polymorphicDiscriminator[polymorphicPropertyName];
@@ -42304,7 +42466,7 @@ var require_serializer = __commonJS({
           if (polymorphicPropertyName === "serializedName") {
             discriminatorName = discriminatorName.replace(/\\/gi, "");
           }
-          const discriminatorValue = object[discriminatorName];
+          const discriminatorValue = object2[discriminatorName];
           const typeName = mapper.type.uberParent ?? mapper.type.className;
           if (typeof discriminatorValue === "string" && typeName) {
             const polymorphicMapper = getIndexDiscriminator(serializer.modelMappers.discriminators, discriminatorValue, typeName);
@@ -42813,18 +42975,18 @@ var require_pipeline3 = __commonJS({
     var core_rest_pipeline_1 = require_commonjs6();
     var serializationPolicy_js_1 = require_serializationPolicy();
     function createClientPipeline(options = {}) {
-      const pipeline = (0, core_rest_pipeline_1.createPipelineFromOptions)(options ?? {});
+      const pipeline2 = (0, core_rest_pipeline_1.createPipelineFromOptions)(options ?? {});
       if (options.credentialOptions) {
-        pipeline.addPolicy((0, core_rest_pipeline_1.bearerTokenAuthenticationPolicy)({
+        pipeline2.addPolicy((0, core_rest_pipeline_1.bearerTokenAuthenticationPolicy)({
           credential: options.credentialOptions.credential,
           scopes: options.credentialOptions.credentialScopes
         }));
       }
-      pipeline.addPolicy((0, serializationPolicy_js_1.serializationPolicy)(options.serializationOptions), { phase: "Serialize" });
-      pipeline.addPolicy((0, deserializationPolicy_js_1.deserializationPolicy)(options.deserializationOptions), {
+      pipeline2.addPolicy((0, serializationPolicy_js_1.serializationPolicy)(options.serializationOptions), { phase: "Serialize" });
+      pipeline2.addPolicy((0, deserializationPolicy_js_1.deserializationPolicy)(options.deserializationOptions), {
         phase: "Deserialize"
       });
-      return pipeline;
+      return pipeline2;
     }
   }
 });
@@ -47137,8 +47299,8 @@ var require_StorageSharedKeyCredentialPolicy = __commonJS({
         headersArray.sort((a, b) => {
           return (0, SharedKeyComparator_js_1.compareHeader)(a.name.toLowerCase(), b.name.toLowerCase());
         });
-        headersArray = headersArray.filter((value, index2, array) => {
-          if (index2 > 0 && value.name.toLowerCase() === array[index2 - 1].name.toLowerCase()) {
+        headersArray = headersArray.filter((value, index2, array2) => {
+          if (index2 > 0 && value.name.toLowerCase() === array2[index2 - 1].name.toLowerCase()) {
             return false;
           }
           return true;
@@ -48889,8 +49051,8 @@ var require_StorageSharedKeyCredentialPolicy2 = __commonJS({
         headersArray.sort((a, b) => {
           return (0, SharedKeyComparator_js_1.compareHeader)(a.name.toLowerCase(), b.name.toLowerCase());
         });
-        headersArray = headersArray.filter((value, index2, array) => {
-          if (index2 > 0 && value.name.toLowerCase() === array[index2 - 1].name.toLowerCase()) {
+        headersArray = headersArray.filter((value, index2, array2) => {
+          if (index2 > 0 && value.name.toLowerCase() === array2[index2 - 1].name.toLowerCase()) {
             return false;
           }
           return true;
@@ -49526,8 +49688,8 @@ var require_StorageSharedKeyCredentialPolicyV2 = __commonJS({
         headersArray.sort((a, b) => {
           return (0, SharedKeyComparator_js_1.compareHeader)(a.name.toLowerCase(), b.name.toLowerCase());
         });
-        headersArray = headersArray.filter((value, index2, array) => {
-          if (index2 > 0 && value.name.toLowerCase() === array[index2 - 1].name.toLowerCase()) {
+        headersArray = headersArray.filter((value, index2, array2) => {
+          if (index2 > 0 && value.name.toLowerCase() === array2[index2 - 1].name.toLowerCase()) {
             return false;
           }
           return true;
@@ -49873,8 +50035,8 @@ var require_StorageSharedKeyCredentialPolicyV22 = __commonJS({
         headersArray.sort((a, b) => {
           return (0, SharedKeyComparator_js_1.compareHeader)(a.name.toLowerCase(), b.name.toLowerCase());
         });
-        headersArray = headersArray.filter((value, index2, array) => {
-          if (index2 > 0 && value.name.toLowerCase() === array[index2 - 1].name.toLowerCase()) {
+        headersArray = headersArray.filter((value, index2, array2) => {
+          if (index2 > 0 && value.name.toLowerCase() === array2[index2 - 1].name.toLowerCase()) {
             return false;
           }
           return true;
@@ -50042,11 +50204,11 @@ var require_Pipeline = __commonJS({
     var StorageSharedKeyCredentialPolicyV2_js_1 = require_StorageSharedKeyCredentialPolicyV22();
     var StorageBrowserPolicyFactory_js_1 = require_StorageBrowserPolicyFactory2();
     var StorageCorrectContentLengthPolicy_js_1 = require_StorageCorrectContentLengthPolicy2();
-    function isPipelineLike(pipeline) {
-      if (!pipeline || typeof pipeline !== "object") {
+    function isPipelineLike(pipeline2) {
+      if (!pipeline2 || typeof pipeline2 !== "object") {
         return false;
       }
-      const castPipeline = pipeline;
+      const castPipeline = pipeline2;
       return Array.isArray(castPipeline.factories) && typeof castPipeline.options === "object" && typeof castPipeline.toServiceClientOptions === "function";
     }
     var Pipeline = class {
@@ -50086,11 +50248,11 @@ var require_Pipeline = __commonJS({
       if (!credential) {
         credential = new AnonymousCredential_js_1.AnonymousCredential();
       }
-      const pipeline = new Pipeline([], pipelineOptions);
-      pipeline._credential = credential;
-      return pipeline;
+      const pipeline2 = new Pipeline([], pipelineOptions);
+      pipeline2._credential = credential;
+      return pipeline2;
     }
-    function processDownlevelPipeline(pipeline) {
+    function processDownlevelPipeline(pipeline2) {
       const knownFactoryFunctions = [
         isAnonymousCredential,
         isStorageSharedKeyCredential,
@@ -50100,8 +50262,8 @@ var require_Pipeline = __commonJS({
         isStorageTelemetryPolicyFactory,
         isCoreHttpPolicyFactory
       ];
-      if (pipeline.factories.length) {
-        const novelFactories = pipeline.factories.filter((factory) => {
+      if (pipeline2.factories.length) {
+        const novelFactories = pipeline2.factories.filter((factory) => {
           return !knownFactoryFunctions.some((knownFactory) => knownFactory(factory));
         });
         if (novelFactories.length) {
@@ -50114,14 +50276,14 @@ var require_Pipeline = __commonJS({
       }
       return void 0;
     }
-    function getCoreClientOptions(pipeline) {
-      const { httpClient: v1Client, ...restOptions } = pipeline.options;
-      let httpClient = pipeline._coreHttpClient;
+    function getCoreClientOptions(pipeline2) {
+      const { httpClient: v1Client, ...restOptions } = pipeline2.options;
+      let httpClient = pipeline2._coreHttpClient;
       if (!httpClient) {
         httpClient = v1Client ? (0, core_http_compat_1.convertHttpClient)(v1Client) : (0, storage_common_1.getCachedDefaultHttpClient)();
-        pipeline._coreHttpClient = httpClient;
+        pipeline2._coreHttpClient = httpClient;
       }
-      let corePipeline = pipeline._corePipeline;
+      let corePipeline = pipeline2._corePipeline;
       if (!corePipeline) {
         const packageDetails = `azsdk-js-azure-storage-blob/${constants_js_1.SDK_VERSION}`;
         const userAgentPrefix = restOptions.userAgentOptions && restOptions.userAgentOptions.userAgentPrefix ? `${restOptions.userAgentOptions.userAgentPrefix} ${packageDetails}` : `${packageDetails}`;
@@ -50162,11 +50324,11 @@ var require_Pipeline = __commonJS({
         corePipeline.addPolicy((0, StorageRetryPolicyV2_js_1.storageRetryPolicy)(restOptions.retryOptions), { phase: "Retry" });
         corePipeline.addPolicy((0, storage_common_1.storageRequestFailureDetailsParserPolicy)());
         corePipeline.addPolicy((0, StorageBrowserPolicyV2_js_1.storageBrowserPolicy)());
-        const downlevelResults = processDownlevelPipeline(pipeline);
+        const downlevelResults = processDownlevelPipeline(pipeline2);
         if (downlevelResults) {
           corePipeline.addPolicy(downlevelResults.wrappedPolicies, downlevelResults.afterRetry ? { afterPhase: "Retry" } : void 0);
         }
-        const credential = getCredentialFromPipeline(pipeline);
+        const credential = getCredentialFromPipeline(pipeline2);
         if ((0, core_auth_1.isTokenCredential)(credential)) {
           corePipeline.addPolicy((0, core_rest_pipeline_1.bearerTokenAuthenticationPolicy)({
             credential,
@@ -50179,7 +50341,7 @@ var require_Pipeline = __commonJS({
             accountKey: credential.accountKey
           }), { phase: "Sign" });
         }
-        pipeline._corePipeline = corePipeline;
+        pipeline2._corePipeline = corePipeline;
       }
       return {
         ...restOptions,
@@ -50188,12 +50350,12 @@ var require_Pipeline = __commonJS({
         pipeline: corePipeline
       };
     }
-    function getCredentialFromPipeline(pipeline) {
-      if (pipeline._credential) {
-        return pipeline._credential;
+    function getCredentialFromPipeline(pipeline2) {
+      if (pipeline2._credential) {
+        return pipeline2._credential;
       }
       let credential = new AnonymousCredential_js_1.AnonymousCredential();
-      for (const factory of pipeline.factories) {
+      for (const factory of pipeline2.factories) {
         if ((0, core_auth_1.isTokenCredential)(factory.credential)) {
           credential = factory.credential;
         } else if (isStorageSharedKeyCredential(factory)) {
@@ -63547,13 +63709,13 @@ var require_storageClient = __commonJS({
         if (!options) {
           options = {};
         }
-        const defaults2 = {
+        const defaults3 = {
           requestContentType: "application/json; charset=utf-8"
         };
         const packageDetails = `azsdk-js-azure-storage-blob/12.29.1`;
         const userAgentPrefix = options.userAgentOptions && options.userAgentOptions.userAgentPrefix ? `${options.userAgentOptions.userAgentPrefix} ${packageDetails}` : `${packageDetails}`;
         const optionsWithDefaults = {
-          ...defaults2,
+          ...defaults3,
           ...options,
           userAgentOptions: {
             userAgentPrefix
@@ -63718,13 +63880,13 @@ var require_StorageClient = __commonJS({
        * @param url - url to resource
        * @param pipeline - request policy pipeline.
        */
-      constructor(url2, pipeline) {
+      constructor(url2, pipeline2) {
         this.url = (0, utils_common_js_1.escapeURLPath)(url2);
         this.accountName = (0, utils_common_js_1.getAccountNameFromUrl)(url2);
-        this.pipeline = pipeline;
-        this.storageClientContext = new StorageContextClient_js_1.StorageContextClient(this.url, (0, Pipeline_js_1.getCoreClientOptions)(pipeline));
+        this.pipeline = pipeline2;
+        this.storageClientContext = new StorageContextClient_js_1.StorageContextClient(this.url, (0, Pipeline_js_1.getCoreClientOptions)(pipeline2));
         this.isHttps = (0, utils_common_js_1.iEqual)((0, utils_common_js_1.getURLScheme)(this.url) || "", "https");
-        this.credential = (0, Pipeline_js_1.getCredentialFromPipeline)(pipeline);
+        this.credential = (0, Pipeline_js_1.getCredentialFromPipeline)(pipeline2);
         const storageClientContext = this.storageClientContext;
         storageClientContext.requestContentType = void 0;
       }
@@ -68507,21 +68669,21 @@ var require_Clients = __commonJS({
       }
       constructor(urlOrConnectionString, credentialOrPipelineOrContainerName, blobNameOrOptions, options) {
         options = options || {};
-        let pipeline;
+        let pipeline2;
         let url2;
         if ((0, Pipeline_js_1.isPipelineLike)(credentialOrPipelineOrContainerName)) {
           url2 = urlOrConnectionString;
-          pipeline = credentialOrPipelineOrContainerName;
+          pipeline2 = credentialOrPipelineOrContainerName;
         } else if (core_util_1.isNodeLike && credentialOrPipelineOrContainerName instanceof StorageSharedKeyCredential_js_1.StorageSharedKeyCredential || credentialOrPipelineOrContainerName instanceof AnonymousCredential_js_1.AnonymousCredential || (0, core_auth_1.isTokenCredential)(credentialOrPipelineOrContainerName)) {
           url2 = urlOrConnectionString;
           options = blobNameOrOptions;
-          pipeline = (0, Pipeline_js_1.newPipeline)(credentialOrPipelineOrContainerName, options);
+          pipeline2 = (0, Pipeline_js_1.newPipeline)(credentialOrPipelineOrContainerName, options);
         } else if (!credentialOrPipelineOrContainerName && typeof credentialOrPipelineOrContainerName !== "string") {
           url2 = urlOrConnectionString;
           if (blobNameOrOptions && typeof blobNameOrOptions !== "string") {
             options = blobNameOrOptions;
           }
-          pipeline = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options);
+          pipeline2 = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options);
         } else if (credentialOrPipelineOrContainerName && typeof credentialOrPipelineOrContainerName === "string" && blobNameOrOptions && typeof blobNameOrOptions === "string") {
           const containerName = credentialOrPipelineOrContainerName;
           const blobName = blobNameOrOptions;
@@ -68533,20 +68695,20 @@ var require_Clients = __commonJS({
               if (!options.proxyOptions) {
                 options.proxyOptions = (0, core_rest_pipeline_1.getDefaultProxySettings)(extractedCreds.proxyUri);
               }
-              pipeline = (0, Pipeline_js_1.newPipeline)(sharedKeyCredential, options);
+              pipeline2 = (0, Pipeline_js_1.newPipeline)(sharedKeyCredential, options);
             } else {
               throw new Error("Account connection string is only supported in Node.js environment");
             }
           } else if (extractedCreds.kind === "SASConnString") {
             url2 = (0, utils_common_js_1.appendToURLPath)((0, utils_common_js_1.appendToURLPath)(extractedCreds.url, encodeURIComponent(containerName)), encodeURIComponent(blobName)) + "?" + extractedCreds.accountSas;
-            pipeline = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options);
+            pipeline2 = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options);
           } else {
             throw new Error("Connection string must be either an Account connection string or a SAS connection string");
           }
         } else {
           throw new Error("Expecting non-empty strings for containerName and blobName parameters");
         }
-        super(url2, pipeline);
+        super(url2, pipeline2);
         ({ blobName: this._name, containerName: this._containerName } = this.getBlobAndContainerNamesFromUrl());
         this.blobContext = this.storageClientContext.blob;
         this._snapshot = (0, utils_common_js_1.getURLParameter)(this.url, constants_js_1.URLConstants.Parameters.SNAPSHOT);
@@ -69532,19 +69694,19 @@ var require_Clients = __commonJS({
        */
       appendBlobContext;
       constructor(urlOrConnectionString, credentialOrPipelineOrContainerName, blobNameOrOptions, options) {
-        let pipeline;
+        let pipeline2;
         let url2;
         options = options || {};
         if ((0, Pipeline_js_1.isPipelineLike)(credentialOrPipelineOrContainerName)) {
           url2 = urlOrConnectionString;
-          pipeline = credentialOrPipelineOrContainerName;
+          pipeline2 = credentialOrPipelineOrContainerName;
         } else if (core_util_1.isNodeLike && credentialOrPipelineOrContainerName instanceof StorageSharedKeyCredential_js_1.StorageSharedKeyCredential || credentialOrPipelineOrContainerName instanceof AnonymousCredential_js_1.AnonymousCredential || (0, core_auth_1.isTokenCredential)(credentialOrPipelineOrContainerName)) {
           url2 = urlOrConnectionString;
           options = blobNameOrOptions;
-          pipeline = (0, Pipeline_js_1.newPipeline)(credentialOrPipelineOrContainerName, options);
+          pipeline2 = (0, Pipeline_js_1.newPipeline)(credentialOrPipelineOrContainerName, options);
         } else if (!credentialOrPipelineOrContainerName && typeof credentialOrPipelineOrContainerName !== "string") {
           url2 = urlOrConnectionString;
-          pipeline = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options);
+          pipeline2 = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options);
         } else if (credentialOrPipelineOrContainerName && typeof credentialOrPipelineOrContainerName === "string" && blobNameOrOptions && typeof blobNameOrOptions === "string") {
           const containerName = credentialOrPipelineOrContainerName;
           const blobName = blobNameOrOptions;
@@ -69556,20 +69718,20 @@ var require_Clients = __commonJS({
               if (!options.proxyOptions) {
                 options.proxyOptions = (0, core_rest_pipeline_1.getDefaultProxySettings)(extractedCreds.proxyUri);
               }
-              pipeline = (0, Pipeline_js_1.newPipeline)(sharedKeyCredential, options);
+              pipeline2 = (0, Pipeline_js_1.newPipeline)(sharedKeyCredential, options);
             } else {
               throw new Error("Account connection string is only supported in Node.js environment");
             }
           } else if (extractedCreds.kind === "SASConnString") {
             url2 = (0, utils_common_js_1.appendToURLPath)((0, utils_common_js_1.appendToURLPath)(extractedCreds.url, encodeURIComponent(containerName)), encodeURIComponent(blobName)) + "?" + extractedCreds.accountSas;
-            pipeline = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options);
+            pipeline2 = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options);
           } else {
             throw new Error("Connection string must be either an Account connection string or a SAS connection string");
           }
         } else {
           throw new Error("Expecting non-empty strings for containerName and blobName parameters");
         }
-        super(url2, pipeline);
+        super(url2, pipeline2);
         this.appendBlobContext = this.storageClientContext.appendBlob;
       }
       /**
@@ -69805,22 +69967,22 @@ var require_Clients = __commonJS({
        */
       blockBlobContext;
       constructor(urlOrConnectionString, credentialOrPipelineOrContainerName, blobNameOrOptions, options) {
-        let pipeline;
+        let pipeline2;
         let url2;
         options = options || {};
         if ((0, Pipeline_js_1.isPipelineLike)(credentialOrPipelineOrContainerName)) {
           url2 = urlOrConnectionString;
-          pipeline = credentialOrPipelineOrContainerName;
+          pipeline2 = credentialOrPipelineOrContainerName;
         } else if (core_util_1.isNodeLike && credentialOrPipelineOrContainerName instanceof StorageSharedKeyCredential_js_1.StorageSharedKeyCredential || credentialOrPipelineOrContainerName instanceof AnonymousCredential_js_1.AnonymousCredential || (0, core_auth_1.isTokenCredential)(credentialOrPipelineOrContainerName)) {
           url2 = urlOrConnectionString;
           options = blobNameOrOptions;
-          pipeline = (0, Pipeline_js_1.newPipeline)(credentialOrPipelineOrContainerName, options);
+          pipeline2 = (0, Pipeline_js_1.newPipeline)(credentialOrPipelineOrContainerName, options);
         } else if (!credentialOrPipelineOrContainerName && typeof credentialOrPipelineOrContainerName !== "string") {
           url2 = urlOrConnectionString;
           if (blobNameOrOptions && typeof blobNameOrOptions !== "string") {
             options = blobNameOrOptions;
           }
-          pipeline = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options);
+          pipeline2 = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options);
         } else if (credentialOrPipelineOrContainerName && typeof credentialOrPipelineOrContainerName === "string" && blobNameOrOptions && typeof blobNameOrOptions === "string") {
           const containerName = credentialOrPipelineOrContainerName;
           const blobName = blobNameOrOptions;
@@ -69832,20 +69994,20 @@ var require_Clients = __commonJS({
               if (!options.proxyOptions) {
                 options.proxyOptions = (0, core_rest_pipeline_1.getDefaultProxySettings)(extractedCreds.proxyUri);
               }
-              pipeline = (0, Pipeline_js_1.newPipeline)(sharedKeyCredential, options);
+              pipeline2 = (0, Pipeline_js_1.newPipeline)(sharedKeyCredential, options);
             } else {
               throw new Error("Account connection string is only supported in Node.js environment");
             }
           } else if (extractedCreds.kind === "SASConnString") {
             url2 = (0, utils_common_js_1.appendToURLPath)((0, utils_common_js_1.appendToURLPath)(extractedCreds.url, encodeURIComponent(containerName)), encodeURIComponent(blobName)) + "?" + extractedCreds.accountSas;
-            pipeline = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options);
+            pipeline2 = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options);
           } else {
             throw new Error("Connection string must be either an Account connection string or a SAS connection string");
           }
         } else {
           throw new Error("Expecting non-empty strings for containerName and blobName parameters");
         }
-        super(url2, pipeline);
+        super(url2, pipeline2);
         this.blockBlobContext = this.storageClientContext.blockBlob;
         this._blobContext = this.storageClientContext.blob;
       }
@@ -70417,19 +70579,19 @@ var require_Clients = __commonJS({
        */
       pageBlobContext;
       constructor(urlOrConnectionString, credentialOrPipelineOrContainerName, blobNameOrOptions, options) {
-        let pipeline;
+        let pipeline2;
         let url2;
         options = options || {};
         if ((0, Pipeline_js_1.isPipelineLike)(credentialOrPipelineOrContainerName)) {
           url2 = urlOrConnectionString;
-          pipeline = credentialOrPipelineOrContainerName;
+          pipeline2 = credentialOrPipelineOrContainerName;
         } else if (core_util_1.isNodeLike && credentialOrPipelineOrContainerName instanceof StorageSharedKeyCredential_js_1.StorageSharedKeyCredential || credentialOrPipelineOrContainerName instanceof AnonymousCredential_js_1.AnonymousCredential || (0, core_auth_1.isTokenCredential)(credentialOrPipelineOrContainerName)) {
           url2 = urlOrConnectionString;
           options = blobNameOrOptions;
-          pipeline = (0, Pipeline_js_1.newPipeline)(credentialOrPipelineOrContainerName, options);
+          pipeline2 = (0, Pipeline_js_1.newPipeline)(credentialOrPipelineOrContainerName, options);
         } else if (!credentialOrPipelineOrContainerName && typeof credentialOrPipelineOrContainerName !== "string") {
           url2 = urlOrConnectionString;
-          pipeline = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options);
+          pipeline2 = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options);
         } else if (credentialOrPipelineOrContainerName && typeof credentialOrPipelineOrContainerName === "string" && blobNameOrOptions && typeof blobNameOrOptions === "string") {
           const containerName = credentialOrPipelineOrContainerName;
           const blobName = blobNameOrOptions;
@@ -70441,20 +70603,20 @@ var require_Clients = __commonJS({
               if (!options.proxyOptions) {
                 options.proxyOptions = (0, core_rest_pipeline_1.getDefaultProxySettings)(extractedCreds.proxyUri);
               }
-              pipeline = (0, Pipeline_js_1.newPipeline)(sharedKeyCredential, options);
+              pipeline2 = (0, Pipeline_js_1.newPipeline)(sharedKeyCredential, options);
             } else {
               throw new Error("Account connection string is only supported in Node.js environment");
             }
           } else if (extractedCreds.kind === "SASConnString") {
             url2 = (0, utils_common_js_1.appendToURLPath)((0, utils_common_js_1.appendToURLPath)(extractedCreds.url, encodeURIComponent(containerName)), encodeURIComponent(blobName)) + "?" + extractedCreds.accountSas;
-            pipeline = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options);
+            pipeline2 = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options);
           } else {
             throw new Error("Connection string must be either an Account connection string or a SAS connection string");
           }
         } else {
           throw new Error("Expecting non-empty strings for containerName and blobName parameters");
         }
-        super(url2, pipeline);
+        super(url2, pipeline2);
         this.pageBlobContext = this.storageClientContext.pageBlob;
       }
       /**
@@ -71519,10 +71681,10 @@ var require_BlobBatch = __commonJS({
             accountKey: credential.accountKey
           }), { phase: "Sign" });
         }
-        const pipeline = new Pipeline_js_1.Pipeline([]);
-        pipeline._credential = credential;
-        pipeline._corePipeline = corePipeline;
-        return pipeline;
+        const pipeline2 = new Pipeline_js_1.Pipeline([]);
+        pipeline2._credential = credential;
+        pipeline2._corePipeline = corePipeline;
+        return pipeline2;
       }
       appendSubRequestToBody(request3) {
         this.body += [
@@ -71614,15 +71776,15 @@ var require_BlobBatchClient = __commonJS({
     var BlobBatchClient = class {
       serviceOrContainerContext;
       constructor(url2, credentialOrPipeline, options) {
-        let pipeline;
+        let pipeline2;
         if ((0, Pipeline_js_1.isPipelineLike)(credentialOrPipeline)) {
-          pipeline = credentialOrPipeline;
+          pipeline2 = credentialOrPipeline;
         } else if (!credentialOrPipeline) {
-          pipeline = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options);
+          pipeline2 = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options);
         } else {
-          pipeline = (0, Pipeline_js_1.newPipeline)(credentialOrPipeline, options);
+          pipeline2 = (0, Pipeline_js_1.newPipeline)(credentialOrPipeline, options);
         }
-        const storageClientContext = new StorageContextClient_js_1.StorageContextClient(url2, (0, Pipeline_js_1.getCoreClientOptions)(pipeline));
+        const storageClientContext = new StorageContextClient_js_1.StorageContextClient(url2, (0, Pipeline_js_1.getCoreClientOptions)(pipeline2));
         const path29 = (0, utils_common_js_1.getURLPath)(url2);
         if (path29 && path29 !== "/") {
           this.serviceOrContainerContext = storageClientContext.container;
@@ -71785,18 +71947,18 @@ var require_ContainerClient = __commonJS({
         return this._containerName;
       }
       constructor(urlOrConnectionString, credentialOrPipelineOrContainerName, options) {
-        let pipeline;
+        let pipeline2;
         let url2;
         options = options || {};
         if ((0, Pipeline_js_1.isPipelineLike)(credentialOrPipelineOrContainerName)) {
           url2 = urlOrConnectionString;
-          pipeline = credentialOrPipelineOrContainerName;
+          pipeline2 = credentialOrPipelineOrContainerName;
         } else if (core_util_1.isNodeLike && credentialOrPipelineOrContainerName instanceof StorageSharedKeyCredential_js_1.StorageSharedKeyCredential || credentialOrPipelineOrContainerName instanceof AnonymousCredential_js_1.AnonymousCredential || (0, core_auth_1.isTokenCredential)(credentialOrPipelineOrContainerName)) {
           url2 = urlOrConnectionString;
-          pipeline = (0, Pipeline_js_1.newPipeline)(credentialOrPipelineOrContainerName, options);
+          pipeline2 = (0, Pipeline_js_1.newPipeline)(credentialOrPipelineOrContainerName, options);
         } else if (!credentialOrPipelineOrContainerName && typeof credentialOrPipelineOrContainerName !== "string") {
           url2 = urlOrConnectionString;
-          pipeline = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options);
+          pipeline2 = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options);
         } else if (credentialOrPipelineOrContainerName && typeof credentialOrPipelineOrContainerName === "string") {
           const containerName = credentialOrPipelineOrContainerName;
           const extractedCreds = (0, utils_common_js_1.extractConnectionStringParts)(urlOrConnectionString);
@@ -71807,20 +71969,20 @@ var require_ContainerClient = __commonJS({
               if (!options.proxyOptions) {
                 options.proxyOptions = (0, core_rest_pipeline_1.getDefaultProxySettings)(extractedCreds.proxyUri);
               }
-              pipeline = (0, Pipeline_js_1.newPipeline)(sharedKeyCredential, options);
+              pipeline2 = (0, Pipeline_js_1.newPipeline)(sharedKeyCredential, options);
             } else {
               throw new Error("Account connection string is only supported in Node.js environment");
             }
           } else if (extractedCreds.kind === "SASConnString") {
             url2 = (0, utils_common_js_1.appendToURLPath)(extractedCreds.url, encodeURIComponent(containerName)) + "?" + extractedCreds.accountSas;
-            pipeline = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options);
+            pipeline2 = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options);
           } else {
             throw new Error("Connection string must be either an Account connection string or a SAS connection string");
           }
         } else {
           throw new Error("Expecting non-empty strings for containerName parameter");
         }
-        super(url2, pipeline);
+        super(url2, pipeline2);
         this._containerName = this.getContainerNameFromUrl();
         this.containerContext = this.storageClientContext.container;
       }
@@ -73498,28 +73660,28 @@ var require_BlobServiceClient = __commonJS({
             if (!options.proxyOptions) {
               options.proxyOptions = (0, core_rest_pipeline_1.getDefaultProxySettings)(extractedCreds.proxyUri);
             }
-            const pipeline = (0, Pipeline_js_1.newPipeline)(sharedKeyCredential, options);
-            return new _BlobServiceClient(extractedCreds.url, pipeline);
+            const pipeline2 = (0, Pipeline_js_1.newPipeline)(sharedKeyCredential, options);
+            return new _BlobServiceClient(extractedCreds.url, pipeline2);
           } else {
             throw new Error("Account connection string is only supported in Node.js environment");
           }
         } else if (extractedCreds.kind === "SASConnString") {
-          const pipeline = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options);
-          return new _BlobServiceClient(extractedCreds.url + "?" + extractedCreds.accountSas, pipeline);
+          const pipeline2 = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options);
+          return new _BlobServiceClient(extractedCreds.url + "?" + extractedCreds.accountSas, pipeline2);
         } else {
           throw new Error("Connection string must be either an Account connection string or a SAS connection string");
         }
       }
       constructor(url2, credentialOrPipeline, options) {
-        let pipeline;
+        let pipeline2;
         if ((0, Pipeline_js_1.isPipelineLike)(credentialOrPipeline)) {
-          pipeline = credentialOrPipeline;
+          pipeline2 = credentialOrPipeline;
         } else if (core_util_1.isNodeLike && credentialOrPipeline instanceof StorageSharedKeyCredential_js_1.StorageSharedKeyCredential || credentialOrPipeline instanceof AnonymousCredential_js_1.AnonymousCredential || (0, core_auth_1.isTokenCredential)(credentialOrPipeline)) {
-          pipeline = (0, Pipeline_js_1.newPipeline)(credentialOrPipeline, options);
+          pipeline2 = (0, Pipeline_js_1.newPipeline)(credentialOrPipeline, options);
         } else {
-          pipeline = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options);
+          pipeline2 = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options);
         }
-        super(url2, pipeline);
+        super(url2, pipeline2);
         this.serviceContext = this.storageClientContext.service;
       }
       /**
@@ -74920,8 +75082,8 @@ var require_downloadUtils = __commonJS({
     var abort_controller_1 = require_dist4();
     function pipeResponseToStream(response, output) {
       return __awaiter2(this, void 0, void 0, function* () {
-        const pipeline = util3.promisify(stream2.pipeline);
-        yield pipeline(response.message, output);
+        const pipeline2 = util3.promisify(stream2.pipeline);
+        yield pipeline2(response.message, output);
       });
     }
     var DownloadProgress = class {
@@ -75324,6 +75486,9 @@ var require_config = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.isGhes = isGhes;
     exports2.getCacheServiceVersion = getCacheServiceVersion;
+    exports2.getCacheMode = getCacheMode;
+    exports2.isCacheReadable = isCacheReadable;
+    exports2.isCacheWritable = isCacheWritable;
     exports2.getCacheServiceURL = getCacheServiceURL;
     function isGhes() {
       const ghUrl = new URL(process.env["GITHUB_SERVER_URL"] || "https://github.com");
@@ -75338,6 +75503,20 @@ var require_config = __commonJS({
         return "v1";
       return process.env["ACTIONS_CACHE_SERVICE_V2"] ? "v2" : "v1";
     }
+    var KNOWN_CACHE_MODES = ["none", "read", "write", "write-only"];
+    function getCacheMode() {
+      return (process.env["ACTIONS_CACHE_MODE"] || "").trim().toLowerCase();
+    }
+    function isCacheReadable(mode) {
+      if (!KNOWN_CACHE_MODES.includes(mode))
+        return true;
+      return mode === "read" || mode === "write";
+    }
+    function isCacheWritable(mode) {
+      if (!KNOWN_CACHE_MODES.includes(mode))
+        return true;
+      return mode === "write" || mode === "write-only";
+    }
     function getCacheServiceURL() {
       const version = getCacheServiceVersion();
       switch (version) {
@@ -75357,7 +75536,7 @@ var require_package = __commonJS({
   "node_modules/@actions/cache/package.json"(exports2, module2) {
     module2.exports = {
       name: "@actions/cache",
-      version: "5.1.0",
+      version: "5.2.0",
       preview: true,
       description: "Actions cache lib",
       keywords: [
@@ -75516,6 +75695,7 @@ var require_cacheHttpClient = __commonJS({
     var options_1 = require_options();
     var requestUtils_1 = require_requestUtils();
     var config_1 = require_config();
+    var constants_1 = require_constants7();
     var user_agent_1 = require_user_agent();
     function getCacheApiUrl(resource) {
       const baseUrl = (0, config_1.getCacheServiceURL)();
@@ -75544,6 +75724,7 @@ var require_cacheHttpClient = __commonJS({
     }
     function getCacheEntry(keys, paths, options) {
       return __awaiter2(this, void 0, void 0, function* () {
+        var _a2;
         const httpClient = createHttpClient();
         const version = utils.getCacheVersion(paths, options === null || options === void 0 ? void 0 : options.compressionMethod, options === null || options === void 0 ? void 0 : options.enableCrossOsArchive);
         const resource = `cache?keys=${encodeURIComponent(keys.join(","))}&version=${version}`;
@@ -75557,6 +75738,10 @@ var require_cacheHttpClient = __commonJS({
           return null;
         }
         if (!(0, requestUtils_1.isSuccessStatusCode)(response.statusCode)) {
+          const errorMessage = (_a2 = response.error) === null || _a2 === void 0 ? void 0 : _a2.message;
+          if (errorMessage === null || errorMessage === void 0 ? void 0 : errorMessage.includes(constants_1.CacheReadDeniedMessagePrefix)) {
+            throw new Error(errorMessage);
+          }
           throw new Error(`Cache service responded with ${response.statusCode}`);
         }
         const cacheResult = response.result;
@@ -78575,9 +78760,9 @@ var require_enum_object = __commonJS({
       if (!isEnumObject(enumObject))
         throw new Error("not a typescript enum object");
       let values = [];
-      for (let [name, number] of Object.entries(enumObject))
-        if (typeof number == "number")
-          values.push({ name, number });
+      for (let [name, number2] of Object.entries(enumObject))
+        if (typeof number2 == "number")
+          values.push({ name, number: number2 });
       return values;
     }
     exports2.listEnumValues = listEnumValues;
@@ -78894,28 +79079,28 @@ var require_rpc_options = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.mergeRpcOptions = void 0;
     var runtime_1 = require_commonjs16();
-    function mergeRpcOptions(defaults2, options) {
+    function mergeRpcOptions(defaults3, options) {
       if (!options)
-        return defaults2;
+        return defaults3;
       let o = {};
-      copy(defaults2, o);
+      copy(defaults3, o);
       copy(options, o);
       for (let key of Object.keys(options)) {
         let val = options[key];
         switch (key) {
           case "jsonOptions":
-            o.jsonOptions = runtime_1.mergeJsonOptions(defaults2.jsonOptions, o.jsonOptions);
+            o.jsonOptions = runtime_1.mergeJsonOptions(defaults3.jsonOptions, o.jsonOptions);
             break;
           case "binaryOptions":
-            o.binaryOptions = runtime_1.mergeBinaryOptions(defaults2.binaryOptions, o.binaryOptions);
+            o.binaryOptions = runtime_1.mergeBinaryOptions(defaults3.binaryOptions, o.binaryOptions);
             break;
           case "meta":
             o.meta = {};
-            copy(defaults2.meta, o.meta);
+            copy(defaults3.meta, o.meta);
             copy(options.meta, o.meta);
             break;
           case "interceptors":
-            o.interceptors = defaults2.interceptors ? defaults2.interceptors.concat(val) : val.concat();
+            o.interceptors = defaults3.interceptors ? defaults3.interceptors.concat(val) : val.concat();
             break;
         }
       }
@@ -81179,7 +81364,7 @@ var require_cache4 = __commonJS({
       });
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.FinalizeCacheError = exports2.CacheWriteDeniedError = exports2.CACHE_WRITE_DENIED_PREFIX = exports2.ReserveCacheError = exports2.ValidationError = void 0;
+    exports2.FinalizeCacheError = exports2.CacheReadDeniedError = exports2.CACHE_READ_DENIED_PREFIX = exports2.CacheWriteDeniedError = exports2.CACHE_WRITE_DENIED_PREFIX = exports2.ReserveCacheError = exports2.ValidationError = void 0;
     exports2.isFeatureAvailable = isFeatureAvailable;
     exports2.restoreCache = restoreCache5;
     exports2.saveCache = saveCache5;
@@ -81191,6 +81376,7 @@ var require_cache4 = __commonJS({
     var config_1 = require_config();
     var tar_1 = require_tar();
     var http_client_1 = require_lib();
+    var constants_1 = require_constants7();
     var ValidationError = class _ValidationError extends Error {
       constructor(message) {
         super(message);
@@ -81216,6 +81402,15 @@ var require_cache4 = __commonJS({
       }
     };
     exports2.CacheWriteDeniedError = CacheWriteDeniedError;
+    exports2.CACHE_READ_DENIED_PREFIX = constants_1.CacheReadDeniedMessagePrefix;
+    var CacheReadDeniedError = class _CacheReadDeniedError extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "CacheReadDeniedError";
+        Object.setPrototypeOf(this, _CacheReadDeniedError.prototype);
+      }
+    };
+    exports2.CacheReadDeniedError = CacheReadDeniedError;
     var FinalizeCacheError = class _FinalizeCacheError extends Error {
       constructor(message) {
         super(message);
@@ -81253,6 +81448,12 @@ var require_cache4 = __commonJS({
         const cacheServiceVersion = (0, config_1.getCacheServiceVersion)();
         core31.debug(`Cache service version: ${cacheServiceVersion}`);
         checkPaths(paths);
+        const cacheMode = (0, config_1.getCacheMode)();
+        if (!(0, config_1.isCacheReadable)(cacheMode)) {
+          core31.info(`Cache restore skipped: the effective cache-mode '${cacheMode}' does not permit reads.`);
+          core31.debug(`Skipped restore for paths [${paths.join(", ")}] with primary key '${primaryKey}'.`);
+          return void 0;
+        }
         switch (cacheServiceVersion) {
           case "v2":
             return yield restoreCacheV2(paths, primaryKey, restoreKeys, options, enableCrossOsArchive);
@@ -81264,6 +81465,7 @@ var require_cache4 = __commonJS({
     }
     function restoreCacheV1(paths_1, primaryKey_1, restoreKeys_1, options_1) {
       return __awaiter2(this, arguments, void 0, function* (paths, primaryKey, restoreKeys, options, enableCrossOsArchive = false) {
+        var _a2;
         restoreKeys = restoreKeys || [];
         const keys = [primaryKey, ...restoreKeys];
         core31.debug("Resolved Keys:");
@@ -81277,10 +81479,19 @@ var require_cache4 = __commonJS({
         const compressionMethod = yield utils.getCompressionMethod();
         let archivePath = "";
         try {
-          const cacheEntry = yield cacheHttpClient.getCacheEntry(keys, paths, {
-            compressionMethod,
-            enableCrossOsArchive
-          });
+          let cacheEntry;
+          try {
+            cacheEntry = yield cacheHttpClient.getCacheEntry(keys, paths, {
+              compressionMethod,
+              enableCrossOsArchive
+            });
+          } catch (error3) {
+            const errorMessage = (_a2 = error3 === null || error3 === void 0 ? void 0 : error3.message) !== null && _a2 !== void 0 ? _a2 : "";
+            if (errorMessage.includes(exports2.CACHE_READ_DENIED_PREFIX)) {
+              throw new CacheReadDeniedError(errorMessage);
+            }
+            throw error3;
+          }
           if (!(cacheEntry === null || cacheEntry === void 0 ? void 0 : cacheEntry.archiveLocation)) {
             return void 0;
           }
@@ -81322,6 +81533,7 @@ var require_cache4 = __commonJS({
     }
     function restoreCacheV2(paths_1, primaryKey_1, restoreKeys_1, options_1) {
       return __awaiter2(this, arguments, void 0, function* (paths, primaryKey, restoreKeys, options, enableCrossOsArchive = false) {
+        var _a2;
         options = Object.assign(Object.assign({}, options), { useAzureSdk: true });
         restoreKeys = restoreKeys || [];
         const keys = [primaryKey, ...restoreKeys];
@@ -81342,7 +81554,16 @@ var require_cache4 = __commonJS({
             restoreKeys,
             version: utils.getCacheVersion(paths, compressionMethod, enableCrossOsArchive)
           };
-          const response = yield twirpClient.GetCacheEntryDownloadURL(request3);
+          let response;
+          try {
+            response = yield twirpClient.GetCacheEntryDownloadURL(request3);
+          } catch (error3) {
+            const errorMessage = (_a2 = error3 === null || error3 === void 0 ? void 0 : error3.message) !== null && _a2 !== void 0 ? _a2 : "";
+            if (errorMessage.includes(exports2.CACHE_READ_DENIED_PREFIX)) {
+              throw new CacheReadDeniedError(errorMessage);
+            }
+            throw error3;
+          }
           if (!response.ok) {
             core31.debug(`Cache not found for version ${request3.version} of keys: ${keys.join(", ")}`);
             return void 0;
@@ -81398,6 +81619,12 @@ var require_cache4 = __commonJS({
         core31.debug(`Cache service version: ${cacheServiceVersion}`);
         checkPaths(paths);
         checkKey(key);
+        const cacheMode = (0, config_1.getCacheMode)();
+        if (!(0, config_1.isCacheWritable)(cacheMode)) {
+          core31.info(`Cache save skipped: the effective cache-mode '${cacheMode}' does not permit writes.`);
+          core31.debug(`Skipped save for paths [${paths.join(", ")}] with key '${key}'.`);
+          return -1;
+        }
         switch (cacheServiceVersion) {
           case "v2":
             return yield saveCacheV2(paths, key, options, enableCrossOsArchive);
@@ -81985,12 +82212,12 @@ var require_tool_cache = __commonJS({
           core31.debug(`Failed to download from "${url2}". Code(${response.message.statusCode}) Message(${response.message.statusMessage})`);
           throw err;
         }
-        const pipeline = util3.promisify(stream2.pipeline);
+        const pipeline2 = util3.promisify(stream2.pipeline);
         const responseMessageFactory = _getGlobal("TEST_DOWNLOAD_TOOL_RESPONSE_MESSAGE_FACTORY", () => response.message);
         const readStream = responseMessageFactory();
         let succeeded = false;
         try {
-          yield pipeline(readStream, fs31.createWriteStream(dest));
+          yield pipeline2(readStream, fs31.createWriteStream(dest));
           core31.debug("download complete");
           succeeded = true;
           return dest;
@@ -88838,16 +89065,18 @@ var require_brace_expansion2 = __commonJS({
     }
     function expand3(str, max, isTop) {
       var expansions = [];
-      var m = balanced2("{", "}", str);
-      if (!m) return [str];
-      var pre = m.pre;
-      var post = m.post.length ? expand3(m.post, max, false) : [""];
-      if (/\$$/.test(m.pre)) {
-        for (var k = 0; k < post.length && k < max; k++) {
-          var expansion = pre + "{" + m.body + "}" + post[k];
-          expansions.push(expansion);
+      for (; ; ) {
+        const m = balanced2("{", "}", str);
+        if (!m) return [str];
+        const pre = m.pre;
+        if (/\$$/.test(m.pre)) {
+          const post2 = m.post.length ? expand3(m.post, max, false) : [""];
+          for (let k2 = 0; k2 < post2.length && k2 < max; k2++) {
+            const expansion2 = pre + "{" + m.body + "}" + post2[k2];
+            expansions.push(expansion2);
+          }
+          return expansions;
         }
-      } else {
         var isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body);
         var isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body);
         var isSequence = isNumericSequence || isAlphaSequence;
@@ -88855,10 +89084,12 @@ var require_brace_expansion2 = __commonJS({
         if (!isSequence && !isOptions) {
           if (m.post.match(/,(?!,).*\}/)) {
             str = m.pre + "{" + m.body + escClose2 + m.post;
-            return expand3(str, max, true);
+            isTop = true;
+            continue;
           }
           return [str];
         }
+        const post = m.post.length ? expand3(m.post, max, false) : [""];
         var n;
         if (isSequence) {
           n = m.body.split(/\.\./);
@@ -88921,8 +89152,8 @@ var require_brace_expansion2 = __commonJS({
               expansions.push(expansion);
           }
         }
+        return expansions;
       }
-      return expansions;
     }
   }
 });
@@ -91168,8 +91399,8 @@ var require_async = __commonJS({
         }
       }
       var race$1 = awaitify(race, 2);
-      function reduceRight(array, memo, iteratee, callback) {
-        var reversed = [...array].reverse();
+      function reduceRight(array2, memo, iteratee, callback) {
+        var reversed = [...array2].reverse();
         return reduce$1(reversed, memo, iteratee, callback);
       }
       function reflect(fn) {
@@ -92581,10 +92812,10 @@ var require_util12 = __commonJS({
       return objectToString(arg) === "[object Array]";
     }
     exports2.isArray = isArray2;
-    function isBoolean(arg) {
+    function isBoolean2(arg) {
       return typeof arg === "boolean";
     }
-    exports2.isBoolean = isBoolean;
+    exports2.isBoolean = isBoolean2;
     function isNull(arg) {
       return arg === null;
     }
@@ -92593,10 +92824,10 @@ var require_util12 = __commonJS({
       return arg == null;
     }
     exports2.isNullOrUndefined = isNullOrUndefined;
-    function isNumber(arg) {
+    function isNumber2(arg) {
       return typeof arg === "number";
     }
-    exports2.isNumber = isNumber;
+    exports2.isNumber = isNumber2;
     function isString3(arg) {
       return typeof arg === "string";
     }
@@ -92940,15 +93171,15 @@ var require_stream_writable = __commonJS({
     if (typeof Symbol === "function" && Symbol.hasInstance && typeof Function.prototype[Symbol.hasInstance] === "function") {
       realHasInstance = Function.prototype[Symbol.hasInstance];
       Object.defineProperty(Writable, Symbol.hasInstance, {
-        value: function(object) {
-          if (realHasInstance.call(this, object)) return true;
+        value: function(object2) {
+          if (realHasInstance.call(this, object2)) return true;
           if (this !== Writable) return false;
-          return object && object._writableState instanceof WritableState;
+          return object2 && object2._writableState instanceof WritableState;
         }
       });
     } else {
-      realHasInstance = function(object) {
-        return object instanceof this;
+      realHasInstance = function(object2) {
+        return object2 instanceof this;
       };
     }
     function Writable(options) {
@@ -94543,16 +94774,16 @@ var require_overRest = __commonJS({
     function overRest(func, start, transform) {
       start = nativeMax(start === void 0 ? func.length - 1 : start, 0);
       return function() {
-        var args = arguments, index2 = -1, length = nativeMax(args.length - start, 0), array = Array(length);
+        var args = arguments, index2 = -1, length = nativeMax(args.length - start, 0), array2 = Array(length);
         while (++index2 < length) {
-          array[index2] = args[start + index2];
+          array2[index2] = args[start + index2];
         }
         index2 = -1;
         var otherArgs = Array(start + 1);
         while (++index2 < start) {
           otherArgs[index2] = args[index2];
         }
-        otherArgs[start] = transform(array);
+        otherArgs[start] = transform(array2);
         return apply(func, this, otherArgs);
       };
     }
@@ -94766,8 +94997,8 @@ var require_baseIsNative = __commonJS({
 // node_modules/lodash/_getValue.js
 var require_getValue = __commonJS({
   "node_modules/lodash/_getValue.js"(exports2, module2) {
-    function getValue(object, key) {
-      return object == null ? void 0 : object[key];
+    function getValue(object2, key) {
+      return object2 == null ? void 0 : object2[key];
     }
     module2.exports = getValue;
   }
@@ -94778,8 +95009,8 @@ var require_getNative = __commonJS({
   "node_modules/lodash/_getNative.js"(exports2, module2) {
     var baseIsNative = require_baseIsNative();
     var getValue = require_getValue();
-    function getNative(object, key) {
-      var value = getValue(object, key);
+    function getNative(object2, key) {
+      var value = getValue(object2, key);
       return baseIsNative(value) ? value : void 0;
     }
     module2.exports = getNative;
@@ -94922,13 +95153,13 @@ var require_isIterateeCall = __commonJS({
     var isArrayLike = require_isArrayLike();
     var isIndex = require_isIndex();
     var isObject2 = require_isObject();
-    function isIterateeCall(value, index2, object) {
-      if (!isObject2(object)) {
+    function isIterateeCall(value, index2, object2) {
+      if (!isObject2(object2)) {
         return false;
       }
       var type = typeof index2;
-      if (type == "number" ? isArrayLike(object) && isIndex(index2, object.length) : type == "string" && index2 in object) {
-        return eq(object[index2], value);
+      if (type == "number" ? isArrayLike(object2) && isIndex(index2, object2.length) : type == "string" && index2 in object2) {
+        return eq(object2[index2], value);
       }
       return false;
     }
@@ -95152,10 +95383,10 @@ var require_isPrototype = __commonJS({
 // node_modules/lodash/_nativeKeysIn.js
 var require_nativeKeysIn = __commonJS({
   "node_modules/lodash/_nativeKeysIn.js"(exports2, module2) {
-    function nativeKeysIn(object) {
+    function nativeKeysIn(object2) {
       var result = [];
-      if (object != null) {
-        for (var key in Object(object)) {
+      if (object2 != null) {
+        for (var key in Object(object2)) {
           result.push(key);
         }
       }
@@ -95173,13 +95404,13 @@ var require_baseKeysIn = __commonJS({
     var nativeKeysIn = require_nativeKeysIn();
     var objectProto = Object.prototype;
     var hasOwnProperty = objectProto.hasOwnProperty;
-    function baseKeysIn(object) {
-      if (!isObject2(object)) {
-        return nativeKeysIn(object);
+    function baseKeysIn(object2) {
+      if (!isObject2(object2)) {
+        return nativeKeysIn(object2);
       }
-      var isProto = isPrototype(object), result = [];
-      for (var key in object) {
-        if (!(key == "constructor" && (isProto || !hasOwnProperty.call(object, key)))) {
+      var isProto = isPrototype(object2), result = [];
+      for (var key in object2) {
+        if (!(key == "constructor" && (isProto || !hasOwnProperty.call(object2, key)))) {
           result.push(key);
         }
       }
@@ -95195,8 +95426,8 @@ var require_keysIn = __commonJS({
     var arrayLikeKeys = require_arrayLikeKeys();
     var baseKeysIn = require_baseKeysIn();
     var isArrayLike = require_isArrayLike();
-    function keysIn(object) {
-      return isArrayLike(object) ? arrayLikeKeys(object, true) : baseKeysIn(object);
+    function keysIn(object2) {
+      return isArrayLike(object2) ? arrayLikeKeys(object2, true) : baseKeysIn(object2);
     }
     module2.exports = keysIn;
   }
@@ -95211,8 +95442,8 @@ var require_defaults = __commonJS({
     var keysIn = require_keysIn();
     var objectProto = Object.prototype;
     var hasOwnProperty = objectProto.hasOwnProperty;
-    var defaults2 = baseRest(function(object, sources) {
-      object = Object(object);
+    var defaults3 = baseRest(function(object2, sources) {
+      object2 = Object(object2);
       var index2 = -1;
       var length = sources.length;
       var guard = length > 2 ? sources[2] : void 0;
@@ -95226,15 +95457,15 @@ var require_defaults = __commonJS({
         var propsLength = props.length;
         while (++propsIndex < propsLength) {
           var key = props[propsIndex];
-          var value = object[key];
-          if (value === void 0 || eq(value, objectProto[key]) && !hasOwnProperty.call(object, key)) {
-            object[key] = source[key];
+          var value = object2[key];
+          if (value === void 0 || eq(value, objectProto[key]) && !hasOwnProperty.call(object2, key)) {
+            object2[key] = source[key];
           }
         }
       }
-      return object;
+      return object2;
     });
-    module2.exports = defaults2;
+    module2.exports = defaults3;
   }
 });
 
@@ -96654,7 +96885,7 @@ var require_validators = __commonJS({
         throw new ERR_INVALID_ARG_TYPE(name, "a dictionary", value);
       }
     });
-    var validateArray = hideStackFrames((value, name, minLength = 0) => {
+    var validateArray2 = hideStackFrames((value, name, minLength = 0) => {
       if (!ArrayIsArray(value)) {
         throw new ERR_INVALID_ARG_TYPE(name, "Array", value);
       }
@@ -96664,19 +96895,19 @@ var require_validators = __commonJS({
       }
     });
     function validateStringArray(value, name) {
-      validateArray(value, name);
+      validateArray2(value, name);
       for (let i = 0; i < value.length; i++) {
         validateString(value[i], `${name}[${i}]`);
       }
     }
     function validateBooleanArray(value, name) {
-      validateArray(value, name);
+      validateArray2(value, name);
       for (let i = 0; i < value.length; i++) {
         validateBoolean(value[i], `${name}[${i}]`);
       }
     }
     function validateAbortSignalArray(value, name) {
-      validateArray(value, name);
+      validateArray2(value, name);
       for (let i = 0; i < value.length; i++) {
         const signal = value[i];
         const indexedName = `${name}[${i}]`;
@@ -96772,7 +97003,7 @@ var require_validators = __commonJS({
       isInt32,
       isUint32,
       parseFileMode,
-      validateArray,
+      validateArray: validateArray2,
       validateStringArray,
       validateBooleanArray,
       validateAbortSignalArray,
@@ -99329,10 +99560,10 @@ var require_writable = __commonJS({
     }
     ObjectDefineProperty(Writable, SymbolHasInstance, {
       __proto__: null,
-      value: function(object) {
-        if (FunctionPrototypeSymbolHasInstance(this, object)) return true;
+      value: function(object2) {
+        if (FunctionPrototypeSymbolHasInstance(this, object2)) return true;
         if (this !== Writable) return false;
-        return object && object._writableState instanceof WritableState;
+        return object2 && object2._writableState instanceof WritableState;
       }
     });
     Writable.prototype.pipe = function() {
@@ -100578,7 +100809,7 @@ var require_pipeline4 = __commonJS({
         }
       }
     }
-    function pipeline(...streams) {
+    function pipeline2(...streams) {
       return pipelineImpl(streams, once(popCallback(streams)));
     }
     function pipelineImpl(streams, callback, opts) {
@@ -100844,7 +101075,7 @@ var require_pipeline4 = __commonJS({
     }
     module2.exports = {
       pipelineImpl,
-      pipeline
+      pipeline: pipeline2
     };
   }
 });
@@ -100853,7 +101084,7 @@ var require_pipeline4 = __commonJS({
 var require_compose = __commonJS({
   "node_modules/readable-stream/lib/internal/streams/compose.js"(exports2, module2) {
     "use strict";
-    var { pipeline } = require_pipeline4();
+    var { pipeline: pipeline2 } = require_pipeline4();
     var Duplex = require_duplex();
     var { destroyer } = require_destroy2();
     var {
@@ -100913,7 +101144,7 @@ var require_compose = __commonJS({
         }
       }
       const head = streams[0];
-      const tail = pipeline(streams, onfinished);
+      const tail = pipeline2(streams, onfinished);
       const writable = !!(isWritable(head) || isWritableStream(head) || isTransformStream(head));
       const readable = !!(isReadable(tail) || isReadableStream(tail) || isTransformStream(tail));
       d = new Duplex({
@@ -101366,24 +101597,24 @@ var require_operators = __commonJS({
         }
       }.call(this);
     }
-    function toIntegerOrInfinity(number) {
-      number = Number2(number);
-      if (NumberIsNaN(number)) {
+    function toIntegerOrInfinity(number2) {
+      number2 = Number2(number2);
+      if (NumberIsNaN(number2)) {
         return 0;
       }
-      if (number < 0) {
-        throw new ERR_OUT_OF_RANGE("number", ">= 0", number);
+      if (number2 < 0) {
+        throw new ERR_OUT_OF_RANGE("number", ">= 0", number2);
       }
-      return number;
+      return number2;
     }
-    function drop(number, options = void 0) {
+    function drop(number2, options = void 0) {
       if (options != null) {
         validateObject(options, "options");
       }
       if ((options === null || options === void 0 ? void 0 : options.signal) != null) {
         validateAbortSignal(options.signal, "options.signal");
       }
-      number = toIntegerOrInfinity(number);
+      number2 = toIntegerOrInfinity(number2);
       return async function* drop2() {
         var _options$signal5;
         if (options !== null && options !== void 0 && (_options$signal5 = options.signal) !== null && _options$signal5 !== void 0 && _options$signal5.aborted) {
@@ -101394,20 +101625,20 @@ var require_operators = __commonJS({
           if (options !== null && options !== void 0 && (_options$signal6 = options.signal) !== null && _options$signal6 !== void 0 && _options$signal6.aborted) {
             throw new AbortError();
           }
-          if (number-- <= 0) {
+          if (number2-- <= 0) {
             yield val;
           }
         }
       }.call(this);
     }
-    function take(number, options = void 0) {
+    function take(number2, options = void 0) {
       if (options != null) {
         validateObject(options, "options");
       }
       if ((options === null || options === void 0 ? void 0 : options.signal) != null) {
         validateAbortSignal(options.signal, "options.signal");
       }
-      number = toIntegerOrInfinity(number);
+      number2 = toIntegerOrInfinity(number2);
       return async function* take2() {
         var _options$signal7;
         if (options !== null && options !== void 0 && (_options$signal7 = options.signal) !== null && _options$signal7 !== void 0 && _options$signal7.aborted) {
@@ -101418,10 +101649,10 @@ var require_operators = __commonJS({
           if (options !== null && options !== void 0 && (_options$signal8 = options.signal) !== null && _options$signal8 !== void 0 && _options$signal8.aborted) {
             throw new AbortError();
           }
-          if (number-- > 0) {
+          if (number2-- > 0) {
             yield val;
           }
-          if (number <= 0) {
+          if (number2 <= 0) {
             return;
           }
         }
@@ -101456,7 +101687,7 @@ var require_promises = __commonJS({
     var { pipelineImpl: pl } = require_pipeline4();
     var { finished } = require_end_of_stream();
     require_stream2();
-    function pipeline(...streams) {
+    function pipeline2(...streams) {
       return new Promise2((resolve14, reject) => {
         let signal;
         let end;
@@ -101484,7 +101715,7 @@ var require_promises = __commonJS({
     }
     module2.exports = {
       finished,
-      pipeline
+      pipeline: pipeline2
     };
   }
 });
@@ -101504,7 +101735,7 @@ var require_stream2 = __commonJS({
     } = require_errors4();
     var compose = require_compose();
     var { setDefaultHighWaterMark, getDefaultHighWaterMark } = require_state3();
-    var { pipeline } = require_pipeline4();
+    var { pipeline: pipeline2 } = require_pipeline4();
     var { destroyer } = require_destroy2();
     var eos = require_end_of_stream();
     var promises6 = require_promises();
@@ -101568,7 +101799,7 @@ var require_stream2 = __commonJS({
     Stream.Duplex = require_duplex();
     Stream.Transform = require_transform();
     Stream.PassThrough = require_passthrough2();
-    Stream.pipeline = pipeline;
+    Stream.pipeline = pipeline2;
     var { addAbortSignal } = require_add_abort_signal();
     Stream.addAbortSignal = addAbortSignal;
     Stream.finished = eos;
@@ -101584,7 +101815,7 @@ var require_stream2 = __commonJS({
         return promises6;
       }
     });
-    ObjectDefineProperty(pipeline, customPromisify, {
+    ObjectDefineProperty(pipeline2, customPromisify, {
       __proto__: null,
       enumerable: true,
       get() {
@@ -101675,12 +101906,12 @@ var require_ours = __commonJS({
 // node_modules/lodash/_arrayPush.js
 var require_arrayPush = __commonJS({
   "node_modules/lodash/_arrayPush.js"(exports2, module2) {
-    function arrayPush(array, values) {
-      var index2 = -1, length = values.length, offset = array.length;
+    function arrayPush(array2, values) {
+      var index2 = -1, length = values.length, offset = array2.length;
       while (++index2 < length) {
-        array[offset + index2] = values[index2];
+        array2[offset + index2] = values[index2];
       }
-      return array;
+      return array2;
     }
     module2.exports = arrayPush;
   }
@@ -101705,12 +101936,12 @@ var require_baseFlatten = __commonJS({
   "node_modules/lodash/_baseFlatten.js"(exports2, module2) {
     var arrayPush = require_arrayPush();
     var isFlattenable = require_isFlattenable();
-    function baseFlatten(array, depth, predicate, isStrict, result) {
-      var index2 = -1, length = array.length;
+    function baseFlatten(array2, depth, predicate, isStrict, result) {
+      var index2 = -1, length = array2.length;
       predicate || (predicate = isFlattenable);
       result || (result = []);
       while (++index2 < length) {
-        var value = array[index2];
+        var value = array2[index2];
         if (depth > 0 && predicate(value)) {
           if (depth > 1) {
             baseFlatten(value, depth - 1, predicate, isStrict, result);
@@ -101731,9 +101962,9 @@ var require_baseFlatten = __commonJS({
 var require_flatten = __commonJS({
   "node_modules/lodash/flatten.js"(exports2, module2) {
     var baseFlatten = require_baseFlatten();
-    function flatten(array) {
-      var length = array == null ? 0 : array.length;
-      return length ? baseFlatten(array, 1) : [];
+    function flatten(array2) {
+      var length = array2 == null ? 0 : array2.length;
+      return length ? baseFlatten(array2, 1) : [];
     }
     module2.exports = flatten;
   }
@@ -101860,10 +102091,10 @@ var require_listCacheClear = __commonJS({
 var require_assocIndexOf = __commonJS({
   "node_modules/lodash/_assocIndexOf.js"(exports2, module2) {
     var eq = require_eq2();
-    function assocIndexOf(array, key) {
-      var length = array.length;
+    function assocIndexOf(array2, key) {
+      var length = array2.length;
       while (length--) {
-        if (eq(array[length][0], key)) {
+        if (eq(array2[length][0], key)) {
           return length;
         }
       }
@@ -102132,10 +102363,10 @@ var require_SetCache = __commonJS({
 // node_modules/lodash/_baseFindIndex.js
 var require_baseFindIndex = __commonJS({
   "node_modules/lodash/_baseFindIndex.js"(exports2, module2) {
-    function baseFindIndex(array, predicate, fromIndex, fromRight) {
-      var length = array.length, index2 = fromIndex + (fromRight ? 1 : -1);
+    function baseFindIndex(array2, predicate, fromIndex, fromRight) {
+      var length = array2.length, index2 = fromIndex + (fromRight ? 1 : -1);
       while (fromRight ? index2-- : ++index2 < length) {
-        if (predicate(array[index2], index2, array)) {
+        if (predicate(array2[index2], index2, array2)) {
           return index2;
         }
       }
@@ -102158,10 +102389,10 @@ var require_baseIsNaN = __commonJS({
 // node_modules/lodash/_strictIndexOf.js
 var require_strictIndexOf = __commonJS({
   "node_modules/lodash/_strictIndexOf.js"(exports2, module2) {
-    function strictIndexOf(array, value, fromIndex) {
-      var index2 = fromIndex - 1, length = array.length;
+    function strictIndexOf(array2, value, fromIndex) {
+      var index2 = fromIndex - 1, length = array2.length;
       while (++index2 < length) {
-        if (array[index2] === value) {
+        if (array2[index2] === value) {
           return index2;
         }
       }
@@ -102177,8 +102408,8 @@ var require_baseIndexOf = __commonJS({
     var baseFindIndex = require_baseFindIndex();
     var baseIsNaN = require_baseIsNaN();
     var strictIndexOf = require_strictIndexOf();
-    function baseIndexOf(array, value, fromIndex) {
-      return value === value ? strictIndexOf(array, value, fromIndex) : baseFindIndex(array, baseIsNaN, fromIndex);
+    function baseIndexOf(array2, value, fromIndex) {
+      return value === value ? strictIndexOf(array2, value, fromIndex) : baseFindIndex(array2, baseIsNaN, fromIndex);
     }
     module2.exports = baseIndexOf;
   }
@@ -102188,9 +102419,9 @@ var require_baseIndexOf = __commonJS({
 var require_arrayIncludes = __commonJS({
   "node_modules/lodash/_arrayIncludes.js"(exports2, module2) {
     var baseIndexOf = require_baseIndexOf();
-    function arrayIncludes(array, value) {
-      var length = array == null ? 0 : array.length;
-      return !!length && baseIndexOf(array, value, 0) > -1;
+    function arrayIncludes(array2, value) {
+      var length = array2 == null ? 0 : array2.length;
+      return !!length && baseIndexOf(array2, value, 0) > -1;
     }
     module2.exports = arrayIncludes;
   }
@@ -102199,10 +102430,10 @@ var require_arrayIncludes = __commonJS({
 // node_modules/lodash/_arrayIncludesWith.js
 var require_arrayIncludesWith = __commonJS({
   "node_modules/lodash/_arrayIncludesWith.js"(exports2, module2) {
-    function arrayIncludesWith(array, value, comparator) {
-      var index2 = -1, length = array == null ? 0 : array.length;
+    function arrayIncludesWith(array2, value, comparator) {
+      var index2 = -1, length = array2 == null ? 0 : array2.length;
       while (++index2 < length) {
-        if (comparator(value, array[index2])) {
+        if (comparator(value, array2[index2])) {
           return true;
         }
       }
@@ -102215,10 +102446,10 @@ var require_arrayIncludesWith = __commonJS({
 // node_modules/lodash/_arrayMap.js
 var require_arrayMap = __commonJS({
   "node_modules/lodash/_arrayMap.js"(exports2, module2) {
-    function arrayMap(array, iteratee) {
-      var index2 = -1, length = array == null ? 0 : array.length, result = Array(length);
+    function arrayMap(array2, iteratee) {
+      var index2 = -1, length = array2 == null ? 0 : array2.length, result = Array(length);
       while (++index2 < length) {
-        result[index2] = iteratee(array[index2], index2, array);
+        result[index2] = iteratee(array2[index2], index2, array2);
       }
       return result;
     }
@@ -102246,8 +102477,8 @@ var require_baseDifference = __commonJS({
     var baseUnary = require_baseUnary();
     var cacheHas = require_cacheHas();
     var LARGE_ARRAY_SIZE = 200;
-    function baseDifference(array, values, iteratee, comparator) {
-      var index2 = -1, includes = arrayIncludes, isCommon = true, length = array.length, result = [], valuesLength = values.length;
+    function baseDifference(array2, values, iteratee, comparator) {
+      var index2 = -1, includes = arrayIncludes, isCommon = true, length = array2.length, result = [], valuesLength = values.length;
       if (!length) {
         return result;
       }
@@ -102264,7 +102495,7 @@ var require_baseDifference = __commonJS({
       }
       outer:
         while (++index2 < length) {
-          var value = array[index2], computed = iteratee == null ? value : iteratee(value);
+          var value = array2[index2], computed = iteratee == null ? value : iteratee(value);
           value = comparator || value !== 0 ? value : 0;
           if (isCommon && computed === computed) {
             var valuesIndex = valuesLength;
@@ -102303,8 +102534,8 @@ var require_difference = __commonJS({
     var baseFlatten = require_baseFlatten();
     var baseRest = require_baseRest();
     var isArrayLikeObject = require_isArrayLikeObject();
-    var difference = baseRest(function(array, values) {
-      return isArrayLikeObject(array) ? baseDifference(array, baseFlatten(values, 1, isArrayLikeObject, true)) : [];
+    var difference = baseRest(function(array2, values) {
+      return isArrayLikeObject(array2) ? baseDifference(array2, baseFlatten(values, 1, isArrayLikeObject, true)) : [];
     });
     module2.exports = difference;
   }
@@ -102367,13 +102598,13 @@ var require_baseUniq = __commonJS({
     var createSet = require_createSet();
     var setToArray = require_setToArray();
     var LARGE_ARRAY_SIZE = 200;
-    function baseUniq(array, iteratee, comparator) {
-      var index2 = -1, includes = arrayIncludes, length = array.length, isCommon = true, result = [], seen = result;
+    function baseUniq(array2, iteratee, comparator) {
+      var index2 = -1, includes = arrayIncludes, length = array2.length, isCommon = true, result = [], seen = result;
       if (comparator) {
         isCommon = false;
         includes = arrayIncludesWith;
       } else if (length >= LARGE_ARRAY_SIZE) {
-        var set = iteratee ? null : createSet(array);
+        var set = iteratee ? null : createSet(array2);
         if (set) {
           return setToArray(set);
         }
@@ -102385,7 +102616,7 @@ var require_baseUniq = __commonJS({
       }
       outer:
         while (++index2 < length) {
-          var value = array[index2], computed = iteratee ? iteratee(value) : value;
+          var value = array2[index2], computed = iteratee ? iteratee(value) : value;
           value = comparator || value !== 0 ? value : 0;
           if (isCommon && computed === computed) {
             var seenIndex = seen.length;
@@ -105657,7 +105888,7 @@ var require_archiver_utils = __commonJS({
     var isStream2 = require_is_stream();
     var lazystream = require_lazystream();
     var normalizePath4 = require_normalize_path();
-    var defaults2 = require_defaults();
+    var defaults3 = require_defaults();
     var Stream = require("stream").Stream;
     var PassThrough3 = require_ours().PassThrough;
     var utils = module2.exports = {};
@@ -105691,10 +105922,10 @@ var require_archiver_utils = __commonJS({
       }
       return dateish;
     };
-    utils.defaults = function(object, source, guard) {
+    utils.defaults = function(object2, source, guard) {
       var args = arguments;
       args[0] = args[0] || {};
-      return defaults2(...args);
+      return defaults3(...args);
     };
     utils.isStream = function(source) {
       return isStream2(source);
@@ -108807,13 +109038,13 @@ var require_streamx = __commonJS({
     }
     function pipelinePromise(...streams) {
       return new Promise((resolve14, reject) => {
-        return pipeline(...streams, (err) => {
+        return pipeline2(...streams, (err) => {
           if (err) return reject(err);
           resolve14();
         });
       });
     }
-    function pipeline(stream2, ...streams) {
+    function pipeline2(stream2, ...streams) {
       const all = Array.isArray(stream2) ? [...stream2, ...streams] : [stream2, ...streams];
       const done = all.length && typeof all[all.length - 1] === "function" ? all.pop() : null;
       if (all.length < 2) throw new Error("Pipeline requires at least 2 streams");
@@ -108898,7 +109129,7 @@ var require_streamx = __commonJS({
       return s._writev !== Writable.prototype._writev && s._writev !== Duplex.prototype._writev;
     }
     module2.exports = {
-      pipeline,
+      pipeline: pipeline2,
       pipelinePromise,
       isStream: isStream2,
       isStreamx,
@@ -111573,12 +111804,12 @@ var require_dist_node2 = __commonJS({
         format: ""
       }
     };
-    function lowercaseKeys2(object) {
-      if (!object) {
+    function lowercaseKeys2(object2) {
+      if (!object2) {
         return {};
       }
-      return Object.keys(object).reduce((newObj, key) => {
-        newObj[key.toLowerCase()] = object[key];
+      return Object.keys(object2).reduce((newObj, key) => {
+        newObj[key.toLowerCase()] = object2[key];
         return newObj;
       }, {});
     }
@@ -111593,14 +111824,14 @@ var require_dist_node2 = __commonJS({
       const Ctor = Object.prototype.hasOwnProperty.call(proto, "constructor") && proto.constructor;
       return typeof Ctor === "function" && Ctor instanceof Ctor && Function.prototype.call(Ctor) === Function.prototype.call(value);
     }
-    function mergeDeep2(defaults2, options) {
-      const result = Object.assign({}, defaults2);
+    function mergeDeep2(defaults3, options) {
+      const result = Object.assign({}, defaults3);
       Object.keys(options).forEach((key) => {
         if (isPlainObject4(options[key])) {
-          if (!(key in defaults2))
+          if (!(key in defaults3))
             Object.assign(result, { [key]: options[key] });
           else
-            result[key] = mergeDeep2(defaults2[key], options[key]);
+            result[key] = mergeDeep2(defaults3[key], options[key]);
         } else {
           Object.assign(result, { [key]: options[key] });
         }
@@ -111615,7 +111846,7 @@ var require_dist_node2 = __commonJS({
       }
       return obj;
     }
-    function merge2(defaults2, route, options) {
+    function merge2(defaults3, route, options) {
       if (typeof route === "string") {
         let [method, url2] = route.split(" ");
         options = Object.assign(url2 ? { method, url: url2 } : { url: method }, options);
@@ -111625,10 +111856,10 @@ var require_dist_node2 = __commonJS({
       options.headers = lowercaseKeys2(options.headers);
       removeUndefinedProperties2(options);
       removeUndefinedProperties2(options.headers);
-      const mergedOptions = mergeDeep2(defaults2 || {}, options);
+      const mergedOptions = mergeDeep2(defaults3 || {}, options);
       if (options.url === "/graphql") {
-        if (defaults2 && defaults2.mediaType.previews?.length) {
-          mergedOptions.mediaType.previews = defaults2.mediaType.previews.filter(
+        if (defaults3 && defaults3.mediaType.previews?.length) {
+          mergedOptions.mediaType.previews = defaults3.mediaType.previews.filter(
             (preview) => !mergedOptions.mediaType.previews.includes(preview)
           ).concat(mergedOptions.mediaType.previews);
         }
@@ -111660,11 +111891,11 @@ var require_dist_node2 = __commonJS({
       }
       return matches.map(removeNonChars2).reduce((a, b) => a.concat(b), []);
     }
-    function omit2(object, keysToOmit) {
+    function omit2(object2, keysToOmit) {
       const result = { __proto__: null };
-      for (const key of Object.keys(object)) {
+      for (const key of Object.keys(object2)) {
         if (keysToOmit.indexOf(key) === -1) {
-          result[key] = object[key];
+          result[key] = object2[key];
         }
       }
       return result;
@@ -111862,8 +112093,8 @@ var require_dist_node2 = __commonJS({
         options.request ? { request: options.request } : null
       );
     }
-    function endpointWithDefaults2(defaults2, route, options) {
-      return parse2(merge2(defaults2, route, options));
+    function endpointWithDefaults2(defaults3, route, options) {
+      return parse2(merge2(defaults3, route, options));
     }
     function withDefaults4(oldDefaults, newDefaults) {
       const DEFAULTS22 = merge2(oldDefaults, newDefaults);
@@ -112537,21 +112768,21 @@ var require_dist_node8 = __commonJS({
       static {
         this.VERSION = VERSION8;
       }
-      static defaults(defaults2) {
+      static defaults(defaults3) {
         const OctokitWithDefaults = class extends this {
           constructor(...args) {
             const options = args[0] || {};
-            if (typeof defaults2 === "function") {
-              super(defaults2(options));
+            if (typeof defaults3 === "function") {
+              super(defaults3(options));
               return;
             }
             super(
               Object.assign(
                 {},
-                defaults2,
+                defaults3,
                 options,
-                options.userAgent && defaults2.userAgent ? {
-                  userAgent: `${options.userAgent} ${defaults2.userAgent}`
+                options.userAgent && defaults3.userAgent ? {
+                  userAgent: `${options.userAgent} ${defaults3.userAgent}`
                 } : null
               )
             );
@@ -114667,14 +114898,14 @@ var require_dist_node9 = __commonJS({
     var endpointMethodsMap2 = /* @__PURE__ */ new Map();
     for (const [scope, endpoints] of Object.entries(endpoints_default2)) {
       for (const [methodName, endpoint2] of Object.entries(endpoints)) {
-        const [route, defaults2, decorations] = endpoint2;
+        const [route, defaults3, decorations] = endpoint2;
         const [method, url2] = route.split(/ /);
         const endpointDefaults = Object.assign(
           {
             method,
             url: url2
           },
-          defaults2
+          defaults3
         );
         if (!endpointMethodsMap2.has(scope)) {
           endpointMethodsMap2.set(scope, /* @__PURE__ */ new Map());
@@ -114744,8 +114975,8 @@ var require_dist_node9 = __commonJS({
       }
       return newMethods;
     }
-    function decorate2(octokit, scope, methodName, defaults2, decorations) {
-      const requestWithDefaults = octokit.request.defaults(defaults2);
+    function decorate2(octokit, scope, methodName, defaults3, decorations) {
+      const requestWithDefaults = octokit.request.defaults(defaults3);
       function withDecorations(...args) {
         let options = requestWithDefaults.endpoint.merge(...args);
         if (decorations.mapToData) {
@@ -120795,7 +121026,7 @@ var require_core3 = __commonJS({
       ExitCode2[ExitCode2["Success"] = 0] = "Success";
       ExitCode2[ExitCode2["Failure"] = 1] = "Failure";
     })(ExitCode || (exports2.ExitCode = ExitCode = {}));
-    function exportVariable15(name, val) {
+    function exportVariable16(name, val) {
       const convertedVal = (0, utils_1.toCommandValue)(val);
       process.env[name] = convertedVal;
       const filePath = process.env["GITHUB_ENV"] || "";
@@ -120804,7 +121035,7 @@ var require_core3 = __commonJS({
       }
       (0, command_1.issueCommand)("set-env", { name }, convertedVal);
     }
-    exports2.exportVariable = exportVariable15;
+    exports2.exportVariable = exportVariable16;
     function setSecret2(secret) {
       (0, command_1.issueCommand)("add-mask", {}, secret);
     }
@@ -120863,11 +121094,11 @@ Support boolean input list: \`true | True | TRUE | false | False | FALSE\``);
       (0, command_1.issue)("echo", enabled ? "on" : "off");
     }
     exports2.setCommandEcho = setCommandEcho;
-    function setFailed13(message) {
+    function setFailed12(message) {
       process.exitCode = ExitCode.Failure;
       error3(message);
     }
-    exports2.setFailed = setFailed13;
+    exports2.setFailed = setFailed12;
     function isDebug5() {
       return process.env["RUNNER_DEBUG"] === "1";
     }
@@ -124735,8 +124966,8 @@ var require_util16 = __commonJS({
       parts.push(format.substring(last));
       return parts.join("");
     };
-    util3.formatNumber = function(number, decimals, dec_point, thousands_sep) {
-      var n = number, c = isNaN(decimals = Math.abs(decimals)) ? 2 : decimals;
+    util3.formatNumber = function(number2, decimals, dec_point, thousands_sep) {
+      var n = number2, c = isNaN(decimals = Math.abs(decimals)) ? 2 : decimals;
       var d = dec_point === void 0 ? "," : dec_point;
       var t = thousands_sep === void 0 ? "." : thousands_sep, s = n < 0 ? "-" : "";
       var i = parseInt(n = Math.abs(+n || 0).toFixed(c), 10) + "";
@@ -141304,6 +141535,69 @@ var toolrunner = __toESM(require_toolrunner());
 var github = __toESM(require_github());
 var io2 = __toESM(require_io());
 
+// src/environment.ts
+function getRequiredEnvVar(env, paramName) {
+  const value = env[paramName];
+  if (value === void 0 || value.length === 0) {
+    throw new Error(`${paramName} environment variable must be set`);
+  }
+  return value;
+}
+function getRequiredEnvParam(paramName) {
+  return getRequiredEnvVar(process.env, paramName);
+}
+function getOptionalEnvVarFrom(env, paramName) {
+  const value = env[paramName];
+  if (value?.trim().length === 0) {
+    return void 0;
+  }
+  return value;
+}
+function getOptionalEnvVar(paramName) {
+  return getOptionalEnvVarFrom(process.env, paramName);
+}
+var ReadOnlyEnv = class {
+  constructor(vars) {
+    this.vars = vars;
+  }
+  vars;
+  /** Clones the object while detaching the underlying environment from the original. */
+  clone() {
+    return Object.create(this, { vars: { value: { ...this.vars } } });
+  }
+  /** Gets a copy of the underlying environment. */
+  get() {
+    return { ...this.vars };
+  }
+  /** Tries to get the value for `name` and throws if there isn't one. */
+  getRequired(name) {
+    return getRequiredEnvVar(this.vars, name);
+  }
+  /** Gets the value for `name`, or `undefined` if it isn't set or empty. */
+  getOptional(name) {
+    return getOptionalEnvVarFrom(this.vars, name);
+  }
+  /** Gets the entries of the underlying `ProcessEnv`. */
+  entries() {
+    return Object.entries(this.vars);
+  }
+};
+var Env = class extends ReadOnlyEnv {
+  changed = false;
+  /** Sets an environment variable. */
+  set(name, value) {
+    this.vars[name] = value;
+    this.changed = true;
+  }
+  /** Gets a value indicating whether `set` was called at least once. */
+  hasChanged() {
+    return this.changed;
+  }
+};
+function getEnv(env = process.env) {
+  return new Env(env);
+}
+
 // src/util.ts
 var fs = __toESM(require("fs"));
 var fsPromises = __toESM(require("fs/promises"));
@@ -141441,7 +141735,7 @@ var nullCoreTag = defineScalarTag("tag:yaml.org,2002:null", {
     if (NULL_VALUES$1.indexOf(source) !== -1) return null;
     return NOT_RESOLVED;
   },
-  identify: (object) => object === null,
+  identify: (object2) => object2 === null,
   represent: () => "null"
 });
 var nullJsonTag = defineScalarTag("tag:yaml.org,2002:null", {
@@ -141451,7 +141745,7 @@ var nullJsonTag = defineScalarTag("tag:yaml.org,2002:null", {
     if (source === "null" || isExplicit && source === "") return null;
     return NOT_RESOLVED;
   },
-  identify: (object) => object === null,
+  identify: (object2) => object2 === null,
   represent: () => "null"
 });
 var NULL_VALUES = [
@@ -141473,7 +141767,7 @@ var nullYaml11Tag = defineScalarTag("tag:yaml.org,2002:null", {
     if (NULL_VALUES.indexOf(source) !== -1) return null;
     return NOT_RESOLVED;
   },
-  identify: (object) => object === null,
+  identify: (object2) => object2 === null,
   represent: () => "null"
 });
 var TRUE_VALUES$2 = [
@@ -141499,8 +141793,8 @@ var boolCoreTag = defineScalarTag("tag:yaml.org,2002:bool", {
     if (FALSE_VALUES$2.indexOf(source) !== -1) return false;
     return NOT_RESOLVED;
   },
-  identify: (object) => Object.prototype.toString.call(object) === "[object Boolean]",
-  represent: (object) => object ? "true" : "false"
+  identify: (object2) => Object.prototype.toString.call(object2) === "[object Boolean]",
+  represent: (object2) => object2 ? "true" : "false"
 });
 var TRUE_VALUES$1 = ["true"];
 var FALSE_VALUES$1 = ["false"];
@@ -141512,8 +141806,8 @@ var boolJsonTag = defineScalarTag("tag:yaml.org,2002:bool", {
     if (FALSE_VALUES$1.indexOf(source) !== -1) return false;
     return NOT_RESOLVED;
   },
-  identify: (object) => Object.prototype.toString.call(object) === "[object Boolean]",
-  represent: (object) => object ? "true" : "false"
+  identify: (object2) => Object.prototype.toString.call(object2) === "[object Boolean]",
+  represent: (object2) => object2 ? "true" : "false"
 });
 var TRUE_VALUES = [
   "true",
@@ -141560,8 +141854,8 @@ var boolYaml11Tag = defineScalarTag("tag:yaml.org,2002:bool", {
     if (FALSE_VALUES.indexOf(source) !== -1) return false;
     return NOT_RESOLVED;
   },
-  identify: (object) => Object.prototype.toString.call(object) === "[object Boolean]",
-  represent: (object) => object ? "true" : "false"
+  identify: (object2) => Object.prototype.toString.call(object2) === "[object Boolean]",
+  represent: (object2) => object2 ? "true" : "false"
 });
 var YAML_INTEGER_IMPLICIT_PATTERN$1 = /* @__PURE__ */ new RegExp("^(?:0o[0-7]+|0x[0-9a-fA-F]+|[-+]?[0-9]+)$");
 var YAML_INTEGER_EXPLICIT_PATTERN$1 = /* @__PURE__ */ new RegExp("^(?:[-+]?0b[0-1]+|[-+]?0o[0-7]+|[-+]?0x[0-9a-fA-F]+|[-+]?[0-9]+)$");
@@ -141592,8 +141886,8 @@ var intCoreTag = defineScalarTag("tag:yaml.org,2002:int", {
     ..."0123456789"
   ],
   resolve: resolveYamlInteger$2,
-  identify: (object) => Object.prototype.toString.call(object) === "[object Number]" && object % 1 === 0 && !Object.is(object, -0),
-  represent: (object) => object.toString(10)
+  identify: (object2) => Number.isInteger(object2) && !Object.is(object2, -0) && object2.toString(10).indexOf("e") < 0,
+  represent: (object2) => object2.toString(10)
 });
 var YAML_INTEGER_IMPLICIT_PATTERN = /* @__PURE__ */ new RegExp("^-?(?:0|[1-9][0-9]*)$");
 var YAML_INTEGER_EXPLICIT_PATTERN = /* @__PURE__ */ new RegExp("^(?:[-+]?0b[0-1]+|[-+]?0o[0-7]+|[-+]?0x[0-9a-fA-F]+|[-+]?[0-9]+)$");
@@ -141620,8 +141914,8 @@ var intJsonTag = defineScalarTag("tag:yaml.org,2002:int", {
   implicit: true,
   implicitFirstChars: ["-", ..."0123456789"],
   resolve: resolveYamlInteger$1,
-  identify: (object) => Object.prototype.toString.call(object) === "[object Number]" && object % 1 === 0 && !Object.is(object, -0),
-  represent: (object) => object.toString(10)
+  identify: (object2) => Number.isInteger(object2) && !Object.is(object2, -0) && object2.toString(10).indexOf("e") < 0,
+  represent: (object2) => object2.toString(10)
 });
 var YAML_INTEGER_PATTERN = /* @__PURE__ */ new RegExp("^(?:[-+]?0b[0-1_]+|[-+]?0[0-7_]+|[-+]?0x[0-9a-fA-F_]+|[-+]?[0-9][0-9_]*(?::[0-5]?[0-9])+|[-+]?(?:0|[1-9][0-9_]*))$");
 function parseYamlInteger(source) {
@@ -141654,8 +141948,8 @@ var intYaml11Tag = defineScalarTag("tag:yaml.org,2002:int", {
     ..."0123456789"
   ],
   resolve: resolveYamlInteger,
-  identify: (object) => Object.prototype.toString.call(object) === "[object Number]" && object % 1 === 0 && !Object.is(object, -0),
-  represent: (object) => object.toString(10)
+  identify: (object2) => Number.isInteger(object2) && !Object.is(object2, -0) && object2.toString(10).indexOf("e") < 0,
+  represent: (object2) => object2.toString(10)
 });
 var YAML_FLOAT_PATTERN$1 = /* @__PURE__ */ new RegExp("^(?:[-+]?[0-9]+(?:\\.[0-9]*)?(?:[eE][-+]?[0-9]+)?|[-+]?\\.[0-9]+(?:[eE][-+]?[0-9]+)?|[-+]?\\.(?:inf|Inf|INF)|\\.(?:nan|NaN|NAN))$");
 var YAML_FLOAT_SPECIAL_PATTERN$1 = /* @__PURE__ */ new RegExp("^(?:[-+]?\\.(?:inf|Inf|INF)|\\.(?:nan|NaN|NAN))$");
@@ -141670,12 +141964,12 @@ function resolveYamlFloat$2(source) {
   if (Number.isFinite(result) || YAML_FLOAT_SPECIAL_PATTERN$1.test(source)) return result;
   return NOT_RESOLVED;
 }
-function representYamlFloat$2(object) {
-  if (isNaN(object)) return ".nan";
-  if (object === Number.POSITIVE_INFINITY) return ".inf";
-  if (object === Number.NEGATIVE_INFINITY) return "-.inf";
-  if (Object.is(object, -0)) return "-0.0";
-  const result = object.toString(10);
+function representYamlFloat$2(object2) {
+  if (isNaN(object2)) return ".nan";
+  if (object2 === Number.POSITIVE_INFINITY) return ".inf";
+  if (object2 === Number.NEGATIVE_INFINITY) return "-.inf";
+  if (Object.is(object2, -0)) return "-0.0";
+  const result = object2.toString(10);
   return /^[-+]?[0-9]+e/.test(result) ? result.replace("e", ".e") : result;
 }
 var floatCoreTag = defineScalarTag("tag:yaml.org,2002:float", {
@@ -141687,7 +141981,7 @@ var floatCoreTag = defineScalarTag("tag:yaml.org,2002:float", {
     ..."0123456789"
   ],
   resolve: resolveYamlFloat$2,
-  identify: (object) => Object.prototype.toString.call(object) === "[object Number]" && (object % 1 !== 0 || Object.is(object, -0)),
+  identify: (object2) => typeof object2 === "number" && (!Number.isInteger(object2) || Object.is(object2, -0) || object2.toString(10).indexOf("e") >= 0),
   represent: representYamlFloat$2
 });
 var YAML_FLOAT_IMPLICIT_PATTERN = /* @__PURE__ */ new RegExp("^-?(?:0|[1-9][0-9]*)(?:\\.[0-9]*)?(?:[eE][-+]?[0-9]+)?$");
@@ -141708,19 +142002,19 @@ function resolveYamlFloat$1(source, isExplicit) {
   if (Number.isFinite(result)) return result;
   return NOT_RESOLVED;
 }
-function representYamlFloat$1(object) {
-  if (isNaN(object)) return ".nan";
-  if (object === Number.POSITIVE_INFINITY) return ".inf";
-  if (object === Number.NEGATIVE_INFINITY) return "-.inf";
-  if (Object.is(object, -0)) return "-0.0";
-  const result = object.toString(10);
+function representYamlFloat$1(object2) {
+  if (isNaN(object2)) return ".nan";
+  if (object2 === Number.POSITIVE_INFINITY) return ".inf";
+  if (object2 === Number.NEGATIVE_INFINITY) return "-.inf";
+  if (Object.is(object2, -0)) return "-0.0";
+  const result = object2.toString(10);
   return /^[-+]?[0-9]+e/.test(result) ? result.replace("e", ".e") : result;
 }
 var floatJsonTag = defineScalarTag("tag:yaml.org,2002:float", {
   implicit: true,
   implicitFirstChars: ["-", ..."0123456789"],
   resolve: resolveYamlFloat$1,
-  identify: (object) => Object.prototype.toString.call(object) === "[object Number]" && (object % 1 !== 0 || Object.is(object, -0)),
+  identify: (object2) => typeof object2 === "number" && (!Number.isInteger(object2) || Object.is(object2, -0) || object2.toString(10).indexOf("e") >= 0),
   represent: representYamlFloat$1
 });
 var YAML_FLOAT_PATTERN = /* @__PURE__ */ new RegExp("^(?:[-+]?(?:(?:[0-9][0-9_]*)?\\.[0-9_]*)(?:[eE][-+][0-9]+)?|[-+]?[0-9][0-9_]*(?::[0-5]?[0-9])+\\.[0-9_]*|[-+]?\\.(?:inf|Inf|INF)|\\.(?:nan|NaN|NAN))$");
@@ -141740,12 +142034,12 @@ function resolveYamlFloat(source) {
   if (Number.isFinite(result) || YAML_FLOAT_SPECIAL_PATTERN.test(source)) return result;
   return NOT_RESOLVED;
 }
-function representYamlFloat(object) {
-  if (isNaN(object)) return ".nan";
-  if (object === Number.POSITIVE_INFINITY) return ".inf";
-  if (object === Number.NEGATIVE_INFINITY) return "-.inf";
-  if (Object.is(object, -0)) return "-0.0";
-  const result = object.toString(10);
+function representYamlFloat(object2) {
+  if (isNaN(object2)) return ".nan";
+  if (object2 === Number.POSITIVE_INFINITY) return ".inf";
+  if (object2 === Number.NEGATIVE_INFINITY) return "-.inf";
+  if (Object.is(object2, -0)) return "-0.0";
+  const result = object2.toString(10);
   return /^[-+]?[0-9]+e/.test(result) ? result.replace("e", ".e") : result;
 }
 var floatYaml11Tag = defineScalarTag("tag:yaml.org,2002:float", {
@@ -141757,7 +142051,7 @@ var floatYaml11Tag = defineScalarTag("tag:yaml.org,2002:float", {
     ..."0123456789"
   ],
   resolve: resolveYamlFloat,
-  identify: (object) => Object.prototype.toString.call(object) === "[object Number]" && (object % 1 !== 0 || Object.is(object, -0)),
+  identify: (object2) => typeof object2 === "number" && (!Number.isInteger(object2) || Object.is(object2, -0) || object2.toString(10).indexOf("e") >= 0),
   represent: representYamlFloat
 });
 var mergeTag = defineScalarTag("tag:yaml.org,2002:merge", {
@@ -141777,14 +142071,14 @@ function resolveYamlBinary(source) {
   for (let index2 = 0; index2 < binary.length; index2++) result[index2] = binary.charCodeAt(index2);
   return result;
 }
-function representYamlBinary(object) {
+function representYamlBinary(object2) {
   let binary = "";
-  for (let index2 = 0; index2 < object.length; index2++) binary += String.fromCharCode(object[index2]);
+  for (let index2 = 0; index2 < object2.length; index2++) binary += String.fromCharCode(object2[index2]);
   return btoa(binary);
 }
 var binaryTag = defineScalarTag("tag:yaml.org,2002:binary", {
   resolve: resolveYamlBinary,
-  identify: (object) => Object.prototype.toString.call(object) === "[object Uint8Array]",
+  identify: (object2) => Object.prototype.toString.call(object2) === "[object Uint8Array]",
   represent: representYamlBinary
 });
 var YAML_DATE_REGEXP = /* @__PURE__ */ new RegExp("^([0-9][0-9][0-9][0-9])-([0-9][0-9])-([0-9][0-9])$");
@@ -141826,8 +142120,8 @@ var timestampTag = defineScalarTag("tag:yaml.org,2002:timestamp", {
   implicit: true,
   implicitFirstChars: [..."0123456789"],
   resolve: resolveYamlTimestamp,
-  identify: (object) => object instanceof Date,
-  represent: (object) => object.toISOString()
+  identify: (object2) => object2 instanceof Date,
+  represent: (object2) => object2.toISOString()
 });
 var seqTag = defineSequenceTag("tag:yaml.org,2002:seq", {
   create: () => [],
@@ -141836,17 +142130,37 @@ var seqTag = defineSequenceTag("tag:yaml.org,2002:seq", {
   },
   identify: Array.isArray
 });
+function isPlainObject3(data) {
+  if (data === null || typeof data !== "object" || Array.isArray(data)) return false;
+  const prototype = Object.getPrototypeOf(data);
+  return prototype === null || prototype === Object.prototype;
+}
+function pick(object2, keys) {
+  const result = {};
+  for (const key of keys) if (object2[key] !== void 0) result[key] = object2[key];
+  return result;
+}
 var omapTag = defineSequenceTag("tag:yaml.org,2002:omap", {
-  create: () => [],
-  addItem: (container, item) => {
-    if (Object.prototype.toString.call(item) !== "[object Object]") return "cannot resolve an ordered map item";
-    const object = item;
-    const itemKeys = Object.keys(object);
-    if (itemKeys.length !== 1) return "cannot resolve an ordered map item";
-    for (const existing of container) if (Object.prototype.hasOwnProperty.call(existing, itemKeys[0])) return "cannot resolve an ordered map item";
-    container.push(object);
+  create: () => ({
+    list: [],
+    seen: /* @__PURE__ */ new Set()
+  }),
+  addItem: (carrier, item) => {
+    let key;
+    if (item instanceof Map) {
+      if (item.size !== 1) return "cannot resolve an ordered map item";
+      key = item.keys().next().value;
+    } else if (isPlainObject3(item)) {
+      const itemKeys = Object.keys(item);
+      if (itemKeys.length !== 1) return "cannot resolve an ordered map item";
+      key = itemKeys[0];
+    } else return "cannot resolve an ordered map item";
+    if (carrier.seen.has(key)) return "duplicate key in ordered map";
+    carrier.seen.add(key);
+    carrier.list.push(item);
     return "";
-  }
+  },
+  finalize: (carrier) => carrier.list
 });
 var pairsTag = defineSequenceTag("tag:yaml.org,2002:pairs", {
   create: () => [],
@@ -141857,23 +142171,13 @@ var pairsTag = defineSequenceTag("tag:yaml.org,2002:pairs", {
       return "";
     }
     if (Object.prototype.toString.call(item) !== "[object Object]") return "cannot resolve a pairs item";
-    const object = item;
-    const keys = Object.keys(object);
+    const object2 = item;
+    const keys = Object.keys(object2);
     if (keys.length !== 1) return "cannot resolve a pairs item";
-    container.push([keys[0], object[keys[0]]]);
+    container.push([keys[0], object2[keys[0]]]);
     return "";
   }
 });
-function isPlainObject3(data) {
-  if (data === null || typeof data !== "object" || Array.isArray(data)) return false;
-  const prototype = Object.getPrototypeOf(data);
-  return prototype === null || prototype === Object.prototype;
-}
-function pick(object, keys) {
-  const result = {};
-  for (const key of keys) if (object[key] !== void 0) result[key] = object[key];
-  return result;
-}
 var mapTag = defineMappingTag("tag:yaml.org,2002:map", {
   create: () => ({}),
   identify: isPlainObject3,
@@ -142057,12 +142361,12 @@ var realMapTag = defineMappingTag("tag:yaml.org,2002:map", {
 });
 function normalizeKey(key) {
   if (Array.isArray(key)) {
-    const array = Array.prototype.slice.call(key);
-    for (let index2 = 0; index2 < array.length; index2++) {
-      if (Array.isArray(array[index2])) return null;
-      if (typeof array[index2] === "object" && Object.prototype.toString.call(array[index2]) === "[object Object]") array[index2] = "[object Object]";
+    const array2 = Array.prototype.slice.call(key);
+    for (let index2 = 0; index2 < array2.length; index2++) {
+      if (Array.isArray(array2[index2])) return null;
+      if (typeof array2[index2] === "object" && Object.prototype.toString.call(array2[index2]) === "[object Object]") array2[index2] = "[object Object]";
     }
-    return String(array);
+    return String(array2);
   }
   if (typeof key === "object" && Object.prototype.toString.call(key) === "[object Object]") return "[object Object]";
   return String(key);
@@ -142456,7 +142760,8 @@ var DEFAULT_CONSTRUCTOR_OPTIONS = {
   filename: "",
   schema: CORE_SCHEMA,
   json: false,
-  maxMergeSeqLength: 20
+  maxTotalMergeKeys: 1e4,
+  maxAliases: -1
 };
 function eventPosition$1(event) {
   if ("tagStart" in event && event.tagStart !== NO_RANGE$2) return event.tagStart;
@@ -142544,6 +142849,7 @@ function isMappingTag(tag) {
 }
 function mergeKeys(state, frame, source, sourceTag) {
   for (const sourceKey of sourceTag.keys(source)) {
+    if (state.maxTotalMergeKeys !== -1 && ++state.totalMergeKeys > state.maxTotalMergeKeys) throwError$1(state, `merge keys exceeded maxTotalMergeKeys (${state.maxTotalMergeKeys})`);
     if (frame.tag.has(frame.value, sourceKey)) continue;
     const err = frame.tag.addPair(frame.value, sourceKey, sourceTag.get(source, sourceKey));
     if (err) throwError$1(state, err);
@@ -142553,14 +142859,8 @@ function mergeKeys(state, frame, source, sourceTag) {
 function mergeSource(state, frame, source, sourceTag) {
   state.position = frame.keyPosition;
   if (isMappingTag(sourceTag)) mergeKeys(state, frame, source, sourceTag);
-  else if (sourceTag.nodeKind === "sequence" && Array.isArray(source)) {
-    const seen = /* @__PURE__ */ new Set();
-    for (const element of source) {
-      if (seen.has(element)) continue;
-      seen.add(element);
-      mergeKeys(state, frame, element, frame.tag);
-    }
-  } else throwError$1(state, "cannot merge mappings; the provided source object is unacceptable");
+  else if (sourceTag.nodeKind === "sequence" && Array.isArray(source)) for (const element of source) mergeKeys(state, frame, element, frame.tag);
+  else throwError$1(state, "cannot merge mappings; the provided source object is unacceptable");
 }
 function addMappingValue(state, frame, key, value, tag) {
   state.position = frame.keyPosition;
@@ -142581,7 +142881,6 @@ function addValue(state, value, tag) {
   } else if (frame.kind === "sequence") {
     if (frame.merge) {
       if (!isMappingTag(tag)) throwError$1(state, "cannot merge mappings; the provided source object is unacceptable");
-      if (frame.index >= state.maxMergeSeqLength) throwError$1(state, `merge sequence length exceeded maxMergeSeqLength (${state.maxMergeSeqLength})`);
     }
     const err = frame.tag.addItem(frame.value, value, frame.index++);
     if (err) throwError$1(state, err);
@@ -142618,7 +142917,9 @@ function constructFromEvents(events, options) {
     position: 0,
     frames: [],
     anchors: /* @__PURE__ */ new Map(),
-    tagHandlers: /* @__PURE__ */ Object.create(null)
+    tagHandlers: /* @__PURE__ */ Object.create(null),
+    totalMergeKeys: 0,
+    aliasCount: 0
   };
   while (state.eventIndex < state.events.length) {
     const event = state.events[state.eventIndex++];
@@ -142626,6 +142927,7 @@ function constructFromEvents(events, options) {
     switch (event.type) {
       case 1:
         state.anchors = /* @__PURE__ */ new Map();
+        state.aliasCount = 0;
         state.tagHandlers = /* @__PURE__ */ Object.create(null);
         for (const directive of event.directives) if (directive.kind === "tag") state.tagHandlers[directive.handle] = directive.prefix;
         state.frames.push({
@@ -142676,6 +142978,7 @@ function constructFromEvents(events, options) {
         break;
       }
       case 5: {
+        if (state.maxAliases !== -1 && ++state.aliasCount > state.maxAliases) throwError$1(state, `aliases exceeded maxAliases (${state.maxAliases})`);
         const name = state.source.slice(event.anchorStart, event.anchorEnd);
         const anchor = state.anchors.get(name);
         if (!anchor) throwError$1(state, `unidentified alias "${name}"`);
@@ -142748,6 +143051,17 @@ function addMappingEvent(state, start, anchorStart, anchorEnd, tagStart, tagEnd,
     style
   });
 }
+function insertFlowPairMappingEvent(state, snapshot) {
+  state.events.splice(snapshot.eventsLength, 0, {
+    type: 3,
+    start: snapshot.position,
+    anchorStart: NO_RANGE$1,
+    anchorEnd: NO_RANGE$1,
+    tagStart: NO_RANGE$1,
+    tagEnd: NO_RANGE$1,
+    style: 2
+  });
+}
 function addScalarEvent(state, valueStart, valueEnd, anchorStart, anchorEnd, tagStart, tagEnd, style, chomping = 1, indent = -1, fast = false) {
   state.events.push({
     type: 4,
@@ -143191,12 +143505,8 @@ function readFlowCollection(state, nodeIndent, props) {
       state.position++;
       skipFlowSeparationSpace(state, nodeIndent);
       if (!isMapping) {
-        restoreState(state, entryStart);
-        addMappingEvent(state, entryStart.position, NO_RANGE$1, NO_RANGE$1, NO_RANGE$1, NO_RANGE$1, 2);
-        if (!parseNode(state, nodeIndent, CONTEXT_FLOW_IN, false, true)) addEmptyScalarEvent(state);
-        skipFlowSeparationSpace(state, nodeIndent);
-        state.position++;
-        skipFlowSeparationSpace(state, nodeIndent);
+        insertFlowPairMappingEvent(state, entryStart);
+        if (!keyWasRead) addEmptyScalarEvent(state);
       } else if (!keyWasRead) addEmptyScalarEvent(state);
       if (!parseNode(state, nodeIndent, CONTEXT_FLOW_IN, false, true)) addEmptyScalarEvent(state);
       skipFlowSeparationSpace(state, nodeIndent);
@@ -143206,9 +143516,8 @@ function readFlowCollection(state, nodeIndent, props) {
       addEmptyScalarEvent(state);
     } else if (isMapping) addEmptyScalarEvent(state);
     else if (isPair) {
-      restoreState(state, entryStart);
-      addMappingEvent(state, entryStart.position, NO_RANGE$1, NO_RANGE$1, NO_RANGE$1, NO_RANGE$1, 2);
-      parseNode(state, nodeIndent, CONTEXT_FLOW_IN, false, true);
+      insertFlowPairMappingEvent(state, entryStart);
+      if (!keyWasRead) addEmptyScalarEvent(state);
       addEmptyScalarEvent(state);
       addPopEvent(state);
     }
@@ -143572,12 +143881,12 @@ function buildRepresentTypes(schema) {
     }))
   ];
 }
-function matchTag(state, object) {
+function matchTag(state, object2) {
   for (let index2 = 0, length = state.representTypes.length; index2 < length; index2 += 1) {
     const { tag, implicitTag } = state.representTypes[index2];
-    if (tag.identify && tag.identify(object)) {
+    if (tag.identify && tag.identify(object2)) {
       let tagName;
-      if (tag.matchByTagPrefix && tag.representTagName) tagName = tag.representTagName(object);
+      if (tag.matchByTagPrefix && tag.representTagName) tagName = tag.representTagName(object2);
       else tagName = tag.tagName;
       return {
         tag,
@@ -143588,9 +143897,9 @@ function matchTag(state, object) {
   }
   return null;
 }
-function build(state, object) {
-  if (!state.noRefs && object !== null && typeof object === "object") {
-    const existing = state.refs.get(object);
+function build(state, object2) {
+  if (!state.noRefs && object2 !== null && typeof object2 === "object") {
+    const existing = state.refs.get(object2);
     if (existing) {
       if (existing.anchor === void 0) existing.anchor = `ref_${state.refCounter++}`;
       return {
@@ -143601,11 +143910,11 @@ function build(state, object) {
       };
     }
   }
-  const matched = matchTag(state, object);
+  const matched = matchTag(state, object2);
   if (!matched) {
-    if (object === void 0) return INVALID;
+    if (object2 === void 0) return INVALID;
     if (state.skipInvalid) return INVALID;
-    throw new YAMLException(`unacceptable kind of an object to dump ${Object.prototype.toString.call(object)}`);
+    throw new YAMLException(`unacceptable kind of an object to dump ${Object.prototype.toString.call(object2)}`);
   }
   const { tag, tagName, implicitTag } = matched;
   const nodeTagName = implicitTag ? tagName : tagNameShort(tagName);
@@ -143616,11 +143925,11 @@ function build(state, object) {
       kind: "scalar",
       tag: nodeTagName,
       style: style2,
-      value: tag.represent(object)
+      value: tag.represent(object2)
     };
   }
   if (tag.nodeKind === "sequence") {
-    const container = tag.represent(object);
+    const container = tag.represent(object2);
     const style2 = new Style();
     style2.tagged = !implicitTag;
     const node2 = {
@@ -143629,7 +143938,7 @@ function build(state, object) {
       style: style2,
       items: []
     };
-    if (!state.noRefs) state.refs.set(object, node2);
+    if (!state.noRefs) state.refs.set(object2, node2);
     for (let index2 = 0, length = container.length; index2 < length; index2 += 1) {
       let item = build(state, container[index2]);
       if (item === INVALID && container[index2] === void 0) item = build(state, null);
@@ -143638,7 +143947,7 @@ function build(state, object) {
     }
     return node2;
   }
-  const map = tag.represent(object);
+  const map = tag.represent(object2);
   const style = new Style();
   style.tagged = !implicitTag;
   const node = {
@@ -143647,7 +143956,7 @@ function build(state, object) {
     style,
     items: []
   };
-  if (!state.noRefs) state.refs.set(object, node);
+  if (!state.noRefs) state.refs.set(object2, node);
   for (const [objectKey, objectValue] of map) {
     const key = build(state, objectKey);
     if (key === INVALID) continue;
@@ -143845,7 +144154,7 @@ function isNsCharOrWhitespace(c) {
 function isPlainSafe(c, prev, inblock) {
   const cIsNsCharOrWhitespace = isNsCharOrWhitespace(c);
   const cIsNsChar = cIsNsCharOrWhitespace && !isWhitespace(c);
-  return (inblock ? cIsNsCharOrWhitespace : cIsNsCharOrWhitespace && c !== CHAR_COMMA && c !== CHAR_LEFT_SQUARE_BRACKET && c !== CHAR_RIGHT_SQUARE_BRACKET && c !== CHAR_LEFT_CURLY_BRACKET && c !== CHAR_RIGHT_CURLY_BRACKET) && c !== CHAR_SHARP && !(prev === CHAR_COLON && !cIsNsChar) || isNsCharOrWhitespace(prev) && !isWhitespace(prev) && c === CHAR_SHARP || prev === CHAR_COLON && cIsNsChar;
+  return (inblock ? cIsNsCharOrWhitespace : cIsNsCharOrWhitespace && c !== CHAR_COMMA && c !== CHAR_LEFT_SQUARE_BRACKET && c !== CHAR_RIGHT_SQUARE_BRACKET && c !== CHAR_LEFT_CURLY_BRACKET && c !== CHAR_RIGHT_CURLY_BRACKET) && c !== CHAR_SHARP && !(prev === CHAR_COLON && !cIsNsChar) || isNsCharOrWhitespace(prev) && !isWhitespace(prev) && c === CHAR_SHARP || prev === CHAR_COLON && cIsNsChar && (inblock || c !== CHAR_COMMA && c !== CHAR_LEFT_SQUARE_BRACKET && c !== CHAR_RIGHT_SQUARE_BRACKET && c !== CHAR_LEFT_CURLY_BRACKET && c !== CHAR_RIGHT_CURLY_BRACKET);
 }
 function isPlainSafeFirst(c) {
   return isPrintable(c) && c !== CHAR_BOM && !isWhitespace(c) && c !== CHAR_MINUS && c !== CHAR_QUESTION && c !== CHAR_COLON && c !== CHAR_COMMA && c !== CHAR_LEFT_SQUARE_BRACKET && c !== CHAR_RIGHT_SQUARE_BRACKET && c !== CHAR_LEFT_CURLY_BRACKET && c !== CHAR_RIGHT_CURLY_BRACKET && c !== CHAR_SHARP && c !== CHAR_AMPERSAND && c !== CHAR_ASTERISK && c !== CHAR_EXCLAMATION && c !== CHAR_VERTICAL_LINE && c !== CHAR_EQUALS && c !== CHAR_GREATER_THAN && c !== CHAR_SINGLE_QUOTE && c !== CHAR_DOUBLE_QUOTE && c !== CHAR_PERCENT && c !== CHAR_COMMERCIAL_AT && c !== CHAR_GRAVE_ACCENT;
@@ -144275,7 +144584,7 @@ var semver = __toESM(require_semver2());
 
 // src/api-compatibility.json
 var maximumVersion = "3.22";
-var minimumVersion = "3.16";
+var minimumVersion = "3.17";
 
 // src/json/index.ts
 function parseString(data) {
@@ -144290,35 +144599,173 @@ function isArray(value) {
 function isString(value) {
   return typeof value === "string";
 }
+function isNumber(value) {
+  return typeof value === "number";
+}
+function isBoolean(value) {
+  return typeof value === "boolean";
+}
 function isStringOrUndefined(value) {
   return value === void 0 || isString(value);
 }
-var string = {
-  validate: isString,
-  required: true
-};
-function optional(validator) {
+function defaultCheck(validate2) {
+  return (arg) => ({ unknownKeys: [], invalidKeys: [], valid: validate2(arg) });
+}
+function makeValidator(validate2) {
+  return {
+    validate: validate2,
+    check: defaultCheck(validate2),
+    required: true
+  };
+}
+var string = makeValidator(isString);
+var number = makeValidator(isNumber);
+var boolean = makeValidator(isBoolean);
+function array(validator) {
+  const validate2 = (val) => {
+    return isArray(val) && val.every((e) => validator.validate(e));
+  };
+  return {
+    validate: validate2,
+    check: (val, opts, path29) => {
+      const result = successfulCheckSchema();
+      if (!isArray(val)) {
+        result.valid = false;
+        return result;
+      }
+      let index2 = 0;
+      for (const e of val) {
+        const elementPath = `${path29}[${index2}]`;
+        const eResult = validator.check(e, opts, `${elementPath}`);
+        result.invalidKeys.push(...eResult.invalidKeys);
+        result.unknownKeys.push(...eResult.unknownKeys);
+        index2++;
+        if (!eResult.valid) {
+          result.valid = false;
+          if (eResult.invalidKeys.length === 0) {
+            result.invalidKeys.push(elementPath);
+          }
+          if (opts.failFast) {
+            return result;
+          }
+          continue;
+        }
+      }
+      return result;
+    },
+    required: true
+  };
+}
+function object(schema) {
+  return {
+    validate: (val) => {
+      return isObject(val) && validateSchema(schema, val);
+    },
+    check: (val, opts, path29) => {
+      if (!isObject(val)) {
+        return invalidCheckSchema();
+      }
+      return checkSchema(schema, val, opts, path29);
+    },
+    required: true
+  };
+}
+function optionalOrNull(validator) {
   return {
     validate: (val) => {
       return val === void 0 || val === null || validator.validate(val);
     },
+    check: (val, opts, path29) => {
+      if (val === void 0 || val === null) {
+        return successfulCheckSchema();
+      }
+      return validator.check(val, opts, path29);
+    },
+    required: false
+  };
+}
+function optional(validator) {
+  return {
+    validate: (val) => {
+      return val === void 0 || validator.validate(val);
+    },
+    check: (val, opts, path29) => {
+      if (val === void 0) {
+        return successfulCheckSchema();
+      }
+      return validator.check(val, opts, path29);
+    },
     required: false
   };
 }
 function validateSchema(schema, obj) {
+  const result = checkSchema(schema, obj, { failFast: true });
+  return result.valid;
+}
+function validateArray(elementSchema, arr) {
+  const elementValidator = object(elementSchema);
+  return array(elementValidator).validate(arr);
+}
+function successfulCheckSchema() {
+  return {
+    valid: true,
+    unknownKeys: [],
+    invalidKeys: []
+  };
+}
+function invalidCheckSchema() {
+  return {
+    valid: false,
+    unknownKeys: [],
+    invalidKeys: []
+  };
+}
+function checkSchema(schema, obj, options = {}, path29 = "") {
+  const result = successfulCheckSchema();
+  const inputKeys = new Set(Object.keys(obj));
+  const invalidKeys = /* @__PURE__ */ new Set();
   for (const [key, validator] of Object.entries(schema)) {
     const hasKey = key in obj;
+    inputKeys.delete(key);
+    invalidKeys.add(key);
     if (validator.required && !hasKey) {
-      return false;
+      result.valid = false;
+      if (options.failFast) {
+        break;
+      }
+      continue;
     }
     if (validator.required && (obj[key] === void 0 || obj[key] === null)) {
-      return false;
+      result.valid = false;
+      if (options.failFast) {
+        break;
+      }
+      continue;
     }
-    if (hasKey && !validator.validate(obj[key])) {
-      return false;
+    if (hasKey) {
+      const checkResult = validator.check(obj[key], options, `${path29}.${key}`);
+      result.unknownKeys.push(...checkResult.unknownKeys);
+      result.invalidKeys.push(...checkResult.invalidKeys);
+      if (checkResult.invalidKeys.length > 0) {
+        invalidKeys.delete(key);
+      }
+      if (!checkResult.valid) {
+        result.valid = false;
+        if (options.failFast) {
+          break;
+        }
+        continue;
+      }
     }
+    invalidKeys.delete(key);
   }
-  return true;
+  for (const remainingKey of inputKeys) {
+    result.unknownKeys.push(`${path29}.${remainingKey}`);
+  }
+  for (const invalidKey of invalidKeys) {
+    result.invalidKeys.push(`${path29}.${invalidKey}`);
+  }
+  return result;
 }
 
 // src/util.ts
@@ -144618,32 +145065,6 @@ function initializeEnvironment(version) {
   core2.exportVariable("CODEQL_ACTION_FEATURE_WILL_UPLOAD" /* FEATURE_WILL_UPLOAD */, "true");
   core2.exportVariable("CODEQL_ACTION_VERSION" /* VERSION */, version);
 }
-function getEnv(env = process.env) {
-  return {
-    getRequired: (name) => getRequiredEnvVar(env, name),
-    getOptional: (name) => getOptionalEnvVarFrom(env, name)
-  };
-}
-function getRequiredEnvVar(env, paramName) {
-  const value = env[paramName];
-  if (value === void 0 || value.length === 0) {
-    throw new Error(`${paramName} environment variable must be set`);
-  }
-  return value;
-}
-function getRequiredEnvParam(paramName) {
-  return getRequiredEnvVar(process.env, paramName);
-}
-function getOptionalEnvVarFrom(env, paramName) {
-  const value = env[paramName];
-  if (value?.trim().length === 0) {
-    return void 0;
-  }
-  return value;
-}
-function getOptionalEnvVar(paramName) {
-  return getOptionalEnvVarFrom(process.env, paramName);
-}
 var HTTPError = class extends Error {
   status;
   constructor(message, status) {
@@ -144924,28 +145345,28 @@ async function isBinaryAccessible(binary, logger) {
     return false;
   }
 }
-async function asyncFilter(array, predicate) {
-  const results = await Promise.all(array.map(predicate));
-  return array.filter((_2, index2) => results[index2]);
+async function asyncFilter(array2, predicate) {
+  const results = await Promise.all(array2.map(predicate));
+  return array2.filter((_2, index2) => results[index2]);
 }
-async function asyncSome(array, predicate) {
-  const results = await Promise.all(array.map(predicate));
+async function asyncSome(array2, predicate) {
+  const results = await Promise.all(array2.map(predicate));
   return results.some((result) => result);
 }
 function isDefined2(value) {
   return value !== void 0 && value !== null;
 }
-function unsafeEntriesInvariant(object) {
-  return Object.entries(object).filter(
+function unsafeEntriesInvariant(object2) {
+  return Object.entries(object2).filter(
     ([_2, val]) => val !== void 0
   );
 }
-function joinAtMost(array, separator, limit) {
-  if (limit > 0 && array.length > limit) {
-    array = array.slice(0, limit);
-    array.push("...");
+function joinAtMost(array2, separator, limit) {
+  if (limit > 0 && array2.length > limit) {
+    array2 = array2.slice(0, limit);
+    array2.push("...");
   }
-  return array.join(separator);
+  return array2.join(separator);
 }
 var Success = class {
   constructor(value) {
@@ -144980,7 +145401,11 @@ var Failure = class {
 
 // src/actions-util.ts
 function getActionsEnv() {
-  return { getOptionalInput };
+  return {
+    getRequiredInput,
+    getOptionalInput,
+    exportVariable: core3.exportVariable
+  };
 }
 var getRequiredInput = function(name) {
   const value = core3.getInput(name);
@@ -144993,31 +145418,30 @@ var getOptionalInput = function(name) {
   const value = core3.getInput(name);
   return value.length > 0 ? value : void 0;
 };
-function getTemporaryDirectory() {
-  const value = process.env["CODEQL_ACTION_TEMP"];
-  return value !== void 0 && value !== "" ? value : getRequiredEnvParam("RUNNER_TEMP" /* RUNNER_TEMP */);
+function getTemporaryDirectory(env = getEnv()) {
+  return env.getOptional("CODEQL_ACTION_TEMP" /* TEMP */) ?? env.getRequired("RUNNER_TEMP" /* RUNNER_TEMP */);
 }
 var PR_DIFF_RANGE_JSON_FILENAME = "pr-diff-range.json";
-function getDiffRangesJsonFilePath() {
-  return path2.join(getTemporaryDirectory(), PR_DIFF_RANGE_JSON_FILENAME);
+function getDiffRangesJsonFilePath(env = getEnv()) {
+  return path2.join(getTemporaryDirectory(env), PR_DIFF_RANGE_JSON_FILENAME);
 }
 function getActionVersion() {
-  return "4.37.0";
+  return "4.37.6";
 }
-function getWorkflowEventName() {
-  return getRequiredEnvParam("GITHUB_EVENT_NAME" /* GITHUB_EVENT_NAME */);
+function getWorkflowEventName(env = getEnv()) {
+  return env.getRequired("GITHUB_EVENT_NAME" /* GITHUB_EVENT_NAME */);
 }
-function isRunningLocalAction() {
-  const relativeScriptPath = getRelativeScriptPath();
+function isRunningLocalAction(env = getEnv()) {
+  const relativeScriptPath = getRelativeScriptPath(env);
   return relativeScriptPath.startsWith("..") || path2.isAbsolute(relativeScriptPath);
 }
-function getRelativeScriptPath() {
-  const runnerTemp = getRequiredEnvParam("RUNNER_TEMP" /* RUNNER_TEMP */);
+function getRelativeScriptPath(env) {
+  const runnerTemp = env.getRequired("RUNNER_TEMP" /* RUNNER_TEMP */);
   const actionsDirectory = path2.join(path2.dirname(runnerTemp), "_actions");
   return path2.relative(actionsDirectory, __filename);
 }
-function getWorkflowEvent() {
-  const eventJsonFile = getRequiredEnvParam("GITHUB_EVENT_PATH" /* GITHUB_EVENT_PATH */);
+function getWorkflowEvent(env = getEnv()) {
+  const eventJsonFile = env.getRequired("GITHUB_EVENT_PATH" /* GITHUB_EVENT_PATH */);
   try {
     return JSON.parse(fs2.readFileSync(eventJsonFile, "utf-8"));
   } catch (e) {
@@ -145073,8 +145497,8 @@ function getUploadValue(input) {
       return "always";
   }
 }
-function getWorkflowRunID() {
-  const workflowRunIdString = getRequiredEnvParam("GITHUB_RUN_ID" /* GITHUB_RUN_ID */);
+function getWorkflowRunID(env = getEnv()) {
+  const workflowRunIdString = env.getRequired("GITHUB_RUN_ID" /* GITHUB_RUN_ID */);
   const workflowRunID = parseInt(workflowRunIdString, 10);
   if (Number.isNaN(workflowRunID)) {
     throw new Error(
@@ -145088,8 +145512,8 @@ function getWorkflowRunID() {
   }
   return workflowRunID;
 }
-function getWorkflowRunAttempt() {
-  const workflowRunAttemptString = getRequiredEnvParam(
+function getWorkflowRunAttempt(env = getEnv()) {
+  const workflowRunAttemptString = env.getRequired(
     "GITHUB_RUN_ATTEMPT" /* GITHUB_RUN_ATTEMPT */
   );
   const workflowRunAttempt = parseInt(workflowRunAttemptString, 10);
@@ -145142,14 +145566,14 @@ var getFileType = async (filePath) => {
     throw e;
   }
 };
-function isSelfHostedRunner() {
-  return process.env.RUNNER_ENVIRONMENT === "self-hosted";
+function isSelfHostedRunner(env = getEnv()) {
+  return env.getOptional("RUNNER_ENVIRONMENT" /* RUNNER_ENVIRONMENT */) === "self-hosted";
 }
-function isDynamicWorkflow() {
-  return getWorkflowEventName() === "dynamic";
+function isDynamicWorkflow(env = getEnv()) {
+  return getWorkflowEventName(env) === "dynamic";
 }
-function isDefaultSetup() {
-  return isDynamicWorkflow();
+function isDefaultSetup(env = getEnv()) {
+  return isDynamicWorkflow(env);
 }
 function prettyPrintInvocation(cmd, args) {
   return [cmd, ...args].map((x) => x.includes(" ") ? `'${x}'` : x).join(" ");
@@ -145213,8 +145637,9 @@ async function runTool(cmd, args = [], opts = {}) {
   return stdout;
 }
 var persistedInputsKey = "persisted_inputs";
-var persistInputs = function() {
-  const inputEnvironmentVariables = Object.entries(process.env).filter(
+var persistInputs = function(env = getEnv()) {
+  const entries = env.entries();
+  const inputEnvironmentVariables = entries.filter(
     ([name]) => name.startsWith("INPUT_")
   );
   core3.saveState(persistedInputsKey, JSON.stringify(inputEnvironmentVariables));
@@ -145227,7 +145652,7 @@ var restoreInputs = function() {
     }
   }
 };
-function getPullRequestBranches() {
+function getPullRequestBranches(env = getEnv()) {
   const pullRequest = github.context.payload.pull_request;
   if (pullRequest) {
     return {
@@ -145238,8 +145663,10 @@ function getPullRequestBranches() {
       head: pullRequest.head.label
     };
   }
-  const codeScanningRef = process.env.CODE_SCANNING_REF;
-  const codeScanningBaseBranch = process.env.CODE_SCANNING_BASE_BRANCH;
+  const codeScanningRef = env.getOptional("CODE_SCANNING_REF" /* CODE_SCANNING_REF */);
+  const codeScanningBaseBranch = env.getOptional(
+    "CODE_SCANNING_BASE_BRANCH" /* CODE_SCANNING_BASE_BRANCH */
+  );
   if (codeScanningRef && codeScanningBaseBranch) {
     return {
       base: codeScanningBaseBranch,
@@ -145250,8 +145677,8 @@ function getPullRequestBranches() {
   }
   return void 0;
 }
-function isAnalyzingPullRequest() {
-  return getPullRequestBranches() !== void 0;
+function isAnalyzingPullRequest(env = getEnv()) {
+  return getPullRequestBranches(env) !== void 0;
 }
 var qualityCategoryMapping = {
   "c#": "csharp",
@@ -145263,8 +145690,8 @@ var qualityCategoryMapping = {
   typescript: "javascript-typescript",
   kotlin: "java-kotlin"
 };
-function fixCodeQualityCategory(logger, category) {
-  if (category !== void 0 && isDefaultSetup() && category.startsWith("/language:")) {
+function fixCodeQualityCategory(logger, category, env = getEnv()) {
+  if (category !== void 0 && isDefaultSetup(env) && category.startsWith("/language:")) {
     const language = category.substring("/language:".length);
     const mappedLanguage = qualityCategoryMapping[language];
     if (mappedLanguage) {
@@ -145323,6 +145750,59 @@ function formatDuration(durationMs) {
 var os3 = __toESM(require("os"));
 var core7 = __toESM(require_core());
 
+// node_modules/uuid/dist-node/regex.js
+var regex_default = /^(?:[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$/i;
+
+// node_modules/uuid/dist-node/validate.js
+function validate(uuid) {
+  return typeof uuid === "string" && regex_default.test(uuid);
+}
+var validate_default = validate;
+
+// node_modules/uuid/dist-node/stringify.js
+var byteToHex = [];
+for (let i = 0; i < 256; ++i) {
+  byteToHex.push((i + 256).toString(16).slice(1));
+}
+function unsafeStringify(arr, offset = 0) {
+  return (byteToHex[arr[offset + 0]] + byteToHex[arr[offset + 1]] + byteToHex[arr[offset + 2]] + byteToHex[arr[offset + 3]] + "-" + byteToHex[arr[offset + 4]] + byteToHex[arr[offset + 5]] + "-" + byteToHex[arr[offset + 6]] + byteToHex[arr[offset + 7]] + "-" + byteToHex[arr[offset + 8]] + byteToHex[arr[offset + 9]] + "-" + byteToHex[arr[offset + 10]] + byteToHex[arr[offset + 11]] + byteToHex[arr[offset + 12]] + byteToHex[arr[offset + 13]] + byteToHex[arr[offset + 14]] + byteToHex[arr[offset + 15]]).toLowerCase();
+}
+
+// node_modules/uuid/dist-node/rng.js
+var rnds8 = new Uint8Array(16);
+function rng() {
+  return crypto.getRandomValues(rnds8);
+}
+
+// node_modules/uuid/dist-node/v4.js
+function v4(options, buf, offset) {
+  if (!buf && !options && crypto.randomUUID) {
+    return crypto.randomUUID();
+  }
+  return _v4(options, buf, offset);
+}
+function _v4(options, buf, offset) {
+  options = options || {};
+  const rnds = options.random ?? options.rng?.() ?? rng();
+  if (rnds.length < 16) {
+    throw new Error("Random bytes length must be >= 16");
+  }
+  rnds[6] = rnds[6] & 15 | 64;
+  rnds[8] = rnds[8] & 63 | 128;
+  if (buf) {
+    offset = offset || 0;
+    if (offset < 0 || offset + 16 > buf.length) {
+      throw new RangeError(`UUID byte range ${offset}:${offset + 15} is out of buffer bounds`);
+    }
+    for (let i = 0; i < 16; ++i) {
+      buf[offset + i] = rnds[i];
+    }
+    return buf;
+  }
+  return unsafeStringify(rnds);
+}
+var v4_default = v4;
+
 // src/api-client.ts
 var core5 = __toESM(require_core());
 var githubUtils = __toESM(require_utils4());
@@ -145402,6 +145882,9 @@ function retry(octokit, octokitOptions) {
 }
 retry.VERSION = VERSION7;
 
+// src/api-client.ts
+var import_undici = __toESM(require_undici());
+
 // src/repository.ts
 function getRepositoryNwo() {
   return getRepositoryNwoFromEnv("GITHUB_REPOSITORY");
@@ -145429,9 +145912,44 @@ function parseRepositoryNwo(input) {
 // src/api-client.ts
 var GITHUB_ENTERPRISE_VERSION_HEADER = "x-github-enterprise-version";
 var DO_NOT_RETRY_STATUSES = [400, 410, 422, 451];
-function createApiClientWithDetails(apiDetails, { allowExternal = false } = {}) {
+function getRegistryProxyConfig(action) {
+  return {
+    host: action.env.getOptional("CODEQL_PROXY_HOST" /* PROXY_HOST */),
+    port: action.env.getOptional("CODEQL_PROXY_PORT" /* PROXY_PORT */),
+    ca: action.env.getOptional("CODEQL_PROXY_CA_CERTIFICATE" /* PROXY_CA_CERTIFICATE */)
+  };
+}
+function getRegistryProxy(action) {
+  const { host, port, ca } = getRegistryProxyConfig(action);
+  if (host && port) {
+    const uri = `http://${host}:${port}`;
+    action.logger.debug(
+      `Using private registry proxy at '${uri}' for API client.`
+    );
+    return new import_undici.ProxyAgent({
+      uri,
+      keepAliveTimeout: 10,
+      keepAliveMaxTimeout: 10,
+      requestTls: ca ? { ca } : void 0
+    });
+  }
+  return void 0;
+}
+function makeProxyRequestOptions(dispatcher) {
+  if (dispatcher === void 0) {
+    return githubUtils.defaults.request;
+  }
+  return {
+    ...githubUtils.defaults.request,
+    fetch: (req, init2) => {
+      return (0, import_undici.fetch)(req, { ...init2, dispatcher });
+    }
+  };
+}
+function createApiClientWithDetails(apiDetails, { allowExternal = false, proxy = void 0 } = {}) {
   const auth2 = allowExternal && apiDetails.externalRepoAuth || apiDetails.auth;
   const retryingOctokit = githubUtils.GitHub.plugin(retry);
+  const requestOptions = makeProxyRequestOptions(proxy);
   return new retryingOctokit(
     githubUtils.getOctokitOptions(auth2, {
       baseUrl: apiDetails.apiURL,
@@ -145442,24 +145960,25 @@ function createApiClientWithDetails(apiDetails, { allowExternal = false } = {})
         warn: core5.warning,
         error: core5.error
       },
+      request: requestOptions,
       retry: {
         doNotRetry: DO_NOT_RETRY_STATUSES
       }
     })
   );
 }
-function getApiDetails() {
+function getApiDetails(env = getEnv()) {
   return {
     auth: getRequiredInput("token"),
-    url: getRequiredEnvParam("GITHUB_SERVER_URL" /* GITHUB_SERVER_URL */),
-    apiURL: getRequiredEnvParam("GITHUB_API_URL" /* GITHUB_API_URL */)
+    url: env.getRequired("GITHUB_SERVER_URL" /* GITHUB_SERVER_URL */),
+    apiURL: env.getRequired("GITHUB_API_URL" /* GITHUB_API_URL */)
   };
 }
-function getApiClient() {
-  return createApiClientWithDetails(getApiDetails());
+function getApiClient(env = getEnv()) {
+  return createApiClientWithDetails(getApiDetails(env));
 }
-function getApiClientWithExternalAuth(apiDetails) {
-  return createApiClientWithDetails(apiDetails, { allowExternal: true });
+function getApiClientWithExternalAuth(apiDetails, proxy) {
+  return createApiClientWithDetails(apiDetails, { allowExternal: true, proxy });
 }
 function getAuthorizationHeaderFor(logger, apiDetails, url2) {
   if (url2.startsWith(`${apiDetails.url}/`) || apiDetails.apiURL && url2.startsWith(`${apiDetails.apiURL}/`)) {
@@ -145895,6 +146414,148 @@ async function getGeneratedFiles(workingDirectory) {
   return generatedFiles;
 }
 
+// src/start-proxy/types.ts
+var usernameSchema = {
+  /** The username needed to authenticate to the package registry, if any. */
+  username: optionalOrNull(string)
+};
+function hasUsername(config) {
+  return "username" in config;
+}
+var usernamePasswordSchema = {
+  /** The password needed to authenticate to the package registry, if any. */
+  password: optionalOrNull(string),
+  ...usernameSchema
+};
+function hasUsernameAndPassword(config) {
+  return hasUsername(config) && "password" in config;
+}
+var tokenSchema = {
+  /** The token needed to authenticate to the package registry, if any. */
+  token: optionalOrNull(string),
+  ...usernameSchema
+};
+function hasToken(config) {
+  return "token" in config;
+}
+function isToken(config) {
+  return "token" in config && validateSchema(tokenSchema, config);
+}
+var azureConfigSchema = {
+  "tenant-id": string,
+  "client-id": string
+};
+function isAzureConfig(config) {
+  return validateSchema(azureConfigSchema, config);
+}
+var awsConfigSchema = {
+  "aws-region": string,
+  "account-id": string,
+  "role-name": string,
+  domain: string,
+  "domain-owner": string,
+  audience: optionalOrNull(string)
+};
+function isAWSConfig(config) {
+  return validateSchema(awsConfigSchema, config);
+}
+var jfrogConfigSchema = {
+  "jfrog-oidc-provider-name": string,
+  audience: optionalOrNull(string),
+  "identity-mapping-name": optionalOrNull(string)
+};
+function isJFrogConfig(config) {
+  return validateSchema(jfrogConfigSchema, config);
+}
+var cloudsmithConfigSchema = {
+  namespace: string,
+  "service-slug": string,
+  "api-host": string
+};
+function isCloudsmithConfig(config) {
+  return validateSchema(cloudsmithConfigSchema, config);
+}
+var gcpConfigSchema = {
+  "workload-identity-provider": string,
+  "service-account": optionalOrNull(string),
+  audience: optionalOrNull(string)
+};
+function isGCPConfig(config) {
+  return validateSchema(gcpConfigSchema, config);
+}
+var oidcSchemas = [
+  { schema: azureConfigSchema, name: "Azure" },
+  { schema: awsConfigSchema, name: "AWS" },
+  { schema: jfrogConfigSchema, name: "JFrog" },
+  { schema: cloudsmithConfigSchema, name: "Cloudsmith" },
+  { schema: gcpConfigSchema, name: "GCP" }
+];
+function credentialToStr(credential) {
+  let result = `Type: ${credential.type};`;
+  const appendIfDefined = (name, val) => {
+    if (isDefined2(val)) {
+      result += ` ${name}: ${val};`;
+    }
+  };
+  appendIfDefined("Url", credential.url);
+  appendIfDefined("Host", credential.host);
+  if (hasUsername(credential)) {
+    appendIfDefined("Username", credential.username);
+  }
+  if ("password" in credential) {
+    appendIfDefined(
+      "Password",
+      isDefined2(credential.password) ? "***" : void 0
+    );
+  }
+  if (hasToken(credential)) {
+    appendIfDefined("Token", isDefined2(credential.token) ? "***" : void 0);
+  }
+  if (isAzureConfig(credential)) {
+    appendIfDefined("Tenant", credential["tenant-id"]);
+    appendIfDefined("Client", credential["client-id"]);
+  } else if (isAWSConfig(credential)) {
+    appendIfDefined("AWS Region", credential["aws-region"]);
+    appendIfDefined("AWS Account", credential["account-id"]);
+    appendIfDefined("AWS Role", credential["role-name"]);
+    appendIfDefined("AWS Domain", credential.domain);
+    appendIfDefined("AWS Domain Owner", credential["domain-owner"]);
+    appendIfDefined("AWS Audience", credential.audience);
+  } else if (isJFrogConfig(credential)) {
+    appendIfDefined("JFrog Provider", credential["jfrog-oidc-provider-name"]);
+    appendIfDefined(
+      "JFrog Identity Mapping",
+      credential["identity-mapping-name"]
+    );
+    appendIfDefined("JFrog Audience", credential.audience);
+  } else if (isCloudsmithConfig(credential)) {
+    appendIfDefined("Cloudsmith Namespace", credential.namespace);
+    appendIfDefined("Cloudsmith Service Slug", credential["service-slug"]);
+    appendIfDefined("Cloudsmith API Host", credential["api-host"]);
+  } else if (isGCPConfig(credential)) {
+    appendIfDefined(
+      "GCP Workload Identity Provider",
+      credential["workload-identity-provider"]
+    );
+    appendIfDefined("GCP Service Account", credential["service-account"]);
+    appendIfDefined("GCP Audience", credential.audience);
+  }
+  return result;
+}
+var registryBaseSchema = {
+  /** The type of the package registry. */
+  type: string,
+  /** Whether the registry replaces the base registry for the ecosystem. */
+  "replaces-base": optional(boolean)
+};
+function getAddressString(address) {
+  if (address.url === void 0) {
+    return address.host;
+  } else {
+    return address.url;
+  }
+}
+
 // src/status-report.ts
 function getDisplayActionName(actionName) {
   if (actionName === "finish" /* Analyze */) {
@@ -145902,6 +146563,17 @@ function getDisplayActionName(actionName) {
   }
   return actionName;
 }
+function getJobUUID(action) {
+  const existingJobRunUuid = action.env.getOptional("CODEQL_ACTION_JOB_RUN_UUID" /* JOB_RUN_UUID */);
+  if (existingJobRunUuid !== void 0 && validate_default(existingJobRunUuid)) {
+    action.logger.info(`Existing job run UUID is ${existingJobRunUuid}.`);
+    return existingJobRunUuid;
+  }
+  const jobRunUuid = v4_default();
+  action.logger.info(`Job run UUID is ${jobRunUuid}.`);
+  action.actions.exportVariable("CODEQL_ACTION_JOB_RUN_UUID" /* JOB_RUN_UUID */, jobRunUuid);
+  return jobRunUuid;
+}
 function isFirstPartyAnalysis(actionName) {
   if (actionName !== "upload-sarif" /* UploadSarif */) {
     return true;
@@ -145952,11 +146624,39 @@ function setJobStatusIfUnsuccessful(actionStatus) {
     );
   }
 }
+function getRegistryTypesFromEnv(logger, env = getEnv()) {
+  const value = env.getOptional("CODEQL_PROXY_URLS" /* PROXY_URLS */);
+  if (value === void 0) {
+    return void 0;
+  }
+  try {
+    const data = JSON.parse(value);
+    if (!isArray(data)) {
+      logger.debug(
+        `Expected '${"CODEQL_PROXY_URLS" /* PROXY_URLS */}' to contain a JSON array, but got '${typeof data}'.`
+      );
+      return void 0;
+    }
+    if (!validateArray(registryBaseSchema, data)) {
+      logger.debug(
+        `Expected '${"CODEQL_PROXY_URLS" /* PROXY_URLS */}' to contain a JSON array of registry objects, but got something else.`
+      );
+      return void 0;
+    }
+    const types2 = new Set(data.map((r) => r.type));
+    return Array.from(types2).sort().join(",");
+  } catch (err) {
+    logger.debug(
+      `Failed to parse '${"CODEQL_PROXY_URLS" /* PROXY_URLS */}': ${getErrorMessage(err)}.`
+    );
+    return void 0;
+  }
+}
 async function createStatusReportBase(actionName, status, actionStartedAt, config, diskInfo, logger, cause, exception) {
   try {
     const commitOid = getOptionalInput("sha") || process.env["GITHUB_SHA"] || "";
     const ref = await getRef();
-    const jobRunUUID = process.env["JOB_RUN_UUID" /* JOB_RUN_UUID */] || "";
+    const jobRunUUID = process.env["CODEQL_ACTION_JOB_RUN_UUID" /* JOB_RUN_UUID */] || "";
     const workflowRunID = getWorkflowRunID();
     const workflowRunAttempt = getWorkflowRunAttempt();
     const workflowName = process.env["GITHUB_WORKFLOW"] || "";
@@ -145986,10 +146686,12 @@ async function createStatusReportBase(actionName, status, actionStartedAt, confi
       analysis_key,
       build_mode: config?.buildMode,
       commit_oid: commitOid,
+      computed_inputs: {},
       first_party_analysis: isFirstPartyAnalysis(actionName),
       job_name: jobName,
       job_run_uuid: jobRunUUID,
       ref,
+      registry_types: getRegistryTypesFromEnv(logger),
       runner_os: runnerOs,
       started_at: workflowStartedAt,
       status,
@@ -146183,18 +146885,26 @@ async function runInActions(action) {
   const env = getEnv();
   const actionsEnv = getActionsEnv();
   try {
-    await action.run({
+    const actionState = {
       name: action.name,
       startedAt,
       logger,
       env,
       actions: actionsEnv
-    });
+    };
+    getJobUUID(actionState);
+    await action.run(actionState);
   } catch (error3) {
     core8.setFailed(
       `${getDisplayActionName(action.name)} action failed: ${getErrorMessage(error3)}`
     );
-    await sendUnhandledErrorStatusReport(action.name, startedAt, error3, logger);
+    const statusReportError = action.transformTelemetryError !== void 0 ? action.transformTelemetryError(wrapError(error3)) : error3;
+    await sendUnhandledErrorStatusReport(
+      action.name,
+      startedAt,
+      statusReportError,
+      logger
+    );
   }
 }
 
@@ -146204,8 +146914,8 @@ var path5 = __toESM(require("path"));
 var semver4 = __toESM(require_semver2());
 
 // src/defaults.json
-var bundleVersion = "codeql-bundle-v2.26.0";
-var cliVersion = "2.26.0";
+var bundleVersion = "codeql-bundle-v2.26.2";
+var cliVersion = "2.26.2";
 
 // src/overlay/index.ts
 var fs4 = __toESM(require("fs"));
@@ -146339,14 +147049,14 @@ var LINKED_CODEQL_VERSION = {
   tagName: bundleVersion
 };
 var featureConfig = {
-  ["allow_multiple_analysis_kinds" /* AllowMultipleAnalysisKinds */]: {
+  ["allow_merge_config_files" /* AllowMergeConfigFiles */]: {
     defaultValue: false,
-    envVar: "CODEQL_ACTION_ALLOW_MULTIPLE_ANALYSIS_KINDS",
+    envVar: "CODEQL_ACTION_ALLOW_MERGE_CONFIG_FILES",
     minimumVersion: void 0
   },
-  ["allow_toolcache_input" /* AllowToolcacheInput */]: {
+  ["allow_multiple_analysis_kinds" /* AllowMultipleAnalysisKinds */]: {
     defaultValue: false,
-    envVar: "CODEQL_ACTION_ALLOW_TOOLCACHE_INPUT",
+    envVar: "CODEQL_ACTION_ALLOW_MULTIPLE_ANALYSIS_KINDS",
     minimumVersion: void 0
   },
   ["cleanup_trap_caches" /* CleanupTrapCaches */]: {
@@ -146423,11 +147133,6 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_JAVA_NETWORK_DEBUGGING",
     minimumVersion: void 0
   },
-  ["new_remote_file_addresses" /* NewRemoteFileAddresses */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_NEW_REMOTE_FILE_ADDRESSES",
-    minimumVersion: void 0
-  },
   ["overlay_analysis" /* OverlayAnalysis */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS",
@@ -146548,6 +147253,11 @@ var featureConfig = {
     legacyApi: true,
     minimumVersion: void 0
   },
+  ["proxy_api_requests" /* ProxyApiRequests */]: {
+    defaultValue: false,
+    envVar: "CODEQL_ACTION_PROXY_API_REQUESTS",
+    minimumVersion: void 0
+  },
   ["skip_file_coverage_on_prs" /* SkipFileCoverageOnPrs */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_SKIP_FILE_COVERAGE_ON_PRS",
@@ -146559,6 +147269,11 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_START_PROXY_USE_FEATURES_RELEASE",
     minimumVersion: void 0
   },
+  ["tools_repository_property" /* ToolsRepositoryProperty */]: {
+    defaultValue: false,
+    envVar: "CODEQL_ACTION_TOOLS_REPOSITORY_PROPERTY",
+    minimumVersion: void 0
+  },
   ["upload_overlay_db_to_api" /* UploadOverlayDbToApi */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_UPLOAD_OVERLAY_DB_TO_API",
@@ -147364,10 +148079,112 @@ function getDependencyCachingEnabled() {
 }
 
 // src/config/db-config.ts
-var path6 = __toESM(require("path"));
+var path7 = __toESM(require("path"));
 var jsonschema = __toESM(require_lib2());
 var semver5 = __toESM(require_semver2());
 
+// src/diagnostics.ts
+var import_fs = require("fs");
+var import_path = __toESM(require("path"));
+var unwrittenDiagnostics = [];
+var unwrittenDefaultLanguageDiagnostics = [];
+var diagnosticCounter = 0;
+function makeDiagnostic(id, name, data = void 0) {
+  return {
+    ...data,
+    timestamp: data?.timestamp ?? (/* @__PURE__ */ new Date()).toISOString(),
+    source: { ...data?.source, id, name }
+  };
+}
+function addDiagnostic(config, language, diagnostic) {
+  const logger = getActionsLogger();
+  const databasePath = language ? getCodeQLDatabasePath(config, language) : config.dbLocation;
+  if ((0, import_fs.existsSync)(databasePath)) {
+    writeDiagnostic(config, language, diagnostic);
+  } else {
+    logger.debug(
+      `Writing a diagnostic for ${language}, but the database at ${databasePath} does not exist yet.`
+    );
+    unwrittenDiagnostics.push({ diagnostic, language });
+  }
+}
+function addNoLanguageDiagnostic(config, diagnostic) {
+  if (config !== void 0) {
+    addDiagnostic(
+      config,
+      // Arbitrarily choose the first language. We could also choose all languages, but that
+      // increases the risk of misinterpreting the data.
+      config.languages[0],
+      diagnostic
+    );
+  } else {
+    unwrittenDefaultLanguageDiagnostics.push(diagnostic);
+  }
+}
+function writeDiagnostic(config, language, diagnostic) {
+  const logger = getActionsLogger();
+  const databasePath = language ? getCodeQLDatabasePath(config, language) : config.dbLocation;
+  const diagnosticsPath = import_path.default.resolve(
+    databasePath,
+    "diagnostic",
+    "codeql-action"
+  );
+  try {
+    (0, import_fs.mkdirSync)(diagnosticsPath, { recursive: true });
+    const uniqueSuffix = (diagnosticCounter++).toString();
+    const sanitizedTimestamp = diagnostic.timestamp.replace(
+      /[^a-zA-Z0-9.-]/g,
+      ""
+    );
+    const jsonPath = import_path.default.resolve(
+      diagnosticsPath,
+      `codeql-action-${sanitizedTimestamp}-${uniqueSuffix}.json`
+    );
+    (0, import_fs.writeFileSync)(jsonPath, JSON.stringify(diagnostic));
+  } catch (err) {
+    logger.warning(`Unable to write diagnostic message to database: ${err}`);
+    logger.debug(JSON.stringify(diagnostic));
+  }
+}
+function logUnwrittenDiagnostics() {
+  const logger = getActionsLogger();
+  const num = unwrittenDiagnostics.length;
+  if (num > 0) {
+    logger.warning(
+      `${num} diagnostic(s) could not be written to the database and will not appear on the Tool Status Page.`
+    );
+    for (const unwritten of unwrittenDiagnostics) {
+      logger.debug(JSON.stringify(unwritten.diagnostic));
+    }
+  }
+}
+function flushDiagnostics(config) {
+  const logger = getActionsLogger();
+  const diagnosticsCount = unwrittenDiagnostics.length + unwrittenDefaultLanguageDiagnostics.length;
+  logger.debug(`Writing ${diagnosticsCount} diagnostic(s) to database.`);
+  for (const unwritten of unwrittenDiagnostics) {
+    writeDiagnostic(config, unwritten.language, unwritten.diagnostic);
+  }
+  for (const unwritten of unwrittenDefaultLanguageDiagnostics) {
+    addNoLanguageDiagnostic(config, unwritten);
+  }
+  unwrittenDiagnostics = [];
+  unwrittenDefaultLanguageDiagnostics = [];
+}
+function makeTelemetryDiagnostic(id, name, attributes, tags) {
+  return makeDiagnostic(id, name, {
+    attributes,
+    visibility: {
+      cliSummaryTable: false,
+      statusPage: false,
+      telemetry: true
+    },
+    source: {
+      tags
+    }
+  });
+}
+
 // src/error-messages.ts
 var PACKS_PROPERTY = "packs";
 function getConfigFileOutsideWorkspaceErrorMessage(configFile) {
@@ -147383,11 +148200,6 @@ function getInvalidConfigFileMessage(configFile, messages) {
   const andMore = messages.length > 10 ? `, and ${messages.length - 10} more.` : ".";
   return `The configuration file "${configFile}" is invalid: ${messages.slice(0, 10).join(", ")}${andMore}`;
 }
-function getConfigFileRepoOldFormatInvalidMessage(configFile) {
-  let error3 = `The configuration file "${configFile}" is not a supported remote file reference.`;
-  error3 += " Expected format <owner>/<repository>/<file-path>@<ref>";
-  return error3;
-}
 function getConfigFileRepoFormatInvalidMessage(configFile) {
   let error3 = `The configuration file "${configFile}" is not a supported remote file reference.`;
   error3 += " Expected format [<owner>/]<repository>[@<ref>][:<file-path>]";
@@ -147427,12 +148239,14 @@ function getUnknownLanguagesError(languages) {
 }
 
 // src/feature-flags/properties.ts
+var github2 = __toESM(require_github());
 var GITHUB_CODEQL_PROPERTY_PREFIX = "github-codeql-";
 var RepositoryPropertyName = /* @__PURE__ */ ((RepositoryPropertyName2) => {
   RepositoryPropertyName2["CONFIG_FILE"] = "github-codeql-config-file";
   RepositoryPropertyName2["DISABLE_OVERLAY"] = "github-codeql-disable-overlay";
   RepositoryPropertyName2["EXTRA_QUERIES"] = "github-codeql-extra-queries";
   RepositoryPropertyName2["FILE_COVERAGE_ON_PRS"] = "github-codeql-file-coverage-on-prs";
+  RepositoryPropertyName2["TOOLS"] = "github-codeql-tools";
   return RepositoryPropertyName2;
 })(RepositoryPropertyName || {});
 function isString2(value) {
@@ -147451,7 +148265,8 @@ var repositoryPropertyParsers = {
   ["github-codeql-config-file" /* CONFIG_FILE */]: stringProperty,
   ["github-codeql-disable-overlay" /* DISABLE_OVERLAY */]: booleanProperty,
   ["github-codeql-extra-queries" /* EXTRA_QUERIES */]: stringProperty,
-  ["github-codeql-file-coverage-on-prs" /* FILE_COVERAGE_ON_PRS */]: booleanProperty
+  ["github-codeql-file-coverage-on-prs" /* FILE_COVERAGE_ON_PRS */]: booleanProperty,
+  ["github-codeql-tools" /* TOOLS */]: stringProperty
 };
 async function loadPropertiesFromApi(logger, repositoryNwo) {
   try {
@@ -147531,8 +148346,105 @@ var KNOWN_REPOSITORY_PROPERTY_NAMES = new Set(
 function isKnownPropertyName(name) {
   return KNOWN_REPOSITORY_PROPERTY_NAMES.has(name);
 }
+async function loadRepositoryProperties(repositoryNwo, logger) {
+  const repositoryOwnerType = github2.context.payload.repository?.owner.type;
+  logger.debug(
+    `Repository owner type is '${repositoryOwnerType ?? "unknown"}'.`
+  );
+  if (repositoryOwnerType === "User") {
+    logger.debug(
+      "Skipping loading repository properties because the repository is owned by a user and therefore cannot have repository properties."
+    );
+    return new Success({});
+  }
+  try {
+    return new Success(await loadPropertiesFromApi(logger, repositoryNwo));
+  } catch (error3) {
+    logger.warning(
+      `Failed to load repository properties: ${getErrorMessage(error3)}`
+    );
+    return new Failure(error3);
+  }
+}
 
 // src/config/db-config.ts
+var ORG_SCHEMA = {
+  /** An array of model pack names. */
+  "model-packs": optional(array(string))
+};
+var DEFAULT_SETUP_SCHEMA = {
+  org: optional(object(ORG_SCHEMA))
+};
+var DEFAULT_SETUP_CONFIG_SCHEMA = {
+  "threat-models": optional(array(string)),
+  "default-setup": optional(
+    object(DEFAULT_SETUP_SCHEMA)
+  )
+};
+function mergeDefaultSetupAndUserConfigs(logger, fromConfigInput, fromConfigFile) {
+  logger.debug(
+    "Combining configuration files from 'config' and 'config-file' inputs"
+  );
+  const schemaCheckResult = checkSchema(
+    DEFAULT_SETUP_CONFIG_SCHEMA,
+    fromConfigInput
+  );
+  if (schemaCheckResult.invalidKeys.length > 0) {
+    logger.warning(
+      `Invalid keys in Default Setup configuration: ${schemaCheckResult.invalidKeys.join(", ")}`
+    );
+    addNoLanguageDiagnostic(
+      void 0,
+      makeTelemetryDiagnostic(
+        "codeql-action/invalid-default-setup-config-keys",
+        "Invalid Default Setup configuration keys",
+        {
+          invalidKeys: schemaCheckResult.invalidKeys
+        },
+        ["internal-error"]
+      )
+    );
+  }
+  if (schemaCheckResult.unknownKeys.length > 0) {
+    logger.warning(
+      `Unrecognised keys in Default Setup configuration: ${schemaCheckResult.unknownKeys.join(", ")}`
+    );
+    addNoLanguageDiagnostic(
+      void 0,
+      makeTelemetryDiagnostic(
+        "codeql-action/unrecognised-default-setup-config-keys",
+        "Unrecognised Default Setup configuration keys",
+        {
+          unrecognisedKeys: schemaCheckResult.unknownKeys
+        },
+        ["internal-error"]
+      )
+    );
+  }
+  const threatModels = new Set(fromConfigInput["threat-models"] || []);
+  for (const configFileThreatModel of fromConfigFile["threat-models"] || []) {
+    threatModels.add(configFileThreatModel);
+  }
+  if (fromConfigFile["default-setup"]) {
+    logger.warning(
+      `The 'default-setup' configuration key is not supported in user-supplied configuration files and will be ignored.`
+    );
+  }
+  const result = { ...fromConfigFile };
+  delete result["threat-models"];
+  delete result["default-setup"];
+  if (fromConfigInput["default-setup"]?.org?.["model-packs"]) {
+    result["default-setup"] = {
+      org: {
+        "model-packs": fromConfigInput["default-setup"].org["model-packs"]
+      }
+    };
+  }
+  if (threatModels.size > 0) {
+    result["threat-models"] = Array.from(threatModels);
+  }
+  return result;
+}
 function shouldCombine(inputValue) {
   return !!inputValue?.trim().startsWith("+");
 }
@@ -147572,11 +148484,11 @@ function parsePacksSpecification(packStr) {
       throw new ConfigurationError(getPacksStrInvalid(packStr));
     }
   }
-  if (packPath && (path6.isAbsolute(packPath) || // Permit using "/" instead of "\" on Windows
+  if (packPath && (path7.isAbsolute(packPath) || // Permit using "/" instead of "\" on Windows
   // Use `x.split(y).join(z)` as a polyfill for `x.replaceAll(y, z)` since
   // if we used a regex we'd need to escape the path separator on Windows
   // which seems more awkward.
-  path6.normalize(packPath).split(path6.sep).join("/") !== packPath.split(path6.sep).join("/"))) {
+  path7.normalize(packPath).split(path7.sep).join("/") !== packPath.split(path7.sep).join("/"))) {
     throw new ConfigurationError(getPacksStrInvalid(packStr));
   }
   if (!packPath && pathStart) {
@@ -147772,7 +148684,7 @@ function parseUserConfig(logger, pathInput, contents, validateConfig) {
 }
 
 // src/config/remote-file.ts
-var DEFAULT_CONFIG_FILE_NAME = ".github/codeql-action.yaml";
+var DEFAULT_CONFIG_FILE_NAME = ".github/codeql-config.yml";
 var DEFAULT_CONFIG_FILE_REF = "main";
 function getDefaultOwner(env) {
   const currentRepoNwo = env.getRequired("GITHUB_REPOSITORY" /* GITHUB_REPOSITORY */);
@@ -147799,66 +148711,76 @@ function parseOldRemoteFileAddress(input) {
     ref: pieces.groups.ref.trim()
   });
 }
-async function parseRemoteFileAddress(actionState, configFile) {
-  const oldFormatAddressResult = parseOldRemoteFileAddress(configFile);
-  if (oldFormatAddressResult.isSuccess()) {
-    return oldFormatAddressResult.value;
-  }
-  const allowNewFormat = await actionState.features.getValue(
-    "new_remote_file_addresses" /* NewRemoteFileAddresses */
-  );
-  if (!allowNewFormat) {
-    throw new ConfigurationError(
-      getConfigFileRepoOldFormatInvalidMessage(configFile)
-    );
-  }
+function parseNewRemoteFileAddress(env, configFile) {
   const format = new RegExp(
     "^((?<owner>[^:@/]+)/)?(?<repo>[^:@/]+)(@(?<ref>[^:]+))?(:(?<path>.+))?$"
   );
   const pieces = format.exec(configFile.trim());
   const repo = pieces?.groups?.repo?.trim();
   if (!pieces?.groups || !repo || repo.length === 0) {
-    throw new ConfigurationError(
-      getConfigFileRepoFormatInvalidMessage(configFile)
-    );
+    return new Failure(void 0);
   }
   const owner = pieces.groups.owner?.trim();
   const path29 = pieces.groups.path?.trim();
   const ref = pieces.groups.ref?.trim();
-  if (path29?.startsWith("/")) {
+  return new Success({
+    owner: owner || getDefaultOwner(env),
+    repo,
+    path: path29 || DEFAULT_CONFIG_FILE_NAME,
+    ref: ref || DEFAULT_CONFIG_FILE_REF
+  });
+}
+async function parseRemoteFileAddress(actionState, configFile) {
+  const oldFormatAddressResult = parseOldRemoteFileAddress(configFile);
+  if (oldFormatAddressResult.isSuccess()) {
+    return oldFormatAddressResult.value;
+  }
+  const newFormatAddressResult = parseNewRemoteFileAddress(
+    actionState.env,
+    configFile
+  );
+  if (newFormatAddressResult.isFailure()) {
+    throw new ConfigurationError(
+      getConfigFileRepoFormatInvalidMessage(configFile)
+    );
+  }
+  const address = newFormatAddressResult.value;
+  if (address.path.startsWith("/")) {
     throw new ConfigurationError(
       `The path component of '${configFile}' cannot be an absolute path.`
     );
   }
-  return {
-    owner: owner || getDefaultOwner(actionState.env),
-    repo,
-    path: path29 || DEFAULT_CONFIG_FILE_NAME,
-    ref: ref || DEFAULT_CONFIG_FILE_REF
-  };
+  return address;
 }
 
 // src/config/file.ts
+var LOCAL_PATH_PREFIX = "./";
+var REMOTE_PATH_PREFIX = "remote=";
 async function getConfigFileInput({
   logger,
   actions,
   features
-}, repositoryProperties) {
+}, repositoryProperties, analysisKinds) {
   const input = actions.getOptionalInput("config-file");
   if (input !== void 0) {
     logger.info(`Using configuration file input from workflow: ${input}`);
     return input;
   }
   const propertyValue = repositoryProperties["github-codeql-config-file" /* CONFIG_FILE */];
+  const analysisKindSupported = analysisKinds === void 0 || analysisKinds.includes("code-scanning" /* CodeScanning */) && analysisKinds.length === 1;
   if (propertyValue !== void 0 && propertyValue.trim().length > 0) {
     const useRepositoryProperty = await features.getValue(
       "config_file_repository_property" /* ConfigFileRepositoryProperty */
     );
-    if (useRepositoryProperty) {
+    if (analysisKindSupported && useRepositoryProperty) {
       logger.info(
         `Using configuration file input from repository property: ${propertyValue}`
       );
       return propertyValue;
+    } else if (!analysisKindSupported) {
+      logger.info(
+        "Ignoring configuration file input from repository property, because it is unsupported for the current analysis kind."
+      );
     } else {
       logger.info(
         "Ignoring configuration file input from repository property, because the corresponding feature flag is disabled."
@@ -147869,7 +148791,11 @@ async function getConfigFileInput({
 }
 async function getRemoteConfig(actionState, configFile, apiDetails) {
   const address = await parseRemoteFileAddress(actionState, configFile);
-  const response = await getApiClientWithExternalAuth(apiDetails).rest.repos.getContent({
+  const shouldProxyRequest = await actionState.features.getValue(
+    "proxy_api_requests" /* ProxyApiRequests */
+  );
+  const proxy = shouldProxyRequest ? getRegistryProxy(actionState) : void 0;
+  const response = await getApiClientWithExternalAuth(apiDetails, proxy).rest.repos.getContent({
     owner: address.owner,
     repo: address.repo,
     path: address.path,
@@ -147898,105 +148824,6 @@ async function getRemoteConfig(actionState, configFile, apiDetails) {
   );
 }
 
-// src/diagnostics.ts
-var import_fs = require("fs");
-var import_path = __toESM(require("path"));
-var unwrittenDiagnostics = [];
-var unwrittenDefaultLanguageDiagnostics = [];
-var diagnosticCounter = 0;
-function makeDiagnostic(id, name, data = void 0) {
-  return {
-    ...data,
-    timestamp: data?.timestamp ?? (/* @__PURE__ */ new Date()).toISOString(),
-    source: { ...data?.source, id, name }
-  };
-}
-function addDiagnostic(config, language, diagnostic) {
-  const logger = getActionsLogger();
-  const databasePath = language ? getCodeQLDatabasePath(config, language) : config.dbLocation;
-  if ((0, import_fs.existsSync)(databasePath)) {
-    writeDiagnostic(config, language, diagnostic);
-  } else {
-    logger.debug(
-      `Writing a diagnostic for ${language}, but the database at ${databasePath} does not exist yet.`
-    );
-    unwrittenDiagnostics.push({ diagnostic, language });
-  }
-}
-function addNoLanguageDiagnostic(config, diagnostic) {
-  if (config !== void 0) {
-    addDiagnostic(
-      config,
-      // Arbitrarily choose the first language. We could also choose all languages, but that
-      // increases the risk of misinterpreting the data.
-      config.languages[0],
-      diagnostic
-    );
-  } else {
-    unwrittenDefaultLanguageDiagnostics.push(diagnostic);
-  }
-}
-function writeDiagnostic(config, language, diagnostic) {
-  const logger = getActionsLogger();
-  const databasePath = language ? getCodeQLDatabasePath(config, language) : config.dbLocation;
-  const diagnosticsPath = import_path.default.resolve(
-    databasePath,
-    "diagnostic",
-    "codeql-action"
-  );
-  try {
-    (0, import_fs.mkdirSync)(diagnosticsPath, { recursive: true });
-    const uniqueSuffix = (diagnosticCounter++).toString();
-    const sanitizedTimestamp = diagnostic.timestamp.replace(
-      /[^a-zA-Z0-9.-]/g,
-      ""
-    );
-    const jsonPath = import_path.default.resolve(
-      diagnosticsPath,
-      `codeql-action-${sanitizedTimestamp}-${uniqueSuffix}.json`
-    );
-    (0, import_fs.writeFileSync)(jsonPath, JSON.stringify(diagnostic));
-  } catch (err) {
-    logger.warning(`Unable to write diagnostic message to database: ${err}`);
-    logger.debug(JSON.stringify(diagnostic));
-  }
-}
-function logUnwrittenDiagnostics() {
-  const logger = getActionsLogger();
-  const num = unwrittenDiagnostics.length;
-  if (num > 0) {
-    logger.warning(
-      `${num} diagnostic(s) could not be written to the database and will not appear on the Tool Status Page.`
-    );
-    for (const unwritten of unwrittenDiagnostics) {
-      logger.debug(JSON.stringify(unwritten.diagnostic));
-    }
-  }
-}
-function flushDiagnostics(config) {
-  const logger = getActionsLogger();
-  const diagnosticsCount = unwrittenDiagnostics.length + unwrittenDefaultLanguageDiagnostics.length;
-  logger.debug(`Writing ${diagnosticsCount} diagnostic(s) to database.`);
-  for (const unwritten of unwrittenDiagnostics) {
-    writeDiagnostic(config, unwritten.language, unwritten.diagnostic);
-  }
-  for (const unwritten of unwrittenDefaultLanguageDiagnostics) {
-    addNoLanguageDiagnostic(config, unwritten);
-  }
-  unwrittenDiagnostics = [];
-  unwrittenDefaultLanguageDiagnostics = [];
-}
-function makeTelemetryDiagnostic(id, name, attributes) {
-  return makeDiagnostic(id, name, {
-    attributes,
-    visibility: {
-      cliSummaryTable: false,
-      statusPage: false,
-      telemetry: true
-    }
-  });
-}
-
 // src/diff-informed-analysis-utils.ts
 var fs6 = __toESM(require("fs"));
 async function getDiffInformedAnalysisBranches(codeql, features, logger) {
@@ -148839,6 +149666,9 @@ async function loadUserConfig(actionState, configFile, workspacePath, apiDetails
     );
     return getLocalConfig(actionState.logger, configFile, validateConfig);
   } else {
+    if (isExplicitRemotePath(configFile)) {
+      configFile = configFile.substring(REMOTE_PATH_PREFIX.length);
+    }
     return await getRemoteConfig(actionState, configFile, apiDetails);
   }
 }
@@ -149125,32 +149955,69 @@ async function applyIncrementalAnalysisSettings(config, hasDiffRanges, codeql, l
     });
   }
 }
-async function initConfig(actionState, inputs) {
-  const { logger, features } = actionState;
-  const { tempDir } = inputs;
+async function determineUserConfig(action, tempDir, inputs) {
+  const validateConfig = await action.features.getValue(
+    "validate_db_config" /* ValidateDbConfig */
+  );
   if (inputs.configInput) {
-    if (inputs.configFile) {
-      logger.warning(
-        `Both a config file and config input were provided. Ignoring config file.`
+    const computedConfigPath = userConfigFromActionPath(tempDir);
+    const allowMergeConfigs = () => action.features.getValue("allow_merge_config_files" /* AllowMergeConfigFiles */);
+    if (inputs.configFile && isDefaultSetup(action.env) && await allowMergeConfigs()) {
+      const fromConfigInput = parseUserConfig(
+        action.logger,
+        "`config` input",
+        inputs.configInput,
+        validateConfig
+      );
+      const fromConfigFile = await loadUserConfig(
+        action,
+        inputs.configFile,
+        inputs.workspacePath,
+        inputs.apiDetails,
+        tempDir
+      );
+      const mergedConfig = mergeDefaultSetupAndUserConfigs(
+        action.logger,
+        fromConfigInput,
+        fromConfigFile
+      );
+      fs9.writeFileSync(computedConfigPath, dump(mergedConfig));
+      action.logger.debug(
+        `Using merged configurations from 'config' input with configuration from '${inputs.configFile}': ${computedConfigPath}`
+      );
+      inputs.configFile = computedConfigPath;
+      return mergedConfig;
+    } else {
+      if (inputs.configFile) {
+        action.logger.warning(
+          `Both a config file and config input were provided. Ignoring config file.`
+        );
+      }
+      fs9.writeFileSync(computedConfigPath, inputs.configInput);
+      inputs.configFile = computedConfigPath;
+      action.logger.debug(
+        `Using config from action input: ${inputs.configFile}`
       );
     }
-    inputs.configFile = userConfigFromActionPath(tempDir);
-    fs9.writeFileSync(inputs.configFile, inputs.configInput);
-    logger.debug(`Using config from action input: ${inputs.configFile}`);
   }
-  let userConfig = {};
   if (!inputs.configFile) {
-    logger.debug("No configuration file was provided");
+    action.logger.debug("No configuration file was provided");
+    return {};
   } else {
-    logger.debug(`Using configuration file: ${inputs.configFile}`);
-    userConfig = await loadUserConfig(
-      actionState,
+    action.logger.debug(`Using configuration file: ${inputs.configFile}`);
+    return await loadUserConfig(
+      action,
       inputs.configFile,
       inputs.workspacePath,
       inputs.apiDetails,
       tempDir
     );
   }
+}
+async function initConfig(actionState, inputs) {
+  const { logger, features } = actionState;
+  const { tempDir } = inputs;
+  const userConfig = await determineUserConfig(actionState, tempDir, inputs);
   const config = await initActionState(inputs, userConfig);
   if (config.analysisKinds.length === 1 && isCodeQualityEnabled(config)) {
     if (hasQueryCustomisation(config.computedConfig)) {
@@ -149167,7 +150034,6 @@ async function initConfig(actionState, inputs) {
   try {
     gitVersion = await getGitVersionOrThrow();
     logger.info(`Using Git version ${gitVersion.fullVersion}`);
-    await logGitVersionTelemetry(config, gitVersion);
   } catch (e) {
     logger.warning(`Could not determine Git version: ${getErrorMessage(e)}`);
     if (isInTestMode() && process.env["CODEQL_ACTION_TOLERATE_MISSING_GIT_VERSION" /* TOLERATE_MISSING_GIT_VERSION */] !== "true") {
@@ -149261,11 +150127,23 @@ async function initConfig(actionState, inputs) {
   await setCppTrapCachingEnvironmentVariables(config, logger);
   return config;
 }
+function isExplicitLocalPath(configPath) {
+  return configPath.startsWith(LOCAL_PATH_PREFIX);
+}
+function isExplicitRemotePath(configPath) {
+  return configPath.startsWith(REMOTE_PATH_PREFIX);
+}
+function containsAtRef(configPath) {
+  return configPath.includes("@");
+}
 function isLocal(configPath) {
-  if (configPath.indexOf("./") === 0) {
+  if (isExplicitLocalPath(configPath)) {
     return true;
   }
-  return configPath.indexOf("@") === -1;
+  if (isExplicitRemotePath(configPath)) {
+    return false;
+  }
+  return !containsAtRef(configPath);
 }
 function getLocalConfig(logger, configFile, validateConfig) {
   if (!fs9.existsSync(configFile)) {
@@ -149431,21 +150309,6 @@ function getPrimaryAnalysisKind(config) {
 function getPrimaryAnalysisConfig(config) {
   return getAnalysisConfig(getPrimaryAnalysisKind(config));
 }
-async function logGitVersionTelemetry(config, gitVersion) {
-  if (config.languages.length > 0) {
-    addNoLanguageDiagnostic(
-      config,
-      makeTelemetryDiagnostic(
-        "codeql-action/git-version-telemetry",
-        "Git version telemetry",
-        {
-          fullVersion: gitVersion.fullVersion,
-          truncatedVersion: gitVersion.truncatedVersion
-        }
-      )
-    );
-  }
-}
 async function logGeneratedFilesTelemetry(config, duration, generatedFilesCount) {
   if (config.languages.length < 1) {
     return;
@@ -149470,50 +150333,6 @@ var toolcache3 = __toESM(require_tool_cache());
 var import_fast_deep_equal = __toESM(require_fast_deep_equal());
 var semver9 = __toESM(require_semver2());
 
-// node_modules/uuid/dist-node/stringify.js
-var byteToHex = [];
-for (let i = 0; i < 256; ++i) {
-  byteToHex.push((i + 256).toString(16).slice(1));
-}
-function unsafeStringify(arr, offset = 0) {
-  return (byteToHex[arr[offset + 0]] + byteToHex[arr[offset + 1]] + byteToHex[arr[offset + 2]] + byteToHex[arr[offset + 3]] + "-" + byteToHex[arr[offset + 4]] + byteToHex[arr[offset + 5]] + "-" + byteToHex[arr[offset + 6]] + byteToHex[arr[offset + 7]] + "-" + byteToHex[arr[offset + 8]] + byteToHex[arr[offset + 9]] + "-" + byteToHex[arr[offset + 10]] + byteToHex[arr[offset + 11]] + byteToHex[arr[offset + 12]] + byteToHex[arr[offset + 13]] + byteToHex[arr[offset + 14]] + byteToHex[arr[offset + 15]]).toLowerCase();
-}
-
-// node_modules/uuid/dist-node/rng.js
-var rnds8 = new Uint8Array(16);
-function rng() {
-  return crypto.getRandomValues(rnds8);
-}
-
-// node_modules/uuid/dist-node/v4.js
-function v4(options, buf, offset) {
-  if (!buf && !options && crypto.randomUUID) {
-    return crypto.randomUUID();
-  }
-  return _v4(options, buf, offset);
-}
-function _v4(options, buf, offset) {
-  options = options || {};
-  const rnds = options.random ?? options.rng?.() ?? rng();
-  if (rnds.length < 16) {
-    throw new Error("Random bytes length must be >= 16");
-  }
-  rnds[6] = rnds[6] & 15 | 64;
-  rnds[8] = rnds[8] & 63 | 128;
-  if (buf) {
-    offset = offset || 0;
-    if (offset < 0 || offset + 16 > buf.length) {
-      throw new RangeError(`UUID byte range ${offset}:${offset + 15} is out of buffer bounds`);
-    }
-    for (let i = 0; i < 16; ++i) {
-      buf[offset + i] = rnds[i];
-    }
-    return buf;
-  }
-  return unsafeStringify(rnds);
-}
-var v4_default = v4;
-
 // src/overlay/caching.ts
 var fs10 = __toESM(require("fs"));
 var actionsCache3 = __toESM(require_cache4());
@@ -149931,10 +150750,12 @@ async function extractTarZst(tar, dest, tarVersion, logger) {
         reject(new Error(`Error while extracting tar: ${err}`));
       });
       if (tar instanceof stream.Readable) {
-        tar.pipe(tarProcess.stdin).on("error", (err) => {
-          reject(
-            new Error(`Error while downloading and extracting tar: ${err}`)
-          );
+        stream.pipeline(tar, tarProcess.stdin, (err) => {
+          if (err) {
+            reject(
+              new Error(`Error while downloading and extracting tar: ${err}`)
+            );
+          }
         });
       }
       tarProcess.on("exit", (code) => {
@@ -149981,23 +150802,8 @@ var toolcache2 = __toESM(require_tool_cache());
 var import_follow_redirects = __toESM(require_follow_redirects());
 var semver8 = __toESM(require_semver2());
 var STREAMING_HIGH_WATERMARK_BYTES = 4 * 1024 * 1024;
+var STREAMING_STALL_TIMEOUT_MS = 5 * 60 * 1e3;
 var TOOLCACHE_TOOL_NAME = "CodeQL";
-function makeDownloadFirstToolsDownloadDurations(downloadDurationMs, extractionDurationMs) {
-  return {
-    combinedDurationMs: downloadDurationMs + extractionDurationMs,
-    downloadDurationMs,
-    extractionDurationMs,
-    streamExtraction: false
-  };
-}
-function makeStreamedToolsDownloadDurations(combinedDurationMs) {
-  return {
-    combinedDurationMs,
-    downloadDurationMs: void 0,
-    extractionDurationMs: void 0,
-    streamExtraction: true
-  };
-}
 async function downloadAndExtract(codeqlURL, compressionMethod, dest, authorization, headers, tarVersion, logger) {
   logger.info(
     `Downloading CodeQL tools from ${codeqlURL} . This may take a while.`
@@ -150022,11 +150828,7 @@ async function downloadAndExtract(codeqlURL, compressionMethod, dest, authorizat
           combinedDurationMs
         )}).`
       );
-      return {
-        compressionMethod,
-        toolsUrl: sanitizeUrlForStatusReport(codeqlURL),
-        ...makeStreamedToolsDownloadDurations(combinedDurationMs)
-      };
+      return {};
     }
   } catch (e) {
     core11.warning(
@@ -150068,14 +150870,7 @@ async function downloadAndExtract(codeqlURL, compressionMethod, dest, authorizat
   } finally {
     await cleanUpPath(archivedBundlePath, "CodeQL bundle archive", logger);
   }
-  return {
-    compressionMethod,
-    toolsUrl: sanitizeUrlForStatusReport(codeqlURL),
-    ...makeDownloadFirstToolsDownloadDurations(
-      downloadDurationMs,
-      extractionDurationMs
-    )
-  };
+  return { downloadDurationMs };
 }
 async function downloadAndExtractZstdWithStreaming(codeqlURL, dest, authorization, headers, tarVersion, logger) {
   fs12.mkdirSync(dest, { recursive: true });
@@ -150085,8 +150880,8 @@ async function downloadAndExtractZstdWithStreaming(codeqlURL, dest, authorizatio
     authorization ? { authorization } : {},
     headers
   );
-  const response = await new Promise(
-    (resolve14) => import_follow_redirects.https.get(
+  const response = await new Promise((resolve14, reject) => {
+    const request3 = import_follow_redirects.https.get(
       codeqlURL,
       {
         headers,
@@ -150096,9 +150891,18 @@ async function downloadAndExtractZstdWithStreaming(codeqlURL, dest, authorizatio
         agent
       },
       (r) => resolve14(r)
-    )
-  );
+    );
+    request3.on("error", reject);
+    request3.setTimeout(STREAMING_STALL_TIMEOUT_MS, () => {
+      request3.destroy(
+        new Error(
+          `No data received for ${formatDuration(STREAMING_STALL_TIMEOUT_MS)}.`
+        )
+      );
+    });
+  });
   if (response.statusCode !== 200) {
+    response.resume();
     throw new Error(
       `Failed to download CodeQL bundle from ${codeqlURL}. HTTP status code: ${response.statusCode}.`
     );
@@ -150118,11 +150922,6 @@ function writeToolcacheMarkerFile(extractedPath, logger) {
   fs12.writeFileSync(markerFilePath, "");
   logger.info(`Created toolcache marker file ${markerFilePath}`);
 }
-function sanitizeUrlForStatusReport(url2) {
-  return ["github/codeql-action", "dsp-testing/codeql-cli-nightlies"].some(
-    (repo) => url2.startsWith(`https://github.com/${repo}/releases/download/`)
-  ) ? url2 : "sanitized-value";
-}
 
 // src/setup-codeql.ts
 var CODEQL_DEFAULT_ACTION_REPOSITORY = "github/codeql-action";
@@ -150414,10 +151213,7 @@ async function getCodeQLSource(toolsInput, defaultCliVersion, rawLanguages, useO
     }
   } else if (toolsInput !== void 0 && toolsInput === CODEQL_TOOLCACHE_INPUT) {
     let latestToolcacheVersion;
-    const allowToolcacheValueFF = await features.getValue(
-      "allow_toolcache_input" /* AllowToolcacheInput */
-    );
-    const allowToolcacheValue = allowToolcacheValueFF && (isDynamicWorkflow() || isInTestMode());
+    const allowToolcacheValue = isDynamicWorkflow() || isInTestMode();
     if (allowToolcacheValue) {
       logger.info(
         `Attempting to use the latest CodeQL CLI version in the toolcache, as requested by 'tools: ${toolsInput}'.`
@@ -150433,15 +151229,9 @@ async function getCodeQLSource(toolsInput, defaultCliVersion, rawLanguages, useO
           `Found no CodeQL CLI in the toolcache, ignoring 'tools: ${toolsInput}'...`
         );
       } else {
-        if (allowToolcacheValueFF) {
-          logger.warning(
-            `Ignoring 'tools: ${toolsInput}' because the workflow was not triggered dynamically.`
-          );
-        } else {
-          logger.info(
-            `Ignoring 'tools: ${toolsInput}' because the feature is not enabled.`
-          );
-        }
+        logger.warning(
+          `Ignoring 'tools: ${toolsInput}' because the workflow was not triggered dynamically.`
+        );
       }
       const version = await resolveDefaultCliVersion(
         defaultCliVersion,
@@ -150731,8 +151521,7 @@ async function setupCodeQLBundle(toolsInput, apiDetails, tempDir, variant, defau
     codeqlFolder,
     toolsDownloadStatusReport,
     toolsSource,
-    toolsVersion,
-    zstdAvailability
+    toolsVersion
   };
 }
 async function useZstdBundle(cliVersion2, tarSupportsZstd) {
@@ -150856,9 +151645,9 @@ async function getCombinedTracerConfig(codeql, config) {
 // src/codeql.ts
 var cachedCodeQL = void 0;
 var CODEQL_MINIMUM_VERSION = "2.19.4";
-var CODEQL_NEXT_MINIMUM_VERSION = "2.19.4";
-var GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.15";
-var GHES_MOST_RECENT_DEPRECATION_DATE = "2026-04-09";
+var CODEQL_NEXT_MINIMUM_VERSION = "2.20.7";
+var GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.16";
+var GHES_MOST_RECENT_DEPRECATION_DATE = "2026-07-01";
 var EXTRACTION_DEBUG_MODE_VERBOSITY = "progress++";
 async function setupCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliVersion, rawLanguages, useOverlayAwareDefaultCliVersion, features, logger, checkVersion) {
   try {
@@ -150866,8 +151655,7 @@ async function setupCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliV
       codeqlFolder,
       toolsDownloadStatusReport,
       toolsSource,
-      toolsVersion,
-      zstdAvailability
+      toolsVersion
     } = await setupCodeQLBundle(
       toolsInput,
       apiDetails,
@@ -150879,11 +151667,6 @@ async function setupCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliV
       features,
       logger
     );
-    logger.debug(
-      `Bundle download status report: ${JSON.stringify(
-        toolsDownloadStatusReport
-      )}`
-    );
     let codeqlCmd = path14.join(codeqlFolder, "codeql", "codeql");
     if (process.platform === "win32") {
       codeqlCmd += ".exe";
@@ -150897,8 +151680,7 @@ async function setupCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliV
       codeql: cachedCodeQL,
       toolsDownloadStatusReport,
       toolsSource,
-      toolsVersion,
-      zstdAvailability
+      toolsVersion
     };
   } catch (rawError) {
     const e = wrapApiConfigurationError(rawError);
@@ -151435,7 +152217,7 @@ function applyAutobuildAzurePipelinesTimeoutFix() {
   ].join(" ");
 }
 async function getJobRunUuidSarifOptions() {
-  const jobRunUuid = process.env["JOB_RUN_UUID" /* JOB_RUN_UUID */];
+  const jobRunUuid = process.env["CODEQL_ACTION_JOB_RUN_UUID" /* JOB_RUN_UUID */];
   return jobRunUuid ? [`--sarif-run-property=jobRunUuid=${jobRunUuid}`] : [];
 }
 
@@ -151491,7 +152273,7 @@ async function setupCppAutobuild(codeql, logger) {
     logger
   );
   if (await features.getValue("cpp_dependency_installation_enabled" /* CppDependencyInstallation */, codeql)) {
-    if (process.env["RUNNER_ENVIRONMENT"] === "self-hosted" && process.env[envVar] !== "true") {
+    if (process.env["RUNNER_ENVIRONMENT" /* RUNNER_ENVIRONMENT */] === "self-hosted" && process.env[envVar] !== "true") {
       logger.info(
         `Disabling ${featureName} as we are on a self-hosted runner.${getWorkflowEventName() !== "dynamic" ? ` To override this, set the ${envVar} environment variable to 'true' in your workflow. See ${"https://docs.github.com/en/actions/learn-github-actions/variables#defining-environment-variables-for-a-single-workflow" /* DEFINE_ENV_VARIABLES */} for more information.` : ""}`
       );
@@ -153506,17 +154288,11 @@ var fs19 = __toESM(require("fs"));
 var path17 = __toESM(require("path"));
 var core14 = __toESM(require_core());
 var toolrunner4 = __toESM(require_toolrunner());
-var github2 = __toESM(require_github());
+var github3 = __toESM(require_github());
 var io6 = __toESM(require_io());
 async function initCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliVersion, rawLanguages, useOverlayAwareDefaultCliVersion, features, logger) {
   logger.startGroup("Setup CodeQL tools");
-  const {
-    codeql,
-    toolsDownloadStatusReport,
-    toolsSource,
-    toolsVersion,
-    zstdAvailability
-  } = await setupCodeQL(
+  const { codeql, toolsDownloadStatusReport, toolsSource, toolsVersion } = await setupCodeQL(
     toolsInput,
     apiDetails,
     tempDir,
@@ -153534,8 +154310,7 @@ async function initCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliVe
     codeql,
     toolsDownloadStatusReport,
     toolsSource,
-    toolsVersion,
-    zstdAvailability
+    toolsVersion
   };
 }
 async function initConfig2(actionState, inputs) {
@@ -153710,7 +154485,7 @@ function logFileCoverageOnPrsDeprecationWarning(logger) {
   if (process.env["CODEQL_ACTION_DID_LOG_FILE_COVERAGE_ON_PRS_DEPRECATION" /* DID_LOG_FILE_COVERAGE_ON_PRS_DEPRECATION */]) {
     return;
   }
-  const repositoryOwnerType = github2.context.payload.repository?.owner.type;
+  const repositoryOwnerType = github3.context.payload.repository?.owner.type;
   let message = "Starting April 2026, the CodeQL Action will skip computing file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses.";
   const envVarOptOut = "set the `CODEQL_ACTION_FILE_COVERAGE_ON_PRS` environment variable to `true`.";
   const repoPropertyOptOut = 'create a custom repository property with the name `github-codeql-file-coverage-on-prs` and the type "True/false", then set this property to `true` in the repository\'s settings.';
@@ -154958,17 +155733,19 @@ function gte6(i, y) {
 }
 function expand_(str, max, isTop) {
   const expansions = [];
-  const m = balanced("{", "}", str);
-  if (!m)
-    return [str];
-  const pre = m.pre;
-  const post = m.post.length ? expand_(m.post, max, false) : [""];
-  if (/\$$/.test(m.pre)) {
-    for (let k = 0; k < post.length && k < max; k++) {
-      const expansion = pre + "{" + m.body + "}" + post[k];
-      expansions.push(expansion);
+  for (; ; ) {
+    const m = balanced("{", "}", str);
+    if (!m)
+      return [str];
+    const pre = m.pre;
+    if (/\$$/.test(m.pre)) {
+      const post2 = m.post.length ? expand_(m.post, max, false) : [""];
+      for (let k = 0; k < post2.length && k < max; k++) {
+        const expansion = pre + "{" + m.body + "}" + post2[k];
+        expansions.push(expansion);
+      }
+      return expansions;
     }
-  } else {
     const isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body);
     const isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body);
     const isSequence = isNumericSequence || isAlphaSequence;
@@ -154976,10 +155753,12 @@ function expand_(str, max, isTop) {
     if (!isSequence && !isOptions) {
       if (m.post.match(/,(?!,).*\}/)) {
         str = m.pre + "{" + m.body + escClose + m.post;
-        return expand_(str, max, true);
+        isTop = true;
+        continue;
       }
       return [str];
     }
+    const post = m.post.length ? expand_(m.post, max, false) : [""];
     let n;
     if (isSequence) {
       n = m.body.split(/\.\./);
@@ -155043,8 +155822,8 @@ function expand_(str, max, isTop) {
         }
       }
     }
+    return expansions;
   }
-  return expansions;
 }
 
 // node_modules/readdir-glob/node_modules/minimatch/dist/esm/assert-valid-pattern.js
@@ -155901,7 +156680,7 @@ var twoStarNoDot = "(?:(?!(?:\\/|^)\\.).)*?";
 var filter = (pattern, options = {}) => (p) => minimatch(p, pattern, options);
 minimatch.filter = filter;
 var ext = (a, b = {}) => Object.assign({}, a, b);
-var defaults = (def) => {
+var defaults2 = (def) => {
   if (!def || typeof def !== "object" || !Object.keys(def).length) {
     return minimatch;
   }
@@ -155937,7 +156716,7 @@ var defaults = (def) => {
     GLOBSTAR
   });
 };
-minimatch.defaults = defaults;
+minimatch.defaults = defaults2;
 var braceExpand = (pattern, options = {}) => {
   assertValidPattern(pattern);
   if (options.nobrace || !/\{(?:(?!\{).)*\}/.test(pattern)) {
@@ -156833,7 +157612,7 @@ var import_async = __toESM(require_async(), 1);
 var import_path6 = require("path");
 
 // node_modules/archiver/lib/error.js
-var import_util32 = __toESM(require("util"), 1);
+var import_util34 = __toESM(require("util"), 1);
 var ERROR_CODES = {
   ABORTED: "archive was aborted",
   DIRECTORYDIRPATHREQUIRED: "diretory dirpath argument must be a non-empty string value",
@@ -156858,7 +157637,7 @@ function ArchiverError(code, data) {
   this.code = code;
   this.data = data;
 }
-import_util32.default.inherits(ArchiverError, Error);
+import_util34.default.inherits(ArchiverError, Error);
 
 // node_modules/archiver/lib/core.js
 var import_readable_stream2 = __toESM(require_ours(), 1);
@@ -159789,10 +160568,43 @@ async function runWrapper3() {
 var fs28 = __toESM(require("fs"));
 var path24 = __toESM(require("path"));
 var core21 = __toESM(require_core());
-var github3 = __toESM(require_github());
 var io7 = __toESM(require_io());
 var semver10 = __toESM(require_semver2());
 
+// src/config/inputs.ts
+async function getToolsInput(action, repositoryProperties) {
+  const name = "tools" /* Tools */;
+  const input = action.actions.getOptionalInput(name);
+  const propertyValue = repositoryProperties["github-codeql-tools" /* TOOLS */];
+  const allowRepositoryProperty = await action.features.getValue(
+    "tools_repository_property" /* ToolsRepositoryProperty */
+  );
+  if (allowRepositoryProperty && propertyValue?.startsWith("!")) {
+    action.logger.info(
+      `Using ${name} input from repository property (enforced): ${propertyValue}`
+    );
+    return {
+      // Drop the '!' from the value.
+      value: propertyValue.substring(1),
+      source: "repository-property" /* RepositoryProperty */
+    };
+  }
+  if (input !== void 0) {
+    action.logger.info(`Using ${name} input from workflow: ${input}`);
+    return { value: input, source: "workflow" /* Workflow */ };
+  }
+  if (allowRepositoryProperty && propertyValue !== void 0) {
+    action.logger.info(
+      `Using ${name} input from repository property: ${propertyValue}`
+    );
+    return {
+      value: propertyValue,
+      source: "repository-property" /* RepositoryProperty */
+    };
+  }
+  return void 0;
+}
+
 // src/workflow.ts
 var fs27 = __toESM(require("fs"));
 var path23 = __toESM(require("path"));
@@ -160083,7 +160895,7 @@ async function sendStartingStatusReport(startedAt, config, logger) {
     await sendStatusReport(statusReportBase);
   }
 }
-async function sendCompletedStatusReport2(startedAt, config, configFile, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, toolsVersion, overlayBaseDatabaseStats, dependencyCachingResults, logger, error3) {
+async function sendCompletedStatusReport2(startedAt, config, configFile, toolsInput, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, toolsVersion, overlayBaseDatabaseStats, dependencyCachingResults, logger, error3) {
   const statusReportBase = await createStatusReportBase(
     "init" /* Init */,
     getActionsStatus(error3),
@@ -160100,11 +160912,14 @@ async function sendCompletedStatusReport2(startedAt, config, configFile, toolsDo
   const workflowLanguages = getOptionalInput("languages");
   const initStatusReport = {
     ...statusReportBase,
-    tools_input: getOptionalInput("tools") || "",
+    tools_input: toolsInput?.value || "",
     tools_resolved_version: toolsVersion,
     tools_source: toolsSource || "UNKNOWN" /* Unknown */,
     workflow_languages: workflowLanguages || ""
   };
+  if (toolsInput !== void 0) {
+    initStatusReport.computed_inputs.tools = toolsInput;
+  }
   const initToolsDownloadFields = {};
   if (toolsDownloadStatusReport?.downloadDurationMs !== void 0) {
     initToolsDownloadFields.tools_download_duration_ms = toolsDownloadStatusReport.downloadDurationMs;
@@ -160140,11 +160955,11 @@ async function run3(actionState) {
   let codeql;
   let features;
   let sourceRoot;
+  let toolsInput;
   let toolsDownloadStatusReport;
   let toolsFeatureFlagsValid;
   let toolsSource;
   let toolsVersion;
-  let zstdAvailability;
   try {
     initializeEnvironment(getActionVersion());
     persistInputs();
@@ -160169,15 +160984,7 @@ async function run3(actionState) {
       logger
     );
     const repositoryProperties = repositoryPropertiesResult.orElse({});
-    const jobRunUuid = v4_default();
-    logger.info(`Job run UUID is ${jobRunUuid}.`);
-    core21.exportVariable("JOB_RUN_UUID" /* JOB_RUN_UUID */, jobRunUuid);
     core21.exportVariable("CODEQL_ACTION_INIT_HAS_RUN" /* INIT_ACTION_HAS_RUN */, "true");
-    const actionStateWithFeatures = { ...actionState, features };
-    configFile = await getConfigFileInput(
-      actionStateWithFeatures,
-      repositoryProperties
-    );
     sourceRoot = path24.resolve(
       getRequiredEnvParam("GITHUB_WORKSPACE"),
       getOptionalInput("source-root") || ""
@@ -160190,12 +160997,22 @@ async function run3(actionState) {
         `Failed to parse analysis kinds for 'starting' status report: ${getErrorMessage(err)}`
       );
     }
+    const actionStateWithFeatures = { ...actionState, features };
+    configFile = await getConfigFileInput(
+      actionStateWithFeatures,
+      repositoryProperties,
+      analysisKinds
+    );
     await sendStartingStatusReport(startedAt, { analysisKinds }, logger);
     if (process.env["CODEQL_ACTION_SETUP_CODEQL_HAS_RUN" /* SETUP_CODEQL_ACTION_HAS_RUN */] === "true") {
       throw new ConfigurationError(
         `The 'init' action should not be run in the same workflow as 'setup-codeql'.`
       );
     }
+    toolsInput = await getToolsInput(
+      actionStateWithFeatures,
+      repositoryProperties
+    );
     const codeQLDefaultVersionInfo = await features.getEnabledDefaultCliVersions(gitHubVersion.type);
     toolsFeatureFlagsValid = codeQLDefaultVersionInfo.toolsFeatureFlagsValid;
     const rawLanguages = getRawLanguagesNoAutodetect(
@@ -160203,7 +161020,7 @@ async function run3(actionState) {
     );
     const useOverlayAwareDefaultCliVersion = analysisKinds?.length === 1 && analysisKinds[0] === "code-scanning" /* CodeScanning */;
     const initCodeQLResult = await initCodeQL(
-      getOptionalInput("tools"),
+      toolsInput?.value,
       apiDetails,
       getTemporaryDirectory(),
       gitHubVersion.type,
@@ -160217,7 +161034,6 @@ async function run3(actionState) {
     toolsDownloadStatusReport = initCodeQLResult.toolsDownloadStatusReport;
     toolsVersion = initCodeQLResult.toolsVersion;
     toolsSource = initCodeQLResult.toolsSource;
-    zstdAvailability = initCodeQLResult.zstdAvailability;
     await checkWorkflow(logger, codeql);
     if (
       // Only enable the experimental features env variable for Rust analysis if the user has explicitly
@@ -160348,19 +161164,6 @@ async function run3(actionState) {
     if (config.overlayDatabaseMode !== "overlay" /* Overlay */) {
       cleanupDatabaseClusterDirectory(config, logger);
     }
-    if (zstdAvailability) {
-      await recordZstdAvailability(config, zstdAvailability);
-    }
-    if (toolsDownloadStatusReport) {
-      addNoLanguageDiagnostic(
-        config,
-        makeTelemetryDiagnostic(
-          "codeql-action/bundle-download-telemetry",
-          "CodeQL bundle download telemetry",
-          toolsDownloadStatusReport
-        )
-      );
-    }
     const goFlags = process.env["GOFLAGS"];
     if (goFlags) {
       core21.exportVariable("GOFLAGS", goFlags);
@@ -160535,6 +161338,7 @@ exec ${goBinaryPath} "$@"`
       config,
       void 0,
       // We only report config info on success.
+      toolsInput,
       toolsDownloadStatusReport,
       toolsFeatureFlagsValid,
       toolsSource,
@@ -160552,6 +161356,7 @@ exec ${goBinaryPath} "$@"`
     startedAt,
     config,
     configFile,
+    toolsInput,
     toolsDownloadStatusReport,
     toolsFeatureFlagsValid,
     toolsSource,
@@ -160561,36 +161366,6 @@ exec ${goBinaryPath} "$@"`
     logger
   );
 }
-async function loadRepositoryProperties(repositoryNwo, logger) {
-  const repositoryOwnerType = github3.context.payload.repository?.owner.type;
-  logger.debug(
-    `Repository owner type is '${repositoryOwnerType ?? "unknown"}'.`
-  );
-  if (repositoryOwnerType === "User") {
-    logger.debug(
-      "Skipping loading repository properties because the repository is owned by a user and therefore cannot have repository properties."
-    );
-    return new Success({});
-  }
-  try {
-    return new Success(await loadPropertiesFromApi(logger, repositoryNwo));
-  } catch (error3) {
-    logger.warning(
-      `Failed to load repository properties: ${getErrorMessage(error3)}`
-    );
-    return new Failure(error3);
-  }
-}
-async function recordZstdAvailability(config, zstdAvailability) {
-  addNoLanguageDiagnostic(
-    config,
-    makeTelemetryDiagnostic(
-      "codeql-action/zstd-availability",
-      "Zstandard availability",
-      zstdAvailability
-    )
-  );
-}
 var init = {
   name: "init" /* Init */,
   run: run3
@@ -161141,7 +161916,7 @@ async function runWrapper6() {
 
 // src/setup-codeql-action.ts
 var core24 = __toESM(require_core());
-async function sendCompletedStatusReport3(startedAt, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, toolsVersion, logger, error3) {
+async function sendCompletedStatusReport3(startedAt, toolsInput, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, toolsVersion, logger, error3) {
   const statusReportBase = await createStatusReportBase(
     "setup-codeql" /* SetupCodeQL */,
     getActionsStatus(error3),
@@ -161157,11 +161932,14 @@ async function sendCompletedStatusReport3(startedAt, toolsDownloadStatusReport,
   }
   const initStatusReport = {
     ...statusReportBase,
-    tools_input: getOptionalInput("tools") || "",
+    tools_input: toolsInput?.value || "",
     tools_resolved_version: toolsVersion,
     tools_source: toolsSource || "UNKNOWN" /* Unknown */,
     workflow_languages: ""
   };
+  if (toolsInput !== void 0) {
+    initStatusReport.computed_inputs.tools = toolsInput;
+  }
   const initToolsDownloadFields = {};
   if (toolsDownloadStatusReport?.downloadDurationMs !== void 0) {
     initToolsDownloadFields.tools_download_duration_ms = toolsDownloadStatusReport.downloadDurationMs;
@@ -161171,11 +161949,10 @@ async function sendCompletedStatusReport3(startedAt, toolsDownloadStatusReport,
   }
   await sendStatusReport({ ...initStatusReport, ...initToolsDownloadFields });
 }
-async function run6({
-  startedAt,
-  logger
-}) {
+async function run6(actionState) {
+  const { logger, startedAt } = actionState;
   let codeql;
+  let toolsInput;
   let toolsDownloadStatusReport;
   let toolsFeatureFlagsValid;
   let toolsSource;
@@ -161198,9 +161975,12 @@ async function run6({
       getTemporaryDirectory(),
       logger
     );
-    const jobRunUuid = v4_default();
-    logger.info(`Job run UUID is ${jobRunUuid}.`);
-    core24.exportVariable("JOB_RUN_UUID" /* JOB_RUN_UUID */, jobRunUuid);
+    const repositoryPropertiesResult = await loadRepositoryProperties(
+      repositoryNwo,
+      logger
+    );
+    const repositoryProperties = repositoryPropertiesResult.orElse({});
+    const actionStateWithFeatures = { ...actionState, features };
     const statusReportBase = await createStatusReportBase(
       "setup-codeql" /* SetupCodeQL */,
       "starting",
@@ -161212,6 +161992,10 @@ async function run6({
     if (statusReportBase !== void 0) {
       await sendStatusReport(statusReportBase);
     }
+    toolsInput = await getToolsInput(
+      actionStateWithFeatures,
+      repositoryProperties
+    );
     const codeQLDefaultVersionInfo = await features.getEnabledDefaultCliVersions(gitHubVersion.type);
     toolsFeatureFlagsValid = codeQLDefaultVersionInfo.toolsFeatureFlagsValid;
     const rawLanguages = getRawLanguagesNoAutodetect(
@@ -161219,7 +162003,7 @@ async function run6({
     );
     const analysisKinds = await getAnalysisKinds(logger, features);
     const initCodeQLResult = await initCodeQL(
-      getOptionalInput("tools"),
+      toolsInput?.value,
       apiDetails,
       getTemporaryDirectory(),
       gitHubVersion.type,
@@ -161256,6 +162040,7 @@ async function run6({
   }
   await sendCompletedStatusReport3(
     startedAt,
+    toolsInput,
     toolsDownloadStatusReport,
     toolsFeatureFlagsValid,
     toolsSource,
@@ -161282,142 +162067,6 @@ var path26 = __toESM(require("path"));
 var core26 = __toESM(require_core());
 var toolcache4 = __toESM(require_tool_cache());
 
-// src/start-proxy/types.ts
-var usernameSchema = {
-  /** The username needed to authenticate to the package registry, if any. */
-  username: optional(string)
-};
-function hasUsername(config) {
-  return "username" in config;
-}
-var usernamePasswordSchema = {
-  /** The password needed to authenticate to the package registry, if any. */
-  password: optional(string),
-  ...usernameSchema
-};
-function hasUsernameAndPassword(config) {
-  return hasUsername(config) && "password" in config;
-}
-var tokenSchema = {
-  /** The token needed to authenticate to the package registry, if any. */
-  token: optional(string),
-  ...usernameSchema
-};
-function hasToken(config) {
-  return "token" in config;
-}
-function isToken(config) {
-  return "token" in config && validateSchema(tokenSchema, config);
-}
-var azureConfigSchema = {
-  "tenant-id": string,
-  "client-id": string
-};
-function isAzureConfig(config) {
-  return validateSchema(azureConfigSchema, config);
-}
-var awsConfigSchema = {
-  "aws-region": string,
-  "account-id": string,
-  "role-name": string,
-  domain: string,
-  "domain-owner": string,
-  audience: optional(string)
-};
-function isAWSConfig(config) {
-  return validateSchema(awsConfigSchema, config);
-}
-var jfrogConfigSchema = {
-  "jfrog-oidc-provider-name": string,
-  audience: optional(string),
-  "identity-mapping-name": optional(string)
-};
-function isJFrogConfig(config) {
-  return validateSchema(jfrogConfigSchema, config);
-}
-var cloudsmithConfigSchema = {
-  namespace: string,
-  "service-slug": string,
-  "api-host": string
-};
-function isCloudsmithConfig(config) {
-  return validateSchema(cloudsmithConfigSchema, config);
-}
-var gcpConfigSchema = {
-  "workload-identity-provider": string,
-  "service-account": optional(string),
-  audience: optional(string)
-};
-function isGCPConfig(config) {
-  return validateSchema(gcpConfigSchema, config);
-}
-var oidcSchemas = [
-  { schema: azureConfigSchema, name: "Azure" },
-  { schema: awsConfigSchema, name: "AWS" },
-  { schema: jfrogConfigSchema, name: "JFrog" },
-  { schema: cloudsmithConfigSchema, name: "Cloudsmith" },
-  { schema: gcpConfigSchema, name: "GCP" }
-];
-function credentialToStr(credential) {
-  let result = `Type: ${credential.type};`;
-  const appendIfDefined = (name, val) => {
-    if (isDefined2(val)) {
-      result += ` ${name}: ${val};`;
-    }
-  };
-  appendIfDefined("Url", credential.url);
-  appendIfDefined("Host", credential.host);
-  if (hasUsername(credential)) {
-    appendIfDefined("Username", credential.username);
-  }
-  if ("password" in credential) {
-    appendIfDefined(
-      "Password",
-      isDefined2(credential.password) ? "***" : void 0
-    );
-  }
-  if (hasToken(credential)) {
-    appendIfDefined("Token", isDefined2(credential.token) ? "***" : void 0);
-  }
-  if (isAzureConfig(credential)) {
-    appendIfDefined("Tenant", credential["tenant-id"]);
-    appendIfDefined("Client", credential["client-id"]);
-  } else if (isAWSConfig(credential)) {
-    appendIfDefined("AWS Region", credential["aws-region"]);
-    appendIfDefined("AWS Account", credential["account-id"]);
-    appendIfDefined("AWS Role", credential["role-name"]);
-    appendIfDefined("AWS Domain", credential.domain);
-    appendIfDefined("AWS Domain Owner", credential["domain-owner"]);
-    appendIfDefined("AWS Audience", credential.audience);
-  } else if (isJFrogConfig(credential)) {
-    appendIfDefined("JFrog Provider", credential["jfrog-oidc-provider-name"]);
-    appendIfDefined(
-      "JFrog Identity Mapping",
-      credential["identity-mapping-name"]
-    );
-    appendIfDefined("JFrog Audience", credential.audience);
-  } else if (isCloudsmithConfig(credential)) {
-    appendIfDefined("Cloudsmith Namespace", credential.namespace);
-    appendIfDefined("Cloudsmith Service Slug", credential["service-slug"]);
-    appendIfDefined("Cloudsmith API Host", credential["api-host"]);
-  } else if (isGCPConfig(credential)) {
-    appendIfDefined(
-      "GCP Workload Identity Provider",
-      credential["workload-identity-provider"]
-    );
-    appendIfDefined("GCP Service Account", credential["service-account"]);
-    appendIfDefined("GCP Audience", credential.audience);
-  }
-  return result;
-}
-function getAddressString(address) {
-  if (address.url === void 0) {
-    return address.host;
-  } else {
-    return address.url;
-  }
-}
-
 // src/start-proxy/validation.ts
 var core25 = __toESM(require_core());
 function cloneCredential(schema, obj) {
@@ -161527,6 +162176,10 @@ function isPAT(value) {
     GITHUB_PAT_FINE_GRAINED_PATTERN
   ]);
 }
+var ALWAYS_ENABLED_REGISTRY_TYPE = [
+  "git_source",
+  "docker_registry"
+];
 var LANGUAGE_TO_REGISTRY_TYPE = {
   actions: [],
   cpp: [],
@@ -161591,7 +162244,7 @@ function getCredentials(logger, registrySecrets, registriesCredentials, language
     }
     const authConfig = getAuthConfig(e);
     const address = getRegistryAddress(e);
-    if (registryTypeForLanguage && !registryTypeForLanguage.some((t) => t === e.type)) {
+    if (!ALWAYS_ENABLED_REGISTRY_TYPE.some((t) => t === e.type) && registryTypeForLanguage && !registryTypeForLanguage.some((t) => t === e.type)) {
       continue;
     }
     const isPrintable2 = (str) => {
@@ -162062,8 +162715,9 @@ async function checkConnections(logger, proxy, backend) {
 }
 
 // src/start-proxy-action.ts
-async function run7(startedAt) {
-  const logger = getActionsLogger();
+async function run7(action) {
+  const startedAt = action.startedAt;
+  const logger = action.logger;
   let features;
   let language;
   try {
@@ -162129,20 +162783,13 @@ async function run7(startedAt) {
     await sendFailedStatusReport(logger, startedAt, language, unwrappedError);
   }
 }
+var startProxyAction = {
+  name: "start-proxy" /* StartProxy */,
+  run: run7,
+  transformTelemetryError: getSafeErrorMessage
+};
 async function runWrapper8() {
-  const startedAt = /* @__PURE__ */ new Date();
-  const logger = getActionsLogger();
-  try {
-    await run7(startedAt);
-  } catch (error3) {
-    core27.setFailed(`start-proxy action failed: ${getErrorMessage(error3)}`);
-    await sendUnhandledErrorStatusReport(
-      "start-proxy" /* StartProxy */,
-      startedAt,
-      getSafeErrorMessage(wrapError(error3)),
-      logger
-    );
-  }
+  await runInActions(startProxyAction);
 }
 async function startProxy(binPath, config, logFilePath, logger) {
   const host = "127.0.0.1";
@@ -162524,7 +163171,7 @@ tmp/lib/tmp.js:
    *)
 
 js-yaml/dist/js-yaml.mjs:
-  (*! js-yaml 5.1.0 https://github.com/nodeca/js-yaml @license MIT *)
+  (*! js-yaml 5.2.2 https://github.com/nodeca/js-yaml @license MIT *)
 
 long/index.js:
   (**
diff --git a/package-lock.json b/package-lock.json
index 83c1027a0a..212400948a 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "codeql",
-  "version": "4.37.0",
+  "version": "4.37.6",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "codeql",
-      "version": "4.37.0",
+      "version": "4.37.6",
       "license": "MIT",
       "workspaces": [
         "pr-checks"
@@ -14,7 +14,7 @@
       "dependencies": {
         "@actions/artifact": "^5.0.3",
         "@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2",
-        "@actions/cache": "^5.1.0",
+        "@actions/cache": "^5.2.0",
         "@actions/core": "^2.0.3",
         "@actions/exec": "^2.0.0",
         "@actions/github": "^8.0.1",
@@ -22,17 +22,21 @@
         "@actions/http-client": "^3.0.0",
         "@actions/io": "^2.0.0",
         "@actions/tool-cache": "^3.0.1",
+        "@octokit/core": "^7.0.6",
+        "@octokit/plugin-paginate-rest": "^14.0.0",
+        "@octokit/plugin-rest-endpoint-methods": "^17.0.0",
         "@octokit/plugin-retry": "^8.1.0",
         "archiver": "^8.0.0",
         "fast-deep-equal": "^3.1.3",
         "follow-redirects": "^1.16.0",
         "get-folder-size": "^5.0.0",
         "https-proxy-agent": "^7.0.6",
-        "js-yaml": "^5.1.0",
+        "js-yaml": "^5.2.2",
         "jsonschema": "1.5.0",
         "long": "^5.3.2",
         "node-forge": "^1.4.0",
         "semver": "^7.8.5",
+        "undici": "^6.24.0",
         "uuid": "^14.0.1"
       },
       "devDependencies": {
@@ -47,21 +51,21 @@
         "@types/node-forge": "^1.3.14",
         "@types/sarif": "^2.1.7",
         "@types/semver": "^7.7.1",
-        "@types/sinon": "^21.0.1",
+        "@types/sinon": "^22.0.0",
         "ava": "^6.4.1",
         "esbuild": "^0.28.1",
-        "eslint": "^9.39.4",
+        "eslint": "^9.39.5",
         "eslint-import-resolver-typescript": "^4.4.5",
-        "eslint-plugin-github": "^6.0.0",
-        "eslint-plugin-import-x": "^4.17.0",
+        "eslint-plugin-github": "^6.1.1",
+        "eslint-plugin-import-x": "^4.17.1",
         "eslint-plugin-jsdoc": "^62.9.0",
         "eslint-plugin-no-async-foreach": "^0.1.1",
         "glob": "^13.0.6",
         "globals": "^17.7.0",
-        "nock": "^14.0.15",
-        "sinon": "^22.0.0",
+        "nock": "^14.0.16",
+        "sinon": "^22.1.0",
         "typescript": "^6.0.3",
-        "typescript-eslint": "^8.62.0"
+        "typescript-eslint": "^8.65.0"
       }
     },
     "node_modules/@aashutoshrathi/word-wrap": {
@@ -370,9 +374,9 @@
       "license": "Apache-2.0"
     },
     "node_modules/@actions/artifact/node_modules/brace-expansion": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.1.tgz",
-      "integrity": "sha512-WR1cURNjuvBLMZBMbqM0UoE+WAfdUcEV1ccD8PVBVOI+Z3ND4+SZbN8RsfT2bMuG1qwz5RFvPukSZm5fF2D5eA==",
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz",
+      "integrity": "sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==",
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^1.0.0"
@@ -455,9 +459,9 @@
       }
     },
     "node_modules/@actions/cache": {
-      "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/@actions/cache/-/cache-5.1.0.tgz",
-      "integrity": "sha512-kTIj4YPrjjRPKSGlj7f8eq+Pijoy/SKBEbJcAwNsQTFGEF29NGqj1mqD02/PmhV6r4bRAixycexAWpmUJ2aCwg==",
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/@actions/cache/-/cache-5.2.0.tgz",
+      "integrity": "sha512-1R1Oc8cuDNCygsIP7gLiKLGCymOw/k5FkGQkXZFcLz6/RWyMImkfP0dZX6kjA9SRAmANcKNocI2XrsIaZ1it8w==",
       "license": "MIT",
       "dependencies": {
         "@actions/core": "^2.0.0",
@@ -1530,9 +1534,9 @@
       }
     },
     "node_modules/@eslint/eslintrc/node_modules/js-yaml": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz",
-      "integrity": "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==",
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz",
+      "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==",
       "dev": true,
       "funding": [
         {
@@ -1553,9 +1557,9 @@
       }
     },
     "node_modules/@eslint/js": {
-      "version": "9.39.4",
-      "resolved": "https://registry.npmjs.org/@eslint/js/-/js-9.39.4.tgz",
-      "integrity": "sha512-nE7DEIchvtiFTwBw4Lfbu59PG+kCofhjsKaCWzxTpt4lfRjRMqG6uMBzKXuEcyXhOHoUp9riAm7/aWYGhXZ9cw==",
+      "version": "9.39.5",
+      "resolved": "https://registry.npmjs.org/@eslint/js/-/js-9.39.5.tgz",
+      "integrity": "sha512-QywQuszQh77pIXCsq998c8hbhSTI/azTty1Z6N53dmAudKHhy573j3yvRLsX2BSp8YpLtoCEG8E9DJe+8zUh4A==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -1975,9 +1979,9 @@
       }
     },
     "node_modules/@microsoft/eslint-formatter-sarif/node_modules/js-yaml": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz",
-      "integrity": "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==",
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz",
+      "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==",
       "dev": true,
       "funding": [
         {
@@ -2572,9 +2576,9 @@
       "license": "MIT"
     },
     "node_modules/@types/sinon": {
-      "version": "21.0.1",
-      "resolved": "https://registry.npmjs.org/@types/sinon/-/sinon-21.0.1.tgz",
-      "integrity": "sha512-5yoJSqLbjH8T9V2bksgRayuhpZy+723/z6wBOR+Soe4ZlXC0eW8Na71TeaZPUWDQvM7LYKa9UGFc6LRqxiR5fQ==",
+      "version": "22.0.0",
+      "resolved": "https://registry.npmjs.org/@types/sinon/-/sinon-22.0.0.tgz",
+      "integrity": "sha512-TDbVpbccc2HfiqHR09Argj3mHV1KMW7sCCKj52fsl8lbRLkEn7fB1966EWhOKWUBcqfBueZuPoA7/OK1CKiy3g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2587,17 +2591,17 @@
       "license": "MIT"
     },
     "node_modules/@typescript-eslint/eslint-plugin": {
-      "version": "8.62.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.62.0.tgz",
-      "integrity": "sha512-o+mpz7EYiMzXoySXiKmzlabIvTVqUuK5yLrAedRPRDA0IpPFMUV1IXt6OqljIxX/kumN6EjUYp41Hqelh6p/Dw==",
+      "version": "8.65.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.65.0.tgz",
+      "integrity": "sha512-IEgob78X12rHpUmtcwFsXhZdVGJtwTVP8FiCLZkR6GlYVrl2PcuB+KhCE5BlVC/eQpQnu8WXRtkHZuPar+gCRA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@eslint-community/regexpp": "^4.12.2",
-        "@typescript-eslint/scope-manager": "8.62.0",
-        "@typescript-eslint/type-utils": "8.62.0",
-        "@typescript-eslint/utils": "8.62.0",
-        "@typescript-eslint/visitor-keys": "8.62.0",
+        "@typescript-eslint/scope-manager": "8.65.0",
+        "@typescript-eslint/type-utils": "8.65.0",
+        "@typescript-eslint/utils": "8.65.0",
+        "@typescript-eslint/visitor-keys": "8.65.0",
         "ignore": "^7.0.5",
         "natural-compare": "^1.4.0",
         "ts-api-utils": "^2.5.0"
@@ -2610,7 +2614,7 @@
         "url": "https://opencollective.com/typescript-eslint"
       },
       "peerDependencies": {
-        "@typescript-eslint/parser": "^8.62.0",
+        "@typescript-eslint/parser": "^8.65.0",
         "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
         "typescript": ">=4.8.4 <6.1.0"
       }
@@ -2626,16 +2630,16 @@
       }
     },
     "node_modules/@typescript-eslint/parser": {
-      "version": "8.62.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.62.0.tgz",
-      "integrity": "sha512-dzHeT2gySzZtLDsuqxU9AkYgIsQoHAHtRBpOqM+Ofzx1Bwrd2RcCjQJ+6iQbsHOIR6NS33bF2W1k3blN1zLDrA==",
+      "version": "8.65.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.65.0.tgz",
+      "integrity": "sha512-CZ4nMxWwgu1HEEFNkeaCptra9QCtkmKdgf3sWh1rl1trIhmxLilgTV4cwcbQ4wemnT4sWQN8CaKOmdYx+g2gMA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/scope-manager": "8.62.0",
-        "@typescript-eslint/types": "8.62.0",
-        "@typescript-eslint/typescript-estree": "8.62.0",
-        "@typescript-eslint/visitor-keys": "8.62.0",
+        "@typescript-eslint/scope-manager": "8.65.0",
+        "@typescript-eslint/types": "8.65.0",
+        "@typescript-eslint/typescript-estree": "8.65.0",
+        "@typescript-eslint/visitor-keys": "8.65.0",
         "debug": "^4.4.3"
       },
       "engines": {
@@ -2669,14 +2673,14 @@
       }
     },
     "node_modules/@typescript-eslint/project-service": {
-      "version": "8.62.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.62.0.tgz",
-      "integrity": "sha512-wexnCqiTg7BOGtbLDftYpRWlmLq4xfoMd7BKFR6Y75sZS3QmRKLdN3yWLhmIYgqMmP/OXWpj3H8odkb5nGURCQ==",
+      "version": "8.65.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.65.0.tgz",
+      "integrity": "sha512-SxnPhbTsGahizDgbu7oqFH/xVtzIqMd/s+WtnSxNxJZJpLbdT5IPdzg8EZxO3+PoKahXmwJLeNQOpKJb3/bi7Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/tsconfig-utils": "^8.62.0",
-        "@typescript-eslint/types": "^8.62.0",
+        "@typescript-eslint/tsconfig-utils": "^8.65.0",
+        "@typescript-eslint/types": "^8.65.0",
         "debug": "^4.4.3"
       },
       "engines": {
@@ -2709,14 +2713,14 @@
       }
     },
     "node_modules/@typescript-eslint/scope-manager": {
-      "version": "8.62.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.62.0.tgz",
-      "integrity": "sha512-1lX38kNxXIRb8mEc3lbq5mdHq1Pf2+U0nFU65KfT18mtPxxl0fvjuEE92mHuXPuCtElJhOrddOpyMlM3Z0umEA==",
+      "version": "8.65.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.65.0.tgz",
+      "integrity": "sha512-Esbl8OSYiVxBokYgWPf7VVWg/BE798wXhimnn9ML9Pt5qoDf8bfQlgjlKXR/k98+AcNzlLKYrpCcrcuZ9DZLgg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.62.0",
-        "@typescript-eslint/visitor-keys": "8.62.0"
+        "@typescript-eslint/types": "8.65.0",
+        "@typescript-eslint/visitor-keys": "8.65.0"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -2727,9 +2731,9 @@
       }
     },
     "node_modules/@typescript-eslint/tsconfig-utils": {
-      "version": "8.62.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.62.0.tgz",
-      "integrity": "sha512-y2GAdB6ykaXUvuspbYnizQc4oDDz0Tz/Yc7iWrXf9mx8vm/L/0vLHCe0tS2boG96Zy+DivnVDQ9ZUEWoHqqx1g==",
+      "version": "8.65.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.65.0.tgz",
+      "integrity": "sha512-j6GzGqCiRdA7Qhur2VVmKZAkBLfnHFQfx4TaJGL9RMveZqCo48jSHHO0DTgizEnGhtWnqmbtCUSrqSkdiY/0Hg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -2744,15 +2748,15 @@
       }
     },
     "node_modules/@typescript-eslint/type-utils": {
-      "version": "8.62.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.62.0.tgz",
-      "integrity": "sha512-+g5O3j0w2ldzC86Pv6fvbO/xhAonbJFIdf/MKQ1d30gndlsVzUOE83ldfSE15Qrl9fhFjK6AovHs5Wpp6vx86w==",
+      "version": "8.65.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.65.0.tgz",
+      "integrity": "sha512-YjaZ7PRI5qY7ax2L3PbvX0rRyGtipAReCWs0mhhDBHjH/vl0g0BonaGXrKdKpMbIIsMIwDgbk/xzkBTyAltS5g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.62.0",
-        "@typescript-eslint/typescript-estree": "8.62.0",
-        "@typescript-eslint/utils": "8.62.0",
+        "@typescript-eslint/types": "8.65.0",
+        "@typescript-eslint/typescript-estree": "8.65.0",
+        "@typescript-eslint/utils": "8.65.0",
         "debug": "^4.4.3",
         "ts-api-utils": "^2.5.0"
       },
@@ -2787,9 +2791,9 @@
       }
     },
     "node_modules/@typescript-eslint/types": {
-      "version": "8.62.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.62.0.tgz",
-      "integrity": "sha512-KvAclkktORPvM54TgLgA4z9HIV1M8zOgw9ZVNXl9f/8dLYfXYX1wkMXP7qmabpijQRV5bHJLOmoyGQbLMaUYeg==",
+      "version": "8.65.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.65.0.tgz",
+      "integrity": "sha512-JSSwWNy+H0E/01jJEM+hrX6N0OFDzFzeIhHFSAS01tlVaevpG8cFyYRPhS5yjGOvBUx3sqQHVMjCL1CAZZMxBg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -2801,16 +2805,16 @@
       }
     },
     "node_modules/@typescript-eslint/typescript-estree": {
-      "version": "8.62.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.62.0.tgz",
-      "integrity": "sha512-+hVbNxtW64pIcZWDPGbyaKF7vp2IBTVY5ma1blwwksrjdsbdqqEKvJWMGbBofei4F6Dovx1M0RJgoFeNu2279A==",
+      "version": "8.65.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.65.0.tgz",
+      "integrity": "sha512-JboAE2swaYt4tb1fHhHTABE2K+OLy09XfcTbhnk4Pw96f9dd2e9iYsJ28gBggHlo5z5x1rkyWvcPoTuNTd4oGg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/project-service": "8.62.0",
-        "@typescript-eslint/tsconfig-utils": "8.62.0",
-        "@typescript-eslint/types": "8.62.0",
-        "@typescript-eslint/visitor-keys": "8.62.0",
+        "@typescript-eslint/project-service": "8.65.0",
+        "@typescript-eslint/tsconfig-utils": "8.65.0",
+        "@typescript-eslint/types": "8.65.0",
+        "@typescript-eslint/visitor-keys": "8.65.0",
         "debug": "^4.4.3",
         "minimatch": "^10.2.2",
         "semver": "^7.7.3",
@@ -2839,16 +2843,16 @@
       }
     },
     "node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": {
-      "version": "5.0.7",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz",
-      "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==",
+      "version": "5.0.8",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz",
+      "integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^4.0.2"
       },
       "engines": {
-        "node": "18 || 20 || >=22"
+        "node": "20 || >=22"
       }
     },
     "node_modules/@typescript-eslint/typescript-estree/node_modules/debug": {
@@ -2870,13 +2874,13 @@
       }
     },
     "node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch": {
-      "version": "10.2.5",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.5.tgz",
-      "integrity": "sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==",
+      "version": "10.2.6",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.6.tgz",
+      "integrity": "sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "dependencies": {
-        "brace-expansion": "^5.0.5"
+        "brace-expansion": "^5.0.8"
       },
       "engines": {
         "node": "18 || 20 || >=22"
@@ -2886,16 +2890,16 @@
       }
     },
     "node_modules/@typescript-eslint/utils": {
-      "version": "8.62.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.62.0.tgz",
-      "integrity": "sha512-82r66fi9zYwZ+mTq3vKgwjbZ1PVk/DJzrXFLpG6RnBbdvH8TEGVHIs9H4d2drhkOzf0syZuD/OZvvlu6GDbP4g==",
+      "version": "8.65.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.65.0.tgz",
+      "integrity": "sha512-gXiwIHsYreboxeJucHKPvgwl7dXt50mF8s1/c00cP/WoVTyWKFdtfhRWwZiXYFU5H2O8vVoSLNrexFZjYS/SGA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@eslint-community/eslint-utils": "^4.9.1",
-        "@typescript-eslint/scope-manager": "8.62.0",
-        "@typescript-eslint/types": "8.62.0",
-        "@typescript-eslint/typescript-estree": "8.62.0"
+        "@typescript-eslint/scope-manager": "8.65.0",
+        "@typescript-eslint/types": "8.65.0",
+        "@typescript-eslint/typescript-estree": "8.65.0"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -2910,13 +2914,13 @@
       }
     },
     "node_modules/@typescript-eslint/visitor-keys": {
-      "version": "8.62.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.62.0.tgz",
-      "integrity": "sha512-CY3uyFSRbcQv3nnSv8S0+lDftMVz6P963PoRlxrV7ew/Md564g9ut60PYzdLM5qW4jFn93GBF+Soi90ISAN+GQ==",
+      "version": "8.65.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.65.0.tgz",
+      "integrity": "sha512-8C71BQkGjiMmXtop7pHVJu1l2NNShFdkCyD6a2ezzs5vU/L3LRtb69EtcteFwz0mYMPzIgOw0n6OV4VBUWZd7A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.62.0",
+        "@typescript-eslint/types": "8.65.0",
         "eslint-visitor-keys": "^5.0.0"
       },
       "engines": {
@@ -3860,9 +3864,9 @@
       "license": "MIT"
     },
     "node_modules/brace-expansion": {
-      "version": "1.1.14",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz",
-      "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==",
+      "version": "1.1.16",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz",
+      "integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==",
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^1.0.0",
@@ -4762,9 +4766,9 @@
       }
     },
     "node_modules/eslint": {
-      "version": "9.39.4",
-      "resolved": "https://registry.npmjs.org/eslint/-/eslint-9.39.4.tgz",
-      "integrity": "sha512-XoMjdBOwe/esVgEvLmNsD3IRHkm7fbKIUGvrleloJXUZgDHig2IPWNniv+GwjyJXzuNqVjlr5+4yVUZjycJwfQ==",
+      "version": "9.39.5",
+      "resolved": "https://registry.npmjs.org/eslint/-/eslint-9.39.5.tgz",
+      "integrity": "sha512-DgZS62aPLXKlnxILS/AYCoRvHaZeXceIzlXPkkGGzJWSow1aEk0lbTlxUSlyjC8jcaKxAdOnTDz+o1JFSBsyjw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4773,8 +4777,8 @@
         "@eslint/config-array": "^0.21.2",
         "@eslint/config-helpers": "^0.4.2",
         "@eslint/core": "^0.17.0",
-        "@eslint/eslintrc": "^3.3.5",
-        "@eslint/js": "9.39.4",
+        "@eslint/eslintrc": "^3.3.6",
+        "@eslint/js": "9.39.5",
         "@eslint/plugin-kit": "^0.4.1",
         "@humanfs/node": "^0.16.6",
         "@humanwhocodes/module-importer": "^1.0.1",
@@ -4984,13 +4988,13 @@
       }
     },
     "node_modules/eslint-plugin-github": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-github/-/eslint-plugin-github-6.0.0.tgz",
-      "integrity": "sha512-J8MvUoiR/TU/Y9NnEmg1AnbvMUj9R6IO260z47zymMLLvso7B4c80IKjd8diqmqtSmeXXlbIus4i0SvK84flag==",
+      "version": "6.1.1",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-github/-/eslint-plugin-github-6.1.1.tgz",
+      "integrity": "sha512-xCqu1S/s/CCvoRLafaXNvwiVrxhroNOFLGyG9Dhi4i1PWZgPHlipjXysH6wccPFQyhSKE7gAjSLqdSdM204bZQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@eslint/compat": "^1.2.3",
+        "@eslint/compat": "^2.0.0",
         "@eslint/eslintrc": "^3.1.0",
         "@eslint/js": "^9.14.0",
         "@github/browserslist-config": "^1.0.0",
@@ -5007,79 +5011,18 @@
         "eslint-plugin-no-only-tests": "^3.0.0",
         "eslint-plugin-prettier": "^5.2.1",
         "eslint-rule-documentation": ">=1.0.0",
-        "globals": "^16.0.0",
+        "globals": "^17.7.0",
         "jsx-ast-utils": "^3.3.2",
         "prettier": "^3.0.0",
         "svg-element-attributes": "^1.3.1",
-        "typescript": "^5.7.3",
+        "typescript": "^6.0.3",
         "typescript-eslint": "^8.14.0"
       },
       "bin": {
         "eslint-ignore-errors": "bin/eslint-ignore-errors.js"
       },
       "peerDependencies": {
-        "eslint": "^8 || ^9"
-      }
-    },
-    "node_modules/eslint-plugin-github/node_modules/@eslint/compat": {
-      "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/@eslint/compat/-/compat-1.4.1.tgz",
-      "integrity": "sha512-cfO82V9zxxGBxcQDr1lfaYB7wykTa0b00mGa36FrJl7iTFd0Z2cHfEYuxcBRP/iNijCsWsEkA+jzT8hGYmv33w==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@eslint/core": "^0.17.0"
-      },
-      "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-      },
-      "peerDependencies": {
-        "eslint": "^8.40 || 9"
-      },
-      "peerDependenciesMeta": {
-        "eslint": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/eslint-plugin-github/node_modules/@eslint/core": {
-      "version": "0.17.0",
-      "resolved": "https://registry.npmjs.org/@eslint/core/-/core-0.17.0.tgz",
-      "integrity": "sha512-yL/sLrpmtDaFEiUj1osRP4TI2MDz1AddJL+jZ7KSqvBuliN4xqYY54IfdN8qD8Toa6g1iloph1fxQNkjOxrrpQ==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@types/json-schema": "^7.0.15"
-      },
-      "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-      }
-    },
-    "node_modules/eslint-plugin-github/node_modules/globals": {
-      "version": "16.5.0",
-      "resolved": "https://registry.npmjs.org/globals/-/globals-16.5.0.tgz",
-      "integrity": "sha512-c/c15i26VrJ4IRt5Z89DnIzCGDn9EcebibhAOjw5ibqEHsE1wLUgkPn9RDmNcUKyU87GeaL633nyJ+pplFR2ZQ==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/eslint-plugin-github/node_modules/typescript": {
-      "version": "5.9.3",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
-      "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "bin": {
-        "tsc": "bin/tsc",
-        "tsserver": "bin/tsserver"
-      },
-      "engines": {
-        "node": ">=14.17"
+        "eslint": "^8 || ^9 || ^10"
       }
     },
     "node_modules/eslint-plugin-i18n-text": {
@@ -5125,9 +5068,9 @@
       }
     },
     "node_modules/eslint-plugin-import-x": {
-      "version": "4.17.0",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-import-x/-/eslint-plugin-import-x-4.17.0.tgz",
-      "integrity": "sha512-aM7V25Bg6YuYxtEhwjafzfS0NTMds1D2PMQI0K4KqJxQJRtkP4CO+MQTWRdBq2qAnmPxTxLevhXUBtByxJqS1w==",
+      "version": "4.17.1",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-import-x/-/eslint-plugin-import-x-4.17.1.tgz",
+      "integrity": "sha512-4cdstYkKCyjumM2Q9NSI03K8D2a9F4Ssz33K2lv2hQa4KmR9jPLwk3uWGtNvclfqBrPGfGuMBwsGMbe6dMRbfg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -5172,9 +5115,9 @@
       }
     },
     "node_modules/eslint-plugin-import-x/node_modules/brace-expansion": {
-      "version": "5.0.6",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz",
-      "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==",
+      "version": "5.0.7",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz",
+      "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -5448,6 +5391,30 @@
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
       }
     },
+    "node_modules/eslint/node_modules/@eslint/eslintrc": {
+      "version": "3.3.6",
+      "resolved": "https://registry.npmjs.org/@eslint/eslintrc/-/eslintrc-3.3.6.tgz",
+      "integrity": "sha512-l2Ul9PrHsPCKcEY/ac7VgFj9D80C7S68sOKc618SyHDPK36s1XcFebXY0iTzUVn4Yq+YbwvSnDmCz9yxjX+QrA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ajv": "^6.14.0",
+        "debug": "^4.3.2",
+        "espree": "^10.0.1",
+        "globals": "^14.0.0",
+        "ignore": "^5.2.0",
+        "import-fresh": "^3.2.1",
+        "js-yaml": "^4.3.0",
+        "minimatch": "^3.1.5",
+        "strip-json-comments": "^3.1.1"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/eslint"
+      }
+    },
     "node_modules/eslint/node_modules/ansi-styles": {
       "version": "4.2.1",
       "dev": true,
@@ -5513,6 +5480,42 @@
         "node": ">=10.13.0"
       }
     },
+    "node_modules/eslint/node_modules/globals": {
+      "version": "14.0.0",
+      "resolved": "https://registry.npmjs.org/globals/-/globals-14.0.0.tgz",
+      "integrity": "sha512-oahGvuMGQlPw/ivIYBjVSrWAfWLBeku5tpPE2fOPLi+WHffIWbuh2tCjhyQhTBPMf5E9jDEH4FOmTYgYwbKwtQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/eslint/node_modules/js-yaml": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz",
+      "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/puzrin"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/nodeca"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "argparse": "^2.0.1"
+      },
+      "bin": {
+        "js-yaml": "bin/js-yaml.js"
+      }
+    },
     "node_modules/espree": {
       "version": "10.4.0",
       "resolved": "https://registry.npmjs.org/espree/-/espree-10.4.0.tgz",
@@ -6108,9 +6111,9 @@
       }
     },
     "node_modules/glob/node_modules/brace-expansion": {
-      "version": "5.0.6",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz",
-      "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==",
+      "version": "5.0.7",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz",
+      "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==",
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^4.0.2"
@@ -6978,9 +6981,9 @@
       }
     },
     "node_modules/js-yaml": {
-      "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.1.0.tgz",
-      "integrity": "sha512-s8VA5jkR8f22S3NAXmhKPFqGUduqZGlsufabVOgN14iTdw/RXcym7bKkbwjxLK9Yw2lEvvmJjFp119+KPeo8Kg==",
+      "version": "5.2.2",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.2.2.tgz",
+      "integrity": "sha512-dayzUzKkJ1MkuUtZglSebU43utNXH0OWQByK9rKOOuYIO8M5TV1y+n8ALMdG0rdzBnfNkOmZEqrURepb0ejqBw==",
       "funding": [
         {
           "type": "github",
@@ -7443,9 +7446,9 @@
       "license": "MIT"
     },
     "node_modules/nock": {
-      "version": "14.0.15",
-      "resolved": "https://registry.npmjs.org/nock/-/nock-14.0.15.tgz",
-      "integrity": "sha512-S0a47C9pLvcYx/Ugf0H30BVBEcUgMMBDk9VJIDlJ8XGrfH2QDUD4Tgdp45qDIiHttokBG+IbsOtsvIjGR/j3bg==",
+      "version": "14.0.16",
+      "resolved": "https://registry.npmjs.org/nock/-/nock-14.0.16.tgz",
+      "integrity": "sha512-8r4KEc6nT1D/fdLD/R1BO1CPaVEL8o40u/guFRJlXabN7vr3RmMqyjsY5Krt0nMwhsOAwXQ/mtN5vy5Jh3aErg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -8087,9 +8090,9 @@
       }
     },
     "node_modules/readdir-glob/node_modules/brace-expansion": {
-      "version": "5.0.6",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz",
-      "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==",
+      "version": "5.0.7",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz",
+      "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==",
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^4.0.2"
@@ -8553,9 +8556,9 @@
       }
     },
     "node_modules/sinon": {
-      "version": "22.0.0",
-      "resolved": "https://registry.npmjs.org/sinon/-/sinon-22.0.0.tgz",
-      "integrity": "sha512-sq/6DpdXOrLyfbKlXLg/Usc7xu8YXPeLkOFZRvA3bNUSA2lhbrZ06yuXbH1fkzBPCbz9O10+7hznzUsjaYNm0Q==",
+      "version": "22.1.0",
+      "resolved": "https://registry.npmjs.org/sinon/-/sinon-22.1.0.tgz",
+      "integrity": "sha512-n1ajF2rBWMTtEwbKcw4UdFg4nCnDdq/U6RDoxtOd7oapOlRoJ5ynwFx60owROyhDpA9QhMZi0pCO/xtmwFjG7w==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
@@ -8896,9 +8899,9 @@
       }
     },
     "node_modules/supertap/node_modules/js-yaml": {
-      "version": "3.14.2",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.2.tgz",
-      "integrity": "sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==",
+      "version": "3.15.0",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.0.tgz",
+      "integrity": "sha512-ttBQIIQPDeLjpPOohtUdXuXUVoA2uIB6fEH9HyJ7234s5mBJ5wTx20njxplLZQgLaOfpmPQA7X2t5AX6tIPbog==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -8975,9 +8978,9 @@
       }
     },
     "node_modules/tar": {
-      "version": "7.5.16",
-      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.16.tgz",
-      "integrity": "sha512-56adEpPMouktRlBLXiaYFFzZ/3+JXa8P9n7WbR+ibIjtviN55mEaOkiysCnPnWm+7kkui1Dn8J9l+g6zV8731w==",
+      "version": "7.5.20",
+      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.20.tgz",
+      "integrity": "sha512-9FcyK4PA6+WbzlTM9WhQm6vB5W7cP7dUiPsv1g7YDwEQnQ1CGpK3MGlKk/ITVWMk05kHZuBhmVhiv8LZoy/PFQ==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "dependencies": {
@@ -9165,9 +9168,9 @@
       "license": "0BSD"
     },
     "node_modules/tsx": {
-      "version": "4.22.4",
-      "resolved": "https://registry.npmjs.org/tsx/-/tsx-4.22.4.tgz",
-      "integrity": "sha512-X8EX+XV4QR5xCsrgxaED954zTDfY8KqlDtskKEL0cHhyS/P8b4IFOvGDQpsC9Q1XnLq915wEfwwY/zzskCtmhg==",
+      "version": "4.23.1",
+      "resolved": "https://registry.npmjs.org/tsx/-/tsx-4.23.1.tgz",
+      "integrity": "sha512-GQHnkIfxyx1wYCOS/wonik5MVRZU9hi1TEZmzGZSCJB1y9YgoZ8H6itNE/u4suE+yLmOzuE4E5S4TZ/ZX2wcWQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -9317,16 +9320,16 @@
       }
     },
     "node_modules/typescript-eslint": {
-      "version": "8.62.0",
-      "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.62.0.tgz",
-      "integrity": "sha512-8QxXi+ZACKX0kaqO4gY8kn0RSD9gFfaHDWwjqtEN48aWCBkX4MJaufWN+c3BzlrXLOxfywDL8CaoqUwcRq4j4Q==",
+      "version": "8.65.0",
+      "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.65.0.tgz",
+      "integrity": "sha512-/ggrHAwyjENDusvyxbuqxAC2dTnZg/Z8F+fgQtYIz+L6n/9HfSlEZcFGV/NsMNa6CkGk0xUjUAFwC0vHOflvIA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/eslint-plugin": "8.62.0",
-        "@typescript-eslint/parser": "8.62.0",
-        "@typescript-eslint/typescript-estree": "8.62.0",
-        "@typescript-eslint/utils": "8.62.0"
+        "@typescript-eslint/eslint-plugin": "8.65.0",
+        "@typescript-eslint/parser": "8.65.0",
+        "@typescript-eslint/typescript-estree": "8.65.0",
+        "@typescript-eslint/utils": "8.65.0"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -9360,10 +9363,9 @@
       }
     },
     "node_modules/undici": {
-      "version": "6.24.1",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-6.24.1.tgz",
-      "integrity": "sha512-sC+b0tB1whOCzbtlx20fx3WgCXwkW627p4EA9uM+/tNNPkSS+eSEld6pAs9nDv7WbY1UUljBMYPtu9BCOrCWKA==",
-      "license": "MIT",
+      "version": "6.27.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-6.27.0.tgz",
+      "integrity": "sha512-YmfV3YnEDzXRC5lZ2jWtWWHKGUm1zIt8AhesR1tens+HTNv+YZlN/dp6G727LOvMJ8xjP9Be7Y2Sdr96LDm+pg==",
       "engines": {
         "node": ">=18.17"
       }
@@ -9815,7 +9817,7 @@
       },
       "devDependencies": {
         "@types/node": "^20.19.43",
-        "tsx": "^4.22.4"
+        "tsx": "^4.23.1"
       }
     }
   }
diff --git a/package.json b/package.json
index 2734c27f6a..caf12f15c0 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "codeql",
-  "version": "4.37.0",
+  "version": "4.37.6",
   "private": true,
   "description": "CodeQL action",
   "scripts": {
@@ -22,7 +22,7 @@
   "dependencies": {
     "@actions/artifact": "^5.0.3",
     "@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2",
-    "@actions/cache": "^5.1.0",
+    "@actions/cache": "^5.2.0",
     "@actions/core": "^2.0.3",
     "@actions/exec": "^2.0.0",
     "@actions/github": "^8.0.1",
@@ -30,18 +30,22 @@
     "@actions/http-client": "^3.0.0",
     "@actions/io": "^2.0.0",
     "@actions/tool-cache": "^3.0.1",
+    "@octokit/core": "^7.0.6",
+    "@octokit/plugin-paginate-rest": "^14.0.0",
+    "@octokit/plugin-rest-endpoint-methods": "^17.0.0",
     "@octokit/plugin-retry": "^8.1.0",
     "archiver": "^8.0.0",
     "fast-deep-equal": "^3.1.3",
     "follow-redirects": "^1.16.0",
     "get-folder-size": "^5.0.0",
     "https-proxy-agent": "^7.0.6",
-    "js-yaml": "^5.1.0",
+    "js-yaml": "^5.2.2",
     "jsonschema": "1.5.0",
     "long": "^5.3.2",
     "node-forge": "^1.4.0",
     "semver": "^7.8.5",
-    "uuid": "^14.0.1"
+    "uuid": "^14.0.1",
+    "undici": "^6.24.0"
   },
   "devDependencies": {
     "@ava/typescript": "6.0.0",
@@ -55,21 +59,21 @@
     "@types/node-forge": "^1.3.14",
     "@types/sarif": "^2.1.7",
     "@types/semver": "^7.7.1",
-    "@types/sinon": "^21.0.1",
+    "@types/sinon": "^22.0.0",
     "ava": "^6.4.1",
     "esbuild": "^0.28.1",
-    "eslint": "^9.39.4",
+    "eslint": "^9.39.5",
     "eslint-import-resolver-typescript": "^4.4.5",
-    "eslint-plugin-github": "^6.0.0",
-    "eslint-plugin-import-x": "^4.17.0",
+    "eslint-plugin-github": "^6.1.1",
+    "eslint-plugin-import-x": "^4.17.1",
     "eslint-plugin-jsdoc": "^62.9.0",
     "eslint-plugin-no-async-foreach": "^0.1.1",
     "glob": "^13.0.6",
     "globals": "^17.7.0",
-    "nock": "^14.0.15",
-    "sinon": "^22.0.0",
+    "nock": "^14.0.16",
+    "sinon": "^22.1.0",
     "typescript": "^6.0.3",
-    "typescript-eslint": "^8.62.0"
+    "typescript-eslint": "^8.65.0"
   },
   "overrides": {
     "@actions/tool-cache": {
diff --git a/pr-checks/bundle-changelog.test.ts b/pr-checks/bundle-changelog.test.ts
new file mode 100644
index 0000000000..6cc4d096ba
--- /dev/null
+++ b/pr-checks/bundle-changelog.test.ts
@@ -0,0 +1,142 @@
+/**
+ * Tests for `bundle-changelog.ts`.
+ */
+
+import * as assert from "node:assert/strict";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { afterEach, beforeEach, describe, it } from "node:test";
+
+import {
+  CLI_VERSION_ENV_VAR,
+  getCLIVersion,
+  getPRNumber,
+  getPRUrl,
+  PR_URL_ENV_VAR,
+  updateChangelog,
+} from "./bundle-changelog";
+import {
+  EMPTY_CHANGELOG,
+  NO_CHANGES_STR,
+  UNRELEASED_PLACEHOLDER,
+} from "./changelog";
+
+let testDir: string;
+
+beforeEach(() => {
+  // Set up a temporary directory for testing
+  testDir = fs.mkdtempSync(path.join(os.tmpdir(), "bundle-changelog-test-"));
+});
+
+afterEach(() => {
+  /** Clean up temporary directories. */
+  fs.rmSync(testDir, { recursive: true, force: true });
+});
+
+describe("getCLIVersion", async () => {
+  await it("throws if the environment variable is not set", async () => {
+    delete process.env[CLI_VERSION_ENV_VAR];
+    assert.throws(() => getCLIVersion());
+  });
+
+  await it("throws if the environment variable is empty", async () => {
+    process.env[CLI_VERSION_ENV_VAR] = "    ";
+    assert.throws(() => getCLIVersion());
+  });
+
+  await it("returns value of the environment variable if set", async () => {
+    const testValue = "1.2.3";
+    process.env[CLI_VERSION_ENV_VAR] = testValue;
+    assert.deepEqual(getCLIVersion(), testValue);
+  });
+});
+
+const testPrUrl = "https://github.com/github/codeql-action/pulls/42";
+
+describe("getPRUrl", async () => {
+  await it("throws if the environment variable is not set", async () => {
+    delete process.env[PR_URL_ENV_VAR];
+    assert.throws(() => getPRUrl());
+  });
+
+  await it("throws if the environment variable is empty", async () => {
+    process.env[PR_URL_ENV_VAR] = "    ";
+    assert.throws(() => getPRUrl());
+  });
+
+  await it("returns value of the environment variable if set", async () => {
+    process.env[PR_URL_ENV_VAR] = testPrUrl;
+    assert.deepEqual(getPRUrl(), testPrUrl);
+  });
+});
+
+describe("getPRNumber", async () => {
+  await it("throws if the last part of the input is not a number", async () => {
+    assert.throws(() => getPRNumber(`${testPrUrl}/foo`));
+  });
+
+  await it("throws if the last part of the input is not a positive number", async () => {
+    assert.throws(() => getPRNumber(`${testPrUrl}/-100`));
+  });
+
+  await it("returns the PR number from an URL", async () => {
+    assert.equal(getPRNumber(testPrUrl), 42);
+  });
+});
+
+const testChangelog = `${EMPTY_CHANGELOG.trimEnd()}
+
+## 4.23.7
+
+- Other change
+
+## 4.23.6
+
+${NO_CHANGES_STR}`;
+
+const expectedChangelog = `# CodeQL Action Changelog
+
+## ${UNRELEASED_PLACEHOLDER}
+
+- Update default CodeQL bundle version to
+
+## 4.23.7
+
+- Other change
+
+## 4.23.6
+
+${NO_CHANGES_STR}`;
+
+describe("updateChangelog", async () => {
+  await it("removes `NO_CHANGES_STR` if present in [UNRELEASED] section", async () => {
+    const result = updateChangelog(EMPTY_CHANGELOG, "");
+    assert.ok(!result.includes(NO_CHANGES_STR.trim()));
+  });
+
+  await it("doesn't remove `NO_CHANGES_STR` if present in versioned section", async () => {
+    const result = updateChangelog(
+      EMPTY_CHANGELOG.replace(UNRELEASED_PLACEHOLDER, "1.2.3"),
+      "",
+    );
+    assert.ok(result.includes(NO_CHANGES_STR.trim()));
+  });
+
+  await it("throws if there are no sections", async () => {
+    assert.throws(() => {
+      updateChangelog(
+        "# CodeQL Action Changelog",
+        "- Update default CodeQL bundle version to",
+      );
+    });
+  });
+
+  await it("adds note at the end of the first section", async () => {
+    const result = updateChangelog(
+      testChangelog,
+      "- Update default CodeQL bundle version to",
+    );
+    assert.deepEqual(result, expectedChangelog);
+  });
+});
diff --git a/pr-checks/bundle-changelog.ts b/pr-checks/bundle-changelog.ts
new file mode 100755
index 0000000000..557a8556c1
--- /dev/null
+++ b/pr-checks/bundle-changelog.ts
@@ -0,0 +1,127 @@
+#!/usr/bin/env npx tsx
+
+/**
+ * Updates the changelog with a change note for an updated CodeQL CLI bundle.
+ */
+
+import * as fs from "node:fs";
+
+import {
+  parseChangelog,
+  renderChangelog,
+  UNRELEASED_PLACEHOLDER,
+} from "./changelog";
+import { CHANGELOG_FILE, CLI_BUNDLE_RELEASE_URL_PREFIX } from "./config";
+import { getErrorMessage } from "./util";
+
+export const CLI_VERSION_ENV_VAR = "CLI_VERSION";
+export const PR_URL_ENV_VAR = "PR_URL";
+
+/** Gets the CLI version from the environment. */
+export function getCLIVersion() {
+  const cliVersion = process.env[CLI_VERSION_ENV_VAR];
+
+  if (cliVersion === undefined || cliVersion.trim() === "") {
+    throw new Error(`No CLI version was set in '${CLI_VERSION_ENV_VAR}'.`);
+  }
+
+  return cliVersion;
+}
+
+/** Gets the PR URL from the environment. */
+export function getPRUrl() {
+  const prUrl = process.env[PR_URL_ENV_VAR];
+
+  if (prUrl === undefined || prUrl.trim() === "") {
+    throw new Error(`No PR URL was set in '${PR_URL_ENV_VAR}'.`);
+  }
+
+  return prUrl;
+}
+
+/**
+ * Gets the PR number from something like a PR URL.
+ */
+export function getPRNumber(prUrl: string) {
+  const prUrlParts = prUrl.split("/");
+  const prNumberStr = prUrlParts[prUrlParts.length - 1];
+
+  const prNumber = Number.parseInt(prNumberStr, 10);
+
+  if (!Number.isInteger(prNumber) || prNumber <= 0) {
+    throw new Error(
+      `Invalid PR URL '${prUrl}': last part is not a positive number`,
+    );
+  }
+
+  return prNumber;
+}
+
+/**
+ * Updates `changelog` by adding `changelogNote` to the first section.
+ *
+ * @param contents The existing changelog contents.
+ * @param changelogNote The note to add to the first section.
+ */
+export function updateChangelog(contents: string, changelogNote: string) {
+  // If the "[UNRELEASED]" section starts with "no user facing changes", remove that line.
+  contents = contents.replace(
+    `## ${UNRELEASED_PLACEHOLDER}\n\nNo user facing changes.`,
+    `## ${UNRELEASED_PLACEHOLDER}\n`,
+  );
+
+  const changelog = parseChangelog(contents);
+
+  if (changelog.sections.length === 0) {
+    throw new Error("The changelog contains no existing sections.");
+  }
+
+  // Add the changelog note to the bottom of the first section.
+  const firstSection = changelog.sections[0];
+  const lastLine = firstSection.bodyLines.pop();
+
+  if (lastLine !== undefined && lastLine.trim() !== "") {
+    // We expect the last line to be empty. If it isn't for some reason,
+    // add it back.
+    firstSection.bodyLines.push(lastLine);
+  }
+
+  firstSection.bodyLines.push(changelogNote);
+
+  // If the last line is empty as expected, then add it back in after the new note.
+  if (lastLine?.trim() === "") {
+    firstSection.bodyLines.push(lastLine);
+  }
+
+  return renderChangelog(changelog);
+}
+
+function main() {
+  try {
+    const cliVersion = getCLIVersion();
+    const prUrl = getPRUrl();
+
+    // The GitHub Release for the new bundle version.
+    const bundleReleaseUrl = `${CLI_BUNDLE_RELEASE_URL_PREFIX}${cliVersion}`;
+
+    // Get the PR number from the PR URL.
+    const prNumber = getPRNumber(prUrl);
+    const changelogNote = `- Update default CodeQL bundle version to [${cliVersion}](${bundleReleaseUrl}). [#${prNumber}](${prUrl})`;
+
+    let changelog = fs.readFileSync(CHANGELOG_FILE, "utf-8");
+
+    changelog = updateChangelog(changelog, changelogNote);
+
+    fs.writeFileSync(CHANGELOG_FILE, changelog);
+
+    return 0;
+  } catch (err) {
+    console.error(`Failed to bundle changelog: ${getErrorMessage(err)}`);
+    return -1;
+  }
+}
+
+// Only call `main` if this script was run directly.
+if (require.main === module) {
+  process.exit(main());
+}
diff --git a/pr-checks/changelog.test.ts b/pr-checks/changelog.test.ts
new file mode 100755
index 0000000000..817852e3e1
--- /dev/null
+++ b/pr-checks/changelog.test.ts
@@ -0,0 +1,72 @@
+#!/usr/bin/env npx tsx
+
+/**
+ * Tests for `changelog.ts`.
+ */
+
+import * as assert from "node:assert/strict";
+import * as fs from "node:fs";
+import { describe, it } from "node:test";
+
+import {
+  EMPTY_CHANGELOG,
+  getReleaseDateString,
+  parseChangelog,
+  processChangelogForBackports,
+  renderChangelog,
+  setVersionAndDate,
+} from "./changelog";
+import { CHANGELOG_FILE } from "./config";
+
+const testDate = new Date(2026, 7, 14);
+
+describe("getReleaseDateString", async () => {
+  await it("formats dates as expected", async () => {
+    assert.equal(getReleaseDateString(testDate), "14 Aug 2026");
+  });
+});
+
+const emptyChangelogExpected = `# CodeQL Action Changelog
+
+## 9.99.9 - 14 Aug 2026
+
+No user facing changes.
+
+`;
+
+describe("setVersionAndDate", async () => {
+  await it("replaces the placeholder", async () => {
+    const result = setVersionAndDate("9.99.9", EMPTY_CHANGELOG, testDate);
+    assert.equal(result, emptyChangelogExpected);
+  });
+});
+
+describe("parseChangelog + renderChangelog", async () => {
+  await it("renderChangelog(parseChangelog(c)) == c", async () => {
+    const actualChangelog = fs.readFileSync(CHANGELOG_FILE, "utf-8");
+    const roundtrip = renderChangelog(parseChangelog(actualChangelog));
+    assert.deepEqual(roundtrip.split("\n"), actualChangelog.split("\n"));
+  });
+});
+
+const testChangelog = `# CodeQL Action Changelog
+
+## 4.12.3 - 14 Aug 2026
+
+No user facing changes.
+`;
+
+const testChangelogResult: string = `# CodeQL Action Changelog
+
+## 3.12.3 - 14 Aug 2026
+
+No user facing changes.
+`;
+
+describe("processChangelogForBackports", async () => {
+  await it("replaces major versions", async () => {
+    const result = processChangelogForBackports("4", "3", testChangelog);
+
+    assert.deepEqual(result.split("\n"), testChangelogResult.split("\n"));
+  });
+});
diff --git a/pr-checks/changelog.ts b/pr-checks/changelog.ts
new file mode 100644
index 0000000000..4cf1e75494
--- /dev/null
+++ b/pr-checks/changelog.ts
@@ -0,0 +1,212 @@
+import * as fs from "node:fs";
+
+import { CHANGELOG_FILE, DryRunOption } from "./config";
+
+/** The placeholder in the header for unreleased changes. */
+export const UNRELEASED_PLACEHOLDER = "[UNRELEASED]";
+
+/** The default contents for a section in the changelog. */
+export const NO_CHANGES_STR = "No user facing changes.\n\n";
+
+/** Placeholder changelog content for a new release. */
+export const EMPTY_CHANGELOG = `# CodeQL Action Changelog
+
+## ${UNRELEASED_PLACEHOLDER}
+
+${NO_CHANGES_STR}`;
+
+/**
+ * Represents sections in a changelog.
+ */
+export interface ChangelogSection {
+  headerLine: string;
+  bodyLines: string[];
+}
+
+/**
+ * Represents a changelog.
+ */
+export interface Changelog {
+  preamble: string[];
+  sections: ChangelogSection[];
+}
+
+/** Returns `date` formatted as `DD Mon YYYY`. */
+export function getReleaseDateString(today: Date = new Date()): string {
+  return today.toLocaleDateString("en-GB", {
+    day: "2-digit",
+    month: "short",
+    year: "numeric",
+  });
+}
+
+export interface OpenChangelogOptions {
+  initChangelog?: boolean;
+}
+
+export function withChangelog(
+  transformer: (contents: string) => string,
+  options: DryRunOption & OpenChangelogOptions,
+): void {
+  let content: string;
+
+  if (options.initChangelog && !fs.existsSync(CHANGELOG_FILE)) {
+    content = EMPTY_CHANGELOG;
+  } else {
+    content = fs.readFileSync(CHANGELOG_FILE, "utf8");
+  }
+
+  if (!options.dryRun) {
+    fs.writeFileSync(CHANGELOG_FILE, transformer(content), "utf8");
+  } else {
+    console.info(`[DRY RUN] Would have written updated changelog.`);
+  }
+}
+
+/**
+ * Updates the `[UNRELEASED]` marker in `CHANGELOG.md` with the given version
+ * and today's date.
+ */
+export function setVersionAndDate(
+  version: string,
+  content: string,
+  date: Date = new Date(),
+): string {
+  const versionAndDate = `${version} - ${getReleaseDateString(date)}`;
+  return content.replace(UNRELEASED_PLACEHOLDER, versionAndDate);
+}
+
+/**
+ * Parses `content` into a structured representation of a changelog.
+ *
+ * @param content The contents of the changelog file.
+ */
+export function parseChangelog(content: string): Changelog {
+  const lines = content.split("\n");
+  let i = 0;
+
+  const preamble: string[] = [];
+  const sections: ChangelogSection[] = [];
+  let currentSection: ChangelogSection | undefined = undefined;
+
+  // Process all lines of the input file.
+  while (i < lines.length) {
+    const line = lines[i];
+
+    // Sections of the changelog start with `## `.
+    if (line.startsWith("## ")) {
+      // We have discovered a new section. If `currentSection` is already defined,
+      // then this marks the end of that section. Push it to the array of sections
+      // in the changelog.
+      if (currentSection !== undefined) {
+        sections.push(currentSection);
+      }
+
+      // Initialise the new section.
+      currentSection = { headerLine: line, bodyLines: [] };
+    } else if (currentSection !== undefined) {
+      // Add lines between the section header and the next to the current section.
+      currentSection.bodyLines.push(line);
+    } else {
+      // This is neither a section header nor are we in a section already,
+      // so this line is part of the preamble.
+      preamble.push(line);
+    }
+
+    i++;
+  }
+
+  // Push the current section to the array of completed sections, if there is
+  // still one unfinished.
+  if (currentSection !== undefined) {
+    sections.push(currentSection);
+  }
+
+  return { preamble, sections };
+}
+
+/**
+ * Combines an array of lines into a single string by adding line breaks.
+ */
+export function unlines(lines: string[]): string {
+  return `${lines.join("\n")}`;
+}
+
+/**
+ * Renders a given changelog to a string.
+ */
+export function renderChangelog(changelog: Changelog): string {
+  let result = unlines(changelog.preamble);
+
+  for (const section of changelog.sections) {
+    result += `\n${section.headerLine}\n${unlines(section.bodyLines)}`;
+  }
+
+  return result;
+}
+
+/**
+ * Processes changelog entries for a backport, converting version references
+ * from the source major version to the target major version and filtering
+ * entries that only apply to newer versions.
+ */
+export function processChangelogForBackports(
+  sourceBranchMajorVersion: string,
+  targetBranchMajorVersion: string,
+  content: string,
+): string {
+  // Changelog entries can use the following format to indicate
+  // that they only apply to newer versions
+  const someVersionsOnlyRegex = /\[v(\d+)\+ only\]/;
+
+  // Parse the changelog.
+  const changelog = parseChangelog(content);
+
+  if (changelog.sections.length === 0) {
+    throw new Error("Could not find any change sections in CHANGELOG.md");
+  }
+
+  // Filter out changelog entries that only apply to newer versions and
+  // update the section headings with the backport major version for
+  // sections we keep.
+  for (const section of changelog.sections) {
+    // Update the section headings with the backport major version.
+    section.headerLine = section.headerLine.replace(
+      `## ${sourceBranchMajorVersion}`,
+      `## ${targetBranchMajorVersion}`,
+    );
+
+    const filteredEntries: string[] = [];
+    let foundContent = false;
+
+    for (const line of section.bodyLines) {
+      // Skip the entry if `someVersionsOnlyRegex` matches and the major version
+      // of the target branch is smaller than the required version.
+      const match = someVersionsOnlyRegex.exec(line);
+      if (
+        match &&
+        Number.parseInt(targetBranchMajorVersion) < Number.parseInt(match[1])
+      ) {
+        continue;
+      }
+
+      // Keep the line.
+      filteredEntries.push(line);
+
+      // Set `foundContent` to `true` if the line is not empty.
+      if (line.trim() !== "") {
+        foundContent = true;
+      }
+    }
+
+    // Update the section with the retained entries.
+    section.bodyLines = filteredEntries;
+
+    // Add an entry if we didn't keep any.
+    if (!foundContent) {
+      section.bodyLines.push(NO_CHANGES_STR.trim());
+    }
+  }
+
+  return renderChangelog(changelog);
+}
diff --git a/pr-checks/checks/bundle-zstd.yml b/pr-checks/checks/bundle-zstd.yml
deleted file mode 100644
index a961af3c36..0000000000
--- a/pr-checks/checks/bundle-zstd.yml
+++ /dev/null
@@ -1,68 +0,0 @@
-name: "Bundle: Zstandard checks"
-description: "A Zstandard CodeQL bundle should be extracted on supported operating systems"
-versions:
-  - linked
-operatingSystems:
-  - ubuntu
-  - macos
-  - windows
-steps:
-  - name: Remove CodeQL from toolcache
-    uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-    with:
-      script: |
-        const fs = require('fs');
-        const path = require('path');
-        const codeqlPath = path.join(process.env['RUNNER_TOOL_CACHE'], 'CodeQL');
-        if (codeqlPath !== undefined) {
-          fs.rmdirSync(codeqlPath, { recursive: true });
-        }
-  - id: init
-    uses: ./../action/init
-    with:
-      languages: javascript
-      tools: ${{ steps.prepare-test.outputs.tools-url }}
-  - uses: ./../action/analyze
-    with:
-      output: ${{ runner.temp }}/results
-      upload-database: false
-  - name: Upload SARIF
-    uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-    with:
-      name: ${{ matrix.os }}-zstd-bundle.sarif
-      path: ${{ runner.temp }}/results/javascript.sarif
-      retention-days: 7
-  - name: Check diagnostic with expected tools URL appears in SARIF
-    uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-    env:
-      SARIF_PATH: ${{ runner.temp }}/results/javascript.sarif
-    with:
-      script: |
-        const fs = require('fs');
-
-        const sarif = JSON.parse(fs.readFileSync(process.env['SARIF_PATH'], 'utf8'));
-        const run = sarif.runs[0];
-
-        const toolExecutionNotifications = run.invocations[0].toolExecutionNotifications;
-        const downloadTelemetryNotifications = toolExecutionNotifications.filter(n =>
-          n.descriptor.id === 'codeql-action/bundle-download-telemetry'
-        );
-        if (downloadTelemetryNotifications.length !== 1) {
-          core.setFailed(
-            'Expected exactly one reporting descriptor in the ' +
-              `'runs[].invocations[].toolExecutionNotifications[]' SARIF property, but found ` +
-              `${downloadTelemetryNotifications.length}. All notification reporting descriptors: ` +
-              `${JSON.stringify(toolExecutionNotifications)}.`
-          );
-        }
-
-        const toolsUrl = downloadTelemetryNotifications[0].properties.attributes.toolsUrl;
-        console.log(`Found tools URL: ${toolsUrl}`);
-
-        const expectedExtension = process.env['RUNNER_OS'] === 'Windows' ? '.tar.gz' : '.tar.zst';
-
-        if (!toolsUrl.endsWith(expectedExtension)) {
-          core.setFailed(
-            `Expected the tools URL to be a ${expectedExtension} file, but found ${toolsUrl}.`
-          );
-        }
diff --git a/pr-checks/checks/global-proxy.yml b/pr-checks/checks/global-proxy.yml
index 5f90022c04..9d9653c13c 100644
--- a/pr-checks/checks/global-proxy.yml
+++ b/pr-checks/checks/global-proxy.yml
@@ -5,17 +5,45 @@ versions:
   - nightly-latest
 container:
   image: ubuntu:22.04
+  options: --cap-add=NET_ADMIN
 services:
   squid-proxy:
     image: ubuntu/squid:latest
     ports:
       - 3128:3128
 env:
-  https_proxy: http://squid-proxy:3128
   CODEQL_ACTION_TOLERATE_MISSING_GIT_VERSION: true
 steps:
+  - name: Block direct internet access to force proxy usage
+    run: |
+      apt-get update -qq && apt-get install -y -qq iptables >/dev/null 2>&1
+      PROXY_IP=$(getent hosts squid-proxy | awk '{ print $1 }')
+      echo "Squid proxy IP: $PROXY_IP"
+      # Allow all traffic to the proxy container
+      iptables -A OUTPUT -d "$PROXY_IP" -j ACCEPT
+      # Allow DNS resolution
+      iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
+      iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT
+      # Allow loopback
+      iptables -A OUTPUT -o lo -j ACCEPT
+      # Allow already-established connections (from checkout/prepare-test)
+      iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+      # Block all other outbound HTTP and HTTPS, ensuring direct access fails
+      iptables -A OUTPUT -p tcp --dport 80 -j REJECT --reject-with tcp-reset
+      iptables -A OUTPUT -p tcp --dport 443 -j REJECT --reject-with tcp-reset
+      echo "Direct HTTP/HTTPS access is now blocked - all traffic must go through the proxy"
+
+  - name: Set proxy environment variables
+    shell: bash
+    run: |
+      echo "http_proxy=http://squid-proxy:3128" >> $GITHUB_ENV
+      echo "HTTP_PROXY=http://squid-proxy:3128" >> $GITHUB_ENV
+      echo "https_proxy=http://squid-proxy:3128" >> $GITHUB_ENV
+      echo "HTTPS_PROXY=http://squid-proxy:3128" >> $GITHUB_ENV
+
   - uses: ./../action/init
     with:
       languages: javascript
       tools: ${{ steps.prepare-test.outputs.tools-url }}
+
   - uses: ./../action/analyze
diff --git a/pr-checks/checks/go-indirect-tracing-workaround-diagnostic.yml b/pr-checks/checks/go-indirect-tracing-workaround-diagnostic.yml
index 895dba2b6c..f0b4097d7b 100644
--- a/pr-checks/checks/go-indirect-tracing-workaround-diagnostic.yml
+++ b/pr-checks/checks/go-indirect-tracing-workaround-diagnostic.yml
@@ -12,7 +12,7 @@ steps:
       languages: go
       tools: ${{ steps.prepare-test.outputs.tools-url }}
   # Deliberately change Go after the `init` step
-  - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+  - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
     with:
       go-version: "1.20"
   - name: Build code
diff --git a/pr-checks/checks/job-run-uuid-sarif.yml b/pr-checks/checks/job-run-uuid-sarif.yml
index dc1dd02d43..b86725d944 100644
--- a/pr-checks/checks/job-run-uuid-sarif.yml
+++ b/pr-checks/checks/job-run-uuid-sarif.yml
@@ -21,8 +21,8 @@ steps:
     run: |
       cd "$RUNNER_TEMP/results"
       actual=$(jq -r '.runs[0].properties.jobRunUuid' javascript.sarif)
-      if [[ "$actual" != "$JOB_RUN_UUID" ]]; then
-        echo "Expected SARIF output to contain job run UUID '$JOB_RUN_UUID', but found '$actual'."
+      if [[ "$actual" != "$CODEQL_ACTION_JOB_RUN_UUID" ]]; then
+        echo "Expected SARIF output to contain job run UUID '$CODEQL_ACTION_JOB_RUN_UUID', but found '$actual'."
         exit 1
       else
         echo "Found job run UUID '$actual'."
diff --git a/pr-checks/checks/multi-language-autodetect.yml b/pr-checks/checks/multi-language-autodetect.yml
index 801f4521a4..b57e90ab4c 100644
--- a/pr-checks/checks/multi-language-autodetect.yml
+++ b/pr-checks/checks/multi-language-autodetect.yml
@@ -23,7 +23,7 @@ steps:
     # We need Python 3.13 for older CLI versions because they are not compatible with Python 3.14 or newer.
     # See https://github.com/github/codeql-action/pull/3212
     if: matrix.version != 'nightly-latest' && matrix.version != 'linked'
-    uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+    uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
     with:
       python-version: "3.13"
 
diff --git a/pr-checks/checks/rubocop-multi-language.yml b/pr-checks/checks/rubocop-multi-language.yml
index dd9c218289..37c5d36e90 100644
--- a/pr-checks/checks/rubocop-multi-language.yml
+++ b/pr-checks/checks/rubocop-multi-language.yml
@@ -5,7 +5,7 @@ versions:
   - default
 steps:
   - name: Set up Ruby
-    uses: ruby/setup-ruby@9eb537ca036ebaed86729dcb9309076e4c5c3b74 # v1.314.0
+    uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
     with:
       ruby-version: 2.6
   - name: Install Code Scanning integration
diff --git a/pr-checks/checks/start-proxy.yml b/pr-checks/checks/start-proxy.yml
index a4bf794873..675fc013a2 100644
--- a/pr-checks/checks/start-proxy.yml
+++ b/pr-checks/checks/start-proxy.yml
@@ -6,16 +6,14 @@ operatingSystems:
   - windows
 versions:
   - linked
+env:
+  CODEQL_ACTION_PROXY_API_REQUESTS: "true"
 steps:
-  - uses: ./../action/init
-    with:
-      languages: csharp
-      tools: ${{ steps.prepare-test.outputs.tools-url }}
-
   - name: Setup proxy for registries
     id: proxy
     uses: ./../action/start-proxy
     with:
+      language: java
       registry_secrets: |
         [
           {
@@ -44,3 +42,13 @@ steps:
       || !contains(steps.proxy.outputs.proxy_urls, 'https://repo.maven.apache.org/maven2/')
       || !contains(steps.proxy.outputs.proxy_urls, 'https://repo1.maven.org/maven2')
     run: exit 1
+
+  - uses: ./../action/init
+    env:
+      CODEQL_PROXY_HOST: ${{ steps.proxy.outputs.proxy_host }}
+      CODEQL_PROXY_PORT: ${{ steps.proxy.outputs.proxy_port }}
+      CODEQL_PROXY_CA_CERTIFICATE: ${{ steps.proxy.outputs.proxy_ca_certificate }}
+    with:
+      languages: java
+      tools: ${{ steps.prepare-test.outputs.tools-url }}
+      config-file: codeql-action@main:tests/multi-language-repo/.github/codeql/custom-queries.yml
diff --git a/pr-checks/checks/submit-sarif-failure.yml b/pr-checks/checks/submit-sarif-failure.yml
index 9212a5dc79..c33e1322f7 100644
--- a/pr-checks/checks/submit-sarif-failure.yml
+++ b/pr-checks/checks/submit-sarif-failure.yml
@@ -21,7 +21,7 @@ permissions:
   security-events: write # needed to upload the SARIF file
 
 steps:
-  - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+  - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
   - uses: ./init
     with:
       languages: javascript
diff --git a/pr-checks/checks/with-checkout-path.yml b/pr-checks/checks/with-checkout-path.yml
index 7a5866b783..a6cde895b6 100644
--- a/pr-checks/checks/with-checkout-path.yml
+++ b/pr-checks/checks/with-checkout-path.yml
@@ -14,7 +14,7 @@ steps:
       rm -rf ./* .github .git
   # Check out the actions repo again, but at a different location.
   # choose an arbitrary SHA so that we can later test that the commit_oid is not from main
-  - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+  - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     with:
       ref: 474bbf07f9247ffe1856c6a0f94aeeb10e7afee6
       path: x/y/z/some-path
diff --git a/pr-checks/config.ts b/pr-checks/config.ts
index 75cd0a1515..356fe665f9 100644
--- a/pr-checks/config.ts
+++ b/pr-checks/config.ts
@@ -12,6 +12,12 @@ export const REPO_ROOT = path.join(PR_CHECKS_DIR, "..");
 /** The path of the file configuring which checks shouldn't be required. */
 export const PR_CHECK_EXCLUDED_FILE = path.join(PR_CHECKS_DIR, "excluded.yml");
 
+/** The path of the main `package.json`. */
+export const PACKAGE_JSON = path.join(REPO_ROOT, "package.json");
+
+/** The path of the changelog. */
+export const CHANGELOG_FILE = path.join(REPO_ROOT, "CHANGELOG.md");
+
 /** The path to the esbuild metadata file. */
 export const BUNDLE_METADATA_FILE = path.join(REPO_ROOT, "meta.json");
 
@@ -30,3 +36,13 @@ export const API_COMPATIBILITY_FILE = path.join(
   SOURCE_ROOT,
   "api-compatibility.json",
 );
+
+/** The prefix of CodeQL CLI bundle release URLs. */
+export const CLI_BUNDLE_RELEASE_URL_PREFIX =
+  "https://github.com/github/codeql-action/releases/tag/codeql-bundle-v";
+
+/** A common interface for operations that support dry runs. */
+export interface DryRunOption {
+  /** A value indicating whether to perform operations with side effects. */
+  dryRun?: boolean;
+}
diff --git a/pr-checks/excluded.yml b/pr-checks/excluded.yml
index d8d643d107..1a5262fc0b 100644
--- a/pr-checks/excluded.yml
+++ b/pr-checks/excluded.yml
@@ -10,6 +10,7 @@ is:
   - "check-expected-release-files"
   - "Cleanup artifacts"
   - "CodeQL"
+  - "copilot-pull-request-reviewer"
   - "Dependabot"
   - "Label PR with size"
   - "Post repo size comment"
diff --git a/pr-checks/package.json b/pr-checks/package.json
index e5a119ff1c..07d599bb68 100644
--- a/pr-checks/package.json
+++ b/pr-checks/package.json
@@ -12,6 +12,6 @@
   },
   "devDependencies": {
     "@types/node": "^20.19.43",
-    "tsx": "^4.22.4"
+    "tsx": "^4.23.1"
   }
 }
diff --git a/pr-checks/prepare-changelog.test.ts b/pr-checks/prepare-changelog.test.ts
new file mode 100644
index 0000000000..13a302c8f6
--- /dev/null
+++ b/pr-checks/prepare-changelog.test.ts
@@ -0,0 +1,54 @@
+/**
+ * Tests for `prepare-changelog.ts`.
+ */
+
+import * as assert from "node:assert/strict";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { afterEach, beforeEach, describe, it } from "node:test";
+
+import { EMPTY_CHANGELOG, NO_CHANGES_STR } from "./changelog";
+import { extractChangelogSnippet } from "./prepare-changelog";
+
+let testDir: string;
+
+beforeEach(() => {
+  // Set up a temporary directory for testing
+  testDir = fs.mkdtempSync(path.join(os.tmpdir(), "prepare-changelog-test-"));
+});
+
+afterEach(() => {
+  /** Clean up temporary directories. */
+  fs.rmSync(testDir, { recursive: true, force: true });
+});
+
+const testBody = `- Test change`;
+const testChangelog = `${EMPTY_CHANGELOG.replace(NO_CHANGES_STR, testBody)}
+
+## Another section
+
+- Other change`;
+
+describe("extractChangelogSnippet", async () => {
+  await it("returns the default body if the input doesn't exist", async () => {
+    const result = extractChangelogSnippet(path.join(testDir, "not-here.md"));
+    assert.deepEqual(result, NO_CHANGES_STR);
+  });
+
+  await it("returns the first section if the input exists", async () => {
+    const changelogPath = path.join(testDir, "test-readme.md");
+    fs.writeFileSync(changelogPath, testChangelog);
+
+    const result = extractChangelogSnippet(changelogPath);
+    assert.deepEqual(result, testBody);
+  });
+
+  await it("returns an empty string if there is no first section", async () => {
+    const changelogPath = path.join(testDir, "test-readme.md");
+    fs.writeFileSync(changelogPath, "# CodeQL Action Changelog\n");
+
+    const result = extractChangelogSnippet(changelogPath);
+    assert.deepEqual(result, "");
+  });
+});
diff --git a/pr-checks/prepare-changelog.ts b/pr-checks/prepare-changelog.ts
new file mode 100755
index 0000000000..0c89699fc8
--- /dev/null
+++ b/pr-checks/prepare-changelog.ts
@@ -0,0 +1,82 @@
+#!/usr/bin/env npx tsx
+
+/**
+ * Extracts the body of the first changelog section and outputs it to either
+ * stdout or a file.
+ */
+
+import * as fs from "node:fs";
+import { parseArgs } from "node:util";
+
+import { NO_CHANGES_STR, parseChangelog } from "./changelog";
+import { CHANGELOG_FILE } from "./config";
+import { getErrorMessage } from "./util";
+
+/**
+ * Prepare the changelog for the new release
+ * This function will extract the part of the changelog that
+ * we want to include in the new release.
+ *
+ * @param changelogPath The path to the changelog file.
+ */
+export function extractChangelogSnippet(changelogPath: string) {
+  try {
+    const content = fs.readFileSync(changelogPath, "utf-8");
+    const changelog = parseChangelog(content);
+
+    // Return an empty string if we couldn't find the first section.
+    if (changelog.sections.length === 0) {
+      return "";
+    }
+
+    return changelog.sections[0].bodyLines.join("\n").trim();
+  } catch (err) {
+    if (err instanceof Error && "code" in err && err.code === "ENOENT") {
+      console.error(`Changelog file at '${changelogPath}' does not exist.`);
+      return NO_CHANGES_STR;
+    } else {
+      throw Error(
+        `Failed to open changelog file at '${changelogPath}': ${getErrorMessage(err)}`,
+      );
+    }
+  }
+}
+
+function main() {
+  try {
+    const { values } = parseArgs({
+      options: {
+        changelog: {
+          type: "string",
+          short: "f",
+          default: CHANGELOG_FILE,
+        },
+        output: {
+          type: "string",
+          short: "o",
+        },
+      },
+      strict: true,
+    });
+
+    const body = extractChangelogSnippet(values.changelog);
+
+    // If no `output` argument was provided, output to stdout. Otherwise,
+    // write a file to the specified path.
+    if (values.output === undefined) {
+      console.info(body);
+    } else {
+      fs.writeFileSync(values.output, body);
+    }
+
+    return 0;
+  } catch (err) {
+    console.error(`Failed to prepare changelog: ${getErrorMessage(err)}`);
+    return -1;
+  }
+}
+
+// Only call `main` if this script was run directly.
+if (require.main === module) {
+  process.exit(main());
+}
diff --git a/pr-checks/rollback-changelog.test.ts b/pr-checks/rollback-changelog.test.ts
new file mode 100644
index 0000000000..5264755a69
--- /dev/null
+++ b/pr-checks/rollback-changelog.test.ts
@@ -0,0 +1,45 @@
+/**
+ * Tests for `rollback-changelog.ts`.
+ */
+
+import * as assert from "node:assert/strict";
+import * as fs from "node:fs";
+import { describe, it } from "node:test";
+
+import { getReleaseDateString, parseChangelog } from "./changelog";
+import { CHANGELOG_FILE } from "./config";
+import { updateChangelog } from "./rollback-changelog";
+
+describe("updateChangelog", async () => {
+  await it("replaces the first section with one for the rollback release", async () => {
+    const actualChangelog = parseChangelog(
+      fs.readFileSync(CHANGELOG_FILE, "utf-8"),
+    );
+    const existingFirstSection = actualChangelog.sections[0];
+
+    const today = new Date();
+    updateChangelog(actualChangelog, {
+      "new-version": "Test.1.3",
+      "rollback-version": "Test.1.2",
+      "target-version": "Test.1.1",
+      today,
+    });
+
+    // Check that the old, first section is gone.
+    for (const section of actualChangelog.sections) {
+      assert.notDeepEqual(section, existingFirstSection);
+    }
+
+    // Check that the new, first section matches our expectations.
+    const newFirstSection = actualChangelog.sections[0];
+    assert.deepEqual(
+      newFirstSection.headerLine,
+      `## Test.1.3 - ${getReleaseDateString(today)}`,
+    );
+    assert.equal(newFirstSection.bodyLines.length, 3);
+    assert.deepEqual(
+      newFirstSection.bodyLines[1],
+      `This release rolls back Test.1.2 due to issues with that release. It is identical to Test.1.1.`,
+    );
+  });
+});
diff --git a/pr-checks/rollback-changelog.ts b/pr-checks/rollback-changelog.ts
new file mode 100755
index 0000000000..15a37b1b7c
--- /dev/null
+++ b/pr-checks/rollback-changelog.ts
@@ -0,0 +1,84 @@
+#!/usr/bin/env npx tsx
+
+/**
+ * Replaces the current, first section of the changelog with a new one for the rollback release.
+ */
+
+import * as fs from "node:fs";
+import { parseArgs } from "node:util";
+
+import {
+  Changelog,
+  ChangelogSection,
+  getReleaseDateString,
+  parseChangelog,
+  renderChangelog,
+} from "./changelog";
+import { CHANGELOG_FILE } from "./config";
+import { getErrorMessage } from "./util";
+
+export interface RollbackChangelogInputs {
+  "target-version": string;
+  "rollback-version": string;
+  "new-version": string;
+  today?: Date;
+}
+
+/**
+ * Replaces the current, first section of the changelog with a new one for the rollback release.
+ */
+export function updateChangelog(
+  changelog: Changelog,
+  versions: RollbackChangelogInputs,
+) {
+  // Drop the existing first section.
+  changelog.sections.shift();
+
+  // Construct the section for the rollback version.
+  const newSection: ChangelogSection = {
+    headerLine: `## ${versions["new-version"]} - ${getReleaseDateString(versions.today)}`,
+    bodyLines: [
+      "",
+      `This release rolls back ${versions["rollback-version"]} due to issues with that release. It is identical to ${versions["target-version"]}.`,
+      "",
+    ],
+  };
+
+  // Add the new section at the top of the changelog.
+  changelog.sections.unshift(newSection);
+}
+
+function main() {
+  try {
+    const options = {
+      "target-version": { type: "string", short: "t" },
+      "rollback-version": { type: "string", short: "r" },
+      "new-version": { type: "string", short: "n" },
+    } as const;
+
+    const { values } = parseArgs({ options, strict: true });
+
+    for (const key of Object.keys(options)) {
+      const val = values[key as keyof typeof values];
+      if (val === undefined || val.trim() === "") {
+        throw new Error(`Argument '--${key}' is required.`);
+      }
+    }
+
+    const changelog = parseChangelog(fs.readFileSync(CHANGELOG_FILE, "utf-8"));
+    updateChangelog(changelog, values as RollbackChangelogInputs);
+    console.info(renderChangelog(changelog));
+
+    return 0;
+  } catch (err) {
+    console.error(
+      `Failed to prepare rollback changelog: ${getErrorMessage(err)}`,
+    );
+    return -1;
+  }
+}
+
+// Only call `main` if this script was run directly.
+if (require.main === module) {
+  process.exit(main());
+}
diff --git a/pr-checks/sync.ts b/pr-checks/sync.ts
index cc4f669460..0517feddbd 100755
--- a/pr-checks/sync.ts
+++ b/pr-checks/sync.ts
@@ -211,8 +211,8 @@ const languageSetups: LanguageSetups = {
         name: "Install Node.js",
         uses: pinnedUses(
           "actions/setup-node",
-          "48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e",
-          "v6.4.0",
+          "820762786026740c76f36085b0efc47a31fe5020",
+          "v7.0.0",
         ),
         with: {
           "node-version": defaultLanguageVersions.javascript,
@@ -233,8 +233,8 @@ const languageSetups: LanguageSetups = {
         name: "Install Go",
         uses: pinnedUses(
           "actions/setup-go",
-          "924ae3a1cded613372ab5595356fb5720e22ba16",
-          "v6.5.0",
+          "b7ad1dad31e06c5925ef5d2fc7ad053ef454303e",
+          "v7.0.0",
         ),
         with: {
           "go-version": `\${{ inputs.go-version || '${defaultLanguageVersions.go}' }}`,
@@ -253,8 +253,8 @@ const languageSetups: LanguageSetups = {
         name: "Install Java",
         uses: pinnedUses(
           "actions/setup-java",
-          "1bcf9fb12cf4aa7d266a90ae39939e61372fe520",
-          "v5.4.0",
+          "03ad4de0992f5dab5e18fcb136590ce7c4a0ac95",
+          "v5.6.0",
         ),
         with: {
           "java-version": `\${{ inputs.java-version || '${defaultLanguageVersions.java}' }}`,
@@ -271,8 +271,8 @@ const languageSetups: LanguageSetups = {
         name: "Install Python",
         uses: pinnedUses(
           "actions/setup-python",
-          "ece7cb06caefa5fff74198d8649806c4678c61a1",
-          "v6.3.0",
+          "5fda3b95a4ea91299a34e894583c3862153e4b97",
+          "v7.0.0",
         ),
         with: {
           "python-version": `\${{ inputs.python-version || '${defaultLanguageVersions.python}' }}`,
@@ -288,8 +288,8 @@ const languageSetups: LanguageSetups = {
         name: "Install .NET",
         uses: pinnedUses(
           "actions/setup-dotnet",
-          "26b0ec14cb23fa6904739307f278c14f94c95bf1",
-          "v5.4.0",
+          "a98b56852c35b8e3190ac28c8c2271da59106c68",
+          "v6.0.0",
         ),
         with: {
           "dotnet-version": `\${{ inputs.dotnet-version || '${defaultLanguageVersions.csharp}' }}`,
@@ -529,8 +529,8 @@ function generateJob(
       name: "Check out repository",
       uses: pinnedUses(
         "actions/checkout",
-        "9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0",
-        "v7.0.0",
+        "3d3c42e5aac5ba805825da76410c181273ba90b1",
+        "v7.0.1",
       ),
     },
     ...setupInfo.steps,
diff --git a/pr-checks/update-release-branch.ts b/pr-checks/update-release-branch.ts
new file mode 100755
index 0000000000..088da59281
--- /dev/null
+++ b/pr-checks/update-release-branch.ts
@@ -0,0 +1,840 @@
+#!/usr/bin/env npx tsx
+
+/**
+ * Creates a release preparation branch and opens a PR to merge changes from a
+ * source branch into a target release branch.
+ *
+ * For primary releases this merges `main` into the latest `releases/vN` branch.
+ * For backports this merges a newer release branch into an older one, handling
+ * version number and changelog migration automatically.
+ *
+ * Usage:
+ *   update-release-branch.ts \
+ *     --repository-nwo github/codeql-action \
+ *     --source-branch main \
+ *     --target-branch releases/v4 \
+ *     --conductor username \
+ *     [--is-primary-release] \
+ *     [--dry-run]
+ */
+
+import { execFileSync, type ExecFileSyncOptions } from "node:child_process";
+import { parseArgs } from "node:util";
+
+import { type ApiClient, getApiClient } from "./api-client";
+import * as changelog from "./changelog";
+import { DryRunOption, REPO_ROOT } from "./config";
+import {
+  getCurrentVersion,
+  replaceVersionInPackageJson,
+  withPackageJson,
+} from "./versions";
+
+/**
+ * NB: This exact commit message is used to find commits for reverting during backports.
+ *  Changing it requires a transition period where both old and new versions are supported.
+ */
+export const BACKPORT_COMMIT_MESSAGE = "Update version and changelog for v";
+
+/**
+ * Commit message used for rebuild commits, both those produced by this script and those produced
+ *  by the `Rebuild Action` workflow (`.github/workflows/rebuild.yml`).
+ */
+export const REBUILD_COMMIT_MESSAGE = "Rebuild";
+
+/** The name of the git remote. */
+const ORIGIN = "origin";
+
+/** Environment variables checked (in order) for a GitHub API token. */
+const TOKEN_ENVIRONMENT_VARIABLES = ["GH_TOKEN", "GITHUB_TOKEN"] as const;
+
+/** The expected prefix for release branch names. */
+const RELEASE_BRANCH_PREFIX = "releases/v";
+
+/**
+ * Gets a GitHub API token from one of the supported environment variables.
+ * @throws If none of the supported environment variables is set.
+ */
+export function getGitHubToken(): string {
+  for (const name of TOKEN_ENVIRONMENT_VARIABLES) {
+    const token = process.env[name]?.trim();
+    if (token) {
+      return token;
+    }
+  }
+  throw new Error("Missing GitHub token. Set GITHUB_TOKEN or GH_TOKEN.");
+}
+
+/** Options for {@link runCommand}. */
+export interface RunCommandOptions extends DryRunOption {
+  /** Options for `execFileSync`. */
+  execOptions?: ExecFileSyncOptions;
+}
+
+/**
+ * Runs a command, streaming output to the console by default.
+ *
+ * @param command The name of the command to run.
+ * @param args The arguments for the command.
+ * @throws When the process exits with a non-zero exit code.
+ * @param options How to run the command.
+ */
+export function runCommand(
+  command: string,
+  args: string[],
+  options?: RunCommandOptions,
+) {
+  if (!options?.dryRun) {
+    console.log(`Running \`${command} ${args.join(" ")}\`.`);
+    return execFileSync(command, args, {
+      stdio: "inherit",
+      cwd: REPO_ROOT,
+      ...options?.execOptions,
+    });
+  } else {
+    console.info(
+      `[DRY RUN] Would have executed '${command} ${args.join(" ")}'`,
+    );
+    return "";
+  }
+}
+
+/** Options for {@link runGit}. */
+export interface RunGitOptions extends DryRunOption {
+  /** When true, non-zero exit codes will not throw. */
+  allowNonZeroExitCode?: boolean;
+}
+
+/**
+ * Runs `git` with the given `args` and returns the stdout.
+ *
+ * @param args - Arguments to pass to `git`.
+ * @param options - Optional settings.
+ * @throws If `git` does not exit successfully, unless
+ *         `options.allowNonZeroExitCode` is `true`.
+ * @returns The trimmed stdout output.
+ */
+export function runGit(args: string[], options?: RunGitOptions): string {
+  const execOptions: ExecFileSyncOptions = {
+    encoding: "utf8",
+    stdio: ["pipe", "pipe", "pipe"],
+  };
+
+  try {
+    const result = runCommand("git", args, {
+      dryRun: options?.dryRun,
+      execOptions,
+    }) as string;
+    return result.trimEnd();
+  } catch (error: unknown) {
+    if (options?.allowNonZeroExitCode) {
+      // execFileSync throws an object with `stdout` when the process exits
+      // with a non-zero code.
+      const execError = error as { stdout?: Buffer | string };
+      if (typeof execError.stdout === "string") {
+        return execError.stdout.trimEnd();
+      }
+      if (Buffer.isBuffer(execError.stdout)) {
+        return execError.stdout.toString("utf8").trimEnd();
+      }
+      return "";
+    }
+    throw error;
+  }
+}
+
+/** Returns true if the given branch exists on the origin remote. */
+export function branchExistsOnRemote(branchName: string): boolean {
+  const result = runGit(["ls-remote", "--heads", ORIGIN, branchName]);
+  return result !== "";
+}
+
+/** Represents commits returned by the GitHub API (relevant fields only). */
+export interface GitHubCommit {
+  sha: string;
+  commit: { message: string; author: { date?: string } | null };
+  author: { login: string } | null;
+  committer: { login: string } | null;
+  parents: Array<{ sha: string }>;
+}
+
+/** Returns true if the commit is an automatic PR merge commit made by GitHub. */
+export function isPrMergeCommit(commit: GitHubCommit): boolean {
+  return commit.committer?.login === "web-flow" && commit.parents.length > 1;
+}
+
+/**
+ * Gets a list of commits on the source branch that are not on the target branch,
+ * excluding automatic PR merge commits. This will not include any commits that
+ * exist on the target branch that aren't on the source branch.
+ *
+ * Uses `git log` to find the SHAs, then fetches each commit from the GitHub API
+ * to obtain full metadata (author, parents, associated PRs, etc.).
+ *
+ * @param client - An authenticated GitHub API client.
+ * @param owner - The repository owner.
+ * @param repo - The repository name.
+ * @param sourceBranch - The source branch name (without `origin/` prefix).
+ * @param targetBranch - The target branch name (without `origin/` prefix).
+ * @returns The list of non-merge commits unique to the source branch.
+ */
+export async function getCommitDifference(
+  client: ApiClient,
+  owner: string,
+  repo: string,
+  sourceBranch: string,
+  targetBranch: string,
+): Promise<GitHubCommit[]> {
+  const logOutput = runGit([
+    "log",
+    "--pretty=format:%H",
+    `${ORIGIN}/${targetBranch}..${ORIGIN}/${sourceBranch}`,
+  ]);
+
+  // An empty log output means no commits to merge.
+  if (logOutput === "") {
+    return [];
+  }
+
+  const shas = logOutput.split("\n");
+
+  // Fetch full commit objects from the API.
+  console.info(
+    `Fetching information about ${shas.length} commits from the API...`,
+  );
+
+  const commits: GitHubCommit[] = [];
+  for (const sha of shas) {
+    const { data } = await client.rest.repos.getCommit({
+      owner,
+      repo,
+      ref: sha,
+    });
+    commits.push(data as GitHubCommit);
+  }
+
+  // Filter out automatic PR merge commits.
+  return commits.filter((c) => !isPrMergeCommit(c));
+}
+
+/** Truncates a commit message for display. */
+export function getTruncatedCommitMessage(message: string): string {
+  const firstLine = message.split("\n")[0];
+  if (firstLine.length > 60) {
+    return `${firstLine.slice(0, 57)}...`;
+  }
+  return firstLine;
+}
+
+/** Represents pull requests associated with a commit (relevant fields only). */
+export interface AssociatedPullRequest {
+  number: number;
+  user: { login: string; site_admin: boolean } | null;
+  merge_commit_sha: string | null;
+}
+
+/**
+ * Gets the pull request that introduced a commit to the source branch.
+ * Returns the earliest PR by number if multiple are associated.
+ */
+export async function getPrForCommit(
+  client: ApiClient,
+  owner: string,
+  repo: string,
+  commit: GitHubCommit,
+): Promise<AssociatedPullRequest | undefined> {
+  const prs = await client.paginate(
+    client.rest.repos.listPullRequestsAssociatedWithCommit,
+    {
+      owner,
+      repo,
+      commit_sha: commit.sha,
+    },
+  );
+
+  if (prs.length === 0) {
+    return undefined;
+  }
+
+  // Return the earliest PR by number.
+  const sorted = [...prs].sort((a, b) => a.number - b.number);
+  return sorted[0];
+}
+
+/**
+ * Get the login of the person who merged a pull request.
+ * Falls back to the commit author of the merge commit.
+ * For most cases this will be the same as the author, but for PRs opened
+ * by external contributors getting the merger will get us the GitHub
+ * employee who reviewed and merged the PR.
+ */
+export async function getMergerOfPr(
+  client: ApiClient,
+  owner: string,
+  repo: string,
+  pr: AssociatedPullRequest,
+): Promise<string> {
+  if (!pr.merge_commit_sha) {
+    return "unknown";
+  }
+  const { data: commit } = await client.rest.repos.getCommit({
+    owner,
+    repo,
+    ref: pr.merge_commit_sha,
+  });
+  return commit.author?.login ?? "unknown";
+}
+
+/**
+ * Returns the PR author's login if they are GitHub staff (site_admin),
+ * otherwise undefined.
+ */
+export function getPrAuthorIfStaff(
+  pr: AssociatedPullRequest,
+): string | undefined {
+  if (pr.user?.site_admin) {
+    return pr.user.login;
+  }
+  return undefined;
+}
+
+/** Parameters for {@link openPr}. */
+interface OpenPrParams {
+  client: ApiClient;
+  owner: string;
+  repo: string;
+  commits: GitHubCommit[];
+  sourceBranchShortSha: string;
+  newBranchName: string;
+  sourceBranch: string;
+  targetBranch: string;
+  conductor: string;
+  isPrimaryRelease: boolean;
+  conflictedFiles: string[];
+  dryRun: boolean;
+}
+
+/**
+ * Opens a pull request from the new branch to the target branch and assigns
+ * the conductor.
+ */
+export async function openPr(params: OpenPrParams): Promise<void> {
+  const {
+    client,
+    owner,
+    repo,
+    commits,
+    sourceBranchShortSha,
+    newBranchName,
+    sourceBranch,
+    targetBranch,
+    conductor,
+    isPrimaryRelease,
+    conflictedFiles,
+    dryRun,
+  } = params;
+
+  // Sort the commits into those with and without associated PRs.
+  const pullRequests: AssociatedPullRequest[] = [];
+  const commitsWithoutPrs: GitHubCommit[] = [];
+
+  console.info(`Finding PRs for ${commits.length} commits...`);
+
+  for (const commit of commits) {
+    const pr = await getPrForCommit(client, owner, repo, commit);
+    if (!pr) {
+      commitsWithoutPrs.push(commit);
+    } else if (!pullRequests.some((p) => p.number === pr.number)) {
+      pullRequests.push(pr);
+    }
+  }
+
+  console.log(`Found ${pullRequests.length} pull requests.`);
+  console.log(
+    `Found ${commitsWithoutPrs.length} commits not in a pull request.`,
+  );
+
+  // Sort PRs by number (ascending) and commits by date.
+  pullRequests.sort((a, b) => a.number - b.number);
+  commitsWithoutPrs.sort((a, b) => {
+    const dateA = a.commit.author?.date ?? "";
+    const dateB = b.commit.author?.date ?? "";
+    return dateA.localeCompare(dateB);
+  });
+
+  // Build the PR body.
+  const body: string[] = [];
+  body.push(`Merging ${sourceBranchShortSha} into \`${targetBranch}\`.`);
+  body.push("");
+  body.push(`Conductor for this PR is @${conductor}.`);
+
+  if (pullRequests.length > 0) {
+    body.push("");
+    body.push("Contains the following pull requests:");
+    for (const pr of pullRequests) {
+      const displayUser =
+        getPrAuthorIfStaff(pr) ??
+        (await getMergerOfPr(client, owner, repo, pr));
+      body.push(`- #${pr.number} (@${displayUser})`);
+    }
+  }
+
+  if (commitsWithoutPrs.length > 0) {
+    body.push("");
+    body.push("Contains the following commits not from a pull request:");
+    for (const commit of commitsWithoutPrs) {
+      const authorDesc = commit.author ? ` (@${commit.author.login})` : "";
+      body.push(
+        `- ${commit.sha} - ${getTruncatedCommitMessage(commit.commit.message)}${authorDesc}`,
+      );
+    }
+  }
+
+  body.push("");
+  body.push("Please do the following:");
+  if (conflictedFiles.length > 0) {
+    body.push(
+      " - [ ] Ensure `package.json` file contains the correct version.",
+    );
+    body.push(
+      " - [ ] Add a commit to this branch to resolve the merge conflicts in the following files:",
+    );
+    for (const file of conflictedFiles) {
+      body.push(`    - \`${file}\``);
+    }
+    body.push(
+      ` - [ ] Rebuild the Action locally (\`npm run build\`) and push any changes to the built output in \`lib\` as a separate commit named exactly \`${REBUILD_COMMIT_MESSAGE}\`.`,
+    );
+    body.push(
+      " - [ ] Ensure another maintainer has reviewed the additional commits you added to this branch to resolve the merge conflicts.",
+    );
+  }
+  body.push(
+    " - [ ] Ensure the CHANGELOG displays the correct version and date.",
+  );
+  body.push(
+    " - [ ] Ensure the CHANGELOG includes all relevant, user-facing changes since the last release.",
+  );
+  body.push(
+    ` - [ ] Check that there are not any unexpected commits being merged into the \`${targetBranch}\` branch.`,
+  );
+  body.push(
+    " - [ ] Ensure the docs team is aware of any documentation changes that need to be released.",
+  );
+  body.push(
+    " - [ ] Approve running the full set of PR checks if you have not pushed any changes.",
+  );
+  body.push(
+    " - [ ] Approve and merge this PR. Make sure `Create a merge commit` is selected rather than `Squash and merge` or `Rebase and merge`.",
+  );
+
+  if (isPrimaryRelease) {
+    body.push(
+      " - [ ] Merge the mergeback PR that will automatically be created once this PR is merged.",
+    );
+    body.push(
+      " - [ ] Merge all backport PRs to older release branches, that will automatically be created once this PR is merged.",
+    );
+  }
+
+  const title = `Merge ${sourceBranch} into ${targetBranch}`;
+
+  if (dryRun) {
+    console.info(`[DRY RUN] Would create PR: "${title}" with body:`);
+
+    for (const line of body) {
+      console.info(`[DRY RUN] > ${line}`);
+    }
+
+    console.info(`[DRY RUN] and assign it to @${conductor}`);
+
+    return;
+  }
+
+  // Create the pull request.
+  const { data: pr } = await client.rest.pulls.create({
+    owner,
+    repo,
+    title,
+    body: body.join("\n"),
+    head: newBranchName,
+    base: targetBranch,
+  });
+  console.log(`Created PR #${pr.number}`);
+
+  // Assign the conductor.
+  await client.rest.issues.addAssignees({
+    owner,
+    repo,
+    issue_number: pr.number,
+    assignees: [conductor],
+  });
+  console.log(`Assigned PR to ${conductor}`);
+}
+
+interface MainOptions {
+  dryRun: boolean;
+  repositoryNwo: string;
+  sourceBranch: string;
+  targetBranch: string;
+  isPrimaryRelease: boolean;
+  conductor: string;
+}
+
+function parseCliOptions(): MainOptions {
+  const { values } = parseArgs({
+    options: {
+      "dry-run": { type: "boolean", default: false },
+      "repository-nwo": { type: "string" },
+      "source-branch": { type: "string" },
+      "target-branch": { type: "string" },
+      "is-primary-release": { type: "boolean", default: false },
+      conductor: { type: "string" },
+    },
+    strict: true,
+  });
+
+  if (!values["repository-nwo"]) {
+    throw new Error("--repository-nwo is required");
+  }
+  if (!values["source-branch"]) {
+    throw new Error("--source-branch is required");
+  }
+  if (!values["target-branch"]) {
+    throw new Error("--target-branch is required");
+  }
+  if (!values["conductor"]) {
+    throw new Error("--conductor is required");
+  }
+
+  return {
+    dryRun: values["dry-run"],
+    repositoryNwo: values["repository-nwo"],
+    sourceBranch: values["source-branch"],
+    targetBranch: values["target-branch"],
+    isPrimaryRelease: values["is-primary-release"] ?? false,
+    conductor: values["conductor"],
+  };
+}
+
+/**
+ * Rebuilds the action (npm ci + npm run build) and commits any changes.
+ */
+export function rebuildAction(options: MainOptions): void {
+  // For backports, the only source-level change vs the source branch is the new version number,
+  // so we just need to refresh the version embedded in `lib/`.
+  runCommand("npm", ["ci"]);
+  runCommand("npm", ["run", "build"]);
+
+  runGit(["add", "--all"], { dryRun: options.dryRun });
+
+  // `git diff --cached --quiet` exits 0 if there are no staged changes.
+  try {
+    execFileSync("git", ["diff", "--cached", "--quiet"]);
+    console.log("Rebuild produced no changes; skipping Rebuild commit.");
+  } catch {
+    runGit(["commit", "-m", REBUILD_COMMIT_MESSAGE], {
+      dryRun: options.dryRun,
+    });
+    console.log("Created Rebuild commit.");
+  }
+}
+
+/**
+ * Prepares the new update/backport branch.
+ *
+ * @param options The options we are running with.
+ * @param newBranchName The name of the new branch to create.
+ * @param targetBranchMajorVersion The target branch's major version.
+ * @param version The target version.
+ */
+export async function prepareNewBranch(
+  options: MainOptions,
+  newBranchName: string,
+  targetBranchMajorVersion: string,
+  version: string,
+): Promise<string[]> {
+  // The process of creating the v{Older} release can run into merge conflicts. We commit the unresolved
+  // conflicts so a maintainer can easily resolve them (vs erroring and requiring maintainers to
+  // reconstruct the release manually)
+  let conflictedFiles: string[] = [];
+
+  if (!options.isPrimaryRelease) {
+    // For backports, the source branch is also a release branch.
+    const sourceBranchMajorVersion = options.sourceBranch.replace(
+      RELEASE_BRANCH_PREFIX,
+      "",
+    );
+
+    // Start from the target branch.
+    console.log(
+      `Creating ${newBranchName} from the ${ORIGIN}/${options.targetBranch} branch`,
+    );
+
+    runGit(
+      ["checkout", "-b", newBranchName, `${ORIGIN}/${options.targetBranch}`],
+      { dryRun: options.dryRun },
+    );
+
+    // Revert the commit that we made as part of the last release that updated the version number and
+    // changelog to refer to {older}.x.x variants. This avoids merge conflicts in the changelog and
+    // package.json files when we merge in the v{latest} branch.
+    // This commit will not exist the first time we release the v{N-1} branch from the v{N} branch, so we
+    // use `git log --grep` to conditionally revert the commit.
+    console.log(
+      "Reverting the version number and changelog updates from the last release to avoid conflicts",
+    );
+    const vOlderUpdateCommits = runGit([
+      "log",
+      "--grep",
+      `^${BACKPORT_COMMIT_MESSAGE}`,
+      "--format=%H",
+    ])
+      .split("\n")
+      .filter((s) => s !== "");
+
+    if (vOlderUpdateCommits.length > 0) {
+      // Only revert the newest commit as older ones will already have been
+      // reverted in previous releases.
+      console.log(`  Reverting ${vOlderUpdateCommits[0]}`);
+      runGit(["revert", vOlderUpdateCommits[0], "--no-edit"], {
+        dryRun: options.dryRun,
+      });
+
+      // Also revert the "Rebuild" commit, whether created by this script or
+      // by the `Rebuild Action` workflow.
+      const rebuildCommits = runGit([
+        "log",
+        "--grep",
+        `^${REBUILD_COMMIT_MESSAGE}$`,
+        "--format=%H",
+      ])
+        .split("\n")
+        .filter((s) => s !== "");
+      const rebuildCommit = rebuildCommits[0];
+      console.log(`  Reverting ${rebuildCommit}`);
+      runGit(["revert", rebuildCommit, "--no-edit"], {
+        dryRun: options.dryRun,
+      });
+    } else {
+      console.log("  Nothing to revert.");
+    }
+
+    // Merge the source branch into the release prep branch.
+    console.log(
+      `Merging ${ORIGIN}/${options.sourceBranch} into the release prep branch`,
+    );
+    runGit(["merge", `${ORIGIN}/${options.sourceBranch}`], {
+      allowNonZeroExitCode: true,
+      dryRun: options.dryRun,
+    });
+    conflictedFiles = runGit(["diff", "--name-only", "--diff-filter", "U"])
+      .split("\n")
+      .filter((s) => s !== "");
+    if (conflictedFiles.length > 0) {
+      runGit(["add", "."], {
+        dryRun: options.dryRun,
+      });
+      runGit(["commit", "--no-edit"], {
+        dryRun: options.dryRun,
+      });
+    }
+
+    // Migrate the package version number.
+    console.log(`Setting version number to '${version}' in package.json`);
+    withPackageJson((content) => {
+      const currentPkgVersion = getCurrentVersion(content);
+      if (currentPkgVersion) {
+        return {
+          content: replaceVersionInPackageJson(
+            currentPkgVersion,
+            version,
+            content,
+          ),
+          value: currentPkgVersion,
+        };
+      }
+      return { value: currentPkgVersion };
+    }, options);
+    runGit(["add", "package.json"], {
+      dryRun: options.dryRun,
+    });
+
+    // Migrate the changelog notes from the source major version to the target.
+    console.log(
+      `Migrating changelog notes from v${sourceBranchMajorVersion} to v${targetBranchMajorVersion}`,
+    );
+    changelog.withChangelog(
+      (contents) =>
+        changelog.processChangelogForBackports(
+          sourceBranchMajorVersion,
+          targetBranchMajorVersion,
+          contents,
+        ),
+      options,
+    );
+
+    runGit(["add", "CHANGELOG.md"], {
+      dryRun: options.dryRun,
+    });
+    runGit(["commit", "-m", `${BACKPORT_COMMIT_MESSAGE}${version}`], {
+      dryRun: options.dryRun,
+    });
+  } else {
+    // For a standard (primary) release, there won't be new commits on the
+    // target branch that aren't already on the source branch, so we can just
+    // start from the source branch.
+    runGit(
+      ["checkout", "-b", newBranchName, `${ORIGIN}/${options.sourceBranch}`],
+      {
+        dryRun: options.dryRun,
+      },
+    );
+
+    console.log("Updating changelog");
+    changelog.withChangelog(
+      (contents) => changelog.setVersionAndDate(version, contents),
+      { ...options, initChangelog: true },
+    );
+
+    runGit(["add", "CHANGELOG.md"], {
+      dryRun: options.dryRun,
+    });
+    runGit(["commit", "-m", `Update changelog for v${version}`], {
+      dryRun: options.dryRun,
+    });
+  }
+
+  // For backports, rebuild the action unless there were merge conflicts.
+  if (!options.isPrimaryRelease) {
+    if (conflictedFiles.length === 0) {
+      console.log("Rebuilding the Action.");
+      rebuildAction(options);
+    } else {
+      console.log(
+        `Skipping automatic rebuild because the merge produced conflicts in: ${conflictedFiles.join(", ")}`,
+      );
+    }
+  }
+
+  return conflictedFiles;
+}
+
+async function main(): Promise<void> {
+  const options = parseCliOptions();
+  const token = getGitHubToken();
+  const client = getApiClient(token);
+
+  if (!options.targetBranch.startsWith(RELEASE_BRANCH_PREFIX)) {
+    throw new Error(
+      `Expected target branch to start with '${RELEASE_BRANCH_PREFIX}', but got '${options.targetBranch}'.`,
+    );
+  }
+  if (
+    !options.isPrimaryRelease &&
+    !options.sourceBranch.startsWith(RELEASE_BRANCH_PREFIX)
+  ) {
+    throw new Error(
+      `Expected source branch to start with '${RELEASE_BRANCH_PREFIX}' for backports, but got '${options.sourceBranch}'.`,
+    );
+  }
+  if (!options.repositoryNwo.includes("/")) {
+    throw new Error(
+      `Expected repository name with owner in 'owner/repo' format, but got '${options.repositoryNwo}'`,
+    );
+  }
+
+  const targetBranchMajorVersion = options.targetBranch.replace(
+    RELEASE_BRANCH_PREFIX,
+    "",
+  );
+
+  const currentVersion = withPackageJson((content) => {
+    return { value: getCurrentVersion(content) };
+  }, options);
+
+  if (!currentVersion) {
+    throw new Error("Failed to read current version from package.json");
+  }
+
+  const [, vMinor, vPatch] = currentVersion.split(".");
+  const version = `${targetBranchMajorVersion}.${vMinor}.${vPatch}`;
+
+  console.log(
+    `Considering difference between ${options.sourceBranch} and ${options.targetBranch}...`,
+  );
+
+  const sourceBranchShortSha = runGit([
+    "rev-parse",
+    "--short",
+    `${ORIGIN}/${options.sourceBranch}`,
+  ]);
+  console.log(
+    `Current head of ${options.sourceBranch} is ${sourceBranchShortSha}.`,
+  );
+
+  const [owner, repo] = options.repositoryNwo.split("/");
+  const commits = await getCommitDifference(
+    client,
+    owner,
+    repo,
+    options.sourceBranch,
+    options.targetBranch,
+  );
+
+  if (commits.length === 0) {
+    console.log(
+      `No commits to merge from ${options.sourceBranch} to ${options.targetBranch}.`,
+    );
+    return;
+  }
+
+  // Use a distinct branch prefix to support specific PR checks on backports.
+  const branchPrefix = options.isPrimaryRelease ? "update" : "backport";
+
+  // The branch name is based on the target version and the SHA of the source
+  // branch head. If the branch already exists we can assume this script has
+  // already run for this combination.
+  const newBranchName = `${branchPrefix}-v${version}-${sourceBranchShortSha}`;
+  console.log(`Branch name is '${newBranchName}'.`);
+
+  // Check if the branch already exists. If so we can abort as this script
+  // has already run on this combination of branches.
+  if (branchExistsOnRemote(newBranchName)) {
+    console.log(`Branch '${newBranchName}' already exists. Nothing to do.`);
+    return;
+  }
+
+  // Prepare the update/backport branch.
+  const conflictedFiles = await prepareNewBranch(
+    options,
+    newBranchName,
+    targetBranchMajorVersion,
+    version,
+  );
+
+  // Push the new branch to the remote.
+  console.log(`Creating branch ${newBranchName}.`);
+  runGit(["push", ORIGIN, newBranchName], { dryRun: options.dryRun });
+
+  // Open a PR to merge the new branch into the target branch.
+  await openPr({
+    client,
+    owner,
+    repo,
+    commits,
+    sourceBranchShortSha,
+    newBranchName,
+    sourceBranch: options.sourceBranch,
+    targetBranch: options.targetBranch,
+    conductor: options.conductor,
+    isPrimaryRelease: options.isPrimaryRelease,
+    conflictedFiles,
+    dryRun: options.dryRun,
+  });
+}
+
+// Only call `main` if this script was run directly.
+if (require.main === module) {
+  void main();
+}
diff --git a/pr-checks/util.ts b/pr-checks/util.ts
new file mode 100644
index 0000000000..353b2a9654
--- /dev/null
+++ b/pr-checks/util.ts
@@ -0,0 +1,9 @@
+/**
+ * Returns an appropriate message for the error.
+ *
+ * If the error is an `Error` instance, this returns the error message without
+ * an `Error: ` prefix.
+ */
+export function getErrorMessage(error: unknown): string {
+  return error instanceof Error ? error.message : String(error);
+}
diff --git a/pr-checks/versions.test.ts b/pr-checks/versions.test.ts
new file mode 100755
index 0000000000..6697710f83
--- /dev/null
+++ b/pr-checks/versions.test.ts
@@ -0,0 +1,44 @@
+#!/usr/bin/env npx tsx
+
+/**
+ * Tests for `versions.ts`.
+ */
+
+import * as assert from "node:assert/strict";
+import { describe, it } from "node:test";
+
+import { getCurrentVersion, replaceVersionInPackageJson } from "./versions";
+
+describe("getCurrentVersion", async () => {
+  await it("reads versions", async () => {
+    const result = getCurrentVersion(`{ "version": "1.23.4" }`);
+    assert.deepEqual(result, "1.23.4");
+  });
+});
+
+const packageJsonContents = `{
+  "name": "codeql",
+  "version": "1.23.4"
+}
+`;
+
+const packageJsonContentsExpected = `{
+  "name": "codeql",
+  "version": "2.23.4"
+}
+`;
+
+describe("replaceVersionInPackageJson", async () => {
+  await it("replaces versions", async () => {
+    const result = replaceVersionInPackageJson(
+      "1.23.4",
+      "2.23.4",
+      packageJsonContents,
+    );
+    assert.deepEqual(
+      result.split("\n"),
+      packageJsonContentsExpected.split("\n"),
+    );
+    assert.deepEqual(JSON.parse(result), { name: "codeql", version: "2.23.4" });
+  });
+});
diff --git a/pr-checks/versions.ts b/pr-checks/versions.ts
new file mode 100644
index 0000000000..4abc7faa17
--- /dev/null
+++ b/pr-checks/versions.ts
@@ -0,0 +1,54 @@
+import * as fs from "node:fs";
+
+import { DryRunOption, PACKAGE_JSON } from "./config";
+
+export function withPackageJson<T>(
+  transformer: (content: string) => { value: T; content?: string },
+  options: DryRunOption,
+): T {
+  const content = fs.readFileSync(PACKAGE_JSON, "utf8");
+  const result = transformer(content);
+
+  if (result.content !== undefined) {
+    if (!options.dryRun) {
+      fs.writeFileSync(PACKAGE_JSON, result.content, "utf8");
+    } else {
+      console.info(`[DRY RUN] Would have written an updated package.json`);
+    }
+  }
+
+  return result.value;
+}
+
+/** Reads the current version from `package.json`. */
+export function getCurrentVersion(content: string): string | undefined {
+  const pkg: { version: string } = JSON.parse(content);
+  return pkg.version;
+}
+
+/**
+ * Replaces the version in `package.json` textually. Only updates the version
+ * field that immediately follows the `"name": "codeql"` line.
+ * `npm version` doesn't always work because of merge conflicts, so we
+ * replace the version in package.json textually.
+ */
+export function replaceVersionInPackageJson(
+  prevVersion: string,
+  newVersion: string,
+  content: string,
+): string {
+  const lines = content.split("\n");
+  let prevLineIsCodeql = false;
+  const output: string[] = [];
+
+  for (const line of lines) {
+    if (prevLineIsCodeql && line.includes(`"version": "${prevVersion}"`)) {
+      output.push(line.replace(prevVersion, newVersion));
+    } else {
+      output.push(line);
+    }
+    prevLineIsCodeql = line.includes('"name": "codeql",');
+  }
+
+  return output.join("\n");
+}
diff --git a/src/action-common.test.ts b/src/action-common.test.ts
new file mode 100644
index 0000000000..fc2e0a9aaa
--- /dev/null
+++ b/src/action-common.test.ts
@@ -0,0 +1,123 @@
+import * as core from "@actions/core";
+import test from "ava";
+import sinon from "sinon";
+
+import * as common from "./action-common";
+import * as actionsUtil from "./actions-util";
+import * as environment from "./environment";
+import * as logging from "./logging";
+import { ActionName } from "./status-report";
+import * as statusReport from "./status-report";
+import {
+  getTestActionsEnv,
+  getTestEnv,
+  makeMacro,
+  RecordingLogger,
+  setupTests,
+} from "./testing-utils";
+import { getErrorMessage } from "./util";
+
+setupTests(test);
+
+interface RunInActionsTestOpts {
+  runFn?: () => Promise<any>;
+  expectedErrorMessage?: string;
+  expectedTelemetryError?: string;
+}
+
+const runInActionsMacro = makeMacro({
+  exec: async (t, opts: RunInActionsTestOpts) => {
+    const expectFailure = opts?.expectedErrorMessage !== undefined;
+
+    const logger = new RecordingLogger();
+    const getActionsLogger = sinon
+      .stub(logging, "getActionsLogger")
+      .returns(logger);
+
+    const env = getTestEnv();
+    const getEnv = sinon.stub(environment, "getEnv").returns(env);
+
+    const actionsEnv = getTestActionsEnv(env);
+    const getActionsEnv = sinon
+      .stub(actionsUtil, "getActionsEnv")
+      .returns(actionsEnv);
+
+    const getJobUUID = sinon
+      .stub(statusReport, "getJobUUID")
+      .returns("test-job-uuid");
+
+    const setFailed = sinon.stub(core, "setFailed");
+    const sendUnhandledErrorStatusReport = sinon.stub(
+      statusReport,
+      "sendUnhandledErrorStatusReport",
+    );
+
+    const name = ActionName.Init;
+    const run = sinon.stub();
+
+    if (opts?.runFn) {
+      run.callsFake(opts.runFn);
+    }
+
+    const transformTelemetryError = sinon
+      .stub()
+      .callsFake((err) => opts?.expectedTelemetryError ?? getErrorMessage(err));
+    const testAction: common.Action = {
+      name,
+      run,
+      transformTelemetryError,
+    };
+
+    await common.runInActions(testAction);
+
+    // These always should have been called once.
+    t.true(getActionsLogger.calledOnce);
+    t.true(getEnv.calledOnce);
+    t.true(getActionsEnv.calledOnce);
+
+    const expectedActionState = {
+      actions: actionsEnv,
+      env,
+      logger,
+      name: ActionName.Init,
+    };
+
+    t.true(getJobUUID.calledOnceWithExactly(sinon.match(expectedActionState)));
+    t.true(run.calledOnceWithExactly(sinon.match(expectedActionState)));
+
+    t.is(setFailed.calledOnce, expectFailure ?? false);
+    t.is(sendUnhandledErrorStatusReport.calledOnce, expectFailure ?? false);
+
+    if (expectFailure) {
+      t.true(
+        setFailed.calledOnceWithExactly(
+          `${statusReport.getDisplayActionName(name)} action failed: ${opts?.expectedErrorMessage}`,
+        ),
+      );
+      t.true(
+        sendUnhandledErrorStatusReport.calledOnceWithExactly(
+          name,
+          sinon.match.any,
+          opts?.expectedTelemetryError ?? opts?.expectedErrorMessage,
+          logger,
+        ),
+      );
+    }
+  },
+  title: (providedTitle) => `runInActions - ${providedTitle}`,
+});
+
+runInActionsMacro.serial("calls run", {});
+runInActionsMacro.serial("handles run exceptions", {
+  runFn: () => {
+    throw new Error("Test failure");
+  },
+  expectedErrorMessage: "Test failure",
+});
+runInActionsMacro.serial("transforms run exceptions", {
+  runFn: () => {
+    throw new Error("Test failure");
+  },
+  expectedErrorMessage: "Test failure",
+  expectedTelemetryError: "Transformed failure message",
+});
diff --git a/src/action-common.ts b/src/action-common.ts
index dc76e9fdbb..95323e7f2a 100644
--- a/src/action-common.ts
+++ b/src/action-common.ts
@@ -1,17 +1,19 @@
 import * as core from "@actions/core";
 
 import { ActionsEnv, getActionsEnv } from "./actions-util";
-import { Env } from "./environment";
-import { FeatureEnablement } from "./feature-flags";
+import type { ApiClient } from "./api-client";
+import { Env, ReadOnlyEnv } from "./environment";
+import type { FeatureEnablement } from "./feature-flags";
 import { getActionsLogger, Logger } from "./logging";
 import {
   ActionName,
   getDisplayActionName,
+  getJobUUID,
   sendUnhandledErrorStatusReport,
 } from "./status-report";
-import { getEnv, getErrorMessage } from "./util";
+import { getEnv, getErrorMessage, wrapError } from "./util";
 
-/** Common state that is always available in `ActionState`. */
+/** Base state that is available to an Action on startup. */
 export interface BaseState {
   /** The name of the Action. */
   name: ActionName;
@@ -21,6 +23,7 @@ export interface BaseState {
 
 /** Describes different state features that an Action may have. */
 export interface FeatureState {
+  Base: BaseState;
   Logger: {
     /** The logger that is in use. */
     logger: Logger;
@@ -29,10 +32,17 @@ export interface FeatureState {
     /** Information about environment variables. */
     env: Env;
   };
+  ReadOnlyEnv: {
+    env: ReadOnlyEnv;
+  };
   Actions: {
     /** Access to Actions-related functionality. */
     actions: ActionsEnv;
   };
+  Api: {
+    /** A GitHub API client. */
+    apiClient: ApiClient;
+  };
   FeatureFlags: {
     /** Information about enabled feature flags. */
     features: FeatureEnablement;
@@ -44,7 +54,7 @@ export type StateFeature = keyof FeatureState;
 
 /** Constructs the intersection of all state types identifies by `Fs`. */
 export type FieldsOf<Fs extends readonly StateFeature[]> = Fs extends []
-  ? BaseState
+  ? Record<never, never>
   : Fs extends [
         infer Head extends StateFeature,
         ...infer Tail extends readonly StateFeature[],
@@ -60,7 +70,7 @@ export type ActionState<Fs extends readonly StateFeature[]> = FieldsOf<Fs>;
  * Each Action can then augment the `state` further if additional features are required.
  */
 export type ActionMain = (
-  state: ActionState<["Logger", "Env", "Actions"]>,
+  state: ActionState<["Base", "Logger", "Env", "Actions"]>,
 ) => Promise<void>;
 
 /** A specification for a CodeQL Action step. */
@@ -69,6 +79,12 @@ export interface Action {
   name: ActionName;
   /** The entry point for the Action. */
   run: ActionMain;
+  /**
+   * An optional function that transforms a caught error into a message suitable for
+   * inclusion in a status report. This is primarily intended for the `start-proxy`
+   * action to replace the thrown `Error`'s message with a safe one.
+   */
+  transformTelemetryError?: (error: Error) => string;
 }
 
 /** A generic entry point that sets up the basic environment for the `action` and runs it. */
@@ -79,17 +95,32 @@ export async function runInActions(action: Action) {
   const actionsEnv = getActionsEnv();
 
   try {
-    await action.run({
+    const actionState = {
       name: action.name,
       startedAt,
       logger,
       env,
       actions: actionsEnv,
-    });
+    };
+
+    // Create a unique identifier for this run.
+    getJobUUID(actionState);
+
+    await action.run(actionState);
   } catch (error) {
     core.setFailed(
       `${getDisplayActionName(action.name)} action failed: ${getErrorMessage(error)}`,
     );
-    await sendUnhandledErrorStatusReport(action.name, startedAt, error, logger);
+
+    const statusReportError =
+      action.transformTelemetryError !== undefined
+        ? action.transformTelemetryError(wrapError(error))
+        : error;
+    await sendUnhandledErrorStatusReport(
+      action.name,
+      startedAt,
+      statusReportError,
+      logger,
+    );
   }
 }
diff --git a/src/actions-util.ts b/src/actions-util.ts
index d7fbacbf3e..dd5124620d 100644
--- a/src/actions-util.ts
+++ b/src/actions-util.ts
@@ -7,12 +7,13 @@ import * as github from "@actions/github";
 import * as io from "@actions/io";
 
 import type { Config } from "./config-utils";
+import { Env, EnvVar, ActionsEnvVars } from "./environment";
 import { Logger } from "./logging";
 import {
   doesDirectoryExist,
   getCodeQLDatabasePath,
-  getRequiredEnvParam,
   ConfigurationError,
+  getEnv,
 } from "./util";
 
 /**
@@ -21,41 +22,25 @@ import {
  */
 declare const __CODEQL_ACTION_VERSION__: string;
 
-/**
- * Enumerates known GitHub Actions environment variables that we expect
- * to be set in a GitHub Actions environment.
- */
-export enum ActionsEnvVars {
-  GITHUB_ACTION_REPOSITORY = "GITHUB_ACTION_REPOSITORY",
-  GITHUB_API_URL = "GITHUB_API_URL",
-  GITHUB_EVENT_NAME = "GITHUB_EVENT_NAME",
-  GITHUB_EVENT_PATH = "GITHUB_EVENT_PATH",
-  GITHUB_JOB = "GITHUB_JOB",
-  GITHUB_REF = "GITHUB_REF",
-  GITHUB_REPOSITORY = "GITHUB_REPOSITORY",
-  GITHUB_RUN_ATTEMPT = "GITHUB_RUN_ATTEMPT",
-  GITHUB_RUN_ID = "GITHUB_RUN_ID",
-  GITHUB_SERVER_URL = "GITHUB_SERVER_URL",
-  GITHUB_SHA = "GITHUB_SHA",
-  GITHUB_WORKFLOW = "GITHUB_WORKFLOW",
-  RUNNER_NAME = "RUNNER_NAME",
-  RUNNER_OS = "RUNNER_OS",
-  RUNNER_TEMP = "RUNNER_TEMP",
-}
-
 /**
  * Abstracts over GitHub Actions functions so that we do not have to stub
  * global functions in tests.
  */
 export interface ActionsEnv {
+  getRequiredInput: (name: string) => string;
   getOptionalInput: (name: string) => string | undefined;
+  exportVariable: (name: string, value: string) => void;
 }
 
 /**
  * Gets the real `ActionsEnv` used by production code.
  */
 export function getActionsEnv(): ActionsEnv {
-  return { getOptionalInput };
+  return {
+    getRequiredInput,
+    getOptionalInput,
+    exportVariable: core.exportVariable,
+  };
 }
 
 /**
@@ -83,17 +68,21 @@ export const getOptionalInput = function (name: string): string | undefined {
   return value.length > 0 ? value : undefined;
 };
 
-export function getTemporaryDirectory(): string {
-  const value = process.env["CODEQL_ACTION_TEMP"];
-  return value !== undefined && value !== ""
-    ? value
-    : getRequiredEnvParam(ActionsEnvVars.RUNNER_TEMP);
+/**
+ * Gets the temporary directory used by the CodeQL Action. This will either be the temporary
+ * directory that has been set in `CODEQL_ACTION_TEMP` by e.g. a previous step, or the
+ * value of `RUNNER_TEMP` otherwise.
+ */
+export function getTemporaryDirectory(env: Env = getEnv()): string {
+  return (
+    env.getOptional(EnvVar.TEMP) ?? env.getRequired(ActionsEnvVars.RUNNER_TEMP)
+  );
 }
 
 const PR_DIFF_RANGE_JSON_FILENAME = "pr-diff-range.json";
 
-export function getDiffRangesJsonFilePath(): string {
-  return path.join(getTemporaryDirectory(), PR_DIFF_RANGE_JSON_FILENAME);
+export function getDiffRangesJsonFilePath(env: Env = getEnv()): string {
+  return path.join(getTemporaryDirectory(env), PR_DIFF_RANGE_JSON_FILENAME);
 }
 
 export function getActionVersion(): string {
@@ -105,16 +94,16 @@ export function getActionVersion(): string {
  *
  * This will be "dynamic" for default setup workflow runs.
  */
-export function getWorkflowEventName() {
-  return getRequiredEnvParam(ActionsEnvVars.GITHUB_EVENT_NAME);
+export function getWorkflowEventName(env: Env = getEnv()) {
+  return env.getRequired(ActionsEnvVars.GITHUB_EVENT_NAME);
 }
 
 /**
  * Returns whether the current workflow is executing a local copy of the Action, e.g. we're running
  * a workflow on the codeql-action repo itself.
  */
-export function isRunningLocalAction(): boolean {
-  const relativeScriptPath = getRelativeScriptPath();
+export function isRunningLocalAction(env: Env = getEnv()): boolean {
+  const relativeScriptPath = getRelativeScriptPath(env);
   return (
     relativeScriptPath.startsWith("..") || path.isAbsolute(relativeScriptPath)
   );
@@ -125,15 +114,15 @@ export function isRunningLocalAction(): boolean {
  *
  * This can be used to get the Action's name or tell if we're running a local Action.
  */
-function getRelativeScriptPath(): string {
-  const runnerTemp = getRequiredEnvParam(ActionsEnvVars.RUNNER_TEMP);
+function getRelativeScriptPath(env: Env): string {
+  const runnerTemp = env.getRequired(ActionsEnvVars.RUNNER_TEMP);
   const actionsDirectory = path.join(path.dirname(runnerTemp), "_actions");
   return path.relative(actionsDirectory, __filename);
 }
 
 /** Returns the contents of `GITHUB_EVENT_PATH` as a JSON object. */
-export function getWorkflowEvent(): any {
-  const eventJsonFile = getRequiredEnvParam(ActionsEnvVars.GITHUB_EVENT_PATH);
+export function getWorkflowEvent(env: Env = getEnv()): any {
+  const eventJsonFile = env.getRequired(ActionsEnvVars.GITHUB_EVENT_PATH);
   try {
     return JSON.parse(fs.readFileSync(eventJsonFile, "utf-8"));
   } catch (e) {
@@ -202,8 +191,8 @@ export function getUploadValue(input: string | undefined): UploadKind {
 /**
  * Get the workflow run ID.
  */
-export function getWorkflowRunID(): number {
-  const workflowRunIdString = getRequiredEnvParam(ActionsEnvVars.GITHUB_RUN_ID);
+export function getWorkflowRunID(env: Env = getEnv()): number {
+  const workflowRunIdString = env.getRequired(ActionsEnvVars.GITHUB_RUN_ID);
   const workflowRunID = parseInt(workflowRunIdString, 10);
   if (Number.isNaN(workflowRunID)) {
     throw new Error(
@@ -221,8 +210,8 @@ export function getWorkflowRunID(): number {
 /**
  * Get the workflow run attempt number.
  */
-export function getWorkflowRunAttempt(): number {
-  const workflowRunAttemptString = getRequiredEnvParam(
+export function getWorkflowRunAttempt(env: Env = getEnv()): number {
+  const workflowRunAttemptString = env.getRequired(
     ActionsEnvVars.GITHUB_RUN_ATTEMPT,
   );
   const workflowRunAttempt = parseInt(workflowRunAttemptString, 10);
@@ -290,18 +279,18 @@ export const getFileType = async (filePath: string): Promise<string> => {
   }
 };
 
-export function isSelfHostedRunner() {
-  return process.env.RUNNER_ENVIRONMENT === "self-hosted";
+export function isSelfHostedRunner(env: Env = getEnv()) {
+  return env.getOptional(ActionsEnvVars.RUNNER_ENVIRONMENT) === "self-hosted";
 }
 
 /** Determines whether the workflow trigger is `dynamic`. */
-export function isDynamicWorkflow(): boolean {
-  return getWorkflowEventName() === "dynamic";
+export function isDynamicWorkflow(env: Env = getEnv()): boolean {
+  return getWorkflowEventName(env) === "dynamic";
 }
 
 /** Determines whether we are running in default setup. */
-export function isDefaultSetup(): boolean {
-  return isDynamicWorkflow();
+export function isDefaultSetup(env: Env = getEnv()): boolean {
+  return isDynamicWorkflow(env);
 }
 
 export function prettyPrintInvocation(cmd: string, args: string[]): string {
@@ -399,9 +388,10 @@ const persistedInputsKey = "persisted_inputs";
  * This would be simplified if actions/runner#3514 is addressed.
  * https://github.com/actions/runner/issues/3514
  */
-export const persistInputs = function () {
-  const inputEnvironmentVariables = Object.entries(process.env).filter(
-    ([name]) => name.startsWith("INPUT_"),
+export const persistInputs = function (env: Env = getEnv()) {
+  const entries = env.entries();
+  const inputEnvironmentVariables = entries.filter(([name]) =>
+    name.startsWith("INPUT_"),
   );
   core.saveState(persistedInputsKey, JSON.stringify(inputEnvironmentVariables));
 };
@@ -429,7 +419,9 @@ export interface PullRequestBranches {
  * @returns the base and head branches of the pull request, or undefined if
  * we are not analyzing a pull request.
  */
-export function getPullRequestBranches(): PullRequestBranches | undefined {
+export function getPullRequestBranches(
+  env: Env = getEnv(),
+): PullRequestBranches | undefined {
   const pullRequest = github.context.payload.pull_request;
   if (pullRequest) {
     return {
@@ -443,8 +435,10 @@ export function getPullRequestBranches(): PullRequestBranches | undefined {
 
   // PR analysis under Default Setup does not have the pull_request context,
   // but it should set CODE_SCANNING_REF and CODE_SCANNING_BASE_BRANCH.
-  const codeScanningRef = process.env.CODE_SCANNING_REF;
-  const codeScanningBaseBranch = process.env.CODE_SCANNING_BASE_BRANCH;
+  const codeScanningRef = env.getOptional(EnvVar.CODE_SCANNING_REF);
+  const codeScanningBaseBranch = env.getOptional(
+    EnvVar.CODE_SCANNING_BASE_BRANCH,
+  );
   if (codeScanningRef && codeScanningBaseBranch) {
     return {
       base: codeScanningBaseBranch,
@@ -459,8 +453,8 @@ export function getPullRequestBranches(): PullRequestBranches | undefined {
 /**
  * Returns whether we are analyzing a pull request.
  */
-export function isAnalyzingPullRequest(): boolean {
-  return getPullRequestBranches() !== undefined;
+export function isAnalyzingPullRequest(env: Env = getEnv()): boolean {
+  return getPullRequestBranches(env) !== undefined;
 }
 
 /**
@@ -484,13 +478,14 @@ const qualityCategoryMapping: Record<string, string> = {
 export function fixCodeQualityCategory(
   logger: Logger,
   category?: string,
+  env: Env = getEnv(),
 ): string | undefined {
   // The `category` should always be set by Default Setup. We perform this check
   // to avoid potential issues if Code Quality supports Advanced Setup in the future
   // and before this workaround is removed.
   if (
     category !== undefined &&
-    isDefaultSetup() &&
+    isDefaultSetup(env) &&
     category.startsWith("/language:")
   ) {
     const language = category.substring("/language:".length);
diff --git a/src/analyze-action.ts b/src/analyze-action.ts
index f7cbbaabe3..5104719bc7 100644
--- a/src/analyze-action.ts
+++ b/src/analyze-action.ts
@@ -212,7 +212,7 @@ async function runAutobuildIfLegacyGoWorkflow(config: Config, logger: Logger) {
   await runAutobuild(config, BuiltInLanguage.go, logger);
 }
 
-async function run({ startedAt, logger }: ActionState<["Logger"]>) {
+async function run({ startedAt, logger }: ActionState<["Base", "Logger"]>) {
   // To capture errors appropriately, keep as much code within the try-catch as
   // possible, and only use safe functions outside.
 
diff --git a/src/api-client.test.ts b/src/api-client.test.ts
index 29cad338f7..ae8c6269b1 100644
--- a/src/api-client.test.ts
+++ b/src/api-client.test.ts
@@ -2,11 +2,13 @@ import * as github from "@actions/github";
 import * as githubUtils from "@actions/github/lib/utils";
 import test from "ava";
 import * as sinon from "sinon";
+import { ProxyAgent } from "undici";
 
 import * as actionsUtil from "./actions-util";
 import * as api from "./api-client";
 import { DO_NOT_RETRY_STATUSES } from "./api-client";
-import { setupTests } from "./testing-utils";
+import { ActionsEnvVars, RegistryProxyVars } from "./environment";
+import { callee, getTestEnv, setupTests } from "./testing-utils";
 import * as util from "./util";
 
 setupTests(test);
@@ -20,23 +22,23 @@ test.serial("getApiClient", async (t) => {
   const githubStub: sinon.SinonStub = sinon.stub();
   pluginStub.returns(githubStub);
 
+  const env = getTestEnv();
+  env.set(ActionsEnvVars.GITHUB_SERVER_URL, "http://github.localhost");
+  env.set(ActionsEnvVars.GITHUB_API_URL, "http://api.github.localhost");
+
   sinon.stub(actionsUtil, "getRequiredInput").withArgs("token").returns("xyz");
-  const requiredEnvParamStub = sinon.stub(util, "getRequiredEnvParam");
-  requiredEnvParamStub
-    .withArgs("GITHUB_SERVER_URL")
-    .returns("http://github.localhost");
-  requiredEnvParamStub
-    .withArgs("GITHUB_API_URL")
-    .returns("http://api.github.localhost");
 
-  api.getApiClient();
+  const apiClient = api.getApiClient(env);
+  t.truthy(apiClient);
 
+  t.true(githubStub.calledOnce);
   t.assert(
     githubStub.calledOnceWithExactly({
       auth: "token xyz",
       baseUrl: "http://api.github.localhost",
       log: sinon.match.any,
       userAgent: `CodeQL-Action/${actionsUtil.getActionVersion()}`,
+      request: sinon.match.any,
       retry: {
         doNotRetry: DO_NOT_RETRY_STATUSES,
       },
@@ -206,3 +208,67 @@ test.serial(
     }
   },
 );
+
+test("getRegistryProxy - returns undefined if the proxy is not configured", async (t) => {
+  const target = callee(api.getRegistryProxy).withArgs();
+
+  // Empty environment.
+  await target.passes(t.is, undefined);
+  // Only the host.
+  await target
+    .withEnv(getTestEnv({ [RegistryProxyVars.PROXY_HOST]: "localhost" }))
+    .passes(t.is, undefined);
+  // Only the port.
+  await target
+    .withEnv(getTestEnv({ [RegistryProxyVars.PROXY_PORT]: "1234" }))
+    .passes(t.is, undefined);
+});
+
+test("getRegistryProxy - returns value when both vars are set", async (t) => {
+  await callee(api.getRegistryProxy)
+    .withArgs()
+    .withEnv(
+      getTestEnv({
+        [RegistryProxyVars.PROXY_HOST]: "localhost",
+        [RegistryProxyVars.PROXY_PORT]: "1234",
+      }),
+    )
+    .passes(t.truthy);
+});
+
+test("getRegistryProxyConfig - gets the configuration from the env vars", async (t) => {
+  const host = "localhost";
+  const port = "1234";
+  const ca = "cert";
+
+  await callee(api.getRegistryProxyConfig)
+    .withArgs()
+    .withEnv(
+      getTestEnv({
+        [RegistryProxyVars.PROXY_HOST]: host,
+        [RegistryProxyVars.PROXY_PORT]: port,
+        [RegistryProxyVars.PROXY_CA_CERTIFICATE]: ca,
+      }),
+    )
+    .passes(t.like, { host, port, ca });
+});
+
+test("makeProxyRequestOptions - returns defaults without custom proxy", async (t) => {
+  t.deepEqual(
+    api.makeProxyRequestOptions(undefined),
+    githubUtils.defaults.request,
+  );
+});
+
+test("makeProxyRequestOptions - returns fetch with custom proxy", async (t) => {
+  const opts = api.makeProxyRequestOptions(
+    new ProxyAgent("http://localhost:1080"),
+  );
+  // Fetch should be different from the defaults.
+  t.notDeepEqual(opts?.fetch, githubUtils.defaults.request?.fetch);
+  // The options should be the same aside from that.
+  t.deepEqual(
+    { ...opts, fetch: githubUtils.defaults.request?.fetch },
+    githubUtils.defaults.request,
+  );
+});
diff --git a/src/api-client.ts b/src/api-client.ts
index 16e4082e90..ba800a2587 100644
--- a/src/api-client.ts
+++ b/src/api-client.ts
@@ -1,13 +1,26 @@
 import * as core from "@actions/core";
 import * as githubUtils from "@actions/github/lib/utils";
+import { type Octokit } from "@octokit/core";
+import { type PaginateInterface } from "@octokit/plugin-paginate-rest";
+import { type Api } from "@octokit/plugin-rest-endpoint-methods";
 import * as retry from "@octokit/plugin-retry";
-
+import { RequestRequestOptions } from "@octokit/types";
+import {
+  ProxyAgent,
+  RequestInfo,
+  RequestInit,
+  fetch as undiciFetch,
+} from "undici";
+
+import type { ActionState } from "./action-common";
+import { getActionVersion, getRequiredInput } from "./actions-util";
 import {
   ActionsEnvVars,
-  getActionVersion,
-  getRequiredInput,
-} from "./actions-util";
-import { EnvVar } from "./environment";
+  EnvVar,
+  ReadOnlyEnv,
+  RegistryProxyVars,
+  getEnv,
+} from "./environment";
 import { Logger } from "./logging";
 import { getRepositoryNwo, RepositoryNwo } from "./repository";
 import {
@@ -47,13 +60,90 @@ export interface GitHubApiExternalRepoDetails {
   apiURL: string | undefined;
 }
 
+/**
+ * Gets the configuration for the private registry authentication proxy,
+ * if it is available in the environment.
+ *
+ * @param action The required Action state.
+ * @returns The hostname, port, and CA retrieved from the corresponding environment variables.
+ */
+export function getRegistryProxyConfig(action: ActionState<["ReadOnlyEnv"]>) {
+  return {
+    host: action.env.getOptional(RegistryProxyVars.PROXY_HOST),
+    port: action.env.getOptional(RegistryProxyVars.PROXY_PORT),
+    ca: action.env.getOptional(RegistryProxyVars.PROXY_CA_CERTIFICATE),
+  };
+}
+
+/**
+ * Gets the configuration for the private registry authentication proxy,
+ * and uses it to initialise a corresponding `ProxyAgent`.
+ *
+ * @param action The required Action state.
+ * @returns A `ProxyAgent` corresponding to the private registry proxy,
+ *          or `undefined` if we couldn't retrieve the host and port.
+ */
+export function getRegistryProxy(
+  action: ActionState<["Logger", "ReadOnlyEnv"]>,
+): ProxyAgent | undefined {
+  const { host, port, ca } = getRegistryProxyConfig(action);
+
+  if (host && port) {
+    const uri = `http://${host}:${port}`;
+    action.logger.debug(
+      `Using private registry proxy at '${uri}' for API client.`,
+    );
+    return new ProxyAgent({
+      uri,
+      keepAliveTimeout: 10,
+      keepAliveMaxTimeout: 10,
+      requestTls: ca ? { ca } : undefined,
+    });
+  }
+
+  return undefined;
+}
+
+/**
+ * Constructs a `RequestRequestOptions` with a custom `fetch` implementation
+ * that uses `dispatcher` as a proxy for requests.
+ *
+ * @param dispatcher The proxy to use, if any.
+ */
+export function makeProxyRequestOptions(
+  dispatcher: ProxyAgent | undefined,
+): RequestRequestOptions | undefined {
+  // If we don't have a custom `ProxyAgent`, return the defaults.
+  if (dispatcher === undefined) {
+    return githubUtils.defaults.request;
+  }
+
+  // Otherwise, construct the custom `fetch` and add it onto the defaults.
+  return {
+    ...githubUtils.defaults.request,
+    fetch: (req: RequestInfo, init?: RequestInit) => {
+      return undiciFetch(req, { ...init, dispatcher });
+    },
+  };
+}
+
+/** The type of GitHub API client we use. */
+export type ApiClient = Octokit & Api & { paginate: PaginateInterface };
+
+/** Options for `createApiClientWithDetails`. */
+interface CreateApiClientOptions {
+  allowExternal?: boolean;
+  proxy?: ProxyAgent;
+}
+
 function createApiClientWithDetails(
   apiDetails: GitHubApiCombinedDetails,
-  { allowExternal = false } = {},
-) {
+  { allowExternal = false, proxy = undefined }: CreateApiClientOptions = {},
+): ApiClient {
   const auth =
     (allowExternal && apiDetails.externalRepoAuth) || apiDetails.auth;
   const retryingOctokit = githubUtils.GitHub.plugin(retry.retry);
+  const requestOptions = makeProxyRequestOptions(proxy);
   return new retryingOctokit(
     githubUtils.getOctokitOptions(auth, {
       baseUrl: apiDetails.apiURL,
@@ -64,6 +154,7 @@ function createApiClientWithDetails(
         warn: core.warning,
         error: core.error,
       },
+      request: requestOptions,
       retry: {
         doNotRetry: DO_NOT_RETRY_STATUSES,
       },
@@ -71,22 +162,23 @@ function createApiClientWithDetails(
   );
 }
 
-export function getApiDetails(): GitHubApiDetails {
+export function getApiDetails(env: ReadOnlyEnv = getEnv()): GitHubApiDetails {
   return {
     auth: getRequiredInput("token"),
-    url: getRequiredEnvParam(ActionsEnvVars.GITHUB_SERVER_URL),
-    apiURL: getRequiredEnvParam(ActionsEnvVars.GITHUB_API_URL),
+    url: env.getRequired(ActionsEnvVars.GITHUB_SERVER_URL),
+    apiURL: env.getRequired(ActionsEnvVars.GITHUB_API_URL),
   };
 }
 
-export function getApiClient() {
-  return createApiClientWithDetails(getApiDetails());
+export function getApiClient(env: ReadOnlyEnv = getEnv()) {
+  return createApiClientWithDetails(getApiDetails(env));
 }
 
 export function getApiClientWithExternalAuth(
   apiDetails: GitHubApiCombinedDetails,
+  proxy?: ProxyAgent,
 ) {
-  return createApiClientWithDetails(apiDetails, { allowExternal: true });
+  return createApiClientWithDetails(apiDetails, { allowExternal: true, proxy });
 }
 
 /**
diff --git a/src/api-compatibility.json b/src/api-compatibility.json
index 435f8f1d6b..7569440194 100644
--- a/src/api-compatibility.json
+++ b/src/api-compatibility.json
@@ -1 +1 @@
-{"maximumVersion": "3.22", "minimumVersion": "3.16"}
+{"maximumVersion": "3.22", "minimumVersion": "3.17"}
diff --git a/src/autobuild-action.ts b/src/autobuild-action.ts
index afda0e236a..b78bffb9d8 100644
--- a/src/autobuild-action.ts
+++ b/src/autobuild-action.ts
@@ -68,7 +68,7 @@ async function sendCompletedStatusReport(
   }
 }
 
-async function run({ startedAt, logger }: ActionState<["Logger"]>) {
+async function run({ startedAt, logger }: ActionState<["Base", "Logger"]>) {
   // To capture errors appropriately, keep as much code within the try-catch as
   // possible, and only use safe functions outside.
 
diff --git a/src/autobuild.ts b/src/autobuild.ts
index fc4983f4ef..7ec6ba9873 100644
--- a/src/autobuild.ts
+++ b/src/autobuild.ts
@@ -5,7 +5,7 @@ import { getGitHubVersion } from "./api-client";
 import { CodeQL, getCodeQL } from "./codeql";
 import * as configUtils from "./config-utils";
 import { DocUrl } from "./doc-url";
-import { EnvVar } from "./environment";
+import { ActionsEnvVars, EnvVar } from "./environment";
 import { Feature, featureConfig, initFeatures } from "./feature-flags";
 import { BuiltInLanguage, Language } from "./languages";
 import { Logger } from "./logging";
@@ -126,7 +126,7 @@ export async function setupCppAutobuild(codeql: CodeQL, logger: Logger) {
   if (await features.getValue(Feature.CppDependencyInstallation, codeql)) {
     // disable autoinstall on self-hosted runners unless explicitly requested
     if (
-      process.env["RUNNER_ENVIRONMENT"] === "self-hosted" &&
+      process.env[ActionsEnvVars.RUNNER_ENVIRONMENT] === "self-hosted" &&
       process.env[envVar] !== "true"
     ) {
       logger.info(
diff --git a/src/codeql.test.ts b/src/codeql.test.ts
index dea4cf04af..84f48b83c9 100644
--- a/src/codeql.test.ts
+++ b/src/codeql.test.ts
@@ -156,6 +156,7 @@ test.serial(
         t.assert(toolcache.find("CodeQL", `0.0.0-${version}`));
         t.is(result.toolsVersion, `0.0.0-${version}`);
         t.is(result.toolsSource, ToolsSource.Download);
+        assertDownloadDurationInteger(t, result.toolsDownloadStatusReport);
       }
 
       t.is(toolcache.findAllVersions("CodeQL").length, 2);
@@ -191,9 +192,7 @@ test.serial(
       t.assert(toolcache.find("CodeQL", `2.15.0`));
       t.is(result.toolsVersion, `2.15.0`);
       t.is(result.toolsSource, ToolsSource.Download);
-      if (result.toolsDownloadStatusReport) {
-        assertDurationsInteger(t, result.toolsDownloadStatusReport);
-      }
+      assertDownloadDurationInteger(t, result.toolsDownloadStatusReport);
     });
   },
 );
@@ -230,9 +229,7 @@ test.serial(
       t.assert(toolcache.find("CodeQL", "0.0.0-20200610"));
       t.deepEqual(result.toolsVersion, "0.0.0-20200610");
       t.is(result.toolsSource, ToolsSource.Download);
-      if (result.toolsDownloadStatusReport) {
-        assertDurationsInteger(t, result.toolsDownloadStatusReport);
-      }
+      assertDownloadDurationInteger(t, result.toolsDownloadStatusReport);
     });
   },
 );
@@ -282,11 +279,7 @@ for (const {
         t.assert(toolcache.find("CodeQL", expectedToolcacheVersion));
         t.deepEqual(result.toolsVersion, expectedToolcacheVersion);
         t.is(result.toolsSource, ToolsSource.Download);
-        t.assert(
-          Number.isInteger(
-            result.toolsDownloadStatusReport?.downloadDurationMs,
-          ),
-        );
+        assertDownloadDurationInteger(t, result.toolsDownloadStatusReport);
       });
     },
   );
@@ -330,9 +323,7 @@ for (const toolcacheVersion of [
           SAMPLE_DEFAULT_CLI_VERSION.enabledVersions[0].cliVersion,
         );
         t.is(result.toolsSource, ToolsSource.Toolcache);
-        t.is(result.toolsDownloadStatusReport?.combinedDurationMs, undefined);
-        t.is(result.toolsDownloadStatusReport?.downloadDurationMs, undefined);
-        t.is(result.toolsDownloadStatusReport?.extractionDurationMs, undefined);
+        t.is(result.toolsDownloadStatusReport, undefined);
       });
     },
   );
@@ -373,9 +364,7 @@ test.serial(
       );
       t.deepEqual(result.toolsVersion, "0.0.0-20200601");
       t.is(result.toolsSource, ToolsSource.Toolcache);
-      t.is(result.toolsDownloadStatusReport?.combinedDurationMs, undefined);
-      t.is(result.toolsDownloadStatusReport?.downloadDurationMs, undefined);
-      t.is(result.toolsDownloadStatusReport?.extractionDurationMs, undefined);
+      t.is(result.toolsDownloadStatusReport, undefined);
 
       const cachedVersions = toolcache.findAllVersions("CodeQL");
       t.is(cachedVersions.length, 1);
@@ -421,9 +410,7 @@ test.serial(
       );
       t.deepEqual(result.toolsVersion, defaults.cliVersion);
       t.is(result.toolsSource, ToolsSource.Download);
-      if (result.toolsDownloadStatusReport) {
-        assertDurationsInteger(t, result.toolsDownloadStatusReport);
-      }
+      t.truthy(result.toolsDownloadStatusReport);
 
       const cachedVersions = toolcache.findAllVersions("CodeQL");
       t.is(cachedVersions.length, 2);
@@ -462,9 +449,7 @@ test.serial(
       );
       t.deepEqual(result.toolsVersion, defaults.cliVersion);
       t.is(result.toolsSource, ToolsSource.Download);
-      if (result.toolsDownloadStatusReport) {
-        assertDurationsInteger(t, result.toolsDownloadStatusReport);
-      }
+      t.truthy(result.toolsDownloadStatusReport);
 
       const cachedVersions = toolcache.findAllVersions("CodeQL");
       t.is(cachedVersions.length, 2);
@@ -506,9 +491,7 @@ test.serial(
 
       t.is(result.toolsVersion, "0.0.0-20230203");
       t.is(result.toolsSource, ToolsSource.Download);
-      if (result.toolsDownloadStatusReport) {
-        assertDurationsInteger(t, result.toolsDownloadStatusReport);
-      }
+      assertDownloadDurationInteger(t, result.toolsDownloadStatusReport);
 
       const cachedVersions = toolcache.findAllVersions("CodeQL");
       t.is(cachedVersions.length, 1);
@@ -519,15 +502,11 @@ test.serial(
   },
 );
 
-function assertDurationsInteger(
+function assertDownloadDurationInteger(
   t: ExecutionContext<unknown>,
-  statusReport: ToolsDownloadStatusReport,
+  statusReport: ToolsDownloadStatusReport | undefined,
 ) {
-  t.assert(Number.isInteger(statusReport?.combinedDurationMs));
-  if (statusReport.downloadDurationMs !== undefined) {
-    t.assert(Number.isInteger(statusReport?.downloadDurationMs));
-    t.assert(Number.isInteger(statusReport?.extractionDurationMs));
-  }
+  t.assert(Number.isInteger(statusReport?.downloadDurationMs));
 }
 
 test.serial("getExtraOptions works for explicit paths", (t) => {
diff --git a/src/codeql.ts b/src/codeql.ts
index bb6c0fb55b..a29df90865 100644
--- a/src/codeql.ts
+++ b/src/codeql.ts
@@ -27,7 +27,6 @@ import { Logger } from "./logging";
 import { writeBaseDatabaseOidsFile, writeOverlayChangesFile } from "./overlay";
 import { OverlayDatabaseMode } from "./overlay/overlay-database-mode";
 import * as setupCodeql from "./setup-codeql";
-import { ZstdAvailability } from "./tar";
 import { ToolsDownloadStatusReport } from "./tools-download";
 import { ToolsFeature, isSupportedToolsFeature } from "./tools-features";
 import { shouldEnableIndirectTracing } from "./tracer-config";
@@ -272,17 +271,17 @@ const CODEQL_MINIMUM_VERSION = "2.19.4";
 /**
  * This version will shortly become the oldest version of CodeQL that the Action will run with.
  */
-const CODEQL_NEXT_MINIMUM_VERSION = "2.19.4";
+const CODEQL_NEXT_MINIMUM_VERSION = "2.20.7";
 
 /**
  * This is the version of GHES that was most recently deprecated.
  */
-const GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.15";
+const GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.16";
 
 /**
  * This is the deprecation date for the version of GHES that was most recently deprecated.
  */
-const GHES_MOST_RECENT_DEPRECATION_DATE = "2026-04-09";
+const GHES_MOST_RECENT_DEPRECATION_DATE = "2026-07-01";
 
 /** The CLI verbosity level to use for extraction in debug mode. */
 const EXTRACTION_DEBUG_MODE_VERBOSITY = "progress++";
@@ -319,7 +318,6 @@ export async function setupCodeQL(
   toolsDownloadStatusReport?: ToolsDownloadStatusReport;
   toolsSource: setupCodeql.ToolsSource;
   toolsVersion: string;
-  zstdAvailability: ZstdAvailability;
 }> {
   try {
     const {
@@ -327,7 +325,6 @@ export async function setupCodeQL(
       toolsDownloadStatusReport,
       toolsSource,
       toolsVersion,
-      zstdAvailability,
     } = await setupCodeql.setupCodeQLBundle(
       toolsInput,
       apiDetails,
@@ -340,12 +337,6 @@ export async function setupCodeQL(
       logger,
     );
 
-    logger.debug(
-      `Bundle download status report: ${JSON.stringify(
-        toolsDownloadStatusReport,
-      )}`,
-    );
-
     let codeqlCmd = path.join(codeqlFolder, "codeql", "codeql");
     if (process.platform === "win32") {
       codeqlCmd += ".exe";
@@ -361,7 +352,6 @@ export async function setupCodeQL(
       toolsDownloadStatusReport,
       toolsSource,
       toolsVersion,
-      zstdAvailability,
     };
   } catch (rawError) {
     const e = api.wrapApiConfigurationError(rawError);
diff --git a/src/config-utils.test.ts b/src/config-utils.test.ts
index 1b042480ba..84c709e72a 100644
--- a/src/config-utils.test.ts
+++ b/src/config-utils.test.ts
@@ -6,12 +6,14 @@ import test, { ExecutionContext } from "ava";
 import * as yaml from "js-yaml";
 import * as sinon from "sinon";
 
+import { ActionState } from "./action-common";
 import * as actionsUtil from "./actions-util";
 import { AnalysisKind, supportedAnalysisKinds } from "./analyses";
 import * as api from "./api-client";
 import { CachingKind } from "./caching-utils";
 import { createStubCodeQL } from "./codeql";
 import { UserConfig } from "./config/db-config";
+import * as file from "./config/file";
 import * as configUtils from "./config-utils";
 import * as errorMessages from "./error-messages";
 import { Feature } from "./feature-flags";
@@ -37,6 +39,9 @@ import {
   createTestConfig,
   makeMacro,
   initAllState,
+  callee,
+  SAMPLE_DOTCOM_API_DETAILS,
+  AssertableTarget,
 } from "./testing-utils";
 import {
   GitHubVariant,
@@ -462,6 +467,24 @@ test.serial("load non-existent input", async (t) => {
   });
 });
 
+/** A non-empty, but fairly minimal configuration file. */
+const simpleConfigFileContents = `
+  name: my config
+  queries:
+    - uses: ./foo_file`;
+
+/** A less minimal configuration file. */
+const otherConfigFileContents = `
+  name: my config
+  disable-default-queries: true
+  queries:
+    - uses: ./foo
+  paths-ignore:
+    - a
+    - b
+  paths:
+    - c/d`;
+
 test.serial("load non-empty input", async (t) => {
   return await withTmpDir(async (tempDir) => {
     setupActionsVars(tempDir, tempDir);
@@ -476,18 +499,6 @@ test.serial("load non-empty input", async (t) => {
       },
     });
 
-    // Just create a generic config object with non-default values for all fields
-    const inputFileContents = `
-      name: my config
-      disable-default-queries: true
-      queries:
-        - uses: ./foo
-      paths-ignore:
-        - a
-        - b
-      paths:
-        - c/d`;
-
     fs.mkdirSync(path.join(tempDir, "foo"));
 
     const userConfig: UserConfig = {
@@ -514,7 +525,7 @@ test.serial("load non-empty input", async (t) => {
     });
 
     const languagesInput = "javascript";
-    const configFilePath = createConfigFile(inputFileContents, tempDir);
+    const configFilePath = createConfigFile(otherConfigFileContents, tempDir);
 
     const state = initAllState();
     const actualConfig = await configUtils.initConfig(
@@ -540,14 +551,12 @@ test.serial(
   "Using config input and file together, config input should be used.",
   async (t) => {
     return await withTmpDir(async (tempDir) => {
-      process.env["RUNNER_TEMP"] = tempDir;
-      process.env["GITHUB_WORKSPACE"] = tempDir;
+      setupActionsVars(tempDir, tempDir);
 
-      const inputFileContents = `
-      name: my config
-      queries:
-        - uses: ./foo_file`;
-      const configFilePath = createConfigFile(inputFileContents, tempDir);
+      const configFilePath = createConfigFile(
+        simpleConfigFileContents,
+        tempDir,
+      );
 
       const configInput = `
       name: my config
@@ -576,7 +585,7 @@ test.serial(
       // Only JS, python packs will be ignored
       const languagesInput = "javascript";
 
-      const state = initAllState();
+      const state = initAllState({ env: util.getEnv() });
       const config = await configUtils.initConfig(
         state,
         createTestInitConfigInputs({
@@ -2259,3 +2268,440 @@ test("applyIncrementalAnalysisSettings: adds exclusions for diff-informed-only r
     { exclude: { tags: "exclude-from-incremental" } },
   ]);
 });
+
+test("determineUserConfig - empty config when neither input is specified", async (t) => {
+  await withTmpDir(async (tmpDir) => {
+    const target = callee(configUtils.determineUserConfig)
+      .withDefaultActionsEnv()
+      .withFeatures([])
+      .withArgs(
+        tmpDir,
+        createTestInitConfigInputs({
+          configInput: undefined,
+          configFile: undefined,
+          workspacePath: tmpDir,
+        }),
+      );
+
+    // The returned configuration should be empty.
+    await target
+      // The fact that no configuration was provided should have been logged,
+      .logs(t, "No configuration file was provided")
+      // But not the messages for the two input sources
+      // or the warning about both inputs.
+      .notLogs(
+        t,
+        "Using config from action input:",
+        "Using configuration file:",
+        "Both a config file and config input were provided. Ignoring config file.",
+      )
+      .passes(t.deepEqual, {});
+  });
+});
+
+test("determineUserConfig - loads config file", async (t) => {
+  await withTmpDir(async (tmpDir) => {
+    const configFilePath = createConfigFile(simpleConfigFileContents, tmpDir);
+
+    const inputs = createTestInitConfigInputs({
+      configInput: undefined,
+      configFile: configFilePath,
+      workspacePath: tmpDir,
+    });
+    const target = callee(configUtils.determineUserConfig)
+      .withDefaultActionsEnv()
+      .withArgs(tmpDir, inputs);
+
+    await target
+      // The path of the input config file should have been logged,
+      .logs(t, `Using configuration file: ${configFilePath}`)
+      .notLogs(
+        t,
+        // The other two origin messages and the warning about both inputs should
+        // not have been logged.
+        "No configuration file was provided",
+        "Using config from action input:",
+        "Both a config file and config input were provided. Ignoring config file.",
+      )
+      // The loaded configuration should match `simpleConfigFileContents`.
+      .passes(t.deepEqual, {
+        name: "my config",
+        queries: [{ uses: "./foo_file" }],
+      });
+
+    // The `configFile` input should not have changed.
+    t.is(inputs.configFile, configFilePath);
+  });
+});
+
+test("determineUserConfig - loads config input", async (t) => {
+  await withTmpDir(async (tmpDir) => {
+    const expectedConfigPath = configUtils.userConfigFromActionPath(tmpDir);
+
+    const inputs = createTestInitConfigInputs({
+      configInput: simpleConfigFileContents,
+      configFile: undefined,
+      workspacePath: tmpDir,
+    });
+    const target = callee(configUtils.determineUserConfig)
+      .withDefaultActionsEnv()
+      .withArgs(tmpDir, inputs);
+
+    await target
+      // The input source and path of the generated config file should have been logged.
+      .logs(
+        t,
+        "Using config from action input:",
+        `Using configuration file: ${expectedConfigPath}`,
+      )
+      // The message about no configuration input and
+      // the warning about both inputs should not have been logged.
+      .notLogs(
+        t,
+        "No configuration file was provided",
+        "Both a config file and config input were provided. Ignoring config file.",
+      )
+      // The loaded configuration should match `simpleConfigFileContents`.
+      .passes(t.deepEqual, {
+        name: "my config",
+        queries: [{ uses: "./foo_file" }],
+      });
+
+    // The `configFile` input should have been mutated to the generated path.
+    t.is(inputs.configFile, expectedConfigPath);
+  });
+});
+
+test("determineUserConfig - ignores config file input when both specified", async (t) => {
+  await withTmpDir(async (tmpDir) => {
+    const configFilePath = createConfigFile(otherConfigFileContents, tmpDir);
+    const expectedConfigPath = configUtils.userConfigFromActionPath(tmpDir);
+
+    const inputs = createTestInitConfigInputs({
+      configInput: simpleConfigFileContents,
+      configFile: configFilePath,
+      workspacePath: tmpDir,
+    });
+    const target = callee(configUtils.determineUserConfig)
+      .withDefaultActionsEnv()
+      .withArgs(tmpDir, inputs);
+
+    await target
+      // The path of the generated config file and
+      // the warning about both inputs should have been logged.
+      .logs(
+        t,
+        `Using config from action input: ${expectedConfigPath}`,
+        `Using configuration file: ${expectedConfigPath}`,
+        "Both a config file and config input were provided. Ignoring config file.",
+      )
+      .notLogs(t, "No configuration file was provided")
+      // The loaded configuration should match `simpleConfigFileContents`.
+      .passes(t.deepEqual, {
+        name: "my config",
+        queries: [{ uses: "./foo_file" }],
+      });
+
+    // The `configFile` input should have been mutated to the generated path.
+    t.is(inputs.configFile, expectedConfigPath);
+  });
+});
+
+/** A `config` input that we might get from Default Setup. */
+const defaultSetupConfigInput = `
+  threat-models: [local, remote]
+  default-setup:
+    org:
+      model-packs: [foo, bar]`;
+
+test("determineUserConfig - merges configs if FF is enabled in Default Setup", async (t) => {
+  await withTmpDir(async (tmpDir) => {
+    const configFilePath = createConfigFile(simpleConfigFileContents, tmpDir);
+    const expectedConfigPath = configUtils.userConfigFromActionPath(tmpDir);
+
+    const inputs = createTestInitConfigInputs({
+      configInput: defaultSetupConfigInput,
+      configFile: configFilePath,
+      workspacePath: tmpDir,
+    });
+    const target = callee(configUtils.determineUserConfig)
+      .withDefaultActionsEnv({ GITHUB_EVENT_NAME: "dynamic" })
+      .withFeatures([Feature.AllowMergeConfigFiles])
+      .withArgs(tmpDir, inputs);
+
+    // The loaded configuration should match the result of merging
+    // `defaultSetupConfigInput` and `simpleConfigFileContents`.
+    const expectedConfig = {
+      name: "my config",
+      queries: [{ uses: "./foo_file" }],
+      "threat-models": ["local", "remote"],
+      "default-setup": {
+        org: {
+          "model-packs": ["foo", "bar"],
+        },
+      },
+    } satisfies UserConfig;
+
+    await target
+      .logs(
+        t,
+        `Using merged configurations from 'config' input with configuration from '${configFilePath}': ${expectedConfigPath}`,
+      )
+      .notLogs(
+        t,
+        `Using configuration file: ${expectedConfigPath}`,
+        "No configuration file was provided",
+        `Using config from action input: ${expectedConfigPath}`,
+        "Both a config file and config input were provided. Ignoring config file.",
+      )
+      .passes(t.deepEqual, expectedConfig);
+
+    // The `configFile` input should have been mutated to the generated path.
+    t.is(inputs.configFile, expectedConfigPath);
+
+    // Since `result` is the result of merging the configurations in-memory,
+    // also check whether loading the configuration from disk that was written
+    // by `determineUserConfig` matches our expectations.
+    const loadedFromDisk = configUtils.getLocalConfig(
+      getRunnerLogger(true),
+      expectedConfigPath,
+      false,
+    );
+    t.deepEqual(loadedFromDisk, expectedConfig);
+  });
+});
+
+test("determineUserConfig - ignores config file input in Default Setup if FF is off", async (t) => {
+  await withTmpDir(async (tmpDir) => {
+    const configFilePath = createConfigFile(otherConfigFileContents, tmpDir);
+    const expectedConfigPath = configUtils.userConfigFromActionPath(tmpDir);
+
+    const target = callee(configUtils.determineUserConfig)
+      .withDefaultActionsEnv({ GITHUB_EVENT_NAME: "dynamic" })
+      .withArgs(
+        tmpDir,
+        createTestInitConfigInputs({
+          configInput: simpleConfigFileContents,
+          configFile: configFilePath,
+          workspacePath: tmpDir,
+        }),
+      );
+
+    await target
+      .logs(
+        t,
+        `Using config from action input: ${expectedConfigPath}`,
+        `Using configuration file: ${expectedConfigPath}`,
+        "Both a config file and config input were provided. Ignoring config file.",
+      )
+      .notLogs(t, "No configuration file was provided")
+      .passes(t.deepEqual, {
+        name: "my config",
+        queries: [{ uses: "./foo_file" }],
+      });
+  });
+});
+
+test("determineUserConfig - ignores config file input outside Default Setup if FF is on", async (t) => {
+  await withTmpDir(async (tmpDir) => {
+    const configFilePath = createConfigFile(otherConfigFileContents, tmpDir);
+    const expectedConfigPath = configUtils.userConfigFromActionPath(tmpDir);
+
+    const target = callee(configUtils.determineUserConfig)
+      .withDefaultActionsEnv()
+      .withFeatures([Feature.AllowMergeConfigFiles])
+      .withArgs(
+        tmpDir,
+        createTestInitConfigInputs({
+          configInput: simpleConfigFileContents,
+          configFile: configFilePath,
+          workspacePath: tmpDir,
+        }),
+      );
+
+    await target
+      .logs(
+        t,
+        `Using config from action input: ${expectedConfigPath}`,
+        `Using configuration file: ${expectedConfigPath}`,
+        "Both a config file and config input were provided. Ignoring config file.",
+      )
+      .notLogs(t, "No configuration file was provided")
+      .passes(t.deepEqual, {
+        name: "my config",
+        queries: [{ uses: "./foo_file" }],
+      });
+  });
+});
+
+test("loadUserConfig - loads local configuration files", async (t) => {
+  await withTmpDir(async (workspaceDir) => {
+    await withTmpDir(async (tmpDir) => {
+      // Construct the test target.
+      const loadUserConfig = (
+        actionState: ActionState<["Logger", "Env", "FeatureFlags"]>,
+        filePath: string,
+      ) =>
+        configUtils.loadUserConfig(
+          actionState,
+          filePath,
+          workspaceDir,
+          SAMPLE_DOTCOM_API_DETAILS,
+          tmpDir,
+        );
+      const target = callee(loadUserConfig);
+
+      // `loadUserConfig` should load local configuration files if they are inside the workspace:
+      const insideOfWorkspace = path.join(workspaceDir, "some-file.yml");
+      fs.writeFileSync(insideOfWorkspace, "test-key: present", "utf8");
+
+      await target
+        .withArgs(insideOfWorkspace)
+        .passes(t.deepEqual, { "test-key": "present" });
+
+      // `loadUserConfig` should normally throw if the path is outside of the workspace:
+      const outsideOfWorkspace = path.join(
+        tmpDir,
+        "not-the-generated-file.yml",
+      );
+      fs.writeFileSync(outsideOfWorkspace, "test-key: present", "utf8");
+
+      await target
+        .withArgs(outsideOfWorkspace)
+        .throws(t, { instanceOf: ConfigurationError });
+
+      // `loadUserConfig` does not throw if the path is the result of `userConfigFromActionPath`:
+      const generatedPath = configUtils.userConfigFromActionPath(tmpDir);
+      fs.writeFileSync(generatedPath, "test-key: present", "utf8");
+
+      await target
+        .withArgs(generatedPath)
+        .passes(t.deepEqual, { "test-key": "present" });
+    });
+  });
+});
+
+test.serial("loadUserConfig - loads remote configuration files", async (t) => {
+  await withTmpDir(async (tmpDir) => {
+    const getRemoteConfig = sinon.stub(file, "getRemoteConfig").resolves({});
+
+    const remoteAddress = "owner/repo/file@ref";
+    await callee(configUtils.loadUserConfig)
+      .withArgs(remoteAddress, tmpDir, SAMPLE_DOTCOM_API_DETAILS, tmpDir)
+      .passes(t.deepEqual, {});
+
+    t.true(
+      getRemoteConfig.calledOnceWithExactly(
+        sinon.match.any,
+        remoteAddress,
+        SAMPLE_DOTCOM_API_DETAILS,
+      ),
+    );
+  });
+});
+
+test.serial(
+  "loadUserConfig - loads remote configuration files (new format, partial)",
+  async (t) => {
+    await withTmpDir(async (tmpDir) => {
+      const getRemoteConfig = sinon.stub(file, "getRemoteConfig").resolves({});
+
+      // Construct the basic test target.
+      const target = callee(configUtils.loadUserConfig).withDefaultActionsEnv();
+
+      // Utility function to assert that `targetWithArgs` has identified
+      // the input as a remote file address.
+      const checkIsRemote =
+        (address: string) =>
+        async <R>(targetWithArgs: AssertableTarget<R>) => {
+          // We have stubbed `getRemoteConfig` to resolve to `{}`, so we
+          // expect that result.
+          await targetWithArgs.passes(t.deepEqual, {});
+
+          // And `getRemoteConfig` should have been called exactly once.
+          t.is(getRemoteConfig.callCount, 1);
+
+          // Get the arguments for the call and check that there were three.
+          // We don't care about the first, but check that the other two
+          // match our expectations. We break it down like this to get
+          // more useful test output.
+          const args = getRemoteConfig.getCalls()[0].args;
+          t.is(args.length, 3);
+          t.deepEqual(args[1], address);
+          t.deepEqual(args[2], SAMPLE_DOTCOM_API_DETAILS);
+        };
+
+      // Utility function to assert that `targetWithArgs` has not identified
+      // the input as a remote file address.
+      const checkIsNotRemote = async <R>(
+        targetWithArgs: AssertableTarget<R>,
+      ) => {
+        // We expect `loadUserConfig` to have thrown if it thinks the path is local,
+        // since the inputs we provide aren't for files that exist.
+        await targetWithArgs.throws(t);
+
+        // Additionally, we expect that `getRemoteConfig` wasn't called.
+        t.is(getRemoteConfig.callCount, 0);
+      };
+
+      // Utility function to add the explicit `REMOTE_PATH_PREFIX` to the input.
+      const withExplicitPrefix = (str: string) =>
+        `${file.REMOTE_PATH_PREFIX}${str}`;
+
+      // Utility to set up a call to `loadUserConfig` with the provided `address`
+      // and pass it to `assertion`.
+      const testTargetWith = async (
+        address: string,
+        assertion: (
+          targetWithArgs: AssertableTarget<Promise<UserConfig>>,
+        ) => Promise<any>,
+      ) => {
+        // Reset the stub's history since we re-use it.
+        getRemoteConfig.resetHistory();
+
+        // Log the input we are testing so that, in the event of a failure,
+        // it is easier to see which input was responsible.
+        t.log(`testTargetWith("${address}")`);
+
+        // Prepare the test call to `loadUserConfig`.
+        const targetWithArgs = target.withArgs(
+          address,
+          tmpDir,
+          SAMPLE_DOTCOM_API_DETAILS,
+          tmpDir,
+        );
+
+        // Pass it to the provided assertion function.
+        await assertion(targetWithArgs);
+      };
+
+      // Since this input contains an '@' character, it is treated as a remote path
+      // by the old logic even without the explicit prefix.
+      const remoteWithoutPrefix = "repo@main";
+      await testTargetWith(
+        remoteWithoutPrefix,
+        checkIsRemote(remoteWithoutPrefix),
+      );
+      await testTargetWith(
+        withExplicitPrefix(remoteWithoutPrefix),
+        checkIsRemote(remoteWithoutPrefix),
+      );
+      // It is only treated as a local path with the corresponding prefix.
+      await testTargetWith(`./${remoteWithoutPrefix}`, checkIsNotRemote);
+
+      // The following test inputs are examples of ambiguous paths. They could refer to
+      // valid local or remote paths. For each, we check that they are treated as remote
+      // paths if the explicit remote file prefix is used and as local paths otherwise.
+      const testInputs = ["repo:file", "input", "../input"];
+
+      for (const testInput of testInputs) {
+        for (const addPrefix of [true, false]) {
+          await testTargetWith(
+            addPrefix ? withExplicitPrefix(testInput) : testInput,
+            addPrefix ? checkIsRemote(testInput) : checkIsNotRemote,
+          );
+        }
+      }
+    });
+  },
+);
diff --git a/src/config-utils.ts b/src/config-utils.ts
index 747fd19a83..b5a880ba7b 100644
--- a/src/config-utils.ts
+++ b/src/config-utils.ts
@@ -10,6 +10,7 @@ import {
   getActionVersion,
   getOptionalInput,
   isAnalyzingPullRequest,
+  isDefaultSetup,
   isDynamicWorkflow,
 } from "./actions-util";
 import {
@@ -26,10 +27,15 @@ import {
   calculateAugmentation,
   ExcludeQueryFilter,
   generateCodeScanningConfig,
+  mergeDefaultSetupAndUserConfigs,
   parseUserConfig,
   UserConfig,
 } from "./config/db-config";
-import { getRemoteConfig } from "./config/file";
+import {
+  getRemoteConfig,
+  LOCAL_PATH_PREFIX,
+  REMOTE_PATH_PREFIX,
+} from "./config/file";
 import {
   parseRegistries,
   type RegistryConfigNoCredentials,
@@ -466,7 +472,17 @@ async function downloadCacheWithTime(
   return { trapCaches, trapCacheDownloadTime };
 }
 
-async function loadUserConfig(
+/**
+ * Loads a CLI configuration file from `configFile`.
+ *
+ * @param actionState The Action state.
+ * @param configFile The address of the configuration file.
+ * @param workspacePath The workspace path, used to check that the configuration file exists relative to it.
+ * @param apiDetails Information for how to access the API to fetch remote files.
+ * @param tempDir The temporary directory which may contain a CodeQL Action-generated configuration file.
+ * @returns The loaded configuration file, if successful.
+ */
+export async function loadUserConfig(
   actionState: ActionState<["Logger", "Env", "FeatureFlags"]>,
   configFile: string,
   workspacePath: string,
@@ -489,6 +505,12 @@ async function loadUserConfig(
     );
     return getLocalConfig(actionState.logger, configFile, validateConfig);
   } else {
+    // Drop the explicit prefix if it is present. Since `REMOTE_PATH_PREFIX` is chosen
+    // to not conflict with permissible characters in "owner" or "repo" components,
+    // this does not risk removing valid parts of either component by accident.
+    if (isExplicitRemotePath(configFile)) {
+      configFile = configFile.substring(REMOTE_PATH_PREFIX.length);
+    }
     return await getRemoteConfig(actionState, configFile, apiDetails);
   }
 }
@@ -936,7 +958,11 @@ function dbLocationOrDefault(
   return dbLocation || path.resolve(tempDir, "codeql_databases");
 }
 
-function userConfigFromActionPath(tempDir: string): string {
+/**
+ * Gets the path for the CodeQL Action-generated configuration file,
+ * which is used to store the `config` input.
+ */
+export function userConfigFromActionPath(tempDir: string): string {
   return path.resolve(tempDir, "user-config-from-action.yml");
 }
 
@@ -997,43 +1023,123 @@ export async function applyIncrementalAnalysisSettings(
 }
 
 /**
- * Load and return the config.
+ * Determines where to load the `UserConfig` for the CLI from and loads it.
  *
- * This will parse the config from the user input if present, or generate
- * a default config. The parsed config is then stored to a known location.
+ * @param inputs The Action inputs. The `configFile` value will be mutated
+ *               if a CodeQL Action-generated file should be used.
+ *
+ * @returns The loaded `UserConfig`, which might be empty if no configuration
+ *          was specified.
  */
-export async function initConfig(
-  actionState: ActionState<["Logger", "Env", "FeatureFlags"]>,
+export async function determineUserConfig(
+  action: ActionState<["Logger", "Env", "FeatureFlags"]>,
+  tempDir: string,
   inputs: InitConfigInputs,
-): Promise<Config> {
-  const { logger, features } = actionState;
-  const { tempDir } = inputs;
+): Promise<UserConfig> {
+  const validateConfig = await action.features.getValue(
+    Feature.ValidateDbConfig,
+  );
 
-  // if configInput is set, it takes precedence over configFile
+  // We have the following cases:
+  // 1. A `config` or `config-file` input is provided, but not both: use the provided one.
+  // 2. Both are provided and we are in an advanced workflow: ignore the `config-file` input.
+  // 3. Both are provided and we are in Default Setup: the `config` input uses a limited
+  //    set of options, which are supported by `mergeDefaultSetupAndUserConfigs`,
+  //    and we merge the two configs.
   if (inputs.configInput) {
-    if (inputs.configFile) {
-      logger.warning(
-        `Both a config file and config input were provided. Ignoring config file.`,
+    const computedConfigPath = userConfigFromActionPath(tempDir);
+
+    // Get a function which enables us to determine whether the FF that allows us to
+    // merge supported configuration file properties is enabled. We only execute
+    // this lazily if the other checks pass.
+    const allowMergeConfigs = () =>
+      action.features.getValue(Feature.AllowMergeConfigFiles);
+
+    // Check whether we also have a `config-file` input and decide what to do.
+    if (
+      inputs.configFile &&
+      isDefaultSetup(action.env) &&
+      (await allowMergeConfigs())
+    ) {
+      // If the FF is enabled and we are in Default Setup, combine the supported
+      // configuration file properties and write the result to disk.
+      const fromConfigInput = parseUserConfig(
+        action.logger,
+        "`config` input",
+        inputs.configInput,
+        validateConfig,
+      );
+      const fromConfigFile = await loadUserConfig(
+        action,
+        inputs.configFile,
+        inputs.workspacePath,
+        inputs.apiDetails,
+        tempDir,
+      );
+
+      // Write the merged configuration to disk so that it can be loaded subsequently by
+      // the CLI or other CodeQL Action steps.
+      const mergedConfig = mergeDefaultSetupAndUserConfigs(
+        action.logger,
+        fromConfigInput,
+        fromConfigFile,
+      );
+      fs.writeFileSync(computedConfigPath, yaml.dump(mergedConfig));
+      action.logger.debug(
+        `Using merged configurations from 'config' input with configuration from '${inputs.configFile}': ${computedConfigPath}`,
+      );
+
+      inputs.configFile = computedConfigPath;
+      return mergedConfig;
+    } else {
+      // If we are in this branch and there is a `config-file` input, then it means
+      // we didn't meet the conditions for merging the configurations. Warn the user
+      // that the configuration file will be ignored.
+      if (inputs.configFile) {
+        action.logger.warning(
+          `Both a config file and config input were provided. Ignoring config file.`,
+        );
+      }
+
+      // Write the `config` input straight to disk.
+      fs.writeFileSync(computedConfigPath, inputs.configInput);
+      inputs.configFile = computedConfigPath;
+      action.logger.debug(
+        `Using config from action input: ${inputs.configFile}`,
       );
     }
-    inputs.configFile = userConfigFromActionPath(tempDir);
-    fs.writeFileSync(inputs.configFile, inputs.configInput);
-    logger.debug(`Using config from action input: ${inputs.configFile}`);
   }
 
-  let userConfig: UserConfig = {};
+  // Load whatever configuration file we have, if any.
   if (!inputs.configFile) {
-    logger.debug("No configuration file was provided");
+    action.logger.debug("No configuration file was provided");
+    return {};
   } else {
-    logger.debug(`Using configuration file: ${inputs.configFile}`);
-    userConfig = await loadUserConfig(
-      actionState,
+    action.logger.debug(`Using configuration file: ${inputs.configFile}`);
+    return await loadUserConfig(
+      action,
       inputs.configFile,
       inputs.workspacePath,
       inputs.apiDetails,
       tempDir,
     );
   }
+}
+
+/**
+ * Load and return the config.
+ *
+ * This will parse the config from the user input if present, or generate
+ * a default config. The parsed config is then stored to a known location.
+ */
+export async function initConfig(
+  actionState: ActionState<["Logger", "Env", "FeatureFlags"]>,
+  inputs: InitConfigInputs,
+): Promise<Config> {
+  const { logger, features } = actionState;
+  const { tempDir } = inputs;
+
+  const userConfig = await determineUserConfig(actionState, tempDir, inputs);
 
   const config = await initActionState(inputs, userConfig);
 
@@ -1060,7 +1166,6 @@ export async function initConfig(
   try {
     gitVersion = await getGitVersionOrThrow();
     logger.info(`Using Git version ${gitVersion.fullVersion}`);
-    await logGitVersionTelemetry(config, gitVersion);
   } catch (e) {
     logger.warning(`Could not determine Git version: ${getErrorMessage(e)}`);
     // Throw the error in test mode so it's more visible, unless the environment
@@ -1181,16 +1286,61 @@ export async function initConfig(
   return config;
 }
 
+/**
+ * Determines if `configPath` is explicitly local. That is, it starts with `LOCAL_PATH_PREFIX`.
+ * A configuration file path that starts with `LOCAL_PATH_PREFIX` is always treated as a local path.
+ *
+ * @param configPath The path to test.
+ */
+function isExplicitLocalPath(configPath: string): boolean {
+  return configPath.startsWith(LOCAL_PATH_PREFIX);
+}
+
+/**
+ * Determines if `configPath` starts with the prefix used to explicitly mark a path
+ * as a remote path (`REMOTE_PATH_PREFIX`).
+ *
+ * @param configPath The path to test.
+ */
+function isExplicitRemotePath(configPath: string): boolean {
+  return configPath.startsWith(REMOTE_PATH_PREFIX);
+}
+
+/**
+ * Determines if `configPath` contains a '@' character.
+ *
+ * @param configPath The path to test.
+ */
+function containsAtRef(configPath: string): boolean {
+  return configPath.includes("@");
+}
+
+/**
+ * Determines if `configPath` refers to a local configuration file.
+ *
+ * @param configPath The path to test.
+ * @returns True if it is local, or false otherwise.
+ */
 function isLocal(configPath: string): boolean {
-  // If the path starts with ./, look locally
-  if (configPath.indexOf("./") === 0) {
+  // If the path starts with `LOCAL_PATH_PREFIX`, it is explicitly local.
+  // This allows local paths that would otherwise contain '@'
+  // to be used with a `LOCAL_PATH_PREFIX` prefix.
+  if (isExplicitLocalPath(configPath)) {
     return true;
   }
+  // If the path starts with `REMOTE_PATH_PREFIX`, it is explicitly remote.
+  // This allows users to resolve ambiguity by specifying `REMOTE_PATH_PREFIX`.
+  if (isExplicitRemotePath(configPath)) {
+    return false;
+  }
 
-  return configPath.indexOf("@") === -1;
+  // Otherwise, the path is also local if it does not contain '@'.
+  // This assumes the `OLD_REMOTE_ADDRESS_FORMAT` which must contain a '@'
+  // character for remote addresses.
+  return !containsAtRef(configPath);
 }
 
-function getLocalConfig(
+export function getLocalConfig(
   logger: Logger,
   configFile: string,
   validateConfig: boolean,
@@ -1493,26 +1643,6 @@ export function getPrimaryAnalysisConfig(config: Config): AnalysisConfig {
   return getAnalysisConfig(getPrimaryAnalysisKind(config));
 }
 
-/** Logs the Git version as a telemetry diagnostic. */
-async function logGitVersionTelemetry(
-  config: Config,
-  gitVersion: GitVersionInfo,
-): Promise<void> {
-  if (config.languages.length > 0) {
-    addNoLanguageDiagnostic(
-      config,
-      makeTelemetryDiagnostic(
-        "codeql-action/git-version-telemetry",
-        "Git version telemetry",
-        {
-          fullVersion: gitVersion.fullVersion,
-          truncatedVersion: gitVersion.truncatedVersion,
-        },
-      ),
-    );
-  }
-}
-
 /**
  * Logs the time it took to identify generated files and how many were discovered as
  * a telemetry diagnostic.
diff --git a/src/config/db-config.test.ts b/src/config/db-config.test.ts
index ca0061e136..63d9d2ffec 100644
--- a/src/config/db-config.test.ts
+++ b/src/config/db-config.test.ts
@@ -8,6 +8,7 @@ import {
   getRecordingLogger,
   LoggedMessage,
   makeMacro,
+  RecordingLogger,
 } from "../testing-utils";
 import { ConfigurationError, prettyPrintPack } from "../util";
 
@@ -488,3 +489,139 @@ test("parseUserConfig - throws no ConfigurationError if validation should fail,
     ),
   );
 });
+
+test("mergeDefaultSetupAndUserConfigs - combines threat models", async (t) => {
+  const logger = new RecordingLogger();
+  const result = dbConfig.mergeDefaultSetupAndUserConfigs(
+    logger,
+    { "threat-models": ["a", "b"] },
+    { "threat-models": ["local", "remote"] },
+  );
+
+  const threatModels = result["threat-models"];
+
+  if (t.truthy(threatModels)) {
+    t.deepEqual(threatModels, ["a", "b", "local", "remote"]);
+  }
+});
+
+test("mergeDefaultSetupAndUserConfigs - warns if user-supplied config contains default setup key", async (t) => {
+  const logger = new RecordingLogger();
+  const result = dbConfig.mergeDefaultSetupAndUserConfigs(
+    logger,
+    {},
+    { "default-setup": {} },
+  );
+
+  // User-supplied value is ignored.
+  t.deepEqual(result, {});
+
+  // Warning is logged.
+  t.true(
+    logger.hasMessage(
+      "The 'default-setup' configuration key is not supported in user-supplied configuration files",
+    ),
+  );
+});
+
+test("mergeDefaultSetupAndUserConfigs - keeps default setup key from 'config' input", async (t) => {
+  const logger = new RecordingLogger();
+  const expected: dbConfig.DefaultSetupConfig = {
+    org: { "model-packs": ["some-pack"] },
+  };
+  const result = dbConfig.mergeDefaultSetupAndUserConfigs(
+    logger,
+    { "default-setup": expected },
+    {},
+  );
+
+  // Result matches the input.
+  t.deepEqual(result["default-setup"], expected);
+
+  // No warning is logged.
+  t.false(
+    logger.hasMessage(
+      "The 'default-setup' configuration key is not supported in user-supplied configuration files",
+    ),
+  );
+});
+
+test("mergeDefaultSetupAndUserConfigs - keeps other properties from user-supplied configuration", async (t) => {
+  const logger = new RecordingLogger();
+  const configFile: dbConfig.UserConfig = {
+    "query-filters": [{ exclude: { a: "b" } }],
+    "paths-ignore": ["path"],
+  };
+
+  const result = dbConfig.mergeDefaultSetupAndUserConfigs(
+    logger,
+    {},
+    configFile,
+  );
+
+  t.deepEqual(result, configFile);
+});
+
+test("mergeDefaultSetupAndUserConfigs - ignores, but warns about, unknown keys from Default Setup", async (t) => {
+  const logger = new RecordingLogger();
+  const configFile: dbConfig.UserConfig = {
+    "query-filters": [{ exclude: { a: "b" } }],
+    "paths-ignore": ["path"],
+  };
+
+  const result = dbConfig.mergeDefaultSetupAndUserConfigs(
+    logger,
+    {
+      "default-setup": {
+        borg: [],
+        org: {
+          unknown: "foo",
+          "model-packs": [],
+        },
+      } as unknown as dbConfig.DefaultSetupConfig,
+      "paths-ignore": ["other-path"],
+    },
+    configFile,
+  );
+
+  t.deepEqual(result, {
+    ...configFile,
+    "default-setup": { org: { "model-packs": [] } },
+  });
+
+  const expectedUnrecognisedKeys = [
+    ".default-setup.org.unknown",
+    ".default-setup.borg",
+    ".paths-ignore",
+  ].join(", ");
+  checkExpectedLogMessages(t, logger.messages, [
+    `Unrecognised keys in Default Setup configuration: ${expectedUnrecognisedKeys}`,
+  ]);
+});
+
+test("mergeDefaultSetupAndUserConfigs - warns about invalid keys from Default Setup", async (t) => {
+  const logger = new RecordingLogger();
+  const configFile: dbConfig.UserConfig = {};
+
+  const result = dbConfig.mergeDefaultSetupAndUserConfigs(
+    logger,
+    {
+      "default-setup": {
+        org: {
+          "model-packs": [123],
+        },
+      } as unknown as dbConfig.DefaultSetupConfig,
+    },
+    configFile,
+  );
+
+  t.deepEqual(result, {
+    ...configFile,
+    "default-setup": { org: { "model-packs": [123] } },
+  });
+
+  const expectedInvalidKeys = [".default-setup.org.model-packs[0]"].join(", ");
+  checkExpectedLogMessages(t, logger.messages, [
+    `Invalid keys in Default Setup configuration: ${expectedInvalidKeys}`,
+  ]);
+});
diff --git a/src/config/db-config.ts b/src/config/db-config.ts
index a84a20f247..7b5bdbd8ce 100644
--- a/src/config/db-config.ts
+++ b/src/config/db-config.ts
@@ -4,11 +4,16 @@ import * as yaml from "js-yaml";
 import * as jsonschema from "jsonschema";
 import * as semver from "semver";
 
+import {
+  addNoLanguageDiagnostic,
+  makeTelemetryDiagnostic,
+} from "../diagnostics";
 import * as errorMessages from "../error-messages";
 import {
   RepositoryProperties,
   RepositoryPropertyName,
 } from "../feature-flags/properties";
+import * as json from "../json";
 import { Language } from "../languages";
 import { Logger } from "../logging";
 import { cloneObject, ConfigurationError, prettyPrintPack } from "../util";
@@ -28,6 +33,21 @@ export interface QuerySpec {
   uses: string;
 }
 
+const ORG_SCHEMA = {
+  /** An array of model pack names. */
+  "model-packs": json.optional(json.array(json.string)),
+} as const satisfies json.Schema;
+
+/** Not intended to be provided directly by a user. */
+export type OrgType = json.FromSchema<typeof ORG_SCHEMA>;
+
+const DEFAULT_SETUP_SCHEMA = {
+  org: json.optional<OrgType>(json.object(ORG_SCHEMA)),
+} as const satisfies json.Schema;
+
+/** Not intended to be provided directly by a user. */
+export type DefaultSetupConfig = json.FromSchema<typeof DEFAULT_SETUP_SCHEMA>;
+
 /**
  * Format of the config file supplied by the user.
  */
@@ -46,6 +66,119 @@ export interface UserConfig {
   // Set of query filters to include and exclude extra queries based on
   // codeql query suite `include` and `exclude` properties
   "query-filters"?: QueryFilter[];
+
+  /** An array (possibly empty or absent) of threat models to use. */
+  "threat-models"?: string[];
+
+  /**
+   * Configuration options that are reserved for us in Default Setup and
+   * not intended to be supplied directly by users.
+   */
+  "default-setup"?: DefaultSetupConfig;
+}
+
+/** A subset of the `UserConfig` schema that is used by Default Setup. */
+const DEFAULT_SETUP_CONFIG_SCHEMA = {
+  "threat-models": json.optional(json.array(json.string)),
+  "default-setup": json.optional<DefaultSetupConfig>(
+    json.object(DEFAULT_SETUP_SCHEMA),
+  ),
+} as const satisfies json.Schema;
+
+/**
+ * Merges supported properties from two configuration files. This is intended only for
+ * use with merging the `config` input provided by Default Setup with a potentially
+ * richer configuration file provided by a user.
+ *
+ * @param logger The logger to use.
+ * @param fromConfigInput The configuration from Default Setup.
+ * @param fromConfigFile The user-supplied configuration.
+ * @returns The combination of both configuration files.
+ */
+export function mergeDefaultSetupAndUserConfigs(
+  logger: Logger,
+  fromConfigInput: UserConfig,
+  fromConfigFile: UserConfig,
+): UserConfig {
+  logger.debug(
+    "Combining configuration files from 'config' and 'config-file' inputs",
+  );
+
+  // Check for unexpected keys in the configuration from the `config` input
+  // that was provided by Default Setup. This should only contain the keys
+  // we would expect to receive from Default Setup.
+  const schemaCheckResult = json.checkSchema(
+    DEFAULT_SETUP_CONFIG_SCHEMA,
+    fromConfigInput as json.UnvalidatedObject<any>,
+  );
+
+  // Report any invalid or unrecognised keys.
+  if (schemaCheckResult.invalidKeys.length > 0) {
+    logger.warning(
+      `Invalid keys in Default Setup configuration: ${schemaCheckResult.invalidKeys.join(", ")}`,
+    );
+    addNoLanguageDiagnostic(
+      undefined,
+      makeTelemetryDiagnostic(
+        "codeql-action/invalid-default-setup-config-keys",
+        "Invalid Default Setup configuration keys",
+        {
+          invalidKeys: schemaCheckResult.invalidKeys,
+        },
+        ["internal-error"],
+      ),
+    );
+  }
+  if (schemaCheckResult.unknownKeys.length > 0) {
+    logger.warning(
+      `Unrecognised keys in Default Setup configuration: ${schemaCheckResult.unknownKeys.join(", ")}`,
+    );
+    addNoLanguageDiagnostic(
+      undefined,
+      makeTelemetryDiagnostic(
+        "codeql-action/unrecognised-default-setup-config-keys",
+        "Unrecognised Default Setup configuration keys",
+        {
+          unrecognisedKeys: schemaCheckResult.unknownKeys,
+        },
+        ["internal-error"],
+      ),
+    );
+  }
+
+  // Combine all specified threat models from both sources.
+  const threatModels = new Set(fromConfigInput["threat-models"] || []);
+  for (const configFileThreatModel of fromConfigFile["threat-models"] || []) {
+    threatModels.add(configFileThreatModel);
+  }
+
+  // Warn if there is a 'default-setup' configuration key in the user-supplied configuration,
+  // since it is not meant to be used and we therefore ignore it here.
+  if (fromConfigFile["default-setup"]) {
+    logger.warning(
+      `The 'default-setup' configuration key is not supported in user-supplied configuration files and will be ignored.`,
+    );
+  }
+
+  // Since we expect the `fromConfigInput` configuration to be provided by Default Setup,
+  // we expect a limited set of options. Therefore, we base the overall configuration on
+  // the one provided via the `config-file` input, which may be richer.
+  const result = { ...fromConfigFile };
+  delete result["threat-models"];
+  delete result["default-setup"];
+
+  if (fromConfigInput["default-setup"]?.org?.["model-packs"]) {
+    result["default-setup"] = {
+      org: {
+        "model-packs": fromConfigInput["default-setup"].org["model-packs"],
+      },
+    };
+  }
+  if (threatModels.size > 0) {
+    result["threat-models"] = Array.from(threatModels);
+  }
+
+  return result;
 }
 
 /**
diff --git a/src/config/file.test.ts b/src/config/file.test.ts
index 3362d26c63..0833ad3d06 100644
--- a/src/config/file.test.ts
+++ b/src/config/file.test.ts
@@ -1,19 +1,27 @@
+import * as github from "@actions/github";
 import test from "ava";
 import sinon from "sinon";
 
+import { AnalysisKind } from "../analyses";
+import * as api from "../api-client";
+import { RegistryProxyVars } from "../environment";
 import { Feature } from "../feature-flags";
 import { RepositoryPropertyName } from "../feature-flags/properties";
-import { callee, setupTests } from "../testing-utils";
+import {
+  callee,
+  SAMPLE_DOTCOM_API_DETAILS,
+  setupTests,
+} from "../testing-utils";
 
-import { getConfigFileInput } from "./file";
+import { getConfigFileInput, getRemoteConfig } from "./file";
 
 setupTests(test);
 
 test("getConfigFileInput returns undefined by default", async (t) => {
   await callee(getConfigFileInput)
-    .withArgs({})
+    .withArgs({}, undefined)
     .withFeatures([Feature.ConfigFileRepositoryProperty])
-    .passes(async (fn) => t.is(await fn(), undefined));
+    .passes(t.is, undefined);
 });
 
 const repositoryProperties = {
@@ -22,75 +30,137 @@ const repositoryProperties = {
 
 test("getConfigFileInput returns input value", async (t) => {
   const testInput = "/some/path";
-  const target = callee(getConfigFileInput).withFeatures([
-    Feature.ConfigFileRepositoryProperty,
-  ]);
-
-  const actionsEnv = target.getState().actions;
-  sinon
-    .stub(actionsEnv, "getOptionalInput")
-    .withArgs("config-file")
-    .returns(testInput);
 
   // Even though both an input and repository property are configured,
   // we prefer the direct input to the Action.
-  const targetWithArgs = target
-    .withActions(actionsEnv)
-    .withArgs(repositoryProperties);
-  await targetWithArgs.passes(async (fn) => t.is(await fn(), testInput));
-
-  // Check for the expected log message.
-  t.true(
-    targetWithArgs
-      .getLogger()
-      .hasMessage("Using configuration file input from workflow"),
-  );
+  await callee(getConfigFileInput)
+    .withFeatures([Feature.ConfigFileRepositoryProperty])
+    .withActions((actionsEnv) => {
+      sinon
+        .stub(actionsEnv, "getOptionalInput")
+        .withArgs("config-file")
+        .returns(testInput);
+    })
+    .withArgs(repositoryProperties, undefined)
+    .logs(t, "Using configuration file input from workflow")
+    .passes(t.is, testInput);
 });
 
 test("getConfigFileInput returns repository property value", async (t) => {
   // Since there is no direct input, we should use the repository property.
-  const target = callee(getConfigFileInput)
+  await callee(getConfigFileInput)
+    .withFeatures([Feature.ConfigFileRepositoryProperty])
+    .withArgs(repositoryProperties, undefined)
+    .logs(t, "Using configuration file input from repository property")
+    .passes(t.is, repositoryProperties[RepositoryPropertyName.CONFIG_FILE]);
+});
+
+test("getConfigFileInput returns repository property value for Code Scanning", async (t) => {
+  // Since there is no direct input, we should use the repository property.
+  await callee(getConfigFileInput)
     .withFeatures([Feature.ConfigFileRepositoryProperty])
-    .withArgs(repositoryProperties);
-
-  await target.passes(async (fn) =>
-    t.is(await fn(), repositoryProperties[RepositoryPropertyName.CONFIG_FILE]),
-  );
-
-  // Check for the expected log message.
-  t.true(
-    target
-      .getLogger()
-      .hasMessage("Using configuration file input from repository property"),
-  );
+    .withArgs(repositoryProperties, [AnalysisKind.CodeScanning])
+    .logs(t, "Using configuration file input from repository property")
+    .passes(t.is, repositoryProperties[RepositoryPropertyName.CONFIG_FILE]);
+});
+
+test("getConfigFileInput ignores repository property for other analysis kinds", async (t) => {
+  const unsupportedCases = [
+    [AnalysisKind.CodeQuality],
+    [AnalysisKind.RiskAssessment],
+    [AnalysisKind.CodeScanning, AnalysisKind.CodeQuality],
+  ];
+
+  const target = callee(getConfigFileInput).withFeatures([
+    Feature.ConfigFileRepositoryProperty,
+  ]);
+
+  for (const unsupportedCase of unsupportedCases) {
+    // Since the analysis kind is unsupported, we should ignore the repository property.
+    await target
+      .withArgs(repositoryProperties, unsupportedCase)
+      .logs(
+        t,
+        "Ignoring configuration file input from repository property, because it is unsupported for the current analysis kind.",
+      )
+      .passes(t.is, undefined);
+  }
 });
 
 test("getConfigFileInput ignores empty repository property value", async (t) => {
   // Since the repository property value is an empty/whitespace string, we should ignore it.
   await callee(getConfigFileInput)
     .withFeatures([Feature.ConfigFileRepositoryProperty])
-    .withArgs({ [RepositoryPropertyName.CONFIG_FILE]: "   " })
-    .passes(async (fn) => t.is(await fn(), undefined));
+    .withArgs({ [RepositoryPropertyName.CONFIG_FILE]: "   " }, undefined)
+    .passes(t.is, undefined);
 });
 
 test("getConfigFileInput ignores repository property value when FF is off", async (t) => {
   // Since the FF is off, we should ignore the repository property value.
-  const target = callee(getConfigFileInput)
+  await callee(getConfigFileInput)
     .withFeatures([])
-    .withArgs(repositoryProperties);
-
-  await target.passes(async (fn) => t.is(await fn(), undefined));
-
-  t.false(
-    target
-      .getLogger()
-      .hasMessage("Using configuration file input from repository property"),
-  );
-  t.true(
-    target
-      .getLogger()
-      .hasMessage(
-        "Ignoring configuration file input from repository property, because the corresponding feature flag is disabled.",
-      ),
-  );
+    .withArgs(repositoryProperties, undefined)
+    .notLogs(t, "Using configuration file input from repository property")
+    .logs(
+      t,
+      "Ignoring configuration file input from repository property, because the corresponding feature flag is disabled.",
+    )
+    .passes(t.is, undefined);
+});
+
+test.serial("getRemoteConfig uses proxy when it is supposed to", async (t) => {
+  const client = github.getOctokit("123");
+  const response = {
+    data: {
+      content: Buffer.from("disable-default-queries: false").toString("base64"),
+    },
+  };
+  sinon
+    .stub(client.rest.repos, "getContent")
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-argument
+    .resolves(response as any);
+
+  // We stub `getApiClientWithExternalAuth` so that it throws if no
+  // proxy is provided and returns the client otherwise. This allows us
+  // to verify the result in the following test cases.
+  const errorMessage = "No `proxy` was provided by the caller.";
+  sinon
+    .stub(api, "getApiClientWithExternalAuth")
+    .callsFake((_details, proxy) => {
+      // Throw if proxy isn't defined.
+      if (proxy === undefined) {
+        throw new Error(errorMessage);
+      }
+      // Otherwise return the client object.
+      return client;
+    });
+
+  const target = callee(getRemoteConfig)
+    .withDefaultActionsEnv()
+    .withArgs("file.yml", SAMPLE_DOTCOM_API_DETAILS);
+
+  // Should use it when the FF is enabled and the environment variables are set.
+  await target
+    .withFeatures([Feature.ProxyApiRequests])
+    .withEnv((env) => {
+      env.set(RegistryProxyVars.PROXY_HOST, "localhost");
+      env.set(RegistryProxyVars.PROXY_PORT, "1234");
+    })
+    .logs(t, "Using private registry proxy at 'http://localhost:1234'")
+    .passes(t.truthy);
+
+  // But not when the FF is not enabled.
+  await target
+    .withEnv((env) => {
+      env.set(RegistryProxyVars.PROXY_HOST, "localhost");
+      env.set(RegistryProxyVars.PROXY_PORT, "1234");
+    })
+    .notLogs(t, "Using private registry proxy at 'http://localhost:1234'")
+    .throws(t, { message: errorMessage });
+
+  // And not when the environment variables aren't set.
+  await target
+    .withFeatures([Feature.ProxyApiRequests])
+    .notLogs(t, "Using private registry proxy at 'http://localhost:1234'")
+    .throws(t, { message: errorMessage });
 });
diff --git a/src/config/file.ts b/src/config/file.ts
index 5ff2dee082..be0e415a38 100644
--- a/src/config/file.ts
+++ b/src/config/file.ts
@@ -1,4 +1,5 @@
 import { ActionState } from "../action-common";
+import { AnalysisKind } from "../analyses";
 import * as api from "../api-client";
 import * as errorMessages from "../error-messages";
 import { Feature } from "../feature-flags";
@@ -11,6 +12,19 @@ import { ConfigurationError } from "../util";
 import { parseUserConfig, UserConfig } from "./db-config";
 import { parseRemoteFileAddress } from "./remote-file";
 
+/**
+ * The prefix that can be specified to indicate that a path should be treated as a local file address.
+ */
+export const LOCAL_PATH_PREFIX = "./";
+
+/**
+ * The prefix that can be specified to indicate that a path should be treated as a remote file address.
+ * The new remote file address format must start with either an owner or repository name. Both
+ * are restricted to ASCII characters, '.', and '-'. The prefix chosen here does not interfere with
+ * those (since it contains an `=`) and is _unlikely_ (but not impossible) to appear in a local file path.
+ */
+export const REMOTE_PATH_PREFIX = "remote=";
+
 /**
  * Gets the value that is configured for the configuration file, if any.
  */
@@ -21,6 +35,7 @@ export async function getConfigFileInput(
     features,
   }: ActionState<["Logger", "Actions", "FeatureFlags"]>,
   repositoryProperties: Partial<RepositoryProperties>,
+  analysisKinds: AnalysisKind[] | undefined,
 ): Promise<string | undefined> {
   const input = actions.getOptionalInput("config-file");
 
@@ -32,17 +47,29 @@ export async function getConfigFileInput(
   const propertyValue =
     repositoryProperties[RepositoryPropertyName.CONFIG_FILE];
 
+  // Only allow the repository property to be used for standard Code Scanning analyses,
+  // since we don't currently support some customisation options for Code Quality.
+  // We don't expect customisations for Risk Assessments either.
+  const analysisKindSupported =
+    analysisKinds === undefined ||
+    (analysisKinds.includes(AnalysisKind.CodeScanning) &&
+      analysisKinds.length === 1);
+
   if (propertyValue !== undefined && propertyValue.trim().length > 0) {
     // Only use the repository property value if the FF is enabled.
     const useRepositoryProperty = await features.getValue(
       Feature.ConfigFileRepositoryProperty,
     );
 
-    if (useRepositoryProperty) {
+    if (analysisKindSupported && useRepositoryProperty) {
       logger.info(
         `Using configuration file input from repository property: ${propertyValue}`,
       );
       return propertyValue;
+    } else if (!analysisKindSupported) {
+      logger.info(
+        "Ignoring configuration file input from repository property, because it is unsupported for the current analysis kind.",
+      );
     } else {
       logger.info(
         "Ignoring configuration file input from repository property, because the corresponding feature flag is disabled.",
@@ -69,8 +96,15 @@ export async function getRemoteConfig(
 ): Promise<UserConfig> {
   const address = await parseRemoteFileAddress(actionState, configFile);
 
+  const shouldProxyRequest = await actionState.features.getValue(
+    Feature.ProxyApiRequests,
+  );
+  const proxy = shouldProxyRequest
+    ? api.getRegistryProxy(actionState)
+    : undefined;
+
   const response = await api
-    .getApiClientWithExternalAuth(apiDetails)
+    .getApiClientWithExternalAuth(apiDetails, proxy)
     .rest.repos.getContent({
       owner: address.owner,
       repo: address.repo,
diff --git a/src/config/inputs.test.ts b/src/config/inputs.test.ts
new file mode 100644
index 0000000000..851dd72e2f
--- /dev/null
+++ b/src/config/inputs.test.ts
@@ -0,0 +1,89 @@
+import test from "ava";
+import sinon from "sinon";
+
+import { ActionsEnv } from "../actions-util";
+import { Feature } from "../feature-flags";
+import { RepositoryPropertyName } from "../feature-flags/properties";
+import { callee } from "../testing-utils";
+
+import { ComputedInput, getToolsInput, InputName, InputSource } from "./inputs";
+
+test("getToolsInput - undefined if there's no input", async (t) => {
+  await callee(getToolsInput).withArgs({}).passes(t.is, undefined);
+});
+
+const expectedWorkflowResult: ComputedInput = {
+  source: InputSource.Workflow,
+  value: "workflow-input-value",
+};
+
+const expectedRepositoryPropertyResult: ComputedInput = {
+  source: InputSource.RepositoryProperty,
+  value: "repo-property-input-value",
+};
+
+function stubGetToolsInput(actions: ActionsEnv) {
+  sinon
+    .stub(actions, "getOptionalInput")
+    .withArgs(InputName.Tools)
+    .returns(expectedWorkflowResult.value);
+}
+
+const workflowLogMessage = `Using ${InputName.Tools} input from workflow:`;
+
+test("getToolsInput - returns workflow input if available", async (t) => {
+  await callee(getToolsInput)
+    .withActions(stubGetToolsInput)
+    .withArgs({})
+    .logs(t, workflowLogMessage)
+    .passes(t.deepEqual, expectedWorkflowResult);
+});
+
+test("getToolsInput - returns repository property value if enforced", async (t) => {
+  const target = callee(getToolsInput)
+    .withActions(stubGetToolsInput)
+    .withArgs({
+      [RepositoryPropertyName.TOOLS]: `!${expectedRepositoryPropertyResult.value}`,
+    });
+
+  // We expect the repository value if provided and the FF is enabled.
+  const enforcedLogMessage = `Using ${InputName.Tools} input from repository property (enforced):`;
+  await target
+    .withFeatures([Feature.ToolsRepositoryProperty])
+    .logs(t, enforcedLogMessage)
+    .passes(t.deepEqual, expectedRepositoryPropertyResult);
+  await target
+    .notLogs(t, enforcedLogMessage)
+    .logs(t, workflowLogMessage)
+    .passes(t.deepEqual, expectedWorkflowResult);
+});
+
+test("getToolsInput - prefers workflow input", async (t) => {
+  const target = callee(getToolsInput)
+    .withActions(stubGetToolsInput)
+    .withArgs({
+      [RepositoryPropertyName.TOOLS]: expectedRepositoryPropertyResult.value,
+    });
+
+  // We expect the workflow input regardless of the FF state.
+  await target
+    .withFeatures([Feature.ToolsRepositoryProperty])
+    .logs(t, workflowLogMessage)
+    .passes(t.deepEqual, expectedWorkflowResult);
+  await target
+    .logs(t, workflowLogMessage)
+    .passes(t.deepEqual, expectedWorkflowResult);
+});
+
+test("getToolsInput - returns repository property", async (t) => {
+  const target = callee(getToolsInput).withArgs({
+    [RepositoryPropertyName.TOOLS]: expectedRepositoryPropertyResult.value,
+  });
+
+  // We expect the repository property if the FF is enabled or undefined otherwise.
+  await target
+    .withFeatures([Feature.ToolsRepositoryProperty])
+    .logs(t, `Using ${InputName.Tools} input from repository property:`)
+    .passes(t.deepEqual, expectedRepositoryPropertyResult);
+  await target.passes(t.is, undefined);
+});
diff --git a/src/config/inputs.ts b/src/config/inputs.ts
new file mode 100644
index 0000000000..32a8dfd6f6
--- /dev/null
+++ b/src/config/inputs.ts
@@ -0,0 +1,80 @@
+import { ActionState } from "../action-common";
+import { Feature } from "../feature-flags";
+import {
+  RepositoryProperties,
+  RepositoryPropertyName,
+} from "../feature-flags/properties";
+
+/** Enumerates input names. */
+export enum InputName {
+  Tools = "tools",
+}
+
+/** Enumerates input sources. */
+export enum InputSource {
+  Workflow = "workflow",
+  RepositoryProperty = "repository-property",
+}
+
+/**
+ * Represents an effective input to the CodeQL Action. That is,
+ * the input value that was computed or selected from multiple sources.
+ */
+export type ComputedInput = {
+  /** The value of the property. */
+  value: string;
+  /** The source of the property. */
+  source: InputSource;
+};
+
+/**
+ * Gets the computed `tools` input. This comes from either the workflow or
+ * the repository property.
+ *
+ * @param action The Action state.
+ * @param repositoryProperties The values of known repository properties.
+ * @returns The computed input or `undefined` if there is no input.
+ */
+export async function getToolsInput(
+  action: ActionState<["Logger", "Actions", "FeatureFlags"]>,
+  repositoryProperties: Partial<RepositoryProperties>,
+): Promise<ComputedInput | undefined> {
+  const name = InputName.Tools;
+  const input = action.actions.getOptionalInput(name);
+  const propertyValue = repositoryProperties[RepositoryPropertyName.TOOLS];
+  const allowRepositoryProperty = await action.features.getValue(
+    Feature.ToolsRepositoryProperty,
+  );
+
+  // The repository property takes precedence if it starts with an '!'.
+  if (allowRepositoryProperty && propertyValue?.startsWith("!")) {
+    action.logger.info(
+      `Using ${name} input from repository property (enforced): ${propertyValue}`,
+    );
+    return {
+      // Drop the '!' from the value.
+      value: propertyValue.substring(1),
+      source: InputSource.RepositoryProperty,
+    };
+  }
+
+  // Otherwise, the input from the workflow takes precedence.
+  if (input !== undefined) {
+    action.logger.info(`Using ${name} input from workflow: ${input}`);
+    return { value: input, source: InputSource.Workflow };
+  }
+
+  // Use the repository property if there's no workflow input.
+  if (allowRepositoryProperty && propertyValue !== undefined) {
+    action.logger.info(
+      `Using ${name} input from repository property: ${propertyValue}`,
+    );
+    return {
+      value: propertyValue,
+      source: InputSource.RepositoryProperty,
+    };
+  }
+
+  // There's no input.
+  return undefined;
+}
diff --git a/src/config/remote-file.test.ts b/src/config/remote-file.test.ts
index c366370293..e263e6d79a 100644
--- a/src/config/remote-file.test.ts
+++ b/src/config/remote-file.test.ts
@@ -1,10 +1,8 @@
 import test from "ava";
 import sinon from "sinon";
 
-import { ActionsEnvVars } from "../actions-util";
-import * as errors from "../error-messages";
-import { Feature } from "../feature-flags";
-import { callee, getTestEnv } from "../testing-utils";
+import { ActionsEnvVars } from "../environment";
+import { callee } from "../testing-utils";
 import { ConfigurationError } from "../util";
 
 import {
@@ -50,7 +48,7 @@ test("parseRemoteFileAddress accepts full remote addresses", async (t) => {
   for (const oldFormatInput of oldFormatInputs) {
     await target
       .withArgs(oldFormatInput.input)
-      .passes(async (fn) => t.deepEqual(await fn(), oldFormatInput.expected));
+      .passes(t.deepEqual, oldFormatInput.expected);
   }
 
   // New format.
@@ -75,31 +73,18 @@ test("parseRemoteFileAddress accepts full remote addresses", async (t) => {
   for (const newFormatInput of newFormatInputs) {
     const targetWithArgs = target.withArgs(newFormatInput.input);
 
-    // Should fail when the FF is not enabled.
-    await targetWithArgs
-      .withFeatures([])
-      .passes(async (fn) =>
-        t.throwsAsync(fn, { instanceOf: ConfigurationError }),
-      );
-
-    // And pass when the FF is enabled.
-    await targetWithArgs
-      .withFeatures([Feature.NewRemoteFileAddresses])
-      .passes(async (fn) => t.deepEqual(await fn(), newFormatInput.expected));
+    await targetWithArgs.passes(t.deepEqual, newFormatInput.expected);
   }
 });
 
 test("parseRemoteFileAddress accepts remote address without an owner", async (t) => {
-  const target = callee(parseRemoteFileAddress);
-
-  const env = target.getState().env;
   const owner = "test-owner";
-  const getRequired = sinon.stub(env, "getRequired");
-  getRequired
-    .withArgs(ActionsEnvVars.GITHUB_REPOSITORY)
-    .returns(`${owner}/current-repo`);
-
-  const targetWithEnv = target.withEnv(env);
+  const target = callee(parseRemoteFileAddress).withEnv((env) => {
+    const getRequired = sinon.stub(env, "getRequired");
+    getRequired
+      .withArgs(ActionsEnvVars.GITHUB_REPOSITORY)
+      .returns(`${owner}/current-repo`);
+  });
 
   const testCases: ParseRemoteFileAddressTest[] = [
     {
@@ -141,33 +126,23 @@ test("parseRemoteFileAddress accepts remote address without an owner", async (t)
   ];
 
   for (const testCase of testCases) {
-    const targetWithArgs = targetWithEnv.withArgs(testCase.input);
-
-    // Should fail when the FF is not enabled.
-    await targetWithArgs
-      .withFeatures([])
-      .passes(async (fn) =>
-        t.throwsAsync(fn, { instanceOf: ConfigurationError }),
-      );
+    const targetWithArgs = target.withArgs(testCase.input);
 
-    // And pass when the FF is enabled.
-    await targetWithArgs
-      .withFeatures([Feature.NewRemoteFileAddresses])
-      .passes(async (fn) => t.deepEqual(await fn(), testCase.expected));
+    await targetWithArgs.passes(t.deepEqual, testCase.expected);
   }
 });
 
 test("parseRemoteFileAddress throws for invalid `GITHUB_REPOSITORY`", async (t) => {
-  const target = callee(parseRemoteFileAddress).withArgs("repo@ref");
-
-  const env = target.getState().env;
-  const getRequired = sinon.stub(env, "getRequired");
+  const getRequired: sinon.SinonStub = sinon.stub();
   getRequired.withArgs(ActionsEnvVars.GITHUB_REPOSITORY).returns(`not-valid`);
 
-  await target
-    .withEnv(env)
-    .withFeatures([Feature.NewRemoteFileAddresses])
-    .passes(async (fn) => t.throwsAsync(fn, { instanceOf: Error }));
+  const target = callee(parseRemoteFileAddress)
+    .withArgs("repo@ref")
+    .withEnv((env) => {
+      sinon.define(env, "getRequired", getRequired);
+    });
+
+  await target.throws(t, { instanceOf: Error });
 
   t.assert(getRequired.calledOnceWith(ActionsEnvVars.GITHUB_REPOSITORY));
 });
@@ -199,46 +174,29 @@ test("parseRemoteFileAddress accepts remote address without a path", async (t) =
   for (const testCase of testCases) {
     const targetWithArgs = target.withArgs(testCase.input);
 
-    // Should fail when the FF is not enabled.
-    await targetWithArgs
-      .withFeatures([])
-      .passes(async (fn) =>
-        t.throwsAsync(fn, { instanceOf: ConfigurationError }),
-      );
-
-    // And pass when the FF is enabled.
-    await targetWithArgs
-      .withFeatures([Feature.NewRemoteFileAddresses])
-      .passes(async (fn) => t.deepEqual(await fn(), testCase.expected));
+    await targetWithArgs.passes(t.deepEqual, testCase.expected);
   }
 });
 
 test("parseRemoteFileAddress accepts remote address without a ref", async (t) => {
   const target = callee(parseRemoteFileAddress).withArgs("owner/repo:path");
 
-  // Should only accept the input if the FF is enabled.
-  await target.withFeatures([]).passes(t.throwsAsync);
-  await target
-    .withFeatures([Feature.NewRemoteFileAddresses])
-    .passes(async (fn) =>
-      t.deepEqual(await fn(), {
-        owner: "owner",
-        repo: "repo",
-        path: "path",
-        ref: DEFAULT_CONFIG_FILE_REF,
-      } satisfies RemoteFileAddress),
-    );
+  await target.passes(t.deepEqual, {
+    owner: "owner",
+    repo: "repo",
+    path: "path",
+    ref: DEFAULT_CONFIG_FILE_REF,
+  } satisfies RemoteFileAddress);
 });
 
 test("parseRemoteFileAddress rejects invalid values", async (t) => {
-  const env = getTestEnv();
   const owner = "owner";
-  const getRequired = sinon.stub(env, "getRequired");
-  getRequired
-    .withArgs(ActionsEnvVars.GITHUB_REPOSITORY)
-    .returns(`${owner}/current-repo`);
-
-  const target = callee(parseRemoteFileAddress).withEnv(env);
+  const target = callee(parseRemoteFileAddress).withEnv((env) => {
+    const getRequired = sinon.stub(env, "getRequired");
+    getRequired
+      .withArgs(ActionsEnvVars.GITHUB_REPOSITORY)
+      .returns(`${owner}/current-repo`);
+  });
 
   const testInputs = [
     "  ",
@@ -261,22 +219,11 @@ test("parseRemoteFileAddress rejects invalid values", async (t) => {
   for (const testInput of testInputs) {
     const targetWithArgs = target.withArgs(testInput);
 
-    // Should throw both when the new format is and isn't accepted.
-    await targetWithArgs.withFeatures([]).passes(async (fn) =>
-      t.throwsAsync(fn, {
-        instanceOf: ConfigurationError,
-        message: errors.getConfigFileRepoOldFormatInvalidMessage(testInput),
-      }),
-    );
-    await targetWithArgs
-      .withFeatures([Feature.NewRemoteFileAddresses])
-      .passes(async (fn) =>
-        t.throwsAsync(fn, {
-          // When the new format is accepted, there are some more specific
-          // errors in some cases. It is sufficient for us to check that
-          // an exception is thrown.
-          instanceOf: ConfigurationError,
-        }),
-      );
+    await targetWithArgs.throws(t, {
+      // When the new format is accepted, there are some more specific
+      // errors in some cases. It is sufficient for us to check that
+      // an exception is thrown.
+      instanceOf: ConfigurationError,
+    });
   }
 });
diff --git a/src/config/remote-file.ts b/src/config/remote-file.ts
index 15990ed23f..1052072a28 100644
--- a/src/config/remote-file.ts
+++ b/src/config/remote-file.ts
@@ -1,8 +1,6 @@
 import { ActionState } from "../action-common";
-import { ActionsEnvVars } from "../actions-util";
-import { Env } from "../environment";
+import { ActionsEnvVars, ReadOnlyEnv } from "../environment";
 import * as errorMessages from "../error-messages";
-import { Feature } from "../feature-flags";
 import { ConfigurationError, Failure, Result, Success } from "../util";
 
 /** Represents remote file addresses. */
@@ -18,13 +16,13 @@ export interface RemoteFileAddress {
 }
 
 /** The default file path to use in configuration file shorthands. */
-export const DEFAULT_CONFIG_FILE_NAME = ".github/codeql-action.yaml";
+export const DEFAULT_CONFIG_FILE_NAME = ".github/codeql-config.yml";
 
 /** The default ref to use in configuration file shorthands. */
 export const DEFAULT_CONFIG_FILE_REF = "main";
 
 /** Extracts the owner from the `GITHUB_REPOSITORY` environment variable. */
-function getDefaultOwner(env: Env): string {
+function getDefaultOwner(env: ReadOnlyEnv): string {
   const currentRepoNwo = env.getRequired(ActionsEnvVars.GITHUB_REPOSITORY);
   const nwoParts = currentRepoNwo.split("/");
 
@@ -71,6 +69,42 @@ function parseOldRemoteFileAddress(
   });
 }
 
+/**
+ * Attempts to parse `input` as a `RemoteFileAddress` using the new format.
+ *
+ * @param env The read-only environment to obtain the owner name from if needed.
+ * @param configFile The input to try and parse.
+ * @returns A `RemoteFileAddress` value if successful or `undefined` otherwise.
+ */
+export function parseNewRemoteFileAddress(
+  env: ReadOnlyEnv,
+  configFile: string,
+): Result<RemoteFileAddress, undefined> {
+  // retrieve the various parts of the config location, and ensure they're present
+  const format = new RegExp(
+    "^((?<owner>[^:@/]+)/)?(?<repo>[^:@/]+)(@(?<ref>[^:]+))?(:(?<path>.+))?$",
+  );
+  const pieces = format.exec(configFile.trim());
+
+  const repo: string | undefined = pieces?.groups?.repo?.trim();
+
+  // Check that the regular expression matched and that we have at least the repo name.
+  if (!pieces?.groups || !repo || repo.length === 0) {
+    return new Failure(undefined);
+  }
+
+  const owner: string | undefined = pieces.groups.owner?.trim();
+  const path: string | undefined = pieces.groups.path?.trim();
+  const ref: string | undefined = pieces.groups.ref?.trim();
+
+  return new Success({
+    owner: owner || getDefaultOwner(env),
+    repo,
+    path: path || DEFAULT_CONFIG_FILE_NAME,
+    ref: ref || DEFAULT_CONFIG_FILE_REF,
+  });
+}
+
 /**
  * Attempts to parse `configFile` into an array of `RemoteFileAddress` components.
  *
@@ -91,26 +125,13 @@ export async function parseRemoteFileAddress(
     return oldFormatAddressResult.value;
   }
 
-  // If the FF for the new format is not enabled, throw the old format error.
-  const allowNewFormat = await actionState.features.getValue(
-    Feature.NewRemoteFileAddresses,
-  );
-  if (!allowNewFormat) {
-    throw new ConfigurationError(
-      errorMessages.getConfigFileRepoOldFormatInvalidMessage(configFile),
-    );
-  }
-
   // retrieve the various parts of the config location, and ensure they're present
-  const format = new RegExp(
-    "^((?<owner>[^:@/]+)/)?(?<repo>[^:@/]+)(@(?<ref>[^:]+))?(:(?<path>.+))?$",
+  const newFormatAddressResult = parseNewRemoteFileAddress(
+    actionState.env,
+    configFile,
   );
-  const pieces = format.exec(configFile.trim());
-
-  const repo: string | undefined = pieces?.groups?.repo?.trim();
 
-  // Check that the regular expression matched and that we have at least the repo name.
-  if (!pieces?.groups || !repo || repo.length === 0) {
+  if (newFormatAddressResult.isFailure()) {
     // Neither the old format nor the new format worked. Throw an error that
     // explains the format we accept. We only mention the new format, since that's
     // what we want to be used going forward.
@@ -119,21 +140,14 @@ export async function parseRemoteFileAddress(
     );
   }
 
-  const owner: string | undefined = pieces.groups.owner?.trim();
-  const path: string | undefined = pieces.groups.path?.trim();
-  const ref: string | undefined = pieces.groups.ref?.trim();
+  const address = newFormatAddressResult.value;
 
   // Ensure that the path is a relative path.
-  if (path?.startsWith("/")) {
+  if (address.path.startsWith("/")) {
     throw new ConfigurationError(
       `The path component of '${configFile}' cannot be an absolute path.`,
     );
   }
 
-  return {
-    owner: owner || getDefaultOwner(actionState.env),
-    repo,
-    path: path || DEFAULT_CONFIG_FILE_NAME,
-    ref: ref || DEFAULT_CONFIG_FILE_REF,
-  };
+  return address;
 }
diff --git a/src/defaults.json b/src/defaults.json
index 660296139f..558dce6e24 100644
--- a/src/defaults.json
+++ b/src/defaults.json
@@ -1,6 +1,6 @@
 {
-  "bundleVersion": "codeql-bundle-v2.26.0",
-  "cliVersion": "2.26.0",
-  "priorBundleVersion": "codeql-bundle-v2.25.6",
-  "priorCliVersion": "2.25.6"
+  "bundleVersion": "codeql-bundle-v2.26.2",
+  "cliVersion": "2.26.2",
+  "priorBundleVersion": "codeql-bundle-v2.26.1",
+  "priorCliVersion": "2.26.1"
 }
diff --git a/src/diagnostics.ts b/src/diagnostics.ts
index 65e82ce1af..fa0e87c046 100644
--- a/src/diagnostics.ts
+++ b/src/diagnostics.ts
@@ -6,24 +6,45 @@ import { Language } from "./languages";
 import { getActionsLogger } from "./logging";
 import { getCodeQLDatabasePath } from "./util";
 
-/** Represents a diagnostic message for the tool status page, etc. */
-export interface DiagnosticMessage {
+/**
+ * Known tags for diagnostics. There is currently only "internal-error",
+ * but others may be added in the future.
+ */
+export type DiagnosticTag = "internal-error";
+
+/** Optional information about the origin of a diagnostic. */
+export type DiagnosticSourceOptions = {
+  /**
+   * Name of the CodeQL extractor. This is used to identify which tool component the reporting
+   * descriptor object should be nested under in SARIF.
+   */
+  extractorName?: string;
+  /** An array of tags for the diagnostic. */
+  tags?: DiagnosticTag[];
+};
+
+/** Represents information about the origin of a diagnostic. */
+export type DiagnosticSource = {
+  /**
+   * An identifier under which it makes sense to group this diagnostic message.
+   * This is used to build the SARIF reporting descriptor object.
+   */
+  id: string;
+  /** Display name for the ID. This is used to build the SARIF reporting descriptor object. */
+  name: string;
+} & DiagnosticSourceOptions;
+
+/**
+ * Represents a diagnostic message for the tool status page, etc.
+ *
+ * Unlike {@link DiagnosticMessage}, properties which can automatically
+ * be populated are optional in this type.
+ */
+export type DiagnosticMessageOptions = {
   /** ISO 8601 timestamp */
-  timestamp: string;
-  source: {
-    /**
-     * An identifier under which it makes sense to group this diagnostic message.
-     * This is used to build the SARIF reporting descriptor object.
-     */
-    id: string;
-    /** Display name for the ID. This is used to build the SARIF reporting descriptor object. */
-    name: string;
-    /**
-     * Name of the CodeQL extractor. This is used to identify which tool component the reporting
-     * descriptor object should be nested under in SARIF.
-     */
-    extractorName?: string;
-  };
+  timestamp?: string;
+  /** Information about the origin of the diagnostic. */
+  source?: DiagnosticSourceOptions;
   /** GitHub flavored Markdown formatted message. Should include inline links to any help pages. */
   markdownMessage?: string;
   /** Plain text message. Used by components where the string processing needed to support Markdown is cumbersome. */
@@ -53,7 +74,15 @@ export interface DiagnosticMessage {
   };
   /** Structured metadata about the diagnostic message */
   attributes?: { [key: string]: any };
-}
+};
+
+/** Represents a diagnostic message for the tool status page, etc. */
+export type DiagnosticMessage = DiagnosticMessageOptions & {
+  /** ISO 8601 timestamp */
+  timestamp: string;
+  /** Information about the origin of the diagnostic. */
+  source: DiagnosticSource;
+};
 
 /** Represents a diagnostic message that has not yet been written to the database. */
 interface UnwrittenDiagnostic {
@@ -90,7 +119,7 @@ let diagnosticCounter = 0;
 export function makeDiagnostic(
   id: string,
   name: string,
-  data: Partial<DiagnosticMessage> | undefined = undefined,
+  data: DiagnosticMessageOptions | undefined = undefined,
 ): DiagnosticMessage {
   return {
     ...data,
@@ -243,6 +272,7 @@ export function makeTelemetryDiagnostic(
   id: string,
   name: string,
   attributes: { [key: string]: any },
+  tags?: DiagnosticTag[],
 ): DiagnosticMessage {
   return makeDiagnostic(id, name, {
     attributes,
@@ -251,5 +281,8 @@ export function makeTelemetryDiagnostic(
       statusPage: false,
       telemetry: true,
     },
+    source: {
+      tags,
+    },
   });
 }
diff --git a/src/environment.ts b/src/environment.ts
index c0ca050b03..d6ff20391a 100644
--- a/src/environment.ts
+++ b/src/environment.ts
@@ -1,3 +1,13 @@
+/**
+ * Environment variables used by Default Setup to communicate the private registry proxy configuration.
+ */
+export enum RegistryProxyVars {
+  PROXY_HOST = "CODEQL_PROXY_HOST",
+  PROXY_PORT = "CODEQL_PROXY_PORT",
+  PROXY_CA_CERTIFICATE = "CODEQL_PROXY_CA_CERTIFICATE",
+  PROXY_URLS = "CODEQL_PROXY_URLS",
+}
+
 /**
  * Environment variables used by the CodeQL Action.
  *
@@ -17,6 +27,18 @@ export enum EnvVar {
    */
   CLI_VERBOSITY = "CODEQL_VERBOSITY",
 
+  /**
+   * Set by Default Setup to the base branch of the PR being analysed, if analysing a PR.
+   * This is needed because the `pull_request` context is not available for `dynamic` events.
+   */
+  CODE_SCANNING_BASE_BRANCH = "CODE_SCANNING_BASE_BRANCH",
+
+  /**
+   * Set by Default Setup to the full ref being analysed, if analysing a PR.
+   * This is needed because the `pull_request` context is not available for `dynamic` events.
+   */
+  CODE_SCANNING_REF = "CODE_SCANNING_REF",
+
   /**
    * `PersistedVersionInfo` for the CodeQL CLI, so later Actions steps can reuse it instead of
    * invoking `codeql version` again.
@@ -66,7 +88,7 @@ export enum EnvVar {
   LOG_VERSION_DEPRECATION = "CODEQL_ACTION_DID_LOG_VERSION_DEPRECATION",
 
   /** UUID representing the current job run. */
-  JOB_RUN_UUID = "JOB_RUN_UUID",
+  JOB_RUN_UUID = "CODEQL_ACTION_JOB_RUN_UUID",
 
   /** Status for the entire job, submitted to the status report in `init-post` */
   JOB_STATUS = "CODEQL_ACTION_JOB_STATUS",
@@ -83,6 +105,9 @@ export enum EnvVar {
   /** Whether to suppress the warning if the current CLI will soon be unsupported. */
   SUPPRESS_DEPRECATED_SOON_WARNING = "CODEQL_ACTION_SUPPRESS_DEPRECATED_SOON_WARNING",
 
+  /** Used to dictate or persist the temporary directory used by the CodeQL Action. */
+  TEMP = "CODEQL_ACTION_TEMP",
+
   /** Whether to disable uploading SARIF results or status reports to the GitHub API */
   TEST_MODE = "CODEQL_ACTION_TEST_MODE",
 
@@ -161,10 +186,134 @@ export enum EnvVar {
   RISK_ASSESSMENT_ID = "CODEQL_ACTION_RISK_ASSESSMENT_ID",
 }
 
-/** A wrapper around an environment, to allow abstracting away from `process.env` in tests. */
-export interface Env {
+/**
+ * Enumerates known GitHub Actions environment variables that we expect
+ * to be set in a GitHub Actions environment.
+ */
+export enum ActionsEnvVars {
+  GITHUB_ACTION_REPOSITORY = "GITHUB_ACTION_REPOSITORY",
+  GITHUB_API_URL = "GITHUB_API_URL",
+  GITHUB_EVENT_NAME = "GITHUB_EVENT_NAME",
+  GITHUB_EVENT_PATH = "GITHUB_EVENT_PATH",
+  GITHUB_JOB = "GITHUB_JOB",
+  GITHUB_REF = "GITHUB_REF",
+  GITHUB_REPOSITORY = "GITHUB_REPOSITORY",
+  GITHUB_RUN_ATTEMPT = "GITHUB_RUN_ATTEMPT",
+  GITHUB_RUN_ID = "GITHUB_RUN_ID",
+  GITHUB_SERVER_URL = "GITHUB_SERVER_URL",
+  GITHUB_SHA = "GITHUB_SHA",
+  GITHUB_WORKFLOW = "GITHUB_WORKFLOW",
+  GITHUB_WORKSPACE = "GITHUB_WORKSPACE",
+  RUNNER_ENVIRONMENT = "RUNNER_ENVIRONMENT",
+  RUNNER_NAME = "RUNNER_NAME",
+  RUNNER_OS = "RUNNER_OS",
+  RUNNER_TEMP = "RUNNER_TEMP",
+  RUNNER_TOOL_CACHE = "RUNNER_TOOL_CACHE",
+}
+
+/** A type representing all known environment variables. */
+export type KnownEnvVar = EnvVar | ActionsEnvVars | RegistryProxyVars;
+
+/**
+ * Gets an environment variable, but throws an error if it is not set.
+ */
+function getRequiredEnvVar(env: NodeJS.ProcessEnv, paramName: string): string {
+  const value = env[paramName];
+  if (value === undefined || value.length === 0) {
+    throw new Error(`${paramName} environment variable must be set`);
+  }
+  return value;
+}
+
+/**
+ * Get an environment parameter, but throw an error if it is not set.
+ *
+ * @deprecated Use `getRequired` of a `ReadOnlyEnv` or `Env` instance instead.
+ */
+export function getRequiredEnvParam(paramName: string): string {
+  return getRequiredEnvVar(process.env, paramName);
+}
+
+/**
+ * Gets an environment variable, but returns `undefined` if it is not set or empty.
+ */
+function getOptionalEnvVarFrom(
+  env: NodeJS.ProcessEnv,
+  paramName: string,
+): string | undefined {
+  const value = env[paramName];
+  if (value?.trim().length === 0) {
+    return undefined;
+  }
+  return value;
+}
+
+/**
+ * Get an environment variable, but return `undefined` if it is not set or empty.
+ *
+ * @deprecated Use `getOptional` of a `ReadOnlyEnv` or `Env` instance instead.
+ */
+export function getOptionalEnvVar(paramName: string): string | undefined {
+  return getOptionalEnvVarFrom(process.env, paramName);
+}
+
+/**
+ * An abstraction around read-only environment variables, to allow abstracting away from `process.env`
+ * in tests, while clearly signalling in regular code that the consumer of the `ReadOnlyEnv` instance
+ * will only read from it.
+ */
+export class ReadOnlyEnv<T extends string | undefined = string | undefined> {
+  constructor(protected readonly vars: Record<string, T>) {}
+
+  /** Clones the object while detaching the underlying environment from the original. */
+  public clone(): this {
+    return Object.create(this, { vars: { value: { ...this.vars } } }) as this;
+  }
+
+  /** Gets a copy of the underlying environment. */
+  public get(): Record<string, T> {
+    return { ...this.vars };
+  }
+
   /** Tries to get the value for `name` and throws if there isn't one. */
-  getRequired(name: string): string;
+  public getRequired(name: string): string {
+    return getRequiredEnvVar(this.vars, name);
+  }
+
   /** Gets the value for `name`, or `undefined` if it isn't set or empty. */
-  getOptional(name: string): string | undefined;
+  public getOptional(name: string): string | undefined {
+    return getOptionalEnvVarFrom(this.vars, name);
+  }
+
+  /** Gets the entries of the underlying `ProcessEnv`. */
+  public entries(): Array<[string, T]> {
+    return Object.entries(this.vars);
+  }
+}
+
+/**
+ * A wrapper around an environment, to allow abstracting away from `process.env` in tests.
+ * Use `ReadOnlyEnv` instead if you only plan to read from the environment.
+ * This type allows writing to the environment.
+ */
+export class Env<
+  T extends string | undefined = string | undefined,
+> extends ReadOnlyEnv<T> {
+  private changed: boolean = false;
+
+  /** Sets an environment variable. */
+  public set(name: string, value: T): void {
+    this.vars[name] = value;
+    this.changed = true;
+  }
+
+  /** Gets a value indicating whether `set` was called at least once. */
+  public hasChanged(): boolean {
+    return this.changed;
+  }
+}
+
+/** Gets an `Env` instance for `env`, which is `process.env` by default. */
+export function getEnv(env: NodeJS.ProcessEnv = process.env): Env {
+  return new Env(env);
 }
diff --git a/src/feature-flags.ts b/src/feature-flags.ts
index dcc5c9d7bd..b3107af962 100644
--- a/src/feature-flags.ts
+++ b/src/feature-flags.ts
@@ -70,9 +70,10 @@ export interface CodeQLDefaultVersionInfo {
  * Legacy features should end with `_enabled`.
  */
 export enum Feature {
+  /** Allows supported properties of configuration files to be merged. */
+  AllowMergeConfigFiles = "allow_merge_config_files",
   /** Controls whether we allow multiple values for the `analysis-kinds` input. */
   AllowMultipleAnalysisKinds = "allow_multiple_analysis_kinds",
-  AllowToolcacheInput = "allow_toolcache_input",
   CleanupTrapCaches = "cleanup_trap_caches",
   /** Whether to allow the `config-file` input to be specified via a repository property. */
   ConfigFileRepositoryProperty = "config_file_repository_property",
@@ -92,8 +93,6 @@ export enum Feature {
   ForceNightly = "force_nightly",
   IgnoreGeneratedFiles = "ignore_generated_files",
   JavaNetworkDebugging = "java_network_debugging",
-  /** Allow the new remote file address format. */
-  NewRemoteFileAddresses = "new_remote_file_addresses",
   OverlayAnalysis = "overlay_analysis",
   OverlayAnalysisCodeScanningCpp = "overlay_analysis_code_scanning_cpp",
   OverlayAnalysisCodeScanningCsharp = "overlay_analysis_code_scanning_csharp",
@@ -136,9 +135,13 @@ export enum Feature {
   /** Controls whether overlay build failures on the default branch are stored in the Actions cache. */
   OverlayAnalysisStatusSave = "overlay_analysis_status_save",
   QaTelemetryEnabled = "qa_telemetry_enabled",
+  /** Routes (some) API requests through the registry proxy. */
+  ProxyApiRequests = "proxy_api_requests",
   /** Note that this currently only disables baseline file coverage information. */
   SkipFileCoverageOnPrs = "skip_file_coverage_on_prs",
   StartProxyUseFeaturesRelease = "start_proxy_use_features_release",
+  /** Whether to allow the `tools` input to be specified via a repository property. */
+  ToolsRepositoryProperty = "tools_repository_property",
   UploadOverlayDbToApi = "upload_overlay_db_to_api",
   ValidateDbConfig = "validate_db_config",
 }
@@ -173,14 +176,14 @@ export type FeatureConfig = {
 };
 
 export const featureConfig = {
-  [Feature.AllowMultipleAnalysisKinds]: {
+  [Feature.AllowMergeConfigFiles]: {
     defaultValue: false,
-    envVar: "CODEQL_ACTION_ALLOW_MULTIPLE_ANALYSIS_KINDS",
+    envVar: "CODEQL_ACTION_ALLOW_MERGE_CONFIG_FILES",
     minimumVersion: undefined,
   },
-  [Feature.AllowToolcacheInput]: {
+  [Feature.AllowMultipleAnalysisKinds]: {
     defaultValue: false,
-    envVar: "CODEQL_ACTION_ALLOW_TOOLCACHE_INPUT",
+    envVar: "CODEQL_ACTION_ALLOW_MULTIPLE_ANALYSIS_KINDS",
     minimumVersion: undefined,
   },
   [Feature.CleanupTrapCaches]: {
@@ -257,11 +260,6 @@ export const featureConfig = {
     envVar: "CODEQL_ACTION_JAVA_NETWORK_DEBUGGING",
     minimumVersion: undefined,
   },
-  [Feature.NewRemoteFileAddresses]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_NEW_REMOTE_FILE_ADDRESSES",
-    minimumVersion: undefined,
-  },
   [Feature.OverlayAnalysis]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS",
@@ -382,6 +380,11 @@ export const featureConfig = {
     legacyApi: true,
     minimumVersion: undefined,
   },
+  [Feature.ProxyApiRequests]: {
+    defaultValue: false,
+    envVar: "CODEQL_ACTION_PROXY_API_REQUESTS",
+    minimumVersion: undefined,
+  },
   [Feature.SkipFileCoverageOnPrs]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_SKIP_FILE_COVERAGE_ON_PRS",
@@ -393,6 +396,11 @@ export const featureConfig = {
     envVar: "CODEQL_ACTION_START_PROXY_USE_FEATURES_RELEASE",
     minimumVersion: undefined,
   },
+  [Feature.ToolsRepositoryProperty]: {
+    defaultValue: false,
+    envVar: "CODEQL_ACTION_TOOLS_REPOSITORY_PROPERTY",
+    minimumVersion: undefined,
+  },
   [Feature.UploadOverlayDbToApi]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_UPLOAD_OVERLAY_DB_TO_API",
diff --git a/src/feature-flags/properties.test.ts b/src/feature-flags/properties.test.ts
index 66526b1fb2..d3094a8d1c 100644
--- a/src/feature-flags/properties.test.ts
+++ b/src/feature-flags/properties.test.ts
@@ -72,13 +72,17 @@ test.serial(
 );
 
 test.serial("loadPropertiesFromApi loads known properties", async (t) => {
+  const knownProperties = [
+    { property_name: "github-codeql-config-file", value: "owner/repo" },
+    { property_name: "github-codeql-extra-queries", value: "+queries" },
+    { property_name: "github-codeql-tools", value: "nightly" },
+  ];
   sinon.stub(api, "getRepositoryProperties").resolves({
     headers: {},
     status: 200,
     url: "",
     data: [
-      { property_name: "github-codeql-config-file", value: "owner/repo" },
-      { property_name: "github-codeql-extra-queries", value: "+queries" },
+      ...knownProperties,
       { property_name: "unknown-property", value: "something" },
     ] satisfies properties.GitHubPropertiesResponse,
   });
@@ -88,10 +92,12 @@ test.serial("loadPropertiesFromApi loads known properties", async (t) => {
     logger,
     mockRepositoryNwo,
   );
-  t.deepEqual(response, {
-    "github-codeql-config-file": "owner/repo",
-    "github-codeql-extra-queries": "+queries",
-  });
+  t.deepEqual(
+    response,
+    Object.fromEntries(
+      knownProperties.map((prop) => [prop.property_name, prop.value]),
+    ),
+  );
 });
 
 test.serial("loadPropertiesFromApi parses true boolean property", async (t) => {
diff --git a/src/feature-flags/properties.ts b/src/feature-flags/properties.ts
index e239c71947..4c888bd5ec 100644
--- a/src/feature-flags/properties.ts
+++ b/src/feature-flags/properties.ts
@@ -1,7 +1,10 @@
+import * as github from "@actions/github";
+
 import { isDynamicWorkflow } from "../actions-util";
 import { getRepositoryProperties } from "../api-client";
 import { Logger } from "../logging";
 import { RepositoryNwo } from "../repository";
+import { Failure, getErrorMessage, Result, Success } from "../util";
 
 /** The common prefix that we expect all of our repository properties to have. */
 export const GITHUB_CODEQL_PROPERTY_PREFIX = "github-codeql-";
@@ -14,6 +17,7 @@ export enum RepositoryPropertyName {
   DISABLE_OVERLAY = "github-codeql-disable-overlay",
   EXTRA_QUERIES = "github-codeql-extra-queries",
   FILE_COVERAGE_ON_PRS = "github-codeql-file-coverage-on-prs",
+  TOOLS = "github-codeql-tools",
 }
 
 /** Parsed types of the known repository properties. */
@@ -22,6 +26,7 @@ export type AllRepositoryProperties = {
   [RepositoryPropertyName.DISABLE_OVERLAY]: boolean;
   [RepositoryPropertyName.EXTRA_QUERIES]: string;
   [RepositoryPropertyName.FILE_COVERAGE_ON_PRS]: boolean;
+  [RepositoryPropertyName.TOOLS]: string;
 };
 
 /** Parsed repository properties. */
@@ -33,6 +38,7 @@ export type RepositoryPropertyApiType = {
   [RepositoryPropertyName.DISABLE_OVERLAY]: string;
   [RepositoryPropertyName.EXTRA_QUERIES]: string;
   [RepositoryPropertyName.FILE_COVERAGE_ON_PRS]: string;
+  [RepositoryPropertyName.TOOLS]: string;
 };
 
 /** The type of functions which take the `value` from the API and try to convert it to the type we want. */
@@ -81,6 +87,7 @@ const repositoryPropertyParsers: {
   [RepositoryPropertyName.DISABLE_OVERLAY]: booleanProperty,
   [RepositoryPropertyName.EXTRA_QUERIES]: stringProperty,
   [RepositoryPropertyName.FILE_COVERAGE_ON_PRS]: booleanProperty,
+  [RepositoryPropertyName.TOOLS]: stringProperty,
 };
 
 /**
@@ -230,3 +237,35 @@ const KNOWN_REPOSITORY_PROPERTY_NAMES = new Set<string>(
 function isKnownPropertyName(name: string): name is RepositoryPropertyName {
   return KNOWN_REPOSITORY_PROPERTY_NAMES.has(name);
 }
+
+/**
+ * Loads [repository properties](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization) if applicable.
+ */
+export async function loadRepositoryProperties(
+  repositoryNwo: RepositoryNwo,
+  logger: Logger,
+): Promise<Result<RepositoryProperties, unknown>> {
+  // See if we can skip loading repository properties early. In particular,
+  // repositories owned by users cannot have repository properties, so we can
+  // skip the API call entirely in that case.
+  const repositoryOwnerType = github.context.payload.repository?.owner.type;
+  logger.debug(
+    `Repository owner type is '${repositoryOwnerType ?? "unknown"}'.`,
+  );
+  if (repositoryOwnerType === "User") {
+    logger.debug(
+      "Skipping loading repository properties because the repository is owned by a user and " +
+        "therefore cannot have repository properties.",
+    );
+    return new Success({});
+  }
+
+  try {
+    return new Success(await loadPropertiesFromApi(logger, repositoryNwo));
+  } catch (error) {
+    logger.warning(
+      `Failed to load repository properties: ${getErrorMessage(error)}`,
+    );
+    return new Failure(error);
+  }
+}
diff --git a/src/init-action.ts b/src/init-action.ts
index acaba701be..00143df427 100644
--- a/src/init-action.ts
+++ b/src/init-action.ts
@@ -2,10 +2,8 @@ import * as fs from "fs";
 import * as path from "path";
 
 import * as core from "@actions/core";
-import * as github from "@actions/github";
 import * as io from "@actions/io";
 import * as semver from "semver";
-import { v4 as uuidV4 } from "uuid";
 
 import { Action, ActionState, runInActions } from "./action-common";
 import {
@@ -26,6 +24,7 @@ import {
 } from "./caching-utils";
 import { CodeQL } from "./codeql";
 import { getConfigFileInput } from "./config/file";
+import { ComputedInput, getToolsInput } from "./config/inputs";
 import * as configUtils from "./config-utils";
 import {
   DependencyCacheRestoreStatusReport,
@@ -41,10 +40,7 @@ import {
 } from "./diagnostics";
 import { EnvVar } from "./environment";
 import { Feature, FeatureEnablement, initFeatures } from "./feature-flags";
-import {
-  loadPropertiesFromApi,
-  RepositoryProperties,
-} from "./feature-flags/properties";
+import { loadRepositoryProperties } from "./feature-flags/properties";
 import {
   checkInstallPython311,
   checkPacksForOverlayCompatibility,
@@ -62,7 +58,7 @@ import {
   OverlayBaseDatabaseDownloadStats,
 } from "./overlay/caching";
 import { OverlayDatabaseMode } from "./overlay/overlay-database-mode";
-import { getRepositoryNwo, RepositoryNwo } from "./repository";
+import { getRepositoryNwo } from "./repository";
 import { ToolsSource } from "./setup-codeql";
 import {
   ActionName,
@@ -74,7 +70,6 @@ import {
   getActionsStatus,
   sendStatusReport,
 } from "./status-report";
-import { ZstdAvailability } from "./tar";
 import { ToolsDownloadStatusReport } from "./tools-download";
 import { ToolsFeature } from "./tools-features";
 import { getCombinedTracerConfig } from "./tracer-config";
@@ -94,10 +89,7 @@ import {
   checkActionVersion,
   getErrorMessage,
   BuildMode,
-  Result,
   getOptionalEnvVar,
-  Success,
-  Failure,
 } from "./util";
 import { checkWorkflow } from "./workflow";
 
@@ -137,6 +129,7 @@ async function sendCompletedStatusReport(
   startedAt: Date,
   config: configUtils.Config | undefined,
   configFile: string | undefined,
+  toolsInput: ComputedInput | undefined,
   toolsDownloadStatusReport: ToolsDownloadStatusReport | undefined,
   toolsFeatureFlagsValid: boolean | undefined,
   toolsSource: ToolsSource,
@@ -165,12 +158,16 @@ async function sendCompletedStatusReport(
 
   const initStatusReport: InitStatusReport = {
     ...statusReportBase,
-    tools_input: getOptionalInput("tools") || "",
+    tools_input: toolsInput?.value || "",
     tools_resolved_version: toolsVersion,
     tools_source: toolsSource || ToolsSource.Unknown,
     workflow_languages: workflowLanguages || "",
   };
 
+  if (toolsInput !== undefined) {
+    initStatusReport.computed_inputs.tools = toolsInput;
+  }
+
   const initToolsDownloadFields: InitToolsDownloadFields = {};
 
   if (toolsDownloadStatusReport?.downloadDurationMs !== undefined) {
@@ -203,7 +200,9 @@ async function sendCompletedStatusReport(
   }
 }
 
-async function run(actionState: ActionState<["Logger", "Env", "Actions"]>) {
+async function run(
+  actionState: ActionState<["Base", "Logger", "Env", "Actions"]>,
+) {
   // To capture errors appropriately, keep as much code within the try-catch as
   // possible, and only use safe functions outside.
 
@@ -216,11 +215,11 @@ async function run(actionState: ActionState<["Logger", "Env", "Actions"]>) {
   let codeql: CodeQL;
   let features: FeatureEnablement;
   let sourceRoot: string;
+  let toolsInput: ComputedInput | undefined;
   let toolsDownloadStatusReport: ToolsDownloadStatusReport | undefined;
   let toolsFeatureFlagsValid: boolean | undefined;
   let toolsSource: ToolsSource;
   let toolsVersion: string;
-  let zstdAvailability: ZstdAvailability | undefined;
 
   try {
     initializeEnvironment(getActionVersion());
@@ -255,19 +254,8 @@ async function run(actionState: ActionState<["Logger", "Env", "Actions"]>) {
     );
     const repositoryProperties = repositoryPropertiesResult.orElse({});
 
-    // Create a unique identifier for this run.
-    const jobRunUuid = uuidV4();
-    logger.info(`Job run UUID is ${jobRunUuid}.`);
-    core.exportVariable(EnvVar.JOB_RUN_UUID, jobRunUuid);
-
     core.exportVariable(EnvVar.INIT_ACTION_HAS_RUN, "true");
 
-    const actionStateWithFeatures = { ...actionState, features };
-    configFile = await getConfigFileInput(
-      actionStateWithFeatures,
-      repositoryProperties,
-    );
-
     // path.resolve() respects the intended semantics of source-root. If
     // source-root is relative, it is relative to the GITHUB_WORKSPACE. If
     // source-root is absolute, it is used as given.
@@ -290,6 +278,14 @@ async function run(actionState: ActionState<["Logger", "Env", "Actions"]>) {
       );
     }
 
+    // Compute the value of the `config-file` input.
+    const actionStateWithFeatures = { ...actionState, features };
+    configFile = await getConfigFileInput(
+      actionStateWithFeatures,
+      repositoryProperties,
+      analysisKinds,
+    );
+
     // Send a status report indicating that an analysis is starting.
     await sendStartingStatusReport(startedAt, { analysisKinds }, logger);
 
@@ -300,6 +296,12 @@ async function run(actionState: ActionState<["Logger", "Env", "Actions"]>) {
       );
     }
 
+    // Get the computed `tools` input.
+    toolsInput = await getToolsInput(
+      actionStateWithFeatures,
+      repositoryProperties,
+    );
+
     const codeQLDefaultVersionInfo =
       await features.getEnabledDefaultCliVersions(gitHubVersion.type);
     toolsFeatureFlagsValid = codeQLDefaultVersionInfo.toolsFeatureFlagsValid;
@@ -310,7 +312,7 @@ async function run(actionState: ActionState<["Logger", "Env", "Actions"]>) {
       analysisKinds?.length === 1 &&
       analysisKinds[0] === AnalysisKind.CodeScanning;
     const initCodeQLResult = await initCodeQL(
-      getOptionalInput("tools"),
+      toolsInput?.value,
       apiDetails,
       getTemporaryDirectory(),
       gitHubVersion.type,
@@ -324,7 +326,6 @@ async function run(actionState: ActionState<["Logger", "Env", "Actions"]>) {
     toolsDownloadStatusReport = initCodeQLResult.toolsDownloadStatusReport;
     toolsVersion = initCodeQLResult.toolsVersion;
     toolsSource = initCodeQLResult.toolsSource;
-    zstdAvailability = initCodeQLResult.zstdAvailability;
 
     // Check the workflow for problems. If there are any problems, they are reported
     // to the workflow log. No exceptions are thrown.
@@ -495,22 +496,6 @@ async function run(actionState: ActionState<["Logger", "Env", "Actions"]>) {
       cleanupDatabaseClusterDirectory(config, logger);
     }
 
-    if (zstdAvailability) {
-      await recordZstdAvailability(config, zstdAvailability);
-    }
-
-    // Log CodeQL download telemetry, if appropriate
-    if (toolsDownloadStatusReport) {
-      addNoLanguageDiagnostic(
-        config,
-        makeTelemetryDiagnostic(
-          "codeql-action/bundle-download-telemetry",
-          "CodeQL bundle download telemetry",
-          toolsDownloadStatusReport,
-        ),
-      );
-    }
-
     // Forward Go flags
     const goFlags = process.env["GOFLAGS"];
     if (goFlags) {
@@ -776,6 +761,7 @@ async function run(actionState: ActionState<["Logger", "Env", "Actions"]>) {
       startedAt,
       config,
       undefined, // We only report config info on success.
+      toolsInput,
       toolsDownloadStatusReport,
       toolsFeatureFlagsValid,
       toolsSource,
@@ -793,6 +779,7 @@ async function run(actionState: ActionState<["Logger", "Env", "Actions"]>) {
     startedAt,
     config,
     configFile,
+    toolsInput,
     toolsDownloadStatusReport,
     toolsFeatureFlagsValid,
     toolsSource,
@@ -803,52 +790,6 @@ async function run(actionState: ActionState<["Logger", "Env", "Actions"]>) {
   );
 }
 
-/**
- * Loads [repository properties](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization) if applicable.
- */
-async function loadRepositoryProperties(
-  repositoryNwo: RepositoryNwo,
-  logger: Logger,
-): Promise<Result<RepositoryProperties, unknown>> {
-  // See if we can skip loading repository properties early. In particular,
-  // repositories owned by users cannot have repository properties, so we can
-  // skip the API call entirely in that case.
-  const repositoryOwnerType = github.context.payload.repository?.owner.type;
-  logger.debug(
-    `Repository owner type is '${repositoryOwnerType ?? "unknown"}'.`,
-  );
-  if (repositoryOwnerType === "User") {
-    logger.debug(
-      "Skipping loading repository properties because the repository is owned by a user and " +
-        "therefore cannot have repository properties.",
-    );
-    return new Success({});
-  }
-
-  try {
-    return new Success(await loadPropertiesFromApi(logger, repositoryNwo));
-  } catch (error) {
-    logger.warning(
-      `Failed to load repository properties: ${getErrorMessage(error)}`,
-    );
-    return new Failure(error);
-  }
-}
-
-async function recordZstdAvailability(
-  config: configUtils.Config,
-  zstdAvailability: ZstdAvailability,
-) {
-  addNoLanguageDiagnostic(
-    config,
-    makeTelemetryDiagnostic(
-      "codeql-action/zstd-availability",
-      "Zstandard availability",
-      zstdAvailability,
-    ),
-  );
-}
-
 /** Defines the `init` Action. */
 const init: Action = {
   name: ActionName.Init,
diff --git a/src/init.test.ts b/src/init.test.ts
index 88ad0c9b18..1f0d2c701c 100644
--- a/src/init.test.ts
+++ b/src/init.test.ts
@@ -8,6 +8,7 @@ import * as sinon from "sinon";
 
 import * as actionsUtil from "./actions-util";
 import { createStubCodeQL } from "./codeql";
+import { ActionsEnvVars } from "./environment";
 import { Feature } from "./feature-flags";
 import {
   checkPacksForOverlayCompatibility,
@@ -84,7 +85,7 @@ for (const { runnerEnv, ErrorConstructor, message } of [
     `cleanupDatabaseClusterDirectory throws a ${ErrorConstructor.name} when cleanup fails on ${runnerEnv} runner`,
     async (t) => {
       await withTmpDir(async (tmpDir: string) => {
-        process.env["RUNNER_ENVIRONMENT"] = runnerEnv;
+        process.env[ActionsEnvVars.RUNNER_ENVIRONMENT] = runnerEnv;
 
         const dbLocation = path.resolve(tmpDir, "dbs");
         fs.mkdirSync(dbLocation, { recursive: true });
diff --git a/src/init.ts b/src/init.ts
index 53efbe99a3..dee62913c2 100644
--- a/src/init.ts
+++ b/src/init.ts
@@ -30,7 +30,6 @@ import {
 import { BuiltInLanguage, Language } from "./languages";
 import { Logger, withGroupAsync } from "./logging";
 import { ToolsSource } from "./setup-codeql";
-import { ZstdAvailability } from "./tar";
 import { ToolsDownloadStatusReport } from "./tools-download";
 import * as util from "./util";
 
@@ -49,27 +48,21 @@ export async function initCodeQL(
   toolsDownloadStatusReport?: ToolsDownloadStatusReport;
   toolsSource: ToolsSource;
   toolsVersion: string;
-  zstdAvailability: ZstdAvailability;
 }> {
   logger.startGroup("Setup CodeQL tools");
-  const {
-    codeql,
-    toolsDownloadStatusReport,
-    toolsSource,
-    toolsVersion,
-    zstdAvailability,
-  } = await setupCodeQL(
-    toolsInput,
-    apiDetails,
-    tempDir,
-    variant,
-    defaultCliVersion,
-    rawLanguages,
-    useOverlayAwareDefaultCliVersion,
-    features,
-    logger,
-    true,
-  );
+  const { codeql, toolsDownloadStatusReport, toolsSource, toolsVersion } =
+    await setupCodeQL(
+      toolsInput,
+      apiDetails,
+      tempDir,
+      variant,
+      defaultCliVersion,
+      rawLanguages,
+      useOverlayAwareDefaultCliVersion,
+      features,
+      logger,
+      true,
+    );
   await codeql.printVersion();
   logger.endGroup();
   return {
@@ -77,7 +70,6 @@ export async function initCodeQL(
     toolsDownloadStatusReport,
     toolsSource,
     toolsVersion,
-    zstdAvailability,
   };
 }
 
diff --git a/src/json/index.test.ts b/src/json/index.test.ts
index 825bbc0e70..80edbedece 100644
--- a/src/json/index.test.ts
+++ b/src/json/index.test.ts
@@ -10,8 +10,8 @@ const testSchema = {
   requiredKey: json.string,
 };
 
-const optionalSchema = {
-  optionalKey: json.optional(json.string),
+const optionalOrNullSchema = {
+  optionalKey: json.optionalOrNull(json.string),
 };
 
 test("validateSchema - required properties are required", async (t) => {
@@ -28,13 +28,36 @@ test("validateSchema - required properties are required", async (t) => {
   t.true(json.validateSchema(testSchema, { requiredKey: "foo" }));
 });
 
-test("validateSchema - optional properties are optional", async (t) => {
+test("validateSchema - optionalOrNullSchema properties are optional or null", async (t) => {
   // Optional fields may be absent
+  t.true(json.validateSchema(optionalOrNullSchema, {}));
+  t.true(json.validateSchema(optionalOrNullSchema, { optionalKey: undefined }));
+  t.true(json.validateSchema(optionalOrNullSchema, { optionalKey: null }));
+
+  // But, if present, should have the expected type
+  t.false(json.validateSchema(optionalOrNullSchema, { optionalKey: 0 }));
+  t.false(json.validateSchema(optionalOrNullSchema, { optionalKey: 123 }));
+  t.false(json.validateSchema(optionalOrNullSchema, { optionalKey: false }));
+  t.false(json.validateSchema(optionalOrNullSchema, { optionalKey: true }));
+  t.false(json.validateSchema(optionalOrNullSchema, { optionalKey: [] }));
+  t.false(json.validateSchema(optionalOrNullSchema, { optionalKey: {} }));
+  t.true(json.validateSchema(optionalOrNullSchema, { optionalKey: "" }));
+  t.true(json.validateSchema(optionalOrNullSchema, { optionalKey: "foo" }));
+});
+
+const optionalSchema = {
+  optionalKey: json.optional(json.string),
+};
+
+test("validateSchema - optional properties are optional", async (t) => {
+  // Optional fields may be absent or explicitly undefined
   t.true(json.validateSchema(optionalSchema, {}));
   t.true(json.validateSchema(optionalSchema, { optionalKey: undefined }));
-  t.true(json.validateSchema(optionalSchema, { optionalKey: null }));
 
-  // But, if present, should have the expected type
+  // But should reject null
+  t.false(json.validateSchema(optionalSchema, { optionalKey: null }));
+
+  // And, if present, should have the expected type
   t.false(json.validateSchema(optionalSchema, { optionalKey: 0 }));
   t.false(json.validateSchema(optionalSchema, { optionalKey: 123 }));
   t.false(json.validateSchema(optionalSchema, { optionalKey: false }));
@@ -44,3 +67,76 @@ test("validateSchema - optional properties are optional", async (t) => {
   t.true(json.validateSchema(optionalSchema, { optionalKey: "" }));
   t.true(json.validateSchema(optionalSchema, { optionalKey: "foo" }));
 });
+
+const arraySchema = {
+  arrayKey: json.array(json.number),
+};
+
+test("validateSchema - validates arrays", async (t) => {
+  // Arrays of numeric elements are accepted.
+  t.true(json.validateSchema(arraySchema, { arrayKey: [] }));
+  t.true(json.validateSchema(arraySchema, { arrayKey: [4] }));
+  t.true(json.validateSchema(arraySchema, { arrayKey: [4, 8] }));
+  t.true(json.validateSchema(arraySchema, { arrayKey: [4, 8, 15] }));
+
+  // Other array elements are not accepted.
+  t.false(json.validateSchema(arraySchema, { arrayKey: [4, 8, 15, "bar"] }));
+  t.false(json.validateSchema(arraySchema, { arrayKey: [4, 8, undefined] }));
+  t.false(json.validateSchema(arraySchema, { arrayKey: [4, 8, 15, null] }));
+});
+
+const objectSchema = {
+  objectKey: json.object(arraySchema),
+};
+
+test("validateSchema - validates objects", async (t) => {
+  // Objects of the given schema are accepted.
+  t.true(json.validateSchema(objectSchema, { objectKey: { arrayKey: [] } }));
+  t.true(json.validateSchema(objectSchema, { objectKey: { arrayKey: [4] } }));
+
+  // Other values are not accepted.
+  t.false(json.validateSchema(objectSchema, {}));
+  t.false(json.validateSchema(objectSchema, { objectKey: [] }));
+  t.false(json.validateSchema(objectSchema, { objectKey: undefined }));
+  t.false(json.validateSchema(objectSchema, { objectKey: null }));
+  t.false(json.validateSchema(objectSchema, { objectKey: "foo" }));
+  t.false(json.validateSchema(objectSchema, { objectKey: 123 }));
+});
+
+const checkSchemaTestSchema = {
+  rootKey: json.object(objectSchema),
+};
+
+test("checkSchema - reports unknown keys", async (t) => {
+  const result = json.checkSchema(checkSchemaTestSchema, {
+    rootKey: {
+      objectKey: {
+        arrayKey: [],
+      },
+      nestedExtraKey: "foo",
+    },
+    extraKey: "bar",
+  });
+
+  t.true(result.valid);
+  t.deepEqual(
+    result.unknownKeys.sort(),
+    [".extraKey", ".rootKey.nestedExtraKey"].sort(),
+  );
+});
+
+test("checkSchema - reports invalid keys", async (t) => {
+  const result = json.checkSchema(checkSchemaTestSchema, {
+    rootKey: {
+      objectKey: {
+        arrayKey: ["foo"],
+      },
+    },
+  });
+
+  t.false(result.valid);
+  t.deepEqual(
+    result.invalidKeys.sort(),
+    [".rootKey.objectKey.arrayKey[0]"].sort(),
+  );
+});
diff --git a/src/json/index.ts b/src/json/index.ts
index 8a1b60a178..d8764ec478 100644
--- a/src/json/index.ts
+++ b/src/json/index.ts
@@ -30,6 +30,16 @@ export function isString(value: unknown): value is string {
   return typeof value === "string";
 }
 
+/** Asserts that `value` is a number. */
+export function isNumber(value: unknown): value is number {
+  return typeof value === "number";
+}
+
+/** Asserts that `value` is a boolean. */
+export function isBoolean(value: unknown): value is boolean {
+  return typeof value === "boolean";
+}
+
 /** Asserts that `value` is either a string or undefined. */
 export function isStringOrUndefined(
   value: unknown,
@@ -43,28 +53,146 @@ export function isStringOrUndefined(
  */
 export type Validator<T> = {
   validate: (val: unknown) => val is T;
+  check: (
+    val: unknown,
+    opts: CheckSchemaOptions,
+    path: string,
+  ) => CheckSchemaResult;
   required: boolean;
 };
 
+function defaultCheck(
+  validate: (val: unknown) => val is any,
+): (arg: unknown) => CheckSchemaResult {
+  return (arg) => ({ unknownKeys: [], invalidKeys: [], valid: validate(arg) });
+}
+
+function makeValidator<T>(validate: (arg: unknown) => arg is T) {
+  return {
+    validate,
+    check: defaultCheck(validate),
+    required: true,
+  } as const satisfies Validator<T>;
+}
+
 /** Extracts `T` from `Validator<T>`. */
 export type UnwrapValidator<V> = V extends Validator<infer A> ? A : never;
 
 /** A validator for string fields in schemas. */
-export const string = {
-  validate: isString,
-  required: true,
-} as const satisfies Validator<string>;
+export const string = makeValidator(isString);
 
-/** Transforms a validator to be optional. */
-export function optional<T>(validator: Validator<T>) {
+/** A validator for number fields in schemas. */
+export const number = makeValidator(isNumber);
+
+/** A validator for boolean fields in schemas. */
+export const boolean = makeValidator(isBoolean);
+
+/** A validator for arrays. */
+export function array<T>(validator: Validator<T>) {
+  const validate = (val: unknown) => {
+    return isArray(val) && val.every((e) => validator.validate(e));
+  };
+  return {
+    validate,
+    check: (val: unknown, opts: CheckSchemaOptions, path: string) => {
+      const result: CheckSchemaResult = successfulCheckSchema();
+
+      // The value must be an array.
+      if (!isArray(val)) {
+        result.valid = false;
+        return result;
+      }
+
+      // Validate all elements of the array.
+      let index = 0;
+      for (const e of val) {
+        const elementPath = `${path}[${index}]`;
+        const eResult = validator.check(e, opts, `${elementPath}`);
+
+        result.invalidKeys.push(...eResult.invalidKeys);
+        result.unknownKeys.push(...eResult.unknownKeys);
+        index++;
+
+        if (!eResult.valid) {
+          result.valid = false;
+
+          // Add the element path to `invalidKeys` if we didn't get
+          // any more specific ones from the element validator.
+          if (eResult.invalidKeys.length === 0) {
+            result.invalidKeys.push(elementPath);
+          }
+
+          if (opts.failFast) {
+            return result;
+          }
+
+          continue;
+        }
+      }
+
+      return result;
+    },
+    required: true,
+  } as const satisfies Validator<T[]>;
+}
+
+/** A validator for objects. */
+export function object<
+  S extends Schema,
+  T extends UnvalidatedObject<any> = FromSchema<S>,
+>(schema: S) {
+  return {
+    validate: (val: unknown) => {
+      return isObject(val) && validateSchema<S, T>(schema, val);
+    },
+    check: (val, opts, path) => {
+      if (!isObject(val)) {
+        return invalidCheckSchema();
+      }
+      return checkSchema(schema, val, opts, path);
+    },
+    required: true,
+  } as const satisfies Validator<T>;
+}
+
+/**
+ * Transforms a validator to be optional, accepting `undefined` or `null` for an
+ * absent value.
+ */
+export function optionalOrNull<T>(validator: Validator<T>) {
   return {
     validate: (val: unknown) => {
       return val === undefined || val === null || validator.validate(val);
     },
+    check: (val, opts, path) => {
+      if (val === undefined || val === null) {
+        return successfulCheckSchema();
+      }
+      return validator.check(val, opts, path);
+    },
     required: false,
   } as const satisfies Validator<T | undefined | null>;
 }
 
+/**
+ * Transforms a validator to be optional, accepting `undefined` for an absent
+ * value but, unlike `optionalOrNull`, rejecting `null`.
+ */
+export function optional<T>(validator: Validator<T>) {
+  return {
+    validate: (val: unknown): val is T | undefined => {
+      return val === undefined || validator.validate(val);
+    },
+    check: (val, opts, path) => {
+      if (val === undefined) {
+        return successfulCheckSchema();
+      }
+      return validator.check(val, opts, path);
+    },
+    required: false,
+  } as const satisfies Validator<T | undefined>;
+}
+
 /** Represents an arbitrary object schema. */
 export type Schema = Record<string, Validator<any>>;
 
@@ -90,28 +218,150 @@ export type FromSchema<S extends Schema> = {
  * @param obj The object to validate.
  * @returns Asserts that `obj` is of the `schema`'s type if validation is successful.
  */
-export function validateSchema<S extends Schema>(
+export function validateSchema<
+  S extends Schema,
+  T extends UnvalidatedObject<any> = FromSchema<S>,
+>(schema: S, obj: UnvalidatedObject<any>): obj is T {
+  const result = checkSchema(schema, obj, { failFast: true });
+  return result.valid;
+}
+
+/**
+ * Validates that `arr` is an array whose elements satisfy at least `elementSchema`.
+ * Additional keys are accepted in each element.
+ *
+ * @param elementSchema The schema to validate the elements against.
+ * @param arr The array to validate.
+ * @returns Asserts that `arr` has elements of `schema`'s type if validation is successful.
+ */
+export function validateArray<
+  S extends Schema,
+  T extends UnvalidatedArray = Array<FromSchema<S>>,
+>(elementSchema: S, arr: UnvalidatedArray): arr is T {
+  const elementValidator = object(elementSchema);
+
+  return array(elementValidator).validate(arr);
+}
+
+export interface CheckSchemaOptions {
+  /** Whether to stop validation after the first error. */
+  failFast?: boolean;
+}
+
+export interface CheckSchemaResult {
+  /** Whether the `obj` satisfies the schema. */
+  valid: boolean;
+  /** Unknown keys that were found during validation. */
+  unknownKeys: string[];
+  /** Known keys that failed validation. */
+  invalidKeys: string[];
+}
+
+/**
+ * Convenience function to produce a `CheckSchemaResult` where `valid: true`.
+ */
+function successfulCheckSchema(): CheckSchemaResult {
+  return {
+    valid: true,
+    unknownKeys: [],
+    invalidKeys: [],
+  };
+}
+
+/**
+ * Convenience function to produce a `CheckSchemaResult` where `valid: false`.
+ */
+function invalidCheckSchema(): CheckSchemaResult {
+  return {
+    valid: false,
+    unknownKeys: [],
+    invalidKeys: [],
+  };
+}
+
+export function checkSchema<S extends Schema>(
   schema: S,
   obj: UnvalidatedObject<any>,
-): obj is FromSchema<S> {
+  options: CheckSchemaOptions = {},
+  path: string = "",
+): CheckSchemaResult {
+  const result: CheckSchemaResult = successfulCheckSchema();
+
+  // Track the set of input keys. We remove keys from this set as we recognise them
+  // during validation.
+  const inputKeys = new Set(Object.keys(obj));
+
+  // Track keys that have failed validation, starting with the empty set.
+  const invalidKeys = new Set();
+
+  // Loop through all keys in the object schema and validate that the given object
+  // satisfies the schema key.
   for (const [key, validator] of Object.entries(schema)) {
     const hasKey = key in obj;
 
+    // Remove key from set of unrecognised keys.
+    inputKeys.delete(key);
+
+    // Add the key to the set of invalid keys. We remove it later once
+    // it passes validation.
+    invalidKeys.add(key);
+
     // If the property is required, but absent, fail.
     if (validator.required && !hasKey) {
-      return false;
+      result.valid = false;
+
+      if (options.failFast) {
+        break;
+      }
+      continue;
     }
 
     // If the property is required, but undefined or null, fail.
     if (validator.required && (obj[key] === undefined || obj[key] === null)) {
-      return false;
+      result.valid = false;
+
+      if (options.failFast) {
+        break;
+      }
+      continue;
     }
 
     // If the property is present, validate it.
-    if (hasKey && !validator.validate(obj[key])) {
-      return false;
+    if (hasKey) {
+      const checkResult = validator.check(obj[key], options, `${path}.${key}`);
+
+      result.unknownKeys.push(...checkResult.unknownKeys);
+      result.invalidKeys.push(...checkResult.invalidKeys);
+
+      // If we have invalid keys from the validator, then that means that
+      // we have a more specific key than `key`. Remove `key` from the results.
+      if (checkResult.invalidKeys.length > 0) {
+        invalidKeys.delete(key);
+      }
+
+      if (!checkResult.valid) {
+        result.valid = false;
+
+        if (options.failFast) {
+          break;
+        }
+        continue;
+      }
     }
+
+    // If we reach this point, the key has been successfully validated.
+    invalidKeys.delete(key);
+  }
+
+  // If there are any remaining keys in `inputKeys`, add them to `unknownKeys`.
+  for (const remainingKey of inputKeys) {
+    result.unknownKeys.push(`${path}.${remainingKey}`);
+  }
+
+  // If there are any remaining keys in `invalidKeys`, add them to the result.
+  for (const invalidKey of invalidKeys) {
+    result.invalidKeys.push(`${path}.${invalidKey}`);
   }
 
-  return true;
+  return result;
 }
diff --git a/src/setup-codeql-action.ts b/src/setup-codeql-action.ts
index a6b5f83f5e..7873449f9c 100644
--- a/src/setup-codeql-action.ts
+++ b/src/setup-codeql-action.ts
@@ -1,5 +1,4 @@
 import * as core from "@actions/core";
-import { v4 as uuidV4 } from "uuid";
 
 import { Action, ActionState, runInActions } from "./action-common";
 import {
@@ -11,9 +10,11 @@ import {
 import { AnalysisKind, getAnalysisKinds } from "./analyses";
 import { getGitHubVersion } from "./api-client";
 import { CodeQL } from "./codeql";
+import { ComputedInput, getToolsInput } from "./config/inputs";
 import { getRawLanguagesNoAutodetect } from "./config-utils";
 import { EnvVar } from "./environment";
 import { initFeatures } from "./feature-flags";
+import { loadRepositoryProperties } from "./feature-flags/properties";
 import { initCodeQL } from "./init";
 import { Logger } from "./logging";
 import { getRepositoryNwo } from "./repository";
@@ -43,6 +44,7 @@ import {
  */
 async function sendCompletedStatusReport(
   startedAt: Date,
+  toolsInput: ComputedInput | undefined,
   toolsDownloadStatusReport: ToolsDownloadStatusReport | undefined,
   toolsFeatureFlagsValid: boolean | undefined,
   toolsSource: ToolsSource,
@@ -67,12 +69,16 @@ async function sendCompletedStatusReport(
 
   const initStatusReport: InitStatusReport = {
     ...statusReportBase,
-    tools_input: getOptionalInput("tools") || "",
+    tools_input: toolsInput?.value || "",
     tools_resolved_version: toolsVersion,
     tools_source: toolsSource || ToolsSource.Unknown,
     workflow_languages: "",
   };
 
+  if (toolsInput !== undefined) {
+    initStatusReport.computed_inputs.tools = toolsInput;
+  }
+
   const initToolsDownloadFields: InitToolsDownloadFields = {};
 
   if (toolsDownloadStatusReport?.downloadDurationMs !== undefined) {
@@ -87,14 +93,15 @@ async function sendCompletedStatusReport(
 }
 
 /** The main behaviour of this action. */
-async function run({
-  startedAt,
-  logger,
-}: ActionState<["Logger"]>): Promise<void> {
+async function run(
+  actionState: ActionState<["Base", "Logger", "Env", "Actions"]>,
+): Promise<void> {
   // To capture errors appropriately, keep as much code within the try-catch as
   // possible, and only use safe functions outside.
+  const { logger, startedAt } = actionState;
 
   let codeql: CodeQL;
+  let toolsInput: ComputedInput | undefined;
   let toolsDownloadStatusReport: ToolsDownloadStatusReport | undefined;
   let toolsFeatureFlagsValid: boolean | undefined;
   let toolsSource: ToolsSource;
@@ -123,9 +130,14 @@ async function run({
       logger,
     );
 
-    const jobRunUuid = uuidV4();
-    logger.info(`Job run UUID is ${jobRunUuid}.`);
-    core.exportVariable(EnvVar.JOB_RUN_UUID, jobRunUuid);
+    // Fetch the values of known repository properties that affect us.
+    const repositoryPropertiesResult = await loadRepositoryProperties(
+      repositoryNwo,
+      logger,
+    );
+    const repositoryProperties = repositoryPropertiesResult.orElse({});
+
+    const actionStateWithFeatures = { ...actionState, features };
 
     const statusReportBase = await createStatusReportBase(
       ActionName.SetupCodeQL,
@@ -138,6 +150,13 @@ async function run({
     if (statusReportBase !== undefined) {
       await sendStatusReport(statusReportBase);
     }
+
+    // Get the computed `tools` input.
+    toolsInput = await getToolsInput(
+      actionStateWithFeatures,
+      repositoryProperties,
+    );
+
     const codeQLDefaultVersionInfo =
       await features.getEnabledDefaultCliVersions(gitHubVersion.type);
     toolsFeatureFlagsValid = codeQLDefaultVersionInfo.toolsFeatureFlagsValid;
@@ -146,7 +165,7 @@ async function run({
     );
     const analysisKinds = await getAnalysisKinds(logger, features);
     const initCodeQLResult = await initCodeQL(
-      getOptionalInput("tools"),
+      toolsInput?.value,
       apiDetails,
       getTemporaryDirectory(),
       gitHubVersion.type,
@@ -187,6 +206,7 @@ async function run({
 
   await sendCompletedStatusReport(
     startedAt,
+    toolsInput,
     toolsDownloadStatusReport,
     toolsFeatureFlagsValid,
     toolsSource,
diff --git a/src/setup-codeql.test.ts b/src/setup-codeql.test.ts
index 49d4d66aad..219e39984c 100644
--- a/src/setup-codeql.test.ts
+++ b/src/setup-codeql.test.ts
@@ -7,6 +7,7 @@ import * as sinon from "sinon";
 
 import * as actionsUtil from "./actions-util";
 import * as api from "./api-client";
+import { EnvVar } from "./environment";
 import { Feature } from "./feature-flags";
 import { getRunnerLogger } from "./logging";
 import { getCacheRestoreKeyPrefix } from "./overlay/caching";
@@ -116,30 +117,69 @@ test.serial(
   },
 );
 
-test.serial(
-  "getCodeQLSource correctly returns bundled CLI version when tools == linked",
-  async (t) => {
-    const features = createFeatures([]);
-
-    await withTmpDir(async (tmpDir) => {
-      setupActionsVars(tmpDir, tmpDir);
-      const source = await setupCodeql.getCodeQLSource(
-        "linked",
-        SAMPLE_DEFAULT_CLI_VERSION,
-        undefined, // rawLanguages
-        false, // useOverlayAwareDefaultCliVersion
-        SAMPLE_DOTCOM_API_DETAILS,
-        GitHubVariant.DOTCOM,
-        false,
-        features,
-        getRunnerLogger(true),
-      );
-
-      t.is(source.toolsVersion, LINKED_CLI_VERSION.cliVersion);
-      t.is(source.sourceType, "download");
-    });
+const LINKED_BUNDLE_TEST_CASES = [
+  {
+    platform: "linux",
+    tarSupportsZstd: true,
+    expectedBundleName: "codeql-bundle-linux64.tar.zst",
+    expectedCompressionMethod: "zstd",
   },
-);
+  {
+    platform: "darwin",
+    tarSupportsZstd: true,
+    expectedBundleName: "codeql-bundle-osx64.tar.zst",
+    expectedCompressionMethod: "zstd",
+  },
+  {
+    platform: "win32",
+    tarSupportsZstd: true,
+    expectedBundleName: "codeql-bundle-win64.tar.gz",
+    expectedCompressionMethod: "gzip",
+  },
+  {
+    platform: "linux",
+    tarSupportsZstd: false,
+    expectedBundleName: "codeql-bundle-linux64.tar.gz",
+    expectedCompressionMethod: "gzip",
+  },
+] as const;
+
+for (const {
+  platform,
+  tarSupportsZstd,
+  expectedBundleName,
+  expectedCompressionMethod,
+} of LINKED_BUNDLE_TEST_CASES) {
+  test.serial(
+    `getCodeQLSource selects ${expectedBundleName} for linked tools`,
+    async (t) => {
+      const features = createFeatures([]);
+      sinon.stub(process, "platform").value(platform);
+
+      await withTmpDir(async (tmpDir) => {
+        setupActionsVars(tmpDir, tmpDir);
+        const source = await setupCodeql.getCodeQLSource(
+          "linked",
+          SAMPLE_DEFAULT_CLI_VERSION,
+          undefined, // rawLanguages
+          false, // useOverlayAwareDefaultCliVersion
+          SAMPLE_DOTCOM_API_DETAILS,
+          GitHubVariant.DOTCOM,
+          tarSupportsZstd,
+          features,
+          getRunnerLogger(true),
+        );
+
+        t.is(source.toolsVersion, LINKED_CLI_VERSION.cliVersion);
+        t.is(source.sourceType, "download");
+        if (source.sourceType === "download") {
+          t.is(source.compressionMethod, expectedCompressionMethod);
+          t.true(source.codeqlURL.endsWith(`/${expectedBundleName}`));
+        }
+      });
+    },
+  );
+}
 
 test.serial(
   "getCodeQLSource correctly returns bundled CLI version when tools == latest",
@@ -193,12 +233,7 @@ test.serial(
     sinon.stub(setupCodeql, "downloadCodeQL").resolves({
       codeqlFolder: "codeql",
       statusReport: {
-        combinedDurationMs: 500,
-        compressionMethod: "gzip",
         downloadDurationMs: 200,
-        extractionDurationMs: 300,
-        streamExtraction: false,
-        toolsUrl: "toolsUrl",
       },
       toolsVersion: LINKED_CLI_VERSION.cliVersion,
     });
@@ -250,12 +285,7 @@ test.serial(
     sinon.stub(setupCodeql, "downloadCodeQL").resolves({
       codeqlFolder: "codeql",
       statusReport: {
-        combinedDurationMs: 500,
-        compressionMethod: "gzip",
         downloadDurationMs: 200,
-        extractionDurationMs: 300,
-        streamExtraction: false,
-        toolsUrl: bundleUrl,
       },
       toolsVersion: expectedVersion,
     });
@@ -421,7 +451,7 @@ test.serial(
   async (t) => {
     const loggedMessages: LoggedMessage[] = [];
     const logger = getRecordingLogger(loggedMessages);
-    const features = createFeatures([Feature.AllowToolcacheInput]);
+    const features = createFeatures([]);
 
     const latestToolcacheVersion = "3.2.1";
     const latestVersionPath = "/path/to/latest";
@@ -550,7 +580,7 @@ const toolcacheInputFallbackMacro = makeMacro({
 
 toolcacheInputFallbackMacro.serial(
   "the toolcache doesn't have a CodeQL CLI when tools == toolcache",
-  [Feature.AllowToolcacheInput],
+  [],
   { GITHUB_EVENT_NAME: "dynamic" },
   [],
   [
@@ -561,7 +591,7 @@ toolcacheInputFallbackMacro.serial(
 
 toolcacheInputFallbackMacro.serial(
   "the workflow trigger is not `dynamic`",
-  [Feature.AllowToolcacheInput],
+  [],
   { GITHUB_EVENT_NAME: "pull_request" },
   [],
   [
@@ -569,14 +599,6 @@ toolcacheInputFallbackMacro.serial(
   ],
 );
 
-toolcacheInputFallbackMacro.serial(
-  "the feature flag is not enabled",
-  [],
-  { GITHUB_EVENT_NAME: "dynamic" },
-  [],
-  [`Ignoring 'tools: toolcache' because the feature is not enabled.`],
-);
-
 test.serial(
   'tryGetTagNameFromUrl extracts the right tag name for a repo name containing "codeql-bundle"',
   (t) => {
@@ -637,8 +659,8 @@ test.serial(
   async (t) => {
     await withTmpDir(async (tmpDir) => {
       setupActionsVars(tmpDir, tmpDir);
-      process.env["CODE_SCANNING_REF"] = "refs/heads/feature-branch";
-      process.env["CODE_SCANNING_BASE_BRANCH"] = "main";
+      process.env[EnvVar.CODE_SCANNING_REF] = "refs/heads/feature-branch";
+      process.env[EnvVar.CODE_SCANNING_BASE_BRANCH] = "main";
 
       sinon.stub(api, "getAutomationID").resolves("test/");
       const listStub = sinon.stub(api, "listActionsCaches").resolves([
diff --git a/src/setup-codeql.ts b/src/setup-codeql.ts
index 3db0b6ca4d..8d374585aa 100644
--- a/src/setup-codeql.ts
+++ b/src/setup-codeql.ts
@@ -533,11 +533,7 @@ export async function getCodeQLSource(
     // We only allow `toolsInput === "toolcache"` for `dynamic` events. In general, using `toolsInput === "toolcache"`
     // can lead to alert wobble and so it shouldn't be used for an analysis where results are intended to be uploaded.
     // We also allow this in test mode.
-    const allowToolcacheValueFF = await features.getValue(
-      Feature.AllowToolcacheInput,
-    );
-    const allowToolcacheValue =
-      allowToolcacheValueFF && (isDynamicWorkflow() || util.isInTestMode());
+    const allowToolcacheValue = isDynamicWorkflow() || util.isInTestMode();
     if (allowToolcacheValue) {
       // If `toolsInput === "toolcache"`, try to find the latest version of the CLI that's available in the toolcache
       // and use that. We perform this check here since we can set `cliVersion` directly and don't want to default to
@@ -558,15 +554,9 @@ export async function getCodeQLSource(
           `Found no CodeQL CLI in the toolcache, ignoring 'tools: ${toolsInput}'...`,
         );
       } else {
-        if (allowToolcacheValueFF) {
-          logger.warning(
-            `Ignoring 'tools: ${toolsInput}' because the workflow was not triggered dynamically.`,
-          );
-        } else {
-          logger.info(
-            `Ignoring 'tools: ${toolsInput}' because the feature is not enabled.`,
-          );
-        }
+        logger.warning(
+          `Ignoring 'tools: ${toolsInput}' because the workflow was not triggered dynamically.`,
+        );
       }
 
       const version = await resolveDefaultCliVersion(
@@ -921,7 +911,6 @@ interface SetupCodeQLResult {
   toolsDownloadStatusReport?: ToolsDownloadStatusReport;
   toolsSource: ToolsSource;
   toolsVersion: string;
-  zstdAvailability: tar.ZstdAvailability;
 }
 
 /**
@@ -1005,7 +994,6 @@ export async function setupCodeQLBundle(
     toolsDownloadStatusReport,
     toolsSource,
     toolsVersion,
-    zstdAvailability,
   };
 }
 
diff --git a/src/start-proxy-action.ts b/src/start-proxy-action.ts
index 3e376ec64f..e8b89732f7 100644
--- a/src/start-proxy-action.ts
+++ b/src/start-proxy-action.ts
@@ -3,11 +3,12 @@ import * as path from "path";
 
 import * as core from "@actions/core";
 
+import { Action, ActionState, runInActions } from "./action-common";
 import * as actionsUtil from "./actions-util";
 import { getGitHubVersion } from "./api-client";
 import { FeatureEnablement, initFeatures } from "./feature-flags";
 import { BuiltInLanguage, parseBuiltInLanguage } from "./languages";
-import { getActionsLogger, Logger } from "./logging";
+import { Logger } from "./logging";
 import { getRepositoryNwo } from "./repository";
 import {
   credentialToStr,
@@ -23,14 +24,14 @@ import {
 import { generateCertificateAuthority } from "./start-proxy/ca";
 import { checkProxyEnvironment } from "./start-proxy/environment";
 import { checkConnections } from "./start-proxy/reachability";
-import { ActionName, sendUnhandledErrorStatusReport } from "./status-report";
+import { ActionName } from "./status-report";
 import * as util from "./util";
 
-async function run(startedAt: Date) {
+async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) {
   // To capture errors appropriately, keep as much code within the try-catch as
   // possible, and only use safe functions outside.
-
-  const logger = getActionsLogger();
+  const startedAt = action.startedAt;
+  const logger = action.logger;
   let features: FeatureEnablement | undefined;
   let language: BuiltInLanguage | undefined;
 
@@ -122,21 +123,15 @@ async function run(startedAt: Date) {
   }
 }
 
-export async function runWrapper() {
-  const startedAt = new Date();
-  const logger = getActionsLogger();
+/** Defines the `start-proxy` Action. */
+const startProxyAction: Action = {
+  name: ActionName.StartProxy,
+  run,
+  transformTelemetryError: getSafeErrorMessage,
+};
 
-  try {
-    await run(startedAt);
-  } catch (error) {
-    core.setFailed(`start-proxy action failed: ${util.getErrorMessage(error)}`);
-    await sendUnhandledErrorStatusReport(
-      ActionName.StartProxy,
-      startedAt,
-      getSafeErrorMessage(util.wrapError(error)),
-      logger,
-    );
-  }
+export async function runWrapper() {
+  await runInActions(startProxyAction);
 }
 
 async function startProxy(
diff --git a/src/start-proxy.test.ts b/src/start-proxy.test.ts
index 6a905f16b7..ee953798b8 100644
--- a/src/start-proxy.test.ts
+++ b/src/start-proxy.test.ts
@@ -120,9 +120,20 @@ const mixedCredentials = [
   { type: "maven_repository", host: "maven.pkg.github.com", token: "def" },
   { type: "nuget_feed", host: "nuget.pkg.github.com", token: "ghi" },
   { type: "goproxy_server", host: "goproxy.example.com", token: "jkl" },
-  { type: "git_source", host: "github.com/github", token: "mno" },
 ];
 
+const gitSourceCredential = {
+  type: "git_source",
+  host: "github.com/github",
+  token: "mno",
+};
+
+const dockerRegistryCredential = {
+  type: "docker_registry",
+  host: "https://registry.example.com",
+  token: "pqr",
+};
+
 test("getCredentials prefers registriesCredentials over registrySecrets", async (t) => {
   const registryCredentials = Buffer.from(
     JSON.stringify([
@@ -241,7 +252,7 @@ test("getCredentials returns all for a language when specified", async (t) => {
   const credentials = startProxyExports.getCredentials(
     getRunnerLogger(true),
     undefined,
-    toEncodedJSON(mixedCredentials),
+    toEncodedJSON([...mixedCredentials, gitSourceCredential]),
     BuiltInLanguage.go,
   );
   t.is(credentials.length, 2);
@@ -284,7 +295,7 @@ test("getCredentials returns all maven_repositories for Java when specified", as
       host: "maven2.pkg.github.com",
       token: "token2",
     },
-    { type: "git_source", host: "github.com/github", token: "mno" },
+    { type: "goproxy_server", host: "github.com/github", token: "mno" },
   ];
 
   const credentials = startProxyExports.getCredentials(
@@ -624,8 +635,12 @@ test("getCredentials validates 'replaces-base' correctly", async (t) => {
   );
 });
 
-test("getCredentials returns no credentials for Actions", async (t) => {
-  const credentialsInput = toEncodedJSON(mixedCredentials);
+test("getCredentials returns only ALWAYS_ENABLED_REGISTRY_TYPE credentials for Actions", async (t) => {
+  const credentialsInput = toEncodedJSON([
+    ...mixedCredentials,
+    gitSourceCredential,
+    dockerRegistryCredential,
+  ]);
 
   const credentials = startProxyExports.getCredentials(
     getRunnerLogger(true),
@@ -633,7 +648,41 @@ test("getCredentials returns no credentials for Actions", async (t) => {
     credentialsInput,
     BuiltInLanguage.actions,
   );
-  t.deepEqual(credentials, []);
+
+  for (const credential of credentials) {
+    t.true(
+      startProxyExports.ALWAYS_ENABLED_REGISTRY_TYPE.some(
+        (ty) => ty === credential.type,
+      ),
+    );
+  }
+});
+
+test("getCredentials always returns ALWAYS_ENABLED_REGISTRY_TYPE credentials for all languages", async (t) => {
+  const alwaysEnabledCredentials: startProxyExports.Credential[] = [];
+
+  for (const alwaysEnabled of startProxyExports.ALWAYS_ENABLED_REGISTRY_TYPE) {
+    alwaysEnabledCredentials.push({
+      type: alwaysEnabled,
+      host: `host-${alwaysEnabled}`,
+      token: `bar-${alwaysEnabled}`,
+      url: `url-${alwaysEnabled}`,
+    });
+  }
+
+  const credentialsInput = toEncodedJSON(alwaysEnabledCredentials);
+
+  // Test all languages.
+  for (const language of Object.values(BuiltInLanguage)) {
+    const credentials = startProxyExports.getCredentials(
+      getRunnerLogger(true),
+      undefined,
+      credentialsInput,
+      language,
+    );
+
+    t.deepEqual(credentials, alwaysEnabledCredentials);
+  }
 });
 
 function mockGetApiClient(endpoints: any) {
diff --git a/src/start-proxy.ts b/src/start-proxy.ts
index 6b956d6473..caa1b3054a 100644
--- a/src/start-proxy.ts
+++ b/src/start-proxy.ts
@@ -83,12 +83,6 @@ export class StartProxyError extends Error {
   }
 }
 
-interface StartProxyStatus extends StatusReportBase {
-  // A comma-separated list of registry types which are configured for CodeQL.
-  // This only includes registry types we support, not all that are configured.
-  registry_types: string;
-}
-
 /**
  * Sends a status report for the `start-proxy` action indicating a successful outcome.
  *
@@ -112,7 +106,7 @@ export async function sendSuccessStatusReport(
     logger,
   );
   if (statusReportBase !== undefined) {
-    const statusReport: StartProxyStatus = {
+    const statusReport: StatusReportBase = {
       ...statusReportBase,
       registry_types: registry_types.join(","),
     };
@@ -187,9 +181,19 @@ function isPAT(value: string) {
   ]);
 }
 
+/**
+ * A list of always-enabled registry types. The registry types in this list are always
+ * enabled, because generic CodeQL workflow components may use them rather than just
+ * language-specific components.
+ */
+export const ALWAYS_ENABLED_REGISTRY_TYPE = [
+  "git_source",
+  "docker_registry",
+] as const;
+
 type RegistryMapping = Partial<Record<BuiltInLanguage, string[]>>;
 
-const LANGUAGE_TO_REGISTRY_TYPE: Required<RegistryMapping> = {
+export const LANGUAGE_TO_REGISTRY_TYPE: Required<RegistryMapping> = {
   actions: [],
   cpp: [],
   java: ["maven_repository"],
@@ -233,9 +237,11 @@ function getRegistryAddress(
   }
 }
 
-// getCredentials returns registry credentials from action inputs.
-// It prefers `registries_credentials` over `registry_secrets`.
-// If neither is set, it returns an empty array.
+/**
+ * Returns registry credentials from action inputs.
+ * It prefers `registriesCredentials` over `registrySecrets`.
+ * If neither is set, it returns an empty array.
+ */
 export function getCredentials(
   logger: Logger,
   registrySecrets: string | undefined,
@@ -291,8 +297,11 @@ export function getCredentials(
     const address = getRegistryAddress(e);
 
     // Filter credentials based on language if specified. `type` is the registry type.
-    // E.g., "maven_feed" for Java/Kotlin, "nuget_repository" for C#.
+    // E.g., "maven_repository" for Java/Kotlin, "nuget_feed" for C#.
+    // We always allow types in `ALWAYS_ENABLED_REGISTRY_TYPE` since they can be used by
+    // other parts of the workflow.
     if (
+      !ALWAYS_ENABLED_REGISTRY_TYPE.some((t) => t === e.type) &&
       registryTypeForLanguage &&
       !registryTypeForLanguage.some((t) => t === e.type)
     ) {
diff --git a/src/start-proxy/types.ts b/src/start-proxy/types.ts
index 13a4ce0e8f..17803e9126 100644
--- a/src/start-proxy/types.ts
+++ b/src/start-proxy/types.ts
@@ -12,7 +12,7 @@ export type RawCredential = UnvalidatedObject<Credential>;
 /** A schema for credential objects with a username. */
 export const usernameSchema = {
   /** The username needed to authenticate to the package registry, if any. */
-  username: json.optional(json.string),
+  username: json.optionalOrNull(json.string),
 } as const satisfies json.Schema;
 
 /** Usernames may be present for both authentication with tokens or passwords. */
@@ -29,7 +29,7 @@ export function hasUsername(config: AuthConfig): config is Username {
 /** A schema for credential objects with a username and password. */
 export const usernamePasswordSchema = {
   /** The password needed to authenticate to the package registry, if any. */
-  password: json.optional(json.string),
+  password: json.optionalOrNull(json.string),
   ...usernameSchema,
 } as const satisfies json.Schema;
 
@@ -52,7 +52,7 @@ export function hasUsernameAndPassword(
 /** A schema for credential objects for token-based authentication. */
 export const tokenSchema = {
   /** The token needed to authenticate to the package registry, if any. */
-  token: json.optional(json.string),
+  token: json.optionalOrNull(json.string),
   ...usernameSchema,
 } as const satisfies json.Schema;
 
@@ -100,7 +100,7 @@ export const awsConfigSchema = {
   "role-name": json.string,
   domain: json.string,
   "domain-owner": json.string,
-  audience: json.optional(json.string),
+  audience: json.optionalOrNull(json.string),
 } as const satisfies json.Schema;
 
 /** Configuration for AWS OIDC. */
@@ -116,8 +116,8 @@ export function isAWSConfig(
 /** A schema for JFrog OIDC configurations. */
 export const jfrogConfigSchema = {
   "jfrog-oidc-provider-name": json.string,
-  audience: json.optional(json.string),
-  "identity-mapping-name": json.optional(json.string),
+  audience: json.optionalOrNull(json.string),
+  "identity-mapping-name": json.optionalOrNull(json.string),
 } as const satisfies json.Schema;
 
 /** Configuration for JFrog OIDC. */
@@ -150,8 +150,8 @@ export function isCloudsmithConfig(
 /** A schema for GCP OIDC configurations. */
 export const gcpConfigSchema = {
   "workload-identity-provider": json.string,
-  "service-account": json.optional(json.string),
-  audience: json.optional(json.string),
+  "service-account": json.optionalOrNull(json.string),
+  audience: json.optionalOrNull(json.string),
 } as const satisfies json.Schema;
 
 /** Configuration for GCP OIDC. */
@@ -254,13 +254,19 @@ export function credentialToStr(credential: Credential): string {
   return result;
 }
 
-/** A package registry is identified by its type and address. */
-export type Registry = {
+/** The schema for `RegistryBase` objects. */
+export const registryBaseSchema = {
   /** The type of the package registry. */
-  type: string;
+  type: json.string,
   /** Whether the registry replaces the base registry for the ecosystem. */
-  "replaces-base"?: boolean;
-} & Address;
+  "replaces-base": json.optional(json.boolean),
+} as const satisfies json.Schema;
+
+/** Information about a registry, other than its address. */
+export type RegistryBase = json.FromSchema<typeof registryBaseSchema>;
+
+/** A package registry is identified by its type and address. */
+export type Registry = RegistryBase & Address;
 
 // If a registry has an `url`, then that takes precedence over the `host` which may or may
 // not be defined.
diff --git a/src/status-report.test.ts b/src/status-report.test.ts
index 52132b7649..2b763da700 100644
--- a/src/status-report.test.ts
+++ b/src/status-report.test.ts
@@ -1,17 +1,21 @@
 import test from "ava";
 import * as sinon from "sinon";
+import * as uuid from "uuid";
 
 import * as actionsUtil from "./actions-util";
 import { Config } from "./config-utils";
-import { EnvVar } from "./environment";
+import { EnvVar, RegistryProxyVars } from "./environment";
 import { BuiltInLanguage } from "./languages";
 import { getRunnerLogger } from "./logging";
 import { ToolsSource } from "./setup-codeql";
+import type { Registry } from "./start-proxy";
 import {
   ActionName,
   createInitWithConfigStatusReport,
   createStatusReportBase,
   getActionsStatus,
+  getRegistryTypesFromEnv,
+  getJobUUID,
   InitStatusReport,
   InitWithConfigStatusReport,
 } from "./status-report";
@@ -20,11 +24,106 @@ import {
   setupActionsVars,
   createTestConfig,
   makeMacro,
+  getTestEnv,
+  RecordingLogger,
+  callee,
 } from "./testing-utils";
 import { BuildMode, ConfigurationError, withTmpDir, wrapError } from "./util";
 
 setupTests(test);
 
+test("getRegistryTypesFromEnv - gets unique registry types from environment", async (t) => {
+  const logger = new RecordingLogger(true);
+  const env = getTestEnv({
+    [RegistryProxyVars.PROXY_URLS]: JSON.stringify([
+      { type: "git_source", url: "https://example.com" },
+      { type: "git_source", url: "https://github.com" },
+      { type: "docker_registry", url: "https://registry.example.com" },
+    ] satisfies Array<Partial<Registry>>),
+  });
+
+  const result = getRegistryTypesFromEnv(logger, env);
+  t.deepEqual(result, ["git_source", "docker_registry"].sort().join(","));
+});
+
+test("getRegistryTypesFromEnv - returns undefined if the env var is not set", async (t) => {
+  const logger = new RecordingLogger(true);
+  const env = getTestEnv({});
+
+  const result = getRegistryTypesFromEnv(logger, env);
+  t.is(result, undefined);
+});
+
+test("getRegistryTypesFromEnv - returns undefined if the env var is not valid JSON", async (t) => {
+  const logger = new RecordingLogger(true);
+  const env = getTestEnv({ [RegistryProxyVars.PROXY_URLS]: "[" });
+
+  const result = getRegistryTypesFromEnv(logger, env);
+  t.is(result, undefined);
+});
+
+test("getRegistryTypesFromEnv - returns undefined if the env var is unexpected JSON", async (t) => {
+  const logger = new RecordingLogger(true);
+
+  t.is(
+    getRegistryTypesFromEnv(
+      logger,
+      getTestEnv({
+        // Top-level object rather than an array of objects.
+        [RegistryProxyVars.PROXY_URLS]: JSON.stringify({ type: "git_source" }),
+      }),
+    ),
+    undefined,
+  );
+  t.is(
+    getRegistryTypesFromEnv(
+      logger,
+      getTestEnv({
+        // Object has no "type" key.
+        [RegistryProxyVars.PROXY_URLS]: JSON.stringify([{}]),
+      }),
+    ),
+    undefined,
+  );
+});
+
+test("getJobUUID - generates valid UUIDs", async (t) => {
+  await callee(getJobUUID)
+    .withArgs()
+    .logs(t, "Job run UUID is ")
+    .hasEnv(t, (val) => {
+      return {
+        [EnvVar.JOB_RUN_UUID]: val,
+      };
+    })
+    .passes((val) => {
+      t.true(uuid.validate(val));
+    });
+});
+
+test("getJobUUID - retrieves existing job UUIDs", async (t) => {
+  const existingJobUuid = uuid.v4();
+  await callee(getJobUUID)
+    .withArgs()
+    .withEnv((env) => {
+      env.set(EnvVar.JOB_RUN_UUID, existingJobUuid);
+    })
+    .logs(t, `Existing job run UUID is ${existingJobUuid}.`)
+    .passes(t.deepEqual, existingJobUuid);
+});
+
+test("getJobUUID - doesn't retrieve invalid UUIDs", async (t) => {
+  const existingJobUuid = "not-a-uuid";
+  await callee(getJobUUID)
+    .withArgs()
+    .withEnv((env) => {
+      env.set(EnvVar.JOB_RUN_UUID, existingJobUuid);
+    })
+    .logs(t, `Job run UUID is `)
+    .notLogs(t, `Existing job run UUID is ${existingJobUuid}.`)
+    .passes(t.notDeepEqual, existingJobUuid);
+});
+
 function setupEnvironmentAndStub(tmpDir: string) {
   setupActionsVars(tmpDir, tmpDir, {
     GITHUB_EVENT_NAME: "dynamic",
@@ -34,6 +133,9 @@ function setupEnvironmentAndStub(tmpDir: string) {
 
   process.env[EnvVar.ANALYSIS_KEY] = "analysis-key";
   process.env["ImageVersion"] = "2023.05.19.1";
+  process.env[RegistryProxyVars.PROXY_URLS] = JSON.stringify([
+    { type: "maven_repository" },
+  ] satisfies Array<Partial<Registry>>);
 
   const getRequiredInput = sinon.stub(actionsUtil, "getRequiredInput");
   getRequiredInput.withArgs("matrix").resolves("input/matrix");
@@ -71,11 +173,13 @@ test.serial("createStatusReportBase", async (t) => {
       t.is(statusReport.build_mode, BuildMode.None);
       t.is(statusReport.cause, "failure cause");
       t.is(statusReport.commit_oid, process.env["GITHUB_SHA"]!);
+      t.deepEqual(statusReport.computed_inputs, {});
       t.is(statusReport.exception, "exception stack trace");
       t.is(statusReport.job_name, process.env["GITHUB_JOB"] || "");
       t.is(typeof statusReport.job_run_uuid, "string");
       t.is(statusReport.languages, "java,swift");
       t.is(statusReport.ref, process.env["GITHUB_REF"]!);
+      t.is(statusReport.registry_types, "maven_repository");
       t.is(statusReport.runner_available_disk_space_bytes, 100);
       t.is(statusReport.runner_image_version, process.env["ImageVersion"]);
       t.is(statusReport.runner_os, process.env["RUNNER_OS"]!);
diff --git a/src/status-report.ts b/src/status-report.ts
index a0c0b3ab40..b471bfa971 100644
--- a/src/status-report.ts
+++ b/src/status-report.ts
@@ -1,7 +1,9 @@
 import * as os from "os";
 
 import * as core from "@actions/core";
+import * as uuid from "uuid";
 
+import type { ActionState } from "./action-common";
 import {
   getWorkflowEventName,
   getOptionalInput,
@@ -13,15 +15,18 @@ import {
 } from "./actions-util";
 import { getAnalysisKey, getApiClient } from "./api-client";
 import type { Config } from "./config/action-config";
+import type { ComputedInput, InputName } from "./config/inputs";
 import { parseRegistriesWithoutCredentials } from "./config/pack-registries";
 import type { DependencyCacheRestoreStatusReport } from "./dependency-caching";
 import { DocUrl } from "./doc-url";
-import { EnvVar } from "./environment";
+import { EnvVar, getEnv, ReadOnlyEnv, RegistryProxyVars } from "./environment";
 import { getRef } from "./git-utils";
+import * as json from "./json";
 import type { Logger } from "./logging";
 import type { OverlayBaseDatabaseDownloadStats } from "./overlay/caching";
 import { getRepositoryNwo } from "./repository";
 import type { ToolsSource } from "./setup-codeql";
+import { registryBaseSchema } from "./start-proxy/types";
 import {
   ConfigurationError,
   getRequiredEnvParam,
@@ -58,6 +63,30 @@ export function getDisplayActionName(actionName: ActionName): string {
   return actionName;
 }
 
+/**
+ * Either creates a UUIDv4 for the analysis or retrieves an existing one from the
+ * environment and returns it.
+ * If a new UUID is generated, it is also exported as an environment variable.
+ */
+export function getJobUUID(
+  action: ActionState<["Logger", "ReadOnlyEnv", "Actions"]>,
+) {
+  // Check if we already have a UUID for the analysis and return it if so.
+  const existingJobRunUuid = action.env.getOptional(EnvVar.JOB_RUN_UUID);
+
+  if (existingJobRunUuid !== undefined && uuid.validate(existingJobRunUuid)) {
+    action.logger.info(`Existing job run UUID is ${existingJobRunUuid}.`);
+    return existingJobRunUuid;
+  }
+
+  // Otherwise generate a new UUID.
+  const jobRunUuid = uuid.v4();
+  action.logger.info(`Job run UUID is ${jobRunUuid}.`);
+
+  action.actions.exportVariable(EnvVar.JOB_RUN_UUID, jobRunUuid);
+  return jobRunUuid;
+}
+
 /**
  * @returns a boolean indicating whether the analysis is considered to be first party.
  *
@@ -122,6 +151,8 @@ export interface StatusReportBase {
   commit_oid: string;
   /** Time this action completed, or undefined if not yet completed. */
   completed_at?: string;
+  /** A mapping of input names to their computed values. */
+  computed_inputs: Partial<Record<InputName, ComputedInput>>;
   /** Stack trace of the failure (or undefined if status is not failure). */
   exception?: string;
   /** Whether this is a first-party (CodeQL) run of the action. */
@@ -156,6 +187,12 @@ export interface StatusReportBase {
   ml_powered_javascript_queries?: string;
   /** Ref that the workflow was triggered on. */
   ref: string;
+  /**
+   * A comma-separated list of private registry types which are configured for CodeQL.
+   * This only includes registry types we support (as determined by the `start-proxy` action),
+   * not all that are configured.
+   */
+  registry_types?: string;
   /** Action runner hardware architecture (context runner.arch). */
   runner_arch?: string;
   /** Available disk space on the runner, in bytes. */
@@ -259,6 +296,50 @@ export interface EventReport {
   started_at: string;
 }
 
+/**
+ * Attempts to retrieve a list of private registry types from the `CODEQL_PROXY_URLS` environment
+ * variable and returns it as a comma-separated string if successful. Returns `undefined` otherwise.
+ */
+export function getRegistryTypesFromEnv(
+  logger: Logger,
+  env: ReadOnlyEnv = getEnv(),
+): string | undefined {
+  // Try to get the value of the environment variable.
+  const value = env.getOptional(RegistryProxyVars.PROXY_URLS);
+
+  if (value === undefined) {
+    return undefined;
+  }
+
+  // Try to parse the JSON we expect to find in it and return the comma-separated list of
+  // (unique) registry types.
+  try {
+    const data = JSON.parse(value) as unknown;
+
+    // Check that the parsed JSON meets our expectations.
+    if (!json.isArray(data)) {
+      logger.debug(
+        `Expected '${RegistryProxyVars.PROXY_URLS}' to contain a JSON array, but got '${typeof data}'.`,
+      );
+      return undefined;
+    }
+    if (!json.validateArray(registryBaseSchema, data)) {
+      logger.debug(
+        `Expected '${RegistryProxyVars.PROXY_URLS}' to contain a JSON array of registry objects, but got something else.`,
+      );
+      return undefined;
+    }
+
+    const types = new Set(data.map((r) => r.type));
+    return Array.from(types).sort().join(",");
+  } catch (err) {
+    logger.debug(
+      `Failed to parse '${RegistryProxyVars.PROXY_URLS}': ${getErrorMessage(err)}.`,
+    );
+    return undefined;
+  }
+}
+
 /**
  * Compose a StatusReport.
  *
@@ -316,10 +397,12 @@ export async function createStatusReportBase(
       analysis_key,
       build_mode: config?.buildMode,
       commit_oid: commitOid,
+      computed_inputs: {},
       first_party_analysis: isFirstPartyAnalysis(actionName),
       job_name: jobName,
       job_run_uuid: jobRunUUID,
       ref,
+      registry_types: getRegistryTypesFromEnv(logger),
       runner_os: runnerOs,
       started_at: workflowStartedAt,
       status,
diff --git a/src/tar.test.ts b/src/tar.test.ts
new file mode 100644
index 0000000000..48f4e866d3
--- /dev/null
+++ b/src/tar.test.ts
@@ -0,0 +1,33 @@
+import * as path from "path";
+import * as stream from "stream";
+
+import test from "ava";
+
+import { getRunnerLogger } from "./logging";
+import { extractTarZst } from "./tar";
+import { setupTests } from "./testing-utils";
+import { withTmpDir } from "./util";
+
+setupTests(test);
+
+test("extractTarZst rejects if the input stream errors", async (t) => {
+  await withTmpDir(async (tmpDir) => {
+    const archive = new stream.PassThrough();
+    const promise = extractTarZst(
+      archive,
+      path.join(tmpDir, "dest"),
+      { type: "gnu", version: "1.34" },
+      getRunnerLogger(true),
+    );
+
+    archive.destroy(
+      Object.assign(new Error("socket hang up"), {
+        code: "ECONNRESET",
+      }),
+    );
+
+    await t.throwsAsync(promise, {
+      message: /Error while downloading and extracting tar/,
+    });
+  });
+});
diff --git a/src/tar.ts b/src/tar.ts
index 723716b016..3a0d79cc64 100644
--- a/src/tar.ts
+++ b/src/tar.ts
@@ -194,10 +194,15 @@ export async function extractTarZst(
       });
 
       if (tar instanceof stream.Readable) {
-        tar.pipe(tarProcess.stdin).on("error", (err) => {
-          reject(
-            new Error(`Error while downloading and extracting tar: ${err}`),
-          );
+        // Use `pipeline` rather than `pipe` so that an error on either stream is reported here
+        // rather than being emitted as an unhandled `error` event, and so that `tar`'s standard
+        // input is closed if the download fails partway through.
+        stream.pipeline(tar, tarProcess.stdin, (err) => {
+          if (err) {
+            reject(
+              new Error(`Error while downloading and extracting tar: ${err}`),
+            );
+          }
         });
       }
 
diff --git a/src/testing-utils.ts b/src/testing-utils.ts
index 748ce40ea3..279459275d 100644
--- a/src/testing-utils.ts
+++ b/src/testing-utils.ts
@@ -3,6 +3,8 @@ import path from "path";
 
 import * as github from "@actions/github";
 import test, {
+  type ThrownError,
+  type ThrowsExpectation,
   type ExecutionContext,
   type MacroDeclarationOptions,
   type TestFn,
@@ -11,7 +13,7 @@ import nock from "nock";
 import * as sinon from "sinon";
 
 import { ActionState, StateFeature } from "./action-common";
-import { ActionsEnv, ActionsEnvVars, getActionVersion } from "./actions-util";
+import { ActionsEnv, getActionVersion } from "./actions-util";
 import { AnalysisKind } from "./analyses";
 import * as apiClient from "./api-client";
 import { GitHubApiDetails } from "./api-client";
@@ -19,7 +21,7 @@ import { CachingKind } from "./caching-utils";
 import * as codeql from "./codeql";
 import { Config } from "./config-utils";
 import * as defaults from "./defaults.json";
-import { Env } from "./environment";
+import { Env, ActionsEnvVars } from "./environment";
 import {
   CodeQLDefaultVersionInfo,
   Feature,
@@ -32,11 +34,14 @@ import { ActionName } from "./status-report";
 import {
   DEFAULT_DEBUG_ARTIFACT_NAME,
   DEFAULT_DEBUG_DATABASE_NAME,
+  Failure,
   getEnv,
   GitHubVariant,
   GitHubVersion,
   HTTPError,
   resetCachedCodeQlVersion,
+  Result,
+  Success,
 } from "./util";
 
 export const SAMPLE_DOTCOM_API_DETAILS = {
@@ -176,68 +181,127 @@ export function makeMacro<Args extends unknown[]>(
   return wrapper;
 }
 
-export function getTestEnv(): Env {
-  const testEnv: NodeJS.ProcessEnv = {};
+export function getTestEnv(testEnv: NodeJS.ProcessEnv = {}): Env {
   return getEnv(testEnv);
 }
 
+/** An implementation of `ActionsEnv` for use in tests. */
+class TestActionsEnv implements ActionsEnv {
+  constructor(private readonly env: Env) {}
+
+  public clone(env: Env): this {
+    return Object.create(this, { env: { value: env } }) as this;
+  }
+
+  public getRequiredInput(name: string): string {
+    throw new Error(`Input required and not supplied: ${name}`);
+  }
+
+  public getOptionalInput(_name: string): string | undefined {
+    return undefined;
+  }
+
+  public exportVariable(name: string, value: string): void {
+    this.env.set(name, value);
+  }
+}
+
 /**
  * Gets an `ActionsEnv` instance for use in tests.
  */
-export function getTestActionsEnv(): ActionsEnv {
-  return {
-    getOptionalInput: () => undefined,
-  };
+export function getTestActionsEnv(env: Env): TestActionsEnv {
+  return new TestActionsEnv(env);
 }
 
 /** For testing purposes, we make all available state features accessible in `TestEnv`. */
-type AllState = ["Logger", "Env", "Actions", "FeatureFlags"];
+type AllState = [
+  "Base",
+  "Logger",
+  "Env",
+  "ReadOnlyEnv",
+  "Actions",
+  "Api",
+  "FeatureFlags",
+];
 
 /** Initialise a fresh `ActionState<AllState>` value. */
 export function initAllState(
   overrides?: Partial<ActionState<AllState>>,
 ): ActionState<AllState> {
+  const env = getTestEnv();
   return {
     name: ActionName.Init,
     startedAt: new Date(),
     logger: new RecordingLogger(),
-    env: getTestEnv(),
-    actions: getTestActionsEnv(),
+    env,
+    actions: getTestActionsEnv(env),
+    apiClient: github.getOctokit("123"),
     features: createFeatures([]),
     ...overrides,
   };
 }
 
+type DelayedCheck<
+  Args extends readonly any[],
+  R,
+  Fs extends ReadonlyArray<AllState[number]>,
+> = (
+  env: Readonly<BaseEnvBuilder<Args, R, Fs>>,
+  result: Result<Awaited<R>, ThrownError<ErrorConstructor | Error>>,
+) => Promise<any>;
+
+export type Mutation<T> = (val: T) => void;
+export type ValueOrMutation<T> = T | Mutation<T>;
+
 /**
  * Wraps a function that accepts an `ActionState` for testing in different environments.
  */
-export class TestEnv<
+abstract class BaseEnvBuilder<
   Args extends readonly any[],
   R,
   Fs extends ReadonlyArray<AllState[number]>,
 > {
-  private readonly fn: (state: ActionState<Fs>, ...args: Args) => R;
-  private args?: Args;
+  protected readonly fn: (state: ActionState<Fs>, ...args: Args) => R;
   private logger: RecordingLogger;
-  private state: ActionState<AllState>;
+  private actions: TestActionsEnv;
+  protected state: ActionState<AllState>;
+  protected checks: Array<DelayedCheck<Args, R, Fs>>;
 
   constructor(
     fn: (state: ActionState<Fs>, ...args: Args) => R,
-    cloneFrom?: TestEnv<Args, R, Fs>,
+    cloneFrom?: BaseEnvBuilder<Args, R, Fs>,
   ) {
     this.fn = fn;
-    this.args = cloneFrom?.args;
     this.logger = new RecordingLogger();
-    this.state =
-      cloneFrom !== undefined
-        ? { ...cloneFrom.state, logger: this.logger }
-        : initAllState({ logger: this.logger });
-  }
 
-  private clone(): TestEnv<Args, R, Fs> {
-    return new TestEnv(this.fn, this);
+    if (cloneFrom !== undefined) {
+      const env = cloneFrom.state.env.clone();
+      this.actions = cloneFrom.actions.clone(env);
+      this.state = {
+        ...cloneFrom.state,
+        env,
+        actions: this.actions,
+        logger: this.logger,
+      } satisfies ActionState<AllState>;
+    } else {
+      const env = getTestEnv();
+      this.actions = getTestActionsEnv(env);
+      this.state = initAllState({
+        logger: this.logger,
+        env,
+        actions: this.actions,
+      });
+    }
+
+    this.checks = [...(cloneFrom?.checks ?? [])];
   }
 
+  /**
+   * Creates a clone of this object. Used internally.
+   * Must be overridden by subclasses.
+   */
+  protected abstract clone(): this;
+
   public getLogger(): RecordingLogger {
     return this.logger;
   }
@@ -246,48 +310,224 @@ export class TestEnv<
     return this.state;
   }
 
-  public getArgs(): Args | undefined {
-    return this.args;
+  public withArgs(...args: Args): CallableEnvBuilder<Args, R, Fs> {
+    const result = new CallableEnvBuilder(this.fn, args, this.clone());
+    return result;
+  }
+
+  public withFeatures(enabled: Feature[]): this {
+    const result = this.clone();
+    result.state.features = createFeatures(enabled);
+    return result;
   }
 
-  public withArgs(...args: Args) {
+  /**
+   * Sets environment variables that are always available to GitHub Actions,
+   * excluding some that are expected to be set to paths.
+   *
+   * @param overrides Overrides for the defaults.
+   */
+  public withDefaultActionsEnv(overrides?: ActionVarOverrides): this {
     const result = this.clone();
-    result.args = args;
+    setupBaseActionsVars(overrides, result.state.env);
     return result;
   }
 
-  public withFeatures(enabled: Feature[]): TestEnv<Args, R, Fs> {
+  /**
+   * Sets environment variables that are always available to GitHub Actions.
+   * @param tempDir A value for `RUNNER_TEMP` and `GITHUB_WORKSPACE`.
+   * @param toolsDir A value for `RUNNER_TOOL_CACHE`.
+   * @param overrides Overrides for the defaults.
+   */
+  public withActionsEnv(
+    tempDir: string,
+    toolsDir: string,
+    overrides?: ActionVarOverrides,
+  ): this {
     const result = this.clone();
-    result.state.features = createFeatures(enabled);
+    setupActionsVars(tempDir, toolsDir, overrides, result.state.env);
+    return result;
+  }
+
+  public withEnv(arg: ValueOrMutation<Env>): this {
+    const result = this.clone();
+    if (typeof arg === "function") {
+      arg(result.state.env);
+    } else {
+      result.state.env = arg;
+    }
     return result;
   }
 
-  public withEnv(env: Env): TestEnv<Args, R, Fs> {
+  /** Applies `fn` to the `ActionsEnv`. */
+  public withActions(fn: Mutation<ActionsEnv>): this {
     const result = this.clone();
-    result.state.env = env;
+    fn(result.state.actions);
     return result;
   }
 
-  public withActions(actions: ActionsEnv): TestEnv<Args, R, Fs> {
+  /**
+   * Adds a delayed check that `messages` are logged. The check will be
+   * performed after the main assertion passes.
+   */
+  public logs(t: ExecutionContext<unknown>, ...messages: string[]): this {
     const result = this.clone();
-    result.state.actions = actions;
+    result.checks.push(async (env) => {
+      checkExpectedLogMessages(t, env.getLogger().messages, messages);
+    });
     return result;
   }
 
+  /**
+   * Adds a delayed check that the environment variables returned by `fn`
+   * are present in the environment after the main assertion passes.
+   */
+  public hasEnv(
+    t: ExecutionContext<unknown>,
+    fn: (
+      value: Awaited<R> | undefined,
+      error: ThrownError<ErrorConstructor | Error> | undefined,
+    ) => Record<string, string | undefined>,
+  ): this {
+    const result = this.clone();
+    result.checks.push(async (env, r) => {
+      const value = r.orElse(undefined);
+      const error = r.isFailure() ? r.value : undefined;
+      const expected = fn(value, error);
+
+      t.like(env.getState().env.get(), expected);
+    });
+    return result;
+  }
+
+  /**
+   * Adds a delayed check that `messages` are not logged. The check will be
+   * performed after the main assertion passes.
+   */
+  public notLogs(t: ExecutionContext<unknown>, ...messages: string[]): this {
+    const result = this.clone();
+    result.checks.push(async (env) => {
+      checkUnexpectedLogMessages(t, env.getLogger().messages, messages);
+    });
+    return result;
+  }
+}
+
+class EnvBuilder<
+  Args extends readonly any[],
+  R,
+  Fs extends ReadonlyArray<AllState[number]>,
+> extends BaseEnvBuilder<Args, R, Fs> {
+  protected clone(): this {
+    return new EnvBuilder(this.fn, this) as this;
+  }
+}
+
+export interface PassedAssertion<R, T> {
+  result: Awaited<R>;
+  assertionResult: T;
+}
+
+/**
+ * A more minimal, exported interface for `CallableEnvBuilder`. This makes it easier to
+ * define helper functions in tests which expect a value of a compatible type.
+ */
+export interface AssertableTarget<R> {
+  passes<AArgs extends readonly any[], AResult>(
+    assertion: (val: Awaited<R>, ...assertionArgs: AArgs) => AResult,
+    ...assertionArgs: AArgs
+  ): Promise<PassedAssertion<R, AResult>>;
+
+  throws<ErrorType extends ErrorConstructor | Error>(
+    t: ExecutionContext<unknown>,
+    expectations?: ThrowsExpectation<ErrorType>,
+  ): Promise<ThrownError<ErrorType>>;
+}
+
+class CallableEnvBuilder<
+    Args extends readonly any[],
+    R,
+    Fs extends ReadonlyArray<AllState[number]>,
+  >
+  extends BaseEnvBuilder<Args, R, Fs>
+  implements AssertableTarget<R>
+{
+  private args: Args;
+
+  constructor(
+    fn: (state: ActionState<Fs>, ...args: Args) => R,
+    args: Args,
+    cloneFrom?: BaseEnvBuilder<Args, R, Fs>,
+  ) {
+    super(fn, cloneFrom);
+    this.args = args;
+  }
+
+  protected clone(): this {
+    return new CallableEnvBuilder(this.fn, this.args, this) as this;
+  }
+
+  public getArgs(): Args {
+    return this.args;
+  }
+
   call(): R {
-    if (!this.args) {
-      throw new Error("Trying to call function in TestEnv without arguments.");
-    }
     return this.fn(this.state as unknown as ActionState<Fs>, ...this.args);
   }
 
-  public passes<T>(
-    assertion: (makeCall: () => R) => T | Promise<T>,
-  ): T | Promise<T> {
-    return assertion(() => {
-      const result = this.call();
-      return result;
-    });
+  /**
+   * Calls the underlying function in the configured environment and passes
+   * the result to `assertion` along with extra `assertionArgs`.
+   *
+   * @param assertion The assertion to apply to the result.
+   * @param assertionArgs Extra arguments for the assertion.
+   * @returns The result of the assertion.
+   */
+  public async passes<AArgs extends readonly any[], AResult>(
+    assertion: (val: Awaited<R>, ...assertionArgs: AArgs) => AResult,
+    ...assertionArgs: AArgs
+  ): Promise<PassedAssertion<R, AResult>> {
+    // this.call() may or may not return a promise,
+    // `Promise.resolve` turns the result into one if it isn't already,
+    // and we then await it. That ensures that `result` is an `Awaited<R>`.
+    const result = await Promise.resolve(this.call());
+
+    // Run the main assertion on the `result`.
+    const assertionResult = await assertion(result, ...assertionArgs);
+
+    // Run other delayed checks.
+    for (const delayedCheck of this.checks) {
+      await delayedCheck(this, new Success(result));
+    }
+
+    // Return the results of the function call and the main assertion.
+    return { result, assertionResult };
+  }
+
+  /**
+   * Asserts that calling the underlying function should throw an exception.
+   *
+   * @param t The execution context for the assertion.
+   * @param expectations Expectations for the error.
+   * @returns The error that was thrown.
+   */
+  public async throws<ErrorType extends ErrorConstructor | Error>(
+    t: ExecutionContext<unknown>,
+    expectations?: ThrowsExpectation<ErrorType>,
+  ): Promise<ThrownError<ErrorType>> {
+    // Run the main assertion.
+    const error = await t.throwsAsync(
+      async () => Promise.resolve(this.call()),
+      expectations,
+    );
+
+    // Run other delayed checks.
+    for (const delayedCheck of this.checks) {
+      await delayedCheck(this, new Failure(error));
+    }
+
+    // Return the error.
+    return error;
   }
 }
 
@@ -296,8 +536,8 @@ export function callee<
   Args extends readonly any[],
   R,
   Fs extends readonly StateFeature[],
->(fn: (state: ActionState<Fs>, ...args: Args) => R): TestEnv<Args, R, Fs> {
-  return new TestEnv(fn);
+>(fn: (state: ActionState<Fs>, ...args: Args) => R): EnvBuilder<Args, R, Fs> {
+  return new EnvBuilder(fn);
 }
 
 /**
@@ -331,11 +571,15 @@ export type ActionVarOverrides = Partial<
  * excluding some that are expected to be set to paths. See `setupActionsVars`.
  *
  * @param overrides Overrides for the defaults.
+ * @param env The environment to set the variables for.
  */
-export function setupBaseActionsVars(overrides?: ActionVarOverrides) {
+export function setupBaseActionsVars(
+  overrides?: ActionVarOverrides,
+  env: Env = getEnv(),
+) {
   const vars = { ...DEFAULT_ACTIONS_VARS, ...overrides };
   for (const [key, value] of Object.entries(vars)) {
-    process.env[key] = value;
+    env.set(key, value);
   }
 }
 
@@ -345,16 +589,18 @@ export function setupBaseActionsVars(overrides?: ActionVarOverrides) {
  * @param tempDir A value for `RUNNER_TEMP` and `GITHUB_WORKSPACE`.
  * @param toolsDir A value for `RUNNER_TOOL_CACHE`.
  * @param overrides Overrides for the defaults.
+ * @param env The environment to set the variables for.
  */
 export function setupActionsVars(
   tempDir: string,
   toolsDir: string,
   overrides?: ActionVarOverrides,
+  env: Env = getEnv(),
 ) {
-  setupBaseActionsVars(overrides);
-  process.env["RUNNER_TEMP"] = tempDir;
-  process.env["RUNNER_TOOL_CACHE"] = toolsDir;
-  process.env["GITHUB_WORKSPACE"] = tempDir;
+  setupBaseActionsVars(overrides, env);
+  env.set(ActionsEnvVars.RUNNER_TEMP, tempDir);
+  env.set(ActionsEnvVars.RUNNER_TOOL_CACHE, toolsDir);
+  env.set(ActionsEnvVars.GITHUB_WORKSPACE, tempDir);
 }
 
 type LogLevel = "debug" | "info" | "warning" | "error";
@@ -488,6 +734,34 @@ export function checkExpectedLogMessages(
   }
 }
 
+/**
+ * Checks that `messages` contains none of `unexpectedMessages`.
+ */
+export function checkUnexpectedLogMessages(
+  t: ExecutionContext<any>,
+  messages: LoggedMessage[],
+  unexpectedMessages: string[],
+) {
+  const presentMessages: string[] = [];
+
+  for (const unexpectedMessage of unexpectedMessages) {
+    if (hasLoggedMessage(messages, unexpectedMessage)) {
+      presentMessages.push(unexpectedMessage);
+    }
+  }
+
+  if (presentMessages.length > 0) {
+    const listify = (lines: string[]) =>
+      lines.map((m) => ` - '${m}'`).join("\n");
+
+    t.fail(
+      `Did not expect\n\n${listify(presentMessages)}\n\nin the logger output, but found them in:\n\n${messages.map((m) => ` - '${m.message}'`).join("\n")}`,
+    );
+  } else {
+    t.pass();
+  }
+}
+
 /**
  * Asserts that `message` should not have been logged to `logger`.
  */
diff --git a/src/tools-download.test.ts b/src/tools-download.test.ts
new file mode 100644
index 0000000000..66fe0e72e4
--- /dev/null
+++ b/src/tools-download.test.ts
@@ -0,0 +1,115 @@
+import { once } from "events";
+import * as path from "path";
+
+import * as toolcache from "@actions/tool-cache";
+import test from "ava";
+import nock from "nock";
+import * as sinon from "sinon";
+
+import { getRunnerLogger } from "./logging";
+import * as tar from "./tar";
+import { setupTests } from "./testing-utils";
+import { downloadAndExtract } from "./tools-download";
+import { withTmpDir } from "./util";
+
+setupTests(test);
+
+test.serial(
+  "downloadAndExtract reports the duration when downloading before extracting",
+  async (t) => {
+    await withTmpDir(async (tmpDir) => {
+      const archivePath = path.join(tmpDir, "codeql-bundle.tar.gz");
+      const destination = path.join(tmpDir, "codeql");
+      sinon.stub(toolcache, "downloadTool").resolves(archivePath);
+      sinon.stub(tar, "extract").resolves(destination);
+
+      const statusReport = await downloadAndExtract(
+        "https://example.com/codeql-bundle.tar.gz",
+        "gzip",
+        destination,
+        undefined,
+        {},
+        undefined,
+        getRunnerLogger(true),
+      );
+
+      t.assert(Number.isInteger(statusReport.downloadDurationMs));
+    });
+  },
+);
+
+test.serial(
+  "downloadAndExtract falls back to downloading before extracting if streaming fails",
+  async (t) => {
+    await withTmpDir(async (tmpDir) => {
+      sinon.stub(process, "platform").value("linux");
+      const archivePath = path.join(tmpDir, "codeql-bundle.tar.zst");
+      const destination = path.join(tmpDir, "codeql");
+      const downloadTool = sinon
+        .stub(toolcache, "downloadTool")
+        .resolves(archivePath);
+      const extract = sinon.stub(tar, "extract").resolves(destination);
+      const extractTarZst = sinon.stub(tar, "extractTarZst").resolves();
+      const request = nock("https://example.com")
+        .get("/codeql-bundle.tar.zst")
+        .replyWithError(
+          Object.assign(new Error("socket hang up"), { code: "ECONNRESET" }),
+        );
+
+      const statusReport = await downloadAndExtract(
+        "https://example.com/codeql-bundle.tar.zst",
+        "zstd",
+        destination,
+        undefined,
+        {},
+        { type: "gnu", version: "1.34" },
+        getRunnerLogger(true),
+      );
+
+      t.assert(Number.isInteger(statusReport.downloadDurationMs));
+      t.true(request.isDone());
+      t.false(extractTarZst.called);
+      t.true(downloadTool.calledOnce);
+      t.true(extract.calledOnce);
+    });
+  },
+);
+
+test.serial(
+  "downloadAndExtract omits the download duration when streaming extraction",
+  async (t) => {
+    await withTmpDir(async (tmpDir) => {
+      sinon.stub(process, "platform").value("linux");
+      const downloadTool = sinon.stub(toolcache, "downloadTool");
+      const extractTarZst = sinon
+        .stub(tar, "extractTarZst")
+        .callsFake(async (archive) => {
+          if (typeof archive === "string") {
+            t.fail("Expected the Zstandard archive to be streamed.");
+            return;
+          }
+          const end = once(archive, "end");
+          archive.resume();
+          await end;
+        });
+      const request = nock("https://example.com")
+        .get("/codeql-bundle.tar.zst")
+        .reply(200, "archive");
+
+      const statusReport = await downloadAndExtract(
+        "https://example.com/codeql-bundle.tar.zst",
+        "zstd",
+        path.join(tmpDir, "codeql"),
+        undefined,
+        {},
+        { type: "gnu", version: "1.34" },
+        getRunnerLogger(true),
+      );
+
+      t.deepEqual(statusReport, {});
+      t.false(downloadTool.called);
+      t.true(extractTarZst.calledOnce);
+      t.true(request.isDone());
+    });
+  },
+);
diff --git a/src/tools-download.ts b/src/tools-download.ts
index 5d8a4c5fb9..9b2fa8723a 100644
--- a/src/tools-download.ts
+++ b/src/tools-download.ts
@@ -20,65 +20,19 @@ import { cleanUpPath, getErrorMessage, getRequiredEnvParam } from "./util";
 const STREAMING_HIGH_WATERMARK_BYTES = 4 * 1024 * 1024; // 4 MiB
 
 /**
- * The name of the tool cache directory for the CodeQL tools.
+ * How long the streaming download of the CodeQL tools may stall for before we abort it. This
+ * applies both to establishing the connection and to gaps between chunks of the response body.
  */
-const TOOLCACHE_TOOL_NAME = "CodeQL";
+const STREAMING_STALL_TIMEOUT_MS = 5 * 60 * 1000; // 5 minutes
 
 /**
- * Timing information for the download and extraction of the CodeQL tools when
- * we fully download the bundle before extracting.
- */
-type DownloadFirstToolsDownloadDurations = {
-  combinedDurationMs: number;
-  downloadDurationMs: number;
-  extractionDurationMs: number;
-  streamExtraction: false;
-};
-
-function makeDownloadFirstToolsDownloadDurations(
-  downloadDurationMs: number,
-  extractionDurationMs: number,
-): DownloadFirstToolsDownloadDurations {
-  return {
-    combinedDurationMs: downloadDurationMs + extractionDurationMs,
-    downloadDurationMs,
-    extractionDurationMs,
-    streamExtraction: false,
-  };
-}
-
-/**
- * Timing information for the download and extraction of the CodeQL tools when
- * we stream the download and extraction of the bundle.
+ * The name of the tool cache directory for the CodeQL tools.
  */
-type StreamedToolsDownloadDurations = {
-  combinedDurationMs: number;
-  downloadDurationMs: undefined;
-  extractionDurationMs: undefined;
-  streamExtraction: true;
-};
-
-function makeStreamedToolsDownloadDurations(
-  combinedDurationMs: number,
-): StreamedToolsDownloadDurations {
-  return {
-    combinedDurationMs,
-    downloadDurationMs: undefined,
-    extractionDurationMs: undefined,
-    streamExtraction: true,
-  };
-}
-
-type ToolsDownloadDurations =
-  | DownloadFirstToolsDownloadDurations
-  | StreamedToolsDownloadDurations;
+const TOOLCACHE_TOOL_NAME = "CodeQL";
 
 export type ToolsDownloadStatusReport = {
-  cacheDurationMs?: number;
-  compressionMethod: tar.CompressionMethod;
-  toolsUrl: string;
-  zstdFailureReason?: string;
-} & ToolsDownloadDurations;
+  downloadDurationMs?: number;
+};
 
 export async function downloadAndExtract(
   codeqlURL: string,
@@ -116,11 +70,7 @@ export async function downloadAndExtract(
         )}).`,
       );
 
-      return {
-        compressionMethod,
-        toolsUrl: sanitizeUrlForStatusReport(codeqlURL),
-        ...makeStreamedToolsDownloadDurations(combinedDurationMs),
-      };
+      return {};
     }
   } catch (e) {
     core.warning(
@@ -170,14 +120,7 @@ export async function downloadAndExtract(
     await cleanUpPath(archivedBundlePath, "CodeQL bundle archive", logger);
   }
 
-  return {
-    compressionMethod,
-    toolsUrl: sanitizeUrlForStatusReport(codeqlURL),
-    ...makeDownloadFirstToolsDownloadDurations(
-      downloadDurationMs,
-      extractionDurationMs,
-    ),
-  };
+  return { downloadDurationMs };
 }
 
 async function downloadAndExtractZstdWithStreaming(
@@ -200,8 +143,8 @@ async function downloadAndExtractZstdWithStreaming(
     authorization ? { authorization } : {},
     headers,
   );
-  const response = await new Promise<IncomingMessage>((resolve) =>
-    https.get(
+  const response = await new Promise<IncomingMessage>((resolve, reject) => {
+    const request = https.get(
       codeqlURL,
       {
         headers,
@@ -211,10 +154,24 @@ async function downloadAndExtractZstdWithStreaming(
         agent,
       } as unknown as RequestOptions,
       (r) => resolve(r),
-    ),
-  );
+    );
+    // Without this listener, connection failures such as `ECONNRESET` are emitted as unhandled
+    // `error` events, which terminate the process instead of letting us fall back to downloading
+    // the bundle before extracting it. This listener stays attached after the response arrives, so
+    // it also handles errors that occur while the response is being streamed.
+    request.on("error", reject);
+    request.setTimeout(STREAMING_STALL_TIMEOUT_MS, () => {
+      request.destroy(
+        new Error(
+          `No data received for ${formatDuration(STREAMING_STALL_TIMEOUT_MS)}.`,
+        ),
+      );
+    });
+  });
 
   if (response.statusCode !== 200) {
+    // Discard the response body so that the connection can be released.
+    response.resume();
     throw new Error(
       `Failed to download CodeQL bundle from ${codeqlURL}. HTTP status code: ${response.statusCode}.`,
     );
@@ -241,11 +198,3 @@ export function writeToolcacheMarkerFile(
   fs.writeFileSync(markerFilePath, "");
   logger.info(`Created toolcache marker file ${markerFilePath}`);
 }
-
-function sanitizeUrlForStatusReport(url: string): string {
-  return ["github/codeql-action", "dsp-testing/codeql-cli-nightlies"].some(
-    (repo) => url.startsWith(`https://github.com/${repo}/releases/download/`),
-  )
-    ? url
-    : "sanitized-value";
-}
diff --git a/src/upload-sarif-action.ts b/src/upload-sarif-action.ts
index 214f3bf980..d3437510ce 100644
--- a/src/upload-sarif-action.ts
+++ b/src/upload-sarif-action.ts
@@ -54,7 +54,7 @@ async function sendSuccessStatusReport(
   }
 }
 
-async function run({ startedAt, logger }: ActionState<["Logger"]>) {
+async function run({ startedAt, logger }: ActionState<["Base", "Logger"]>) {
   // To capture errors appropriately, keep as much code within the try-catch as
   // possible, and only use safe functions outside.
   try {
diff --git a/src/util.ts b/src/util.ts
index 7f52456608..b7d27afae3 100644
--- a/src/util.ts
+++ b/src/util.ts
@@ -13,11 +13,14 @@ import * as apiCompatibility from "./api-compatibility.json";
 import type { CodeQL, VersionInfo } from "./codeql";
 import type { Pack } from "./config/db-config";
 import type { Config } from "./config-utils";
-import { Env, EnvVar } from "./environment";
+import { EnvVar, getRequiredEnvParam } from "./environment";
 import * as json from "./json";
 import { Language } from "./languages";
 import { Logger } from "./logging";
 
+// Re-export for backwards compatibility to avoid updating a lot of imports elsewhere.
+export { getRequiredEnvParam, getOptionalEnvVar, getEnv } from "./environment";
+
 /**
  * The name of the file containing the base database OIDs, as stored in the
  * root of the database location.
@@ -566,56 +569,6 @@ export function initializeEnvironment(version: string) {
   core.exportVariable(EnvVar.VERSION, version);
 }
 
-/** Gets an `Env` instance for `env`, which is `process.env` by default. */
-export function getEnv(env: NodeJS.ProcessEnv = process.env): Env {
-  return {
-    getRequired: (name) => getRequiredEnvVar(env, name),
-    getOptional: (name) => getOptionalEnvVarFrom(env, name),
-  };
-}
-
-/**
- * Gets an environment variable, but throws an error if it is not set.
- */
-export function getRequiredEnvVar(
-  env: NodeJS.ProcessEnv,
-  paramName: string,
-): string {
-  const value = env[paramName];
-  if (value === undefined || value.length === 0) {
-    throw new Error(`${paramName} environment variable must be set`);
-  }
-  return value;
-}
-
-/**
- * Get an environment parameter, but throw an error if it is not set.
- */
-export function getRequiredEnvParam(paramName: string): string {
-  return getRequiredEnvVar(process.env, paramName);
-}
-
-/**
- * Gets an environment variable, but returns `undefined` if it is not set or empty.
- */
-export function getOptionalEnvVarFrom(
-  env: NodeJS.ProcessEnv,
-  paramName: string,
-): string | undefined {
-  const value = env[paramName];
-  if (value?.trim().length === 0) {
-    return undefined;
-  }
-  return value;
-}
-
-/**
- * Get an environment variable, but return `undefined` if it is not set or empty.
- */
-export function getOptionalEnvVar(paramName: string): string | undefined {
-  return getOptionalEnvVarFrom(process.env, paramName);
-}
-
 export class HTTPError extends Error {
   public status: number;