Merge remote-tracking branch 'origin/releases/v3' into backport-v2.27.0-662472033

2025-12-27 17:50:07 +08:00 · 2024-10-22 15:48:08 +00:00
parent a666febdd9 662472033e
commit 02b20c03ad
1064 changed files with 10861 additions and 8896 deletions
--- a/.github/actions/prepare-test/action.yml
+++ b/.github/actions/prepare-test/action.yml
@@ -2,7 +2,7 @@ name: "Prepare test"
 description: Performs some preparation to run tests
 inputs:
  version:
-    description: "The version of the CodeQL CLI to use. Can be 'linked', 'default', 'nightly-latest', 'nightly-YYYY-MM-DD', or 'stable-YYYY-MM-DD'."
+    description: "The version of the CodeQL CLI to use. Can be 'linked', 'default', 'nightly-latest', 'nightly-YYYYMMDD', or 'stable-vX.Y.Z"
    required: true
  use-all-platform-bundle:
    description: "If true, we output a tools URL with codeql-bundle.tar.gz file rather than platform-specific URL"
@@ -32,6 +32,14 @@ runs:
      run: |
        set -e # Fail this Action if `gh release list` fails.

+        if [[ ${{ inputs.version }} == "linked" ]]; then
+          echo "tools-url=linked" >> "$GITHUB_OUTPUT"
+          exit 0
+        elif [[ ${{ inputs.version }} == "default" ]]; then
+          echo "tools-url=" >> "$GITHUB_OUTPUT"
+          exit 0
+        fi
+
        if [[ ${{ inputs.version }} == "nightly-latest" ]]; then
          extension="tar.zst"
        else
@@ -56,14 +64,10 @@ runs:
          echo "tools-url=https://github.com/dsp-testing/codeql-cli-nightlies/releases/download/$tag/$artifact_name" >> $GITHUB_OUTPUT
        elif [[ ${{ inputs.version }} == *"nightly"* ]]; then
          version=`echo ${{ inputs.version }} | sed -e 's/^.*\-//'`
-          echo "tools-url=https://github.com/dsp-testing/codeql-cli-nightlies/releases/download/codeql-bundle-$version-manual/$artifact_name" >> $GITHUB_OUTPUT
+          echo "tools-url=https://github.com/dsp-testing/codeql-cli-nightlies/releases/download/codeql-bundle-$version/$artifact_name" >> $GITHUB_OUTPUT
        elif [[ ${{ inputs.version }} == *"stable"* ]]; then
          version=`echo ${{ inputs.version }} | sed -e 's/^.*\-//'`
          echo "tools-url=https://github.com/github/codeql-action/releases/download/codeql-bundle-$version/$artifact_name" >> $GITHUB_OUTPUT
-        elif [[ ${{ inputs.version }} == "linked" ]]; then
-          echo "tools-url=linked" >> $GITHUB_OUTPUT
-        elif [[ ${{ inputs.version }} == "default" ]]; then
-          echo "tools-url=" >> $GITHUB_OUTPUT
        else
          echo "::error::Unrecognized version specified!"
          exit 1
--- a/.github/workflows/__all-platform-bundle.yml
+++ b/.github/workflows/__all-platform-bundle.yml
@@ -38,12 +38,7 @@ jobs:
    steps:
      - name: Setup Python on MacOS
        uses: actions/setup-python@v5
-        if: >-
-          runner.os == 'macOS' && (
-
-          matrix.version == 'stable-v2.13.5' ||
-
-          matrix.version == 'stable-v2.14.6')
+        if: runner.os == 'macOS' && matrix.version == 'stable-v2.14.6'
        with:
          python-version: '3.11'
      - name: Check out repository
--- a/.github/workflows/__analyze-ref-input.yml
+++ b/.github/workflows/__analyze-ref-input.yml
@@ -42,12 +42,7 @@ jobs:
    steps:
      - name: Setup Python on MacOS
        uses: actions/setup-python@v5
-        if: >-
-          runner.os == 'macOS' && (
-
-          matrix.version == 'stable-v2.13.5' ||
-
-          matrix.version == 'stable-v2.14.6')
+        if: runner.os == 'macOS' && matrix.version == 'stable-v2.14.6'
        with:
          python-version: '3.11'
      - name: Check out repository
--- a/.github/workflows/__autobuild-action.yml
+++ b/.github/workflows/__autobuild-action.yml
@@ -42,12 +42,7 @@ jobs:
    steps:
      - name: Setup Python on MacOS
        uses: actions/setup-python@v5
-        if: >-
-          runner.os == 'macOS' && (
-
-          matrix.version == 'stable-v2.13.5' ||
-
-          matrix.version == 'stable-v2.14.6')
+        if: runner.os == 'macOS' && matrix.version == 'stable-v2.14.6'
        with:
          python-version: '3.11'
      - name: Check out repository
--- a/.github/workflows/__autobuild-direct-tracing-with-working-dir.yml
+++ b/.github/workflows/__autobuild-direct-tracing-with-working-dir.yml
@@ -44,12 +44,7 @@ jobs:
    steps:
      - name: Setup Python on MacOS
        uses: actions/setup-python@v5
-        if: >-
-          runner.os == 'macOS' && (
-
-          matrix.version == 'stable-v2.13.5' ||
-
-          matrix.version == 'stable-v2.14.6')
+        if: runner.os == 'macOS' && matrix.version == 'stable-v2.14.6'
        with:
          python-version: '3.11'
      - name: Check out repository
--- a/.github/workflows/__autobuild-direct-tracing.yml
+++ b/.github/workflows/__autobuild-direct-tracing.yml
@@ -44,12 +44,7 @@ jobs:
    steps:
      - name: Setup Python on MacOS
        uses: actions/setup-python@v5
-        if: >-
-          runner.os == 'macOS' && (
-
-          matrix.version == 'stable-v2.13.5' ||
-
-          matrix.version == 'stable-v2.14.6')
+        if: runner.os == 'macOS' && matrix.version == 'stable-v2.14.6'
        with:
          python-version: '3.11'
      - name: Check out repository
--- a/.github/workflows/__build-mode-autobuild.yml
+++ b/.github/workflows/__build-mode-autobuild.yml
@@ -38,12 +38,7 @@ jobs:
    steps:
      - name: Setup Python on MacOS
        uses: actions/setup-python@v5
-        if: >-
-          runner.os == 'macOS' && (
-
-          matrix.version == 'stable-v2.13.5' ||
-
-          matrix.version == 'stable-v2.14.6')
+        if: runner.os == 'macOS' && matrix.version == 'stable-v2.14.6'
        with:
          python-version: '3.11'
      - name: Check out repository
--- a/.github/workflows/__build-mode-manual.yml
+++ b/.github/workflows/__build-mode-manual.yml
@@ -38,12 +38,7 @@ jobs:
    steps:
      - name: Setup Python on MacOS
        uses: actions/setup-python@v5
-        if: >-
-          runner.os == 'macOS' && (
-
-          matrix.version == 'stable-v2.13.5' ||
-
-          matrix.version == 'stable-v2.14.6')
+        if: runner.os == 'macOS' && matrix.version == 'stable-v2.14.6'
        with:
          python-version: '3.11'
      - name: Check out repository
--- a/.github/workflows/__build-mode-none.yml
+++ b/.github/workflows/__build-mode-none.yml
@@ -40,12 +40,7 @@ jobs:
    steps:
      - name: Setup Python on MacOS
        uses: actions/setup-python@v5
-        if: >-
-          runner.os == 'macOS' && (
-
-          matrix.version == 'stable-v2.13.5' ||
-
-          matrix.version == 'stable-v2.14.6')
+        if: runner.os == 'macOS' && matrix.version == 'stable-v2.14.6'
        with:
          python-version: '3.11'
      - name: Check out repository
--- a/.github/workflows/__build-mode-rollback.yml
+++ b/.github/workflows/__build-mode-rollback.yml
@@ -38,12 +38,7 @@ jobs:
    steps:
      - name: Setup Python on MacOS
        uses: actions/setup-python@v5
-        if: >-
-          runner.os == 'macOS' && (
-
-          matrix.version == 'stable-v2.13.5' ||
-
-          matrix.version == 'stable-v2.14.6')
+        if: runner.os == 'macOS' && matrix.version == 'stable-v2.14.6'
        with:
          python-version: '3.11'
      - name: Check out repository
--- a/.github/workflows/__cleanup-db-cluster-dir.yml
+++ b/.github/workflows/__cleanup-db-cluster-dir.yml
@@ -38,12 +38,7 @@ jobs:
    steps:
      - name: Setup Python on MacOS
        uses: actions/setup-python@v5
-        if: >-
-          runner.os == 'macOS' && (
-
-          matrix.version == 'stable-v2.13.5' ||
-
-          matrix.version == 'stable-v2.14.6')
+        if: runner.os == 'macOS' && matrix.version == 'stable-v2.14.6'
        with:
          python-version: '3.11'
      - name: Check out repository
--- a/.github/workflows/__config-export.yml
+++ b/.github/workflows/__config-export.yml
@@ -48,12 +48,7 @@ jobs:
    steps:
      - name: Setup Python on MacOS
        uses: actions/setup-python@v5
-        if: >-
-          runner.os == 'macOS' && (
-
-          matrix.version == 'stable-v2.13.5' ||
-
-          matrix.version == 'stable-v2.14.6')
+        if: runner.os == 'macOS' && matrix.version == 'stable-v2.14.6'
        with:
          python-version: '3.11'
      - name: Check out repository
--- a/.github/workflows/__config-input.yml
+++ b/.github/workflows/__config-input.yml
@@ -38,12 +38,7 @@ jobs:
    steps:
      - name: Setup Python on MacOS
        uses: actions/setup-python@v5
-        if: >-
-          runner.os == 'macOS' && (
-
-          matrix.version == 'stable-v2.13.5' ||
-
-          matrix.version == 'stable-v2.14.6')
+        if: runner.os == 'macOS' && matrix.version == 'stable-v2.14.6'
        with:
          python-version: '3.11'
      - name: Check out repository
--- a/.github/workflows/__cpp-deptrace-disabled.yml
+++ b/.github/workflows/__cpp-deptrace-disabled.yml
@@ -42,12 +42,7 @@ jobs:
    steps:
      - name: Setup Python on MacOS
        uses: actions/setup-python@v5
-        if: >-
-          runner.os == 'macOS' && (
-
-          matrix.version == 'stable-v2.13.5' ||
-
-          matrix.version == 'stable-v2.14.6')
+        if: runner.os == 'macOS' && matrix.version == 'stable-v2.14.6'
        with:
          python-version: '3.11'
      - name: Check out repository
--- a/.github/workflows/__cpp-deptrace-enabled-on-macos.yml
+++ b/.github/workflows/__cpp-deptrace-enabled-on-macos.yml
@@ -38,12 +38,7 @@ jobs:
    steps:
      - name: Setup Python on MacOS
        uses: actions/setup-python@v5
-        if: >-
-          runner.os == 'macOS' && (
-
-          matrix.version == 'stable-v2.13.5' ||
-
-          matrix.version == 'stable-v2.14.6')
+        if: runner.os == 'macOS' && matrix.version == 'stable-v2.14.6'
        with:
          python-version: '3.11'
      - name: Check out repository
--- a/.github/workflows/__cpp-deptrace-enabled.yml
+++ b/.github/workflows/__cpp-deptrace-enabled.yml
@@ -42,12 +42,7 @@ jobs:
    steps:
      - name: Setup Python on MacOS
        uses: actions/setup-python@v5
-        if: >-
-          runner.os == 'macOS' && (
-
-          matrix.version == 'stable-v2.13.5' ||
-
-          matrix.version == 'stable-v2.14.6')
+        if: runner.os == 'macOS' && matrix.version == 'stable-v2.14.6'
        with:
          python-version: '3.11'
      - name: Check out repository
--- a/.github/workflows/__diagnostics-export.yml
+++ b/.github/workflows/__diagnostics-export.yml
@@ -48,12 +48,7 @@ jobs:
    steps:
      - name: Setup Python on MacOS
        uses: actions/setup-python@v5
-        if: >-
-          runner.os == 'macOS' && (
-
-          matrix.version == 'stable-v2.13.5' ||
-
-          matrix.version == 'stable-v2.14.6')
+        if: runner.os == 'macOS' && matrix.version == 'stable-v2.14.6'
        with:
          python-version: '3.11'
      - name: Check out repository
--- a/.github/workflows/__export-file-baseline-information.yml
+++ b/.github/workflows/__export-file-baseline-information.yml
@@ -42,12 +42,7 @@ jobs:
    steps:
      - name: Setup Python on MacOS
        uses: actions/setup-python@v5
-        if: >-
-          runner.os == 'macOS' && (
-
-          matrix.version == 'stable-v2.13.5' ||
-
-          matrix.version == 'stable-v2.14.6')
+        if: runner.os == 'macOS' && matrix.version == 'stable-v2.14.6'
        with:
          python-version: '3.11'
      - name: Check out repository
--- a/.github/workflows/__extractor-ram-threads.yml
+++ b/.github/workflows/__extractor-ram-threads.yml
@@ -38,12 +38,7 @@ jobs:
    steps:
      - name: Setup Python on MacOS
        uses: actions/setup-python@v5
-        if: >-
-          runner.os == 'macOS' && (
-
-          matrix.version == 'stable-v2.13.5' ||
-
-          matrix.version == 'stable-v2.14.6')
+        if: runner.os == 'macOS' && matrix.version == 'stable-v2.14.6'
        with:
          python-version: '3.11'
      - name: Check out repository
--- a/.github/workflows/__go-custom-queries.yml
+++ b/.github/workflows/__go-custom-queries.yml
@@ -40,12 +40,7 @@ jobs:
    steps:
      - name: Setup Python on MacOS
        uses: actions/setup-python@v5
-        if: >-
-          runner.os == 'macOS' && (
-
-          matrix.version == 'stable-v2.13.5' ||
-
-          matrix.version == 'stable-v2.14.6')
+        if: runner.os == 'macOS' && matrix.version == 'stable-v2.14.6'
        with:
          python-version: '3.11'
      - name: Check out repository
--- a/.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml
+++ b/.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml
@@ -38,12 +38,7 @@ jobs:
    steps:
      - name: Setup Python on MacOS
        uses: actions/setup-python@v5
-        if: >-
-          runner.os == 'macOS' && (
-
-          matrix.version == 'stable-v2.13.5' ||
-
-          matrix.version == 'stable-v2.14.6')
+        if: runner.os == 'macOS' && matrix.version == 'stable-v2.14.6'
        with:
          python-version: '3.11'
      - name: Check out repository
--- a/.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml
+++ b/.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml
@@ -38,12 +38,7 @@ jobs:
    steps:
      - name: Setup Python on MacOS
        uses: actions/setup-python@v5
-        if: >-
-          runner.os == 'macOS' && (
-
-          matrix.version == 'stable-v2.13.5' ||
-
-          matrix.version == 'stable-v2.14.6')
+        if: runner.os == 'macOS' && matrix.version == 'stable-v2.14.6'
        with:
          python-version: '3.11'
      - name: Check out repository
--- a/.github/workflows/__go-indirect-tracing-workaround.yml
+++ b/.github/workflows/__go-indirect-tracing-workaround.yml
@@ -38,12 +38,7 @@ jobs:
    steps:
      - name: Setup Python on MacOS
        uses: actions/setup-python@v5
-        if: >-
-          runner.os == 'macOS' && (
-
-          matrix.version == 'stable-v2.13.5' ||
-
-          matrix.version == 'stable-v2.14.6')
+        if: runner.os == 'macOS' && matrix.version == 'stable-v2.14.6'
        with:
          python-version: '3.11'
      - name: Check out repository
--- a/.github/workflows/__go-tracing-autobuilder.yml
+++ b/.github/workflows/__go-tracing-autobuilder.yml
@@ -27,10 +27,6 @@ jobs:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
-            version: stable-v2.13.5
-          - os: macos-12
-            version: stable-v2.13.5
          - os: ubuntu-latest
            version: stable-v2.14.6
          - os: macos-12
@@ -47,6 +43,10 @@ jobs:
            version: stable-v2.17.6
          - os: macos-latest
            version: stable-v2.17.6
+          - os: ubuntu-latest
+            version: stable-v2.18.4
+          - os: macos-latest
+            version: stable-v2.18.4
          - os: ubuntu-latest
            version: default
          - os: macos-latest
@@ -68,12 +68,7 @@ jobs:
    steps:
      - name: Setup Python on MacOS
        uses: actions/setup-python@v5
-        if: >-
-          runner.os == 'macOS' && (
-
-          matrix.version == 'stable-v2.13.5' ||
-
-          matrix.version == 'stable-v2.14.6')
+        if: runner.os == 'macOS' && matrix.version == 'stable-v2.14.6'
        with:
          python-version: '3.11'
      - name: Check out repository
--- a/.github/workflows/__go-tracing-custom-build-steps.yml
+++ b/.github/workflows/__go-tracing-custom-build-steps.yml
@@ -27,10 +27,6 @@ jobs:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
-            version: stable-v2.13.5
-          - os: macos-12
-            version: stable-v2.13.5
          - os: ubuntu-latest
            version: stable-v2.14.6
          - os: macos-12
@@ -47,6 +43,10 @@ jobs:
            version: stable-v2.17.6
          - os: macos-latest
            version: stable-v2.17.6
+          - os: ubuntu-latest
+            version: stable-v2.18.4
+          - os: macos-latest
+            version: stable-v2.18.4
          - os: ubuntu-latest
            version: default
          - os: macos-latest
@@ -68,12 +68,7 @@ jobs:
    steps:
      - name: Setup Python on MacOS
        uses: actions/setup-python@v5
-        if: >-
-          runner.os == 'macOS' && (
-
-          matrix.version == 'stable-v2.13.5' ||
-
-          matrix.version == 'stable-v2.14.6')
+        if: runner.os == 'macOS' && matrix.version == 'stable-v2.14.6'
        with:
          python-version: '3.11'
      - name: Check out repository
--- a/.github/workflows/__go-tracing-legacy-workflow.yml
+++ b/.github/workflows/__go-tracing-legacy-workflow.yml
@@ -27,10 +27,6 @@ jobs:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
-            version: stable-v2.13.5
-          - os: macos-12
-            version: stable-v2.13.5
          - os: ubuntu-latest
            version: stable-v2.14.6
          - os: macos-12
@@ -47,6 +43,10 @@ jobs:
            version: stable-v2.17.6
          - os: macos-latest
            version: stable-v2.17.6
+          - os: ubuntu-latest
+            version: stable-v2.18.4
+          - os: macos-latest
+            version: stable-v2.18.4
          - os: ubuntu-latest
            version: default
          - os: macos-latest
@@ -68,12 +68,7 @@ jobs:
    steps:
      - name: Setup Python on MacOS
        uses: actions/setup-python@v5
-        if: >-
-          runner.os == 'macOS' && (
-
-          matrix.version == 'stable-v2.13.5' ||
-
-          matrix.version == 'stable-v2.14.6')
+        if: runner.os == 'macOS' && matrix.version == 'stable-v2.14.6'
        with:
          python-version: '3.11'
      - name: Check out repository
--- a/.github/workflows/__init-with-registries.yml
+++ b/.github/workflows/__init-with-registries.yml
@@ -55,12 +55,7 @@ jobs:
    steps:
      - name: Setup Python on MacOS
        uses: actions/setup-python@v5
-        if: >-
-          runner.os == 'macOS' && (
-
-          matrix.version == 'stable-v2.13.5' ||
-
-          matrix.version == 'stable-v2.14.6')
+        if: runner.os == 'macOS' && matrix.version == 'stable-v2.14.6'
        with:
          python-version: '3.11'
      - name: Check out repository
--- a/.github/workflows/__javascript-source-root.yml
+++ b/.github/workflows/__javascript-source-root.yml
@@ -42,12 +42,7 @@ jobs:
    steps:
      - name: Setup Python on MacOS
        uses: actions/setup-python@v5
-        if: >-
-          runner.os == 'macOS' && (
-
-          matrix.version == 'stable-v2.13.5' ||
-
-          matrix.version == 'stable-v2.14.6')
+        if: runner.os == 'macOS' && matrix.version == 'stable-v2.14.6'
        with:
          python-version: '3.11'
      - name: Check out repository
--- a/.github/workflows/__job-run-uuid-sarif.yml
+++ b/.github/workflows/__job-run-uuid-sarif.yml
@@ -38,12 +38,7 @@ jobs:
    steps:
      - name: Setup Python on MacOS
        uses: actions/setup-python@v5
-        if: >-
-          runner.os == 'macOS' && (
-
-          matrix.version == 'stable-v2.13.5' ||
-
-          matrix.version == 'stable-v2.14.6')
+        if: runner.os == 'macOS' && matrix.version == 'stable-v2.14.6'
        with:
          python-version: '3.11'
      - name: Check out repository
--- a/.github/workflows/__language-aliases.yml
+++ b/.github/workflows/__language-aliases.yml
@@ -38,12 +38,7 @@ jobs:
    steps:
      - name: Setup Python on MacOS
        uses: actions/setup-python@v5
-        if: >-
-          runner.os == 'macOS' && (
-
-          matrix.version == 'stable-v2.13.5' ||
-
-          matrix.version == 'stable-v2.14.6')
+        if: runner.os == 'macOS' && matrix.version == 'stable-v2.14.6'
        with:
          python-version: '3.11'
      - name: Check out repository
--- a/.github/workflows/__multi-language-autodetect.yml
+++ b/.github/workflows/__multi-language-autodetect.yml
@@ -27,10 +27,6 @@ jobs:
      fail-fast: false
      matrix:
        include:
-          - os: macos-12
-            version: stable-v2.13.5
-          - os: ubuntu-latest
-            version: stable-v2.13.5
          - os: macos-12
            version: stable-v2.14.6
          - os: ubuntu-latest
@@ -47,6 +43,10 @@ jobs:
            version: stable-v2.17.6
          - os: ubuntu-latest
            version: stable-v2.17.6
+          - os: macos-latest
+            version: stable-v2.18.4
+          - os: ubuntu-latest
+            version: stable-v2.18.4
          - os: macos-latest
            version: default
          - os: ubuntu-latest
@@ -68,12 +68,7 @@ jobs:
    steps:
      - name: Setup Python on MacOS
        uses: actions/setup-python@v5
-        if: >-
-          runner.os == 'macOS' && (
-
-          matrix.version == 'stable-v2.13.5' ||
-
-          matrix.version == 'stable-v2.14.6')
+        if: runner.os == 'macOS' && matrix.version == 'stable-v2.14.6'
        with:
          python-version: '3.11'
      - name: Check out repository
--- a/.github/workflows/__packaging-codescanning-config-inputs-js.yml
+++ b/.github/workflows/__packaging-codescanning-config-inputs-js.yml
@@ -54,12 +54,7 @@ jobs:
    steps:
      - name: Setup Python on MacOS
        uses: actions/setup-python@v5
-        if: >-
-          runner.os == 'macOS' && (
-
-          matrix.version == 'stable-v2.13.5' ||
-
-          matrix.version == 'stable-v2.14.6')
+        if: runner.os == 'macOS' && matrix.version == 'stable-v2.14.6'
        with:
          python-version: '3.11'
      - name: Check out repository
--- a/.github/workflows/__packaging-config-inputs-js.yml
+++ b/.github/workflows/__packaging-config-inputs-js.yml
@@ -54,12 +54,7 @@ jobs:
    steps:
      - name: Setup Python on MacOS
        uses: actions/setup-python@v5
-        if: >-
-          runner.os == 'macOS' && (
-
-          matrix.version == 'stable-v2.13.5' ||
-
-          matrix.version == 'stable-v2.14.6')
+        if: runner.os == 'macOS' && matrix.version == 'stable-v2.14.6'
        with:
          python-version: '3.11'
      - name: Check out repository
--- a/.github/workflows/__packaging-config-js.yml
+++ b/.github/workflows/__packaging-config-js.yml
@@ -54,12 +54,7 @@ jobs:
    steps:
      - name: Setup Python on MacOS
        uses: actions/setup-python@v5
-        if: >-
-          runner.os == 'macOS' && (
-
-          matrix.version == 'stable-v2.13.5' ||
-
-          matrix.version == 'stable-v2.14.6')
+        if: runner.os == 'macOS' && matrix.version == 'stable-v2.14.6'
        with:
          python-version: '3.11'
      - name: Check out repository
--- a/.github/workflows/__packaging-inputs-js.yml
+++ b/.github/workflows/__packaging-inputs-js.yml
@@ -54,12 +54,7 @@ jobs:
    steps:
      - name: Setup Python on MacOS
        uses: actions/setup-python@v5
-        if: >-
-          runner.os == 'macOS' && (
-
-          matrix.version == 'stable-v2.13.5' ||
-
-          matrix.version == 'stable-v2.14.6')
+        if: runner.os == 'macOS' && matrix.version == 'stable-v2.14.6'
        with:
          python-version: '3.11'
      - name: Check out repository
--- a/.github/workflows/__remote-config.yml
+++ b/.github/workflows/__remote-config.yml
@@ -40,12 +40,7 @@ jobs:
    steps:
      - name: Setup Python on MacOS
        uses: actions/setup-python@v5
-        if: >-
-          runner.os == 'macOS' && (
-
-          matrix.version == 'stable-v2.13.5' ||
-
-          matrix.version == 'stable-v2.14.6')
+        if: runner.os == 'macOS' && matrix.version == 'stable-v2.14.6'
        with:
          python-version: '3.11'
      - name: Check out repository
--- a/.github/workflows/__resolve-environment-action.yml
+++ b/.github/workflows/__resolve-environment-action.yml
@@ -27,12 +27,6 @@ jobs:
      fail-fast: false
      matrix:
        include:
-          - os: ubuntu-latest
-            version: stable-v2.13.5
-          - os: macos-12
-            version: stable-v2.13.5
-          - os: windows-latest
-            version: stable-v2.13.5
          - os: ubuntu-latest
            version: default
          - os: macos-latest
@@ -60,12 +54,7 @@ jobs:
    steps:
      - name: Setup Python on MacOS
        uses: actions/setup-python@v5
-        if: >-
-          runner.os == 'macOS' && (
-
-          matrix.version == 'stable-v2.13.5' ||
-
-          matrix.version == 'stable-v2.14.6')
+        if: runner.os == 'macOS' && matrix.version == 'stable-v2.14.6'
        with:
          python-version: '3.11'
      - name: Check out repository
@@ -79,8 +68,7 @@ jobs:
          setup-kotlin: 'true'
      - uses: ./../action/init
        with:
-          languages: ${{ matrix.version == 'stable-v2.13.5' && 'go' || 'go,javascript-typescript'
-            }}
+          languages: go,javascript-typescript
          tools: ${{ steps.prepare-test.outputs.tools-url }}

      - name: Resolve environment for Go
@@ -94,14 +82,13 @@ jobs:
        run: exit 1

      - name: Resolve environment for JavaScript/TypeScript
-        if: matrix.version != 'stable-v2.13.5'
        uses: ./../action/resolve-environment
        id: resolve-environment-js
        with:
          language: javascript-typescript

      - name: Fail if JavaScript/TypeScript configuration present
-        if: matrix.version != 'stable-v2.13.5' && 
+        if: 
          fromJSON(steps.resolve-environment-js.outputs.environment).configuration.javascript
        run: exit 1
    env:
--- a/.github/workflows/__rubocop-multi-language.yml
+++ b/.github/workflows/__rubocop-multi-language.yml
@@ -38,12 +38,7 @@ jobs:
    steps:
      - name: Setup Python on MacOS
        uses: actions/setup-python@v5
-        if: >-
-          runner.os == 'macOS' && (
-
-          matrix.version == 'stable-v2.13.5' ||
-
-          matrix.version == 'stable-v2.14.6')
+        if: runner.os == 'macOS' && matrix.version == 'stable-v2.14.6'
        with:
          python-version: '3.11'
      - name: Check out repository
--- a/.github/workflows/__ruby.yml
+++ b/.github/workflows/__ruby.yml
@@ -48,12 +48,7 @@ jobs:
    steps:
      - name: Setup Python on MacOS
        uses: actions/setup-python@v5
-        if: >-
-          runner.os == 'macOS' && (
-
-          matrix.version == 'stable-v2.13.5' ||
-
-          matrix.version == 'stable-v2.14.6')
+        if: runner.os == 'macOS' && matrix.version == 'stable-v2.14.6'
        with:
          python-version: '3.11'
      - name: Check out repository
--- a/.github/workflows/__split-workflow.yml
+++ b/.github/workflows/__split-workflow.yml
@@ -48,12 +48,7 @@ jobs:
    steps:
      - name: Setup Python on MacOS
        uses: actions/setup-python@v5
-        if: >-
-          runner.os == 'macOS' && (
-
-          matrix.version == 'stable-v2.13.5' ||
-
-          matrix.version == 'stable-v2.14.6')
+        if: runner.os == 'macOS' && matrix.version == 'stable-v2.14.6'
        with:
          python-version: '3.11'
      - name: Check out repository
--- a/.github/workflows/__submit-sarif-failure.yml
+++ b/.github/workflows/__submit-sarif-failure.yml
@@ -42,12 +42,7 @@ jobs:
    steps:
      - name: Setup Python on MacOS
        uses: actions/setup-python@v5
-        if: >-
-          runner.os == 'macOS' && (
-
-          matrix.version == 'stable-v2.13.5' ||
-
-          matrix.version == 'stable-v2.14.6')
+        if: runner.os == 'macOS' && matrix.version == 'stable-v2.14.6'
        with:
          python-version: '3.11'
      - name: Check out repository
--- a/.github/workflows/__swift-autobuild.yml
+++ b/.github/workflows/__swift-autobuild.yml
@@ -38,12 +38,7 @@ jobs:
    steps:
      - name: Setup Python on MacOS
        uses: actions/setup-python@v5
-        if: >-
-          runner.os == 'macOS' && (
-
-          matrix.version == 'stable-v2.13.5' ||
-
-          matrix.version == 'stable-v2.14.6')
+        if: runner.os == 'macOS' && matrix.version == 'stable-v2.14.6'
        with:
          python-version: '3.11'
      - name: Check out repository
--- a/.github/workflows/__swift-custom-build.yml
+++ b/.github/workflows/__swift-custom-build.yml
@@ -42,12 +42,7 @@ jobs:
    steps:
      - name: Setup Python on MacOS
        uses: actions/setup-python@v5
-        if: >-
-          runner.os == 'macOS' && (
-
-          matrix.version == 'stable-v2.13.5' ||
-
-          matrix.version == 'stable-v2.14.6')
+        if: runner.os == 'macOS' && matrix.version == 'stable-v2.14.6'
        with:
          python-version: '3.11'
      - name: Check out repository
--- a/.github/workflows/__test-autobuild-working-dir.yml
+++ b/.github/workflows/__test-autobuild-working-dir.yml
@@ -38,12 +38,7 @@ jobs:
    steps:
      - name: Setup Python on MacOS
        uses: actions/setup-python@v5
-        if: >-
-          runner.os == 'macOS' && (
-
-          matrix.version == 'stable-v2.13.5' ||
-
-          matrix.version == 'stable-v2.14.6')
+        if: runner.os == 'macOS' && matrix.version == 'stable-v2.14.6'
        with:
          python-version: '3.11'
      - name: Check out repository
--- a/.github/workflows/__test-local-codeql.yml
+++ b/.github/workflows/__test-local-codeql.yml
@@ -38,12 +38,7 @@ jobs:
    steps:
      - name: Setup Python on MacOS
        uses: actions/setup-python@v5
-        if: >-
-          runner.os == 'macOS' && (
-
-          matrix.version == 'stable-v2.13.5' ||
-
-          matrix.version == 'stable-v2.14.6')
+        if: runner.os == 'macOS' && matrix.version == 'stable-v2.14.6'
        with:
          python-version: '3.11'
      - name: Check out repository
--- a/.github/workflows/__test-proxy.yml
+++ b/.github/workflows/__test-proxy.yml
@@ -38,12 +38,7 @@ jobs:
    steps:
      - name: Setup Python on MacOS
        uses: actions/setup-python@v5
-        if: >-
-          runner.os == 'macOS' && (
-
-          matrix.version == 'stable-v2.13.5' ||
-
-          matrix.version == 'stable-v2.14.6')
+        if: runner.os == 'macOS' && matrix.version == 'stable-v2.14.6'
        with:
          python-version: '3.11'
      - name: Check out repository
--- a/.github/workflows/__unset-environment.yml
+++ b/.github/workflows/__unset-environment.yml
@@ -40,12 +40,7 @@ jobs:
    steps:
      - name: Setup Python on MacOS
        uses: actions/setup-python@v5
-        if: >-
-          runner.os == 'macOS' && (
-
-          matrix.version == 'stable-v2.13.5' ||
-
-          matrix.version == 'stable-v2.14.6')
+        if: runner.os == 'macOS' && matrix.version == 'stable-v2.14.6'
        with:
          python-version: '3.11'
      - name: Check out repository
--- a/.github/workflows/__upload-ref-sha-input.yml
+++ b/.github/workflows/__upload-ref-sha-input.yml
@@ -42,12 +42,7 @@ jobs:
    steps:
      - name: Setup Python on MacOS
        uses: actions/setup-python@v5
-        if: >-
-          runner.os == 'macOS' && (
-
-          matrix.version == 'stable-v2.13.5' ||
-
-          matrix.version == 'stable-v2.14.6')
+        if: runner.os == 'macOS' && matrix.version == 'stable-v2.14.6'
        with:
          python-version: '3.11'
      - name: Check out repository
--- a/.github/workflows/__with-checkout-path.yml
+++ b/.github/workflows/__with-checkout-path.yml
@@ -42,12 +42,7 @@ jobs:
    steps:
      - name: Setup Python on MacOS
        uses: actions/setup-python@v5
-        if: >-
-          runner.os == 'macOS' && (
-
-          matrix.version == 'stable-v2.13.5' ||
-
-          matrix.version == 'stable-v2.14.6')
+        if: runner.os == 'macOS' && matrix.version == 'stable-v2.14.6'
        with:
          python-version: '3.11'
      - name: Check out repository
--- a/.github/workflows/__zstd-bundle-fallback.yml
+++ b/.github/workflows/__zstd-bundle-fallback.yml
@@ -40,12 +40,7 @@ jobs:
    steps:
      - name: Setup Python on MacOS
        uses: actions/setup-python@v5
-        if: >-
-          runner.os == 'macOS' && (
-
-          matrix.version == 'stable-v2.13.5' ||
-
-          matrix.version == 'stable-v2.14.6')
+        if: runner.os == 'macOS' && matrix.version == 'stable-v2.14.6'
        with:
          python-version: '3.11'
      - name: Check out repository
--- a/.github/workflows/__zstd-bundle-streaming.yml
+++ b/.github/workflows/__zstd-bundle-streaming.yml
@@ -0,0 +1,113 @@
+# Warning: This file is generated automatically, and should not be modified.
+# Instead, please modify the template in the pr-checks directory and run:
+#     (cd pr-checks; pip install ruamel.yaml@0.17.31 && python3 sync.py)
+# to regenerate this file.
+
+name: PR Check - Zstandard bundle (streaming)
+env:
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  GO111MODULE: auto
+on:
+  push:
+    branches:
+      - main
+      - releases/v*
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
+  schedule:
+    - cron: '0 5 * * *'
+  workflow_dispatch: {}
+jobs:
+  zstd-bundle-streaming:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: macos-latest
+            version: linked
+          - os: ubuntu-latest
+            version: linked
+    name: Zstandard bundle (streaming)
+    permissions:
+      contents: read
+      security-events: write
+    timeout-minutes: 45
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Setup Python on MacOS
+        uses: actions/setup-python@v5
+        if: runner.os == 'macOS' && matrix.version == 'stable-v2.14.6'
+        with:
+          python-version: '3.11'
+      - name: Check out repository
+        uses: actions/checkout@v4
+      - name: Prepare test
+        id: prepare-test
+        uses: ./.github/actions/prepare-test
+        with:
+          version: ${{ matrix.version }}
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
+      - name: Remove CodeQL from toolcache
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const fs = require('fs');
+            const path = require('path');
+            const codeqlPath = path.join(process.env['RUNNER_TOOL_CACHE'], 'CodeQL');
+            fs.rmdirSync(codeqlPath, { recursive: true });
+      - id: init
+        uses: ./../action/init
+        with:
+          languages: javascript
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
+      - uses: ./../action/analyze
+        with:
+          output: ${{ runner.temp }}/results
+          upload-database: false
+      - name: Upload SARIF
+        uses: actions/upload-artifact@v3
+        with:
+          name: zstd-bundle.sarif
+          path: ${{ runner.temp }}/results/javascript.sarif
+          retention-days: 7
+      - name: Check diagnostic with expected tools URL appears in SARIF
+        uses: actions/github-script@v7
+        env:
+          SARIF_PATH: ${{ runner.temp }}/results/javascript.sarif
+        with:
+          script: |
+            const fs = require('fs');
+
+            const sarif = JSON.parse(fs.readFileSync(process.env['SARIF_PATH'], 'utf8'));
+            const run = sarif.runs[0];
+
+            const toolExecutionNotifications = run.invocations[0].toolExecutionNotifications;
+            const downloadTelemetryNotifications = toolExecutionNotifications.filter(n =>
+              n.descriptor.id === 'codeql-action/bundle-download-telemetry'
+            );
+            if (downloadTelemetryNotifications.length !== 1) {
+              core.setFailed(
+                'Expected exactly one reporting descriptor in the ' +
+                  `'runs[].invocations[].toolExecutionNotifications[]' SARIF property, but found ` +
+                  `${downloadTelemetryNotifications.length}. All notification reporting descriptors: ` +
+                  `${JSON.stringify(toolExecutionNotifications)}.`
+              );
+            }
+
+            const toolsUrl = downloadTelemetryNotifications[0].properties.attributes.toolsUrl;
+            console.log(`Found tools URL: ${toolsUrl}`);
+
+            if (!toolsUrl.endsWith('.tar.zst')) {
+              core.setFailed(
+                `Expected the tools URL to be a .tar.zst file, but found ${toolsUrl}.`
+              );
+            }
+    env:
+      CODEQL_ACTION_ZSTD_BUNDLE: true
+      CODEQL_ACTION_ZSTD_BUNDLE_STREAMING_EXTRACTION: true
+      CODEQL_ACTION_TEST_MODE: true
--- a/.github/workflows/__zstd-bundle.yml
+++ b/.github/workflows/__zstd-bundle.yml
@@ -42,12 +42,7 @@ jobs:
    steps:
      - name: Setup Python on MacOS
        uses: actions/setup-python@v5
-        if: >-
-          runner.os == 'macOS' && (
-
-          matrix.version == 'stable-v2.13.5' ||
-
-          matrix.version == 'stable-v2.14.6')
+        if: runner.os == 'macOS' && matrix.version == 'stable-v2.14.6'
        with:
          python-version: '3.11'
      - name: Check out repository
--- a/.github/workflows/debug-artifacts-legacy.yml
+++ b/.github/workflows/debug-artifacts-legacy.yml
@@ -24,11 +24,11 @@ jobs:
      fail-fast: false
      matrix:
        version:
-        - stable-v2.13.5
        - stable-v2.14.6
        - stable-v2.15.5
        - stable-v2.16.6
        - stable-v2.17.6
+        - stable-v2.18.4
        - default
        - linked
        - nightly-latest
@@ -73,7 +73,7 @@ jobs:
      - name: Check expected artifacts exist
        shell: bash
        run: |
-          VERSIONS="stable-v2.13.5 stable-v2.14.6 stable-v2.15.5 stable-v2.16.6 stable-v2.17.6 default linked nightly-latest"
+          VERSIONS="stable-v2.14.6 stable-v2.15.5 stable-v2.16.6 stable-v2.17.6 stable-v2.18.4 default linked nightly-latest"
          LANGUAGES="cpp csharp go java javascript python"
          for version in $VERSIONS; do
            pushd "./my-debug-artifacts-${version//./}"
--- a/.github/workflows/debug-artifacts.yml
+++ b/.github/workflows/debug-artifacts.yml
@@ -23,11 +23,11 @@ jobs:
      fail-fast: false
      matrix:
        version:
-        - stable-v2.13.5
        - stable-v2.14.6
        - stable-v2.15.5
        - stable-v2.16.6
        - stable-v2.17.6
+        - stable-v2.18.4
        - default
        - linked
        - nightly-latest
@@ -72,7 +72,7 @@ jobs:
      - name: Check expected artifacts exist
        shell: bash
        run: |
-          VERSIONS="stable-v2.13.5 stable-v2.14.6 stable-v2.15.5 stable-v2.16.6 stable-v2.17.6 default linked nightly-latest"
+          VERSIONS="stable-v2.14.6 stable-v2.15.5 stable-v2.16.6 stable-v2.17.6 stable-v2.18.4 default linked nightly-latest"
          LANGUAGES="cpp csharp go java javascript python"
          for version in $VERSIONS; do
            pushd "./my-debug-artifacts-${version//./}"
--- a/.github/workflows/post-release-mergeback.yml
+++ b/.github/workflows/post-release-mergeback.yml
@@ -108,6 +108,17 @@ jobs:
          # - `--force` since we're overwriting the `vN` tag
          git push origin --atomic --force refs/tags/"${VERSION}" refs/tags/"${major_version_tag}"

+      - name: Prepare partial Changelog
+        env:
+          PARTIAL_CHANGELOG: "${{ runner.temp }}/partial_changelog.md"
+          VERSION: "${{ steps.getVersion.outputs.version }}"
+        run: |
+          python .github/workflows/script/prepare_changelog.py CHANGELOG.md "$VERSION" > $PARTIAL_CHANGELOG
+
+          echo "::group::Partial CHANGELOG"
+          cat $PARTIAL_CHANGELOG
+          echo "::endgroup::"
+
      - name: Create mergeback branch
        if: ${{ steps.check.outputs.exists != 'true' && endsWith(github.ref_name, steps.getVersion.outputs.latest_release_branch) }}
        env:
@@ -150,3 +161,16 @@ jobs:
            --body "${pr_body}" \
            --assignee "${GITHUB_ACTOR}" \
            --draft
+
+      - name: Create the GitHub release
+        env:
+          PARTIAL_CHANGELOG: "${{ runner.temp }}/partial_changelog.md"
+          VERSION: "${{ steps.getVersion.outputs.version }}"
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          # Do not mark this release as latest. The most recent CLI release must be marked as latest.
+          gh release create \
+            "$VERSION" \
+            --latest=false \
+            --title "$VERSION" \
+            --notes-file "$PARTIAL_CHANGELOG"
--- a/.github/workflows/pr-checks.yml
+++ b/.github/workflows/pr-checks.yml
@@ -13,6 +13,9 @@ jobs:
    name: Check JS
    runs-on: ubuntu-latest
    timeout-minutes: 45
+    permissions:
+      contents: read
+      security-events: write

    strategy:
      fail-fast: false
--- a/.github/workflows/script/prepare_changelog.py
+++ b/.github/workflows/script/prepare_changelog.py
@@ -0,0 +1,37 @@
+import os
+import sys
+
+EMPTY_CHANGELOG = 'No changes.\n\n'
+
+# Prepare the changelog for the new release
+# This function will extract the part of the changelog that
+# we want to include in the new release.
+def extract_changelog_snippet(changelog_file, version_tag):
+  output = ''
+  if (not os.path.exists(changelog_file)):
+    output = EMPTY_CHANGELOG
+
+  else:
+    with open('CHANGELOG.md', 'r') as f:
+      lines = f.readlines()
+
+      # Include everything up to, but excluding the second heading
+      found_first_section = False
+      for i, line in enumerate(lines):
+        if line.startswith('## '):
+          if found_first_section:
+            break
+          found_first_section = True
+        output += line
+
+  output += f"See the full [CHANGELOG.md](https://github.com/github/codeql-action/blob/{version_tag}/CHANGELOG.md) for more information."
+
+  return output
+
+
+if len(sys.argv) < 3:
+  raise Exception('Expecting argument: changelog_file version_tag')
+changelog_file = sys.argv[1]
+version_tag = sys.argv[2]
+
+print(extract_changelog_snippet(changelog_file, version_tag))
--- a/.github/workflows/script/update-required-checks.sh
+++ b/.github/workflows/script/update-required-checks.sh
@@ -27,8 +27,8 @@ fi

 echo "Getting checks for $GITHUB_SHA"

-# Ignore any checks with "https://", CodeQL, LGTM, and Update checks.
-CHECKS="$(gh api repos/github/codeql-action/commits/"${GITHUB_SHA}"/check-runs --paginate | jq --slurp --compact-output --raw-output '[.[].check_runs.[] | select(.conclusion != "skipped") | .name | select(contains("https://") or . == "CodeQL" or . == "Dependabot" or . == "check-expected-release-files" or contains("Update") or contains("update") or contains("test-setup-python-scripts") | not)] | unique | sort')"
+# Ignore any checks with "https://", CodeQL, LGTM, Update, and ESLint checks.
+CHECKS="$(gh api repos/github/codeql-action/commits/"${GITHUB_SHA}"/check-runs --paginate | jq --slurp --compact-output --raw-output '[.[].check_runs.[] | select(.conclusion != "skipped") | .name | select(contains("https://") or . == "CodeQL" or . == "Dependabot" or . == "check-expected-release-files" or contains("Update") or contains("ESLint") or contains("update") or contains("test-setup-python-scripts") | not)] | unique | sort')"

 echo "$CHECKS" | jq