diff --git a/.github/workflows/__unsupported-macos.yml b/.github/workflows/__unsupported-macos.yml
new file mode 100644
index 0000000000..38fc9e9579
--- /dev/null
+++ b/.github/workflows/__unsupported-macos.yml
@@ -0,0 +1,131 @@
+# Warning: This file is generated automatically, and should not be modified.
+# Instead, please modify the template in the pr-checks directory and run:
+#     pr-checks/sync.sh
+# to regenerate this file.
+
+name: PR Check - Unsupported macOS
+env:
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  GO111MODULE: auto
+on:
+  push:
+    branches:
+      - main
+      - releases/v*
+  pull_request: {}
+  merge_group:
+    types:
+      - checks_requested
+  schedule:
+    - cron: '0 5 * * *'
+  workflow_dispatch:
+    inputs: {}
+  workflow_call:
+    inputs: {}
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
+  group: unsupported-macos-${{github.ref}}
+jobs:
+  unsupported-macos:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: xcode-27
+            version: linked
+          - os: xcode-27
+            version: nightly-latest
+    name: Unsupported macOS
+    if: github.triggering_actor != 'dependabot[bot]'
+    permissions:
+      contents: read
+      security-events: read
+    timeout-minutes: 45
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Node.js
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 20.x
+          cache: npm
+      - name: Install newer npm
+        run: npm install -g npm@11.19.1
+      - name: Install dependencies
+        run: npm ci
+      - name: Prepare test
+        id: prepare-test
+        uses: ./.github/actions/prepare-test
+        with:
+          version: ${{ matrix.version }}
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
+      - name: Check xcode_select_link
+        run: |
+          readlink /private/var/db/xcode_select_link
+          file -h /private/var/db/xcode_select_link
+
+      - uses: ./../action/init
+        id: init
+        with:
+          languages: swift
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
+
+      - name: Analyze
+        # We could run `analyze` here from `./../analyze`, but `getAnalyzeActionName` in `workflow.ts`
+        # can't cope with that unless we introduce a different testing environment. Since this step
+        # would just fail on `xcode-27` anyway, we just skip it instead.
+        if: false
+        uses: ./analyze
+        with:
+          category: '/test-codeql-version:${{ matrix.version }}'
+    env:
+      CODEQL_ACTION_SKIP_GENERATE_FAILED_SARIF: false
+      CODEQL_ACTION_SKIP_SARIF_UPLOAD: true
+      CODEQL_ACTION_TESTING_ENVIRONMENT: codeql-action-pr-checks
+      CODEQL_ACTION_TEST_MODE: true
+  unsupported-macos-sarif-checks:
+    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - unsupported-macos
+    permissions:
+      contents: read
+      security-events: read
+    timeout-minutes: 5
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Node.js
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 20.x
+          cache: npm
+      - name: Install newer npm
+        run: npm install -g npm@11.19.1
+      - name: Install dependencies
+        run: npm ci
+      - name: Download workflow artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          pattern: test-mode-sarif-*
+          path: sarif
+
+      - name: List artifact contents
+        run: ls -laR ./sarif
+
+      - name: Check diagnostics appear in SARIF
+        env:
+          SARIF_PATH: "./sarif/"
+          DIAGNOSTIC_ID: "codeql-action/unsupported-traced-analysis-macos"
+          DIAGNOSTIC_NAME: "Traced analysis is not supported on this version of macOS"
+          EXPECTED_LOCATIONS: "0"
+          EXPECTED_MESSAGE: |
+            Traced analysis is not supported on macOS 27 or above.
+        run: npx tsx ./pr-checks/check-diagnostics.ts
+    env:
+      CODEQL_ACTION_TEST_MODE: true
diff --git a/lib/entry-points.js b/lib/entry-points.js
index 7cea6c0b6d..62360250b9 100644
--- a/lib/entry-points.js
+++ b/lib/entry-points.js
@@ -117,11 +117,11 @@ var require_command = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.issueCommand = issueCommand;
     exports2.issue = issue;
-    var os7 = __importStar2(require("os"));
+    var os8 = __importStar2(require("os"));
     var utils_1 = require_utils();
     function issueCommand(command, properties, message) {
       const cmd = new Command(command, properties, message);
-      process.stdout.write(cmd.toString() + os7.EOL);
+      process.stdout.write(cmd.toString() + os8.EOL);
     }
     function issue(name, message = "") {
       issueCommand(name, {}, message);
@@ -213,18 +213,18 @@ var require_file_command = __commonJS({
     exports2.issueFileCommand = issueFileCommand;
     exports2.prepareKeyValueMessage = prepareKeyValueMessage;
     var crypto3 = __importStar2(require("crypto"));
-    var fs33 = __importStar2(require("fs"));
-    var os7 = __importStar2(require("os"));
+    var fs34 = __importStar2(require("fs"));
+    var os8 = __importStar2(require("os"));
     var utils_1 = require_utils();
     function issueFileCommand(command, message) {
       const filePath = process.env[`GITHUB_${command}`];
       if (!filePath) {
         throw new Error(`Unable to find environment variable for file command ${command}`);
       }
-      if (!fs33.existsSync(filePath)) {
+      if (!fs34.existsSync(filePath)) {
         throw new Error(`Missing file at path: ${filePath}`);
       }
-      fs33.appendFileSync(filePath, `${(0, utils_1.toCommandValue)(message)}${os7.EOL}`, {
+      fs34.appendFileSync(filePath, `${(0, utils_1.toCommandValue)(message)}${os8.EOL}`, {
         encoding: "utf8"
       });
     }
@@ -237,7 +237,7 @@ var require_file_command = __commonJS({
       if (convertedValue.includes(delimiter)) {
         throw new Error(`Unexpected input: value should not contain the delimiter "${delimiter}"`);
       }
-      return `${key}<<${delimiter}${os7.EOL}${convertedValue}${os7.EOL}${delimiter}`;
+      return `${key}<<${delimiter}${os8.EOL}${convertedValue}${os8.EOL}${delimiter}`;
     }
   }
 });
@@ -20443,13 +20443,13 @@ var require_io_util = __commonJS({
     exports2.isRooted = isRooted;
     exports2.tryGetExecutablePath = tryGetExecutablePath;
     exports2.getCmdPath = getCmdPath;
-    var fs33 = __importStar2(require("fs"));
+    var fs34 = __importStar2(require("fs"));
     var path30 = __importStar2(require("path"));
-    _a6 = fs33.promises, exports2.chmod = _a6.chmod, exports2.copyFile = _a6.copyFile, exports2.lstat = _a6.lstat, exports2.mkdir = _a6.mkdir, exports2.open = _a6.open, exports2.readdir = _a6.readdir, exports2.rename = _a6.rename, exports2.rm = _a6.rm, exports2.rmdir = _a6.rmdir, exports2.stat = _a6.stat, exports2.symlink = _a6.symlink, exports2.unlink = _a6.unlink;
+    _a6 = fs34.promises, exports2.chmod = _a6.chmod, exports2.copyFile = _a6.copyFile, exports2.lstat = _a6.lstat, exports2.mkdir = _a6.mkdir, exports2.open = _a6.open, exports2.readdir = _a6.readdir, exports2.rename = _a6.rename, exports2.rm = _a6.rm, exports2.rmdir = _a6.rmdir, exports2.stat = _a6.stat, exports2.symlink = _a6.symlink, exports2.unlink = _a6.unlink;
     exports2.IS_WINDOWS = process.platform === "win32";
     function readlink(fsPath) {
       return __awaiter2(this, void 0, void 0, function* () {
-        const result = yield fs33.promises.readlink(fsPath);
+        const result = yield fs34.promises.readlink(fsPath);
         if (exports2.IS_WINDOWS && !result.endsWith("\\")) {
           return `${result}\\`;
         }
@@ -20457,7 +20457,7 @@ var require_io_util = __commonJS({
       });
     }
     exports2.UV_FS_O_EXLOCK = 268435456;
-    exports2.READONLY = fs33.constants.O_RDONLY;
+    exports2.READONLY = fs34.constants.O_RDONLY;
     function exists(fsPath) {
       return __awaiter2(this, void 0, void 0, function* () {
         try {
@@ -20895,7 +20895,7 @@ var require_toolrunner = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.ToolRunner = void 0;
     exports2.argStringToArray = argStringToArray;
-    var os7 = __importStar2(require("os"));
+    var os8 = __importStar2(require("os"));
     var events = __importStar2(require("events"));
     var child = __importStar2(require("child_process"));
     var path30 = __importStar2(require("path"));
@@ -20950,12 +20950,12 @@ var require_toolrunner = __commonJS({
       _processLineBuffer(data, strBuffer, onLine) {
         try {
           let s = strBuffer + data.toString();
-          let n = s.indexOf(os7.EOL);
+          let n = s.indexOf(os8.EOL);
           while (n > -1) {
             const line = s.substring(0, n);
             onLine(line);
-            s = s.substring(n + os7.EOL.length);
-            n = s.indexOf(os7.EOL);
+            s = s.substring(n + os8.EOL.length);
+            n = s.indexOf(os8.EOL);
           }
           return s;
         } catch (err) {
@@ -21124,7 +21124,7 @@ var require_toolrunner = __commonJS({
             }
             const optionsNonNull = this._cloneExecOptions(this.options);
             if (!optionsNonNull.silent && optionsNonNull.outStream) {
-              optionsNonNull.outStream.write(this._getCommandString(optionsNonNull) + os7.EOL);
+              optionsNonNull.outStream.write(this._getCommandString(optionsNonNull) + os8.EOL);
             }
             const state = new ExecState(optionsNonNull, this.toolPath);
             state.on("debug", (message) => {
@@ -21665,7 +21665,7 @@ var require_core = __commonJS({
     var command_1 = require_command();
     var file_command_1 = require_file_command();
     var utils_1 = require_utils();
-    var os7 = __importStar2(require("os"));
+    var os8 = __importStar2(require("os"));
     var path30 = __importStar2(require("path"));
     var oidc_utils_1 = require_oidc_utils();
     var ExitCode;
@@ -21727,7 +21727,7 @@ Support boolean input list: \`true | True | TRUE | false | False | FALSE\``);
       if (filePath) {
         return (0, file_command_1.issueFileCommand)("OUTPUT", (0, file_command_1.prepareKeyValueMessage)(name, value));
       }
-      process.stdout.write(os7.EOL);
+      process.stdout.write(os8.EOL);
       (0, command_1.issueCommand)("set-output", { name }, (0, utils_1.toCommandValue)(value));
     }
     function setCommandEcho(enabled) {
@@ -21753,7 +21753,7 @@ Support boolean input list: \`true | True | TRUE | false | False | FALSE\``);
       (0, command_1.issueCommand)("notice", (0, utils_1.toCommandProperties)(properties), message instanceof Error ? message.toString() : message);
     }
     function info8(message) {
-      process.stdout.write(message + os7.EOL);
+      process.stdout.write(message + os8.EOL);
     }
     function startGroup3(name) {
       (0, command_1.issue)("group", name);
@@ -26831,8 +26831,8 @@ var require_semver = __commonJS({
       }
       // preminor will bump the version up to the next minor release, and immediately
       // down to pre-release. premajor and prepatch work the same way.
-      inc(release2, identifier, identifierBase) {
-        if (release2.startsWith("pre")) {
+      inc(release3, identifier, identifierBase) {
+        if (release3.startsWith("pre")) {
           if (!identifier && identifierBase === false) {
             throw new Error("invalid increment argument: identifier is empty");
           }
@@ -26843,7 +26843,7 @@ var require_semver = __commonJS({
             }
           }
         }
-        switch (release2) {
+        switch (release3) {
           case "premajor":
             this.prerelease.length = 0;
             this.patch = 0;
@@ -26935,7 +26935,7 @@ var require_semver = __commonJS({
             break;
           }
           default:
-            throw new Error(`invalid increment argument: ${release2}`);
+            throw new Error(`invalid increment argument: ${release3}`);
         }
         this.raw = this.format();
         if (this.build.length) {
@@ -26953,7 +26953,7 @@ var require_parse2 = __commonJS({
   "node_modules/semver/functions/parse.js"(exports2, module2) {
     "use strict";
     var SemVer = require_semver();
-    var parse3 = (version, options, throwErrors = false) => {
+    var parse4 = (version, options, throwErrors = false) => {
       if (version instanceof SemVer) {
         return version;
       }
@@ -26966,7 +26966,7 @@ var require_parse2 = __commonJS({
         throw er;
       }
     };
-    module2.exports = parse3;
+    module2.exports = parse4;
   }
 });
 
@@ -26974,9 +26974,9 @@ var require_parse2 = __commonJS({
 var require_valid = __commonJS({
   "node_modules/semver/functions/valid.js"(exports2, module2) {
     "use strict";
-    var parse3 = require_parse2();
+    var parse4 = require_parse2();
     var valid4 = (version, options) => {
-      const v = parse3(version, options);
+      const v = parse4(version, options);
       return v ? v.version : null;
     };
     module2.exports = valid4;
@@ -26987,9 +26987,9 @@ var require_valid = __commonJS({
 var require_clean = __commonJS({
   "node_modules/semver/functions/clean.js"(exports2, module2) {
     "use strict";
-    var parse3 = require_parse2();
+    var parse4 = require_parse2();
     var clean3 = (version, options) => {
-      const s = parse3(version.trim().replace(/^[=v]+/, ""), options);
+      const s = parse4(version.trim().replace(/^[=v]+/, ""), options);
       return s ? s.version : null;
     };
     module2.exports = clean3;
@@ -27001,7 +27001,7 @@ var require_inc = __commonJS({
   "node_modules/semver/functions/inc.js"(exports2, module2) {
     "use strict";
     var SemVer = require_semver();
-    var inc = (version, release2, options, identifier, identifierBase) => {
+    var inc = (version, release3, options, identifier, identifierBase) => {
       if (typeof options === "string") {
         identifierBase = identifier;
         identifier = options;
@@ -27011,7 +27011,7 @@ var require_inc = __commonJS({
         return new SemVer(
           version instanceof SemVer ? version.version : version,
           options
-        ).inc(release2, identifier, identifierBase).version;
+        ).inc(release3, identifier, identifierBase).version;
       } catch (er) {
         return null;
       }
@@ -27024,10 +27024,10 @@ var require_inc = __commonJS({
 var require_diff = __commonJS({
   "node_modules/semver/functions/diff.js"(exports2, module2) {
     "use strict";
-    var parse3 = require_parse2();
+    var parse4 = require_parse2();
     var diff = (version1, version2) => {
-      const v1 = parse3(version1, null, true);
-      const v2 = parse3(version2, null, true);
+      const v1 = parse4(version1, null, true);
+      const v2 = parse4(version2, null, true);
       const comparison = v1.compare(v2);
       if (comparison === 0) {
         return null;
@@ -27098,9 +27098,9 @@ var require_patch = __commonJS({
 var require_prerelease = __commonJS({
   "node_modules/semver/functions/prerelease.js"(exports2, module2) {
     "use strict";
-    var parse3 = require_parse2();
+    var parse4 = require_parse2();
     var prerelease = (version, options) => {
-      const parsed = parse3(version, options);
+      const parsed = parse4(version, options);
       return parsed && parsed.prerelease.length ? parsed.prerelease : null;
     };
     module2.exports = prerelease;
@@ -27286,9 +27286,9 @@ var require_coerce = __commonJS({
   "node_modules/semver/functions/coerce.js"(exports2, module2) {
     "use strict";
     var SemVer = require_semver();
-    var parse3 = require_parse2();
+    var parse4 = require_parse2();
     var { safeRe: re, t } = require_re();
-    var coerce3 = (version, options) => {
+    var coerce4 = (version, options) => {
       if (version instanceof SemVer) {
         return version;
       }
@@ -27321,9 +27321,9 @@ var require_coerce = __commonJS({
       const patch = match2[4] || "0";
       const prerelease = options.includePrerelease && match2[5] ? `-${match2[5]}` : "";
       const build2 = options.includePrerelease && match2[6] ? `+${match2[6]}` : "";
-      return parse3(`${major}.${minor}.${patch}${prerelease}${build2}`, options);
+      return parse4(`${major}.${minor}.${patch}${prerelease}${build2}`, options);
     };
-    module2.exports = coerce3;
+    module2.exports = coerce4;
   }
 });
 
@@ -27331,7 +27331,7 @@ var require_coerce = __commonJS({
 var require_truncate = __commonJS({
   "node_modules/semver/functions/truncate.js"(exports2, module2) {
     "use strict";
-    var parse3 = require_parse2();
+    var parse4 = require_parse2();
     var constants = require_constants6();
     var SemVer = require_semver();
     var truncate = (version, truncation, options) => {
@@ -27343,7 +27343,7 @@ var require_truncate = __commonJS({
     };
     var cloneInputVersion = (version, options) => {
       const versionStringToParse = version instanceof SemVer ? version.version : version;
-      return parse3(versionStringToParse, options);
+      return parse4(versionStringToParse, options);
     };
     var doTruncation = (version, truncation) => {
       if (isPrerelease(truncation)) {
@@ -28387,7 +28387,7 @@ var require_semver2 = __commonJS({
     var constants = require_constants6();
     var SemVer = require_semver();
     var identifiers = require_identifiers();
-    var parse3 = require_parse2();
+    var parse4 = require_parse2();
     var valid4 = require_valid();
     var clean3 = require_clean();
     var inc = require_inc();
@@ -28409,7 +28409,7 @@ var require_semver2 = __commonJS({
     var gte7 = require_gte();
     var lte2 = require_lte();
     var cmp = require_cmp();
-    var coerce3 = require_coerce();
+    var coerce4 = require_coerce();
     var truncate = require_truncate();
     var Comparator = require_comparator();
     var Range2 = require_range();
@@ -28426,7 +28426,7 @@ var require_semver2 = __commonJS({
     var simplifyRange = require_simplify();
     var subset = require_subset();
     module2.exports = {
-      parse: parse3,
+      parse: parse4,
       valid: valid4,
       clean: clean3,
       inc,
@@ -28448,7 +28448,7 @@ var require_semver2 = __commonJS({
       gte: gte7,
       lte: lte2,
       cmp,
-      coerce: coerce3,
+      coerce: coerce4,
       truncate,
       Comparator,
       Range: Range2,
@@ -32109,9 +32109,9 @@ var require_minimatch = __commonJS({
         throw new TypeError("pattern is too long");
       }
     };
-    Minimatch2.prototype.parse = parse3;
+    Minimatch2.prototype.parse = parse4;
     var SUBPARSE = {};
-    function parse3(pattern, isSub) {
+    function parse4(pattern, isSub) {
       assertValidPattern2(pattern);
       var options = this.options;
       if (pattern === "**") {
@@ -32746,7 +32746,7 @@ var require_internal_pattern = __commonJS({
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.Pattern = void 0;
-    var os7 = __importStar2(require("os"));
+    var os8 = __importStar2(require("os"));
     var path30 = __importStar2(require("path"));
     var pathHelper = __importStar2(require_internal_path_helper());
     var assert_1 = __importDefault2(require("assert"));
@@ -32839,7 +32839,7 @@ var require_internal_pattern = __commonJS({
         if (pattern === "." || pattern.startsWith(`.${path30.sep}`)) {
           pattern = _Pattern.globEscape(process.cwd()) + pattern.substr(1);
         } else if (pattern === "~" || pattern.startsWith(`~${path30.sep}`)) {
-          homedir2 = homedir2 || os7.homedir();
+          homedir2 = homedir2 || os8.homedir();
           (0, assert_1.default)(homedir2, "Unable to determine HOME directory");
           (0, assert_1.default)(pathHelper.hasAbsoluteRoot(homedir2), `Expected HOME directory to be a rooted path. Actual '${homedir2}'`);
           pattern = _Pattern.globEscape(homedir2) + pattern.substr(1);
@@ -33065,7 +33065,7 @@ var require_internal_globber = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.DefaultGlobber = void 0;
     var core29 = __importStar2(require_core());
-    var fs33 = __importStar2(require("fs"));
+    var fs34 = __importStar2(require("fs"));
     var globOptionsHelper = __importStar2(require_internal_glob_options_helper());
     var path30 = __importStar2(require("path"));
     var patternHelper = __importStar2(require_internal_pattern_helper());
@@ -33119,7 +33119,7 @@ var require_internal_globber = __commonJS({
           for (const searchPath of patternHelper.getSearchPaths(patterns)) {
             core29.debug(`Search path '${searchPath}'`);
             try {
-              yield __await2(fs33.promises.lstat(searchPath));
+              yield __await2(fs34.promises.lstat(searchPath));
             } catch (err) {
               if (err.code === "ENOENT") {
                 continue;
@@ -33153,7 +33153,7 @@ var require_internal_globber = __commonJS({
                 continue;
               }
               const childLevel = item.level + 1;
-              const childItems = (yield __await2(fs33.promises.readdir(item.path))).map((x) => new internal_search_state_1.SearchState(path30.join(item.path, x), childLevel));
+              const childItems = (yield __await2(fs34.promises.readdir(item.path))).map((x) => new internal_search_state_1.SearchState(path30.join(item.path, x), childLevel));
               stack.push(...childItems.reverse());
             } else if (match2 & internal_match_kind_1.MatchKind.File) {
               yield yield __await2(item.path);
@@ -33188,7 +33188,7 @@ var require_internal_globber = __commonJS({
           let stats;
           if (options.followSymbolicLinks) {
             try {
-              stats = yield fs33.promises.stat(item.path);
+              stats = yield fs34.promises.stat(item.path);
             } catch (err) {
               if (err.code === "ENOENT") {
                 if (options.omitBrokenSymbolicLinks) {
@@ -33200,10 +33200,10 @@ var require_internal_globber = __commonJS({
               throw err;
             }
           } else {
-            stats = yield fs33.promises.lstat(item.path);
+            stats = yield fs34.promises.lstat(item.path);
           }
           if (stats.isDirectory() && options.followSymbolicLinks) {
-            const realPath = yield fs33.promises.realpath(item.path);
+            const realPath = yield fs34.promises.realpath(item.path);
             while (traversalChain.length >= item.level) {
               traversalChain.pop();
             }
@@ -33312,7 +33312,7 @@ var require_internal_hash_files = __commonJS({
     exports2.hashFiles = hashFiles2;
     var crypto3 = __importStar2(require("crypto"));
     var core29 = __importStar2(require_core());
-    var fs33 = __importStar2(require("fs"));
+    var fs34 = __importStar2(require("fs"));
     var stream2 = __importStar2(require("stream"));
     var util4 = __importStar2(require("util"));
     var path30 = __importStar2(require("path"));
@@ -33335,13 +33335,13 @@ var require_internal_hash_files = __commonJS({
               writeDelegate(`Ignore '${file}' since it is not under GITHUB_WORKSPACE.`);
               continue;
             }
-            if (fs33.statSync(file).isDirectory()) {
+            if (fs34.statSync(file).isDirectory()) {
               writeDelegate(`Skip directory '${file}'.`);
               continue;
             }
             const hash2 = crypto3.createHash("sha256");
             const pipeline2 = util4.promisify(stream2.pipeline);
-            yield pipeline2(fs33.createReadStream(file), hash2);
+            yield pipeline2(fs34.createReadStream(file), hash2);
             result.write(hash2.digest());
             count++;
             if (!hasMatch) {
@@ -33561,8 +33561,8 @@ var require_semver3 = __commonJS({
       }
     }
     var i;
-    exports2.parse = parse3;
-    function parse3(version, options) {
+    exports2.parse = parse4;
+    function parse4(version, options) {
       if (!options || typeof options !== "object") {
         options = {
           loose: !!options,
@@ -33590,12 +33590,12 @@ var require_semver3 = __commonJS({
     }
     exports2.valid = valid4;
     function valid4(version, options) {
-      var v = parse3(version, options);
+      var v = parse4(version, options);
       return v ? v.version : null;
     }
     exports2.clean = clean3;
     function clean3(version, options) {
-      var s = parse3(version.trim().replace(/^[=v]+/, ""), options);
+      var s = parse4(version.trim().replace(/^[=v]+/, ""), options);
       return s ? s.version : null;
     }
     exports2.SemVer = SemVer;
@@ -33731,8 +33731,8 @@ var require_semver3 = __commonJS({
         }
       } while (++i2);
     };
-    SemVer.prototype.inc = function(release2, identifier) {
-      switch (release2) {
+    SemVer.prototype.inc = function(release3, identifier) {
+      switch (release3) {
         case "premajor":
           this.prerelease.length = 0;
           this.patch = 0;
@@ -33808,20 +33808,20 @@ var require_semver3 = __commonJS({
           }
           break;
         default:
-          throw new Error("invalid increment argument: " + release2);
+          throw new Error("invalid increment argument: " + release3);
       }
       this.format();
       this.raw = this.version;
       return this;
     };
     exports2.inc = inc;
-    function inc(version, release2, loose, identifier) {
+    function inc(version, release3, loose, identifier) {
       if (typeof loose === "string") {
         identifier = loose;
         loose = void 0;
       }
       try {
-        return new SemVer(version, loose).inc(release2, identifier).version;
+        return new SemVer(version, loose).inc(release3, identifier).version;
       } catch (er) {
         return null;
       }
@@ -33831,8 +33831,8 @@ var require_semver3 = __commonJS({
       if (eq(version1, version2)) {
         return null;
       } else {
-        var v1 = parse3(version1);
-        var v2 = parse3(version2);
+        var v1 = parse4(version1);
+        var v2 = parse4(version2);
         var prefix = "";
         if (v1.prerelease.length || v2.prerelease.length) {
           prefix = "pre";
@@ -34538,7 +34538,7 @@ var require_semver3 = __commonJS({
     }
     exports2.prerelease = prerelease;
     function prerelease(version, options) {
-      var parsed = parse3(version, options);
+      var parsed = parse4(version, options);
       return parsed && parsed.prerelease.length ? parsed.prerelease : null;
     }
     exports2.intersects = intersects;
@@ -34547,8 +34547,8 @@ var require_semver3 = __commonJS({
       r2 = new Range2(r2, options);
       return r1.intersects(r2);
     }
-    exports2.coerce = coerce3;
-    function coerce3(version, options) {
+    exports2.coerce = coerce4;
+    function coerce4(version, options) {
       if (version instanceof SemVer) {
         return version;
       }
@@ -34575,7 +34575,7 @@ var require_semver3 = __commonJS({
       if (match2 === null) {
         return null;
       }
-      return parse3(match2[2] + "." + (match2[3] || "0") + "." + (match2[4] || "0"), options);
+      return parse4(match2[2] + "." + (match2[3] || "0") + "." + (match2[4] || "0"), options);
     }
   }
 });
@@ -34717,9 +34717,9 @@ var require_cacheUtils = __commonJS({
     var glob2 = __importStar2(require_glob());
     var io9 = __importStar2(require_io());
     var crypto3 = __importStar2(require("crypto"));
-    var fs33 = __importStar2(require("fs"));
+    var fs34 = __importStar2(require("fs"));
     var path30 = __importStar2(require("path"));
-    var semver11 = __importStar2(require_semver3());
+    var semver12 = __importStar2(require_semver3());
     var util4 = __importStar2(require("util"));
     var constants_1 = require_constants7();
     var versionSalt = "1.0";
@@ -34746,7 +34746,7 @@ var require_cacheUtils = __commonJS({
       });
     }
     function getArchiveFileSizeInBytes(filePath) {
-      return fs33.statSync(filePath).size;
+      return fs34.statSync(filePath).size;
     }
     function resolvePaths(patterns) {
       return __awaiter2(this, void 0, void 0, function* () {
@@ -34784,7 +34784,7 @@ var require_cacheUtils = __commonJS({
     }
     function unlinkFile(filePath) {
       return __awaiter2(this, void 0, void 0, function* () {
-        return util4.promisify(fs33.unlink)(filePath);
+        return util4.promisify(fs34.unlink)(filePath);
       });
     }
     function getVersion(app_1) {
@@ -34812,7 +34812,7 @@ var require_cacheUtils = __commonJS({
     function getCompressionMethod() {
       return __awaiter2(this, void 0, void 0, function* () {
         const versionOutput = yield getVersion("zstd", ["--quiet"]);
-        const version = semver11.clean(versionOutput);
+        const version = semver12.clean(versionOutput);
         core29.debug(`zstd version: ${version}`);
         if (versionOutput === "") {
           return constants_1.CompressionMethod.Gzip;
@@ -34826,7 +34826,7 @@ var require_cacheUtils = __commonJS({
     }
     function getGnuTarPathOnWindows() {
       return __awaiter2(this, void 0, void 0, function* () {
-        if (fs33.existsSync(constants_1.GnuTarPathOnWindows)) {
+        if (fs34.existsSync(constants_1.GnuTarPathOnWindows)) {
           return constants_1.GnuTarPathOnWindows;
         }
         const versionOutput = yield getVersion("tar");
@@ -37490,7 +37490,7 @@ var require_ms = __commonJS({
       options = options || {};
       var type = typeof val;
       if (type === "string" && val.length > 0) {
-        return parse3(val);
+        return parse4(val);
       } else if (type === "number" && isFinite(val)) {
         return options.long ? fmtLong(val) : fmtShort(val);
       }
@@ -37498,7 +37498,7 @@ var require_ms = __commonJS({
         "val is not a non-empty string or a valid number. val=" + JSON.stringify(val)
       );
     };
-    function parse3(str) {
+    function parse4(str) {
       str = String(str);
       if (str.length > 100) {
         return;
@@ -37599,7 +37599,7 @@ var require_common = __commonJS({
     function setup(env) {
       createDebug.debug = createDebug;
       createDebug.default = createDebug;
-      createDebug.coerce = coerce3;
+      createDebug.coerce = coerce4;
       createDebug.disable = disable;
       createDebug.enable = enable;
       createDebug.enabled = enabled;
@@ -37754,7 +37754,7 @@ var require_common = __commonJS({
         }
         return false;
       }
-      function coerce3(val) {
+      function coerce4(val) {
         if (val instanceof Error) {
           return val.stack || val.message;
         }
@@ -37957,7 +37957,7 @@ var require_has_flag = __commonJS({
 var require_supports_color = __commonJS({
   "node_modules/supports-color/index.js"(exports2, module2) {
     "use strict";
-    var os7 = require("os");
+    var os8 = require("os");
     var tty = require("tty");
     var hasFlag = require_has_flag();
     var { env } = process;
@@ -38005,7 +38005,7 @@ var require_supports_color = __commonJS({
         return min;
       }
       if (process.platform === "win32") {
-        const osRelease = os7.release().split(".");
+        const osRelease = os8.release().split(".");
         if (Number(osRelease[0]) >= 10 && Number(osRelease[2]) >= 10586) {
           return Number(osRelease[2]) >= 14931 ? 3 : 2;
         }
@@ -42967,11 +42967,11 @@ var require_tracingPolicy = __commonJS({
     var import_log = require_log3();
     var import_core_util = require_commonjs4();
     var import_restError = require_restError3();
-    var import_util59 = require_internal3();
+    var import_util62 = require_internal3();
     var tracingPolicyName2 = "tracingPolicy";
     function tracingPolicy2(options = {}) {
       const userAgentPromise = (0, import_userAgent.getUserAgentValue)(options.userAgentPrefix);
-      const sanitizer = new import_util59.Sanitizer({
+      const sanitizer = new import_util62.Sanitizer({
         additionalAllowedQueryParameters: options.additionalAllowedQueryParameters
       });
       const tracingClient = tryCreateTracingClient();
@@ -45399,7 +45399,7 @@ var require_deserializationPolicy = __commonJS({
       return result;
     }
     async function deserializeResponseBody(jsonContentTypes, xmlContentTypes, response, options, parseXML) {
-      const parsedResponse = await parse3(jsonContentTypes, xmlContentTypes, response, options, parseXML);
+      const parsedResponse = await parse4(jsonContentTypes, xmlContentTypes, response, options, parseXML);
       if (!shouldDeserializeResponse(parsedResponse)) {
         return parsedResponse;
       }
@@ -45500,7 +45500,7 @@ var require_deserializationPolicy = __commonJS({
       }
       return { error: error3, shouldReturnResponse: false };
     }
-    async function parse3(jsonContentTypes, xmlContentTypes, operationResponse, opts, parseXML) {
+    async function parse4(jsonContentTypes, xmlContentTypes, operationResponse, opts, parseXML) {
       if (!operationResponse.request.streamResponseStatusCodes?.has(operationResponse.status) && operationResponse.bodyAsText) {
         const text = operationResponse.bodyAsText;
         const contentType = operationResponse.headers.get("Content-Type") || "";
@@ -46597,11 +46597,11 @@ var require_response2 = __commonJS({
     });
     module2.exports = __toCommonJS2(response_exports);
     var import_core_rest_pipeline = require_commonjs6();
-    var import_util59 = require_util9();
+    var import_util62 = require_util9();
     var originalResponse = /* @__PURE__ */ Symbol("Original FullOperationResponse");
     function toCompatResponse2(response, options) {
-      let request3 = (0, import_util59.toWebResourceLike)(response.request);
-      let headers = (0, import_util59.toHttpHeadersLike)(response.headers);
+      let request3 = (0, import_util62.toWebResourceLike)(response.request);
+      let headers = (0, import_util62.toHttpHeadersLike)(response.headers);
       if (options?.createProxy) {
         return new Proxy(response, {
           get(target, prop, receiver) {
@@ -46642,7 +46642,7 @@ var require_response2 = __commonJS({
         return {
           ...compatResponse,
           headers,
-          request: (0, import_util59.toPipelineRequest)(compatResponse.request)
+          request: (0, import_util62.toPipelineRequest)(compatResponse.request)
         };
       }
     }
@@ -46749,7 +46749,7 @@ var require_requestPolicyFactoryPolicy = __commonJS({
       requestPolicyFactoryPolicyName: () => requestPolicyFactoryPolicyName2
     });
     module2.exports = __toCommonJS2(requestPolicyFactoryPolicy_exports);
-    var import_util59 = require_util9();
+    var import_util62 = require_util9();
     var import_response = require_response2();
     var HttpPipelineLogLevel2 = /* @__PURE__ */ ((HttpPipelineLogLevel22) => {
       HttpPipelineLogLevel22[HttpPipelineLogLevel22["ERROR"] = 1] = "ERROR";
@@ -46773,14 +46773,14 @@ var require_requestPolicyFactoryPolicy = __commonJS({
         async sendRequest(request3, next) {
           let httpPipeline = {
             async sendRequest(httpRequest) {
-              const response2 = await next((0, import_util59.toPipelineRequest)(httpRequest));
+              const response2 = await next((0, import_util62.toPipelineRequest)(httpRequest));
               return (0, import_response.toCompatResponse)(response2, { createProxy: true });
             }
           };
           for (const factory of orderedFactories) {
             httpPipeline = factory.create(httpPipeline, mockRequestPolicyOptions);
           }
-          const webResourceLike = (0, import_util59.toWebResourceLike)(request3, { createProxy: true });
+          const webResourceLike = (0, import_util62.toWebResourceLike)(request3, { createProxy: true });
           const response = await httpPipeline.sendRequest(webResourceLike);
           return (0, import_response.toPipelineResponse)(response);
         }
@@ -46815,12 +46815,12 @@ var require_httpClientAdapter = __commonJS({
     });
     module2.exports = __toCommonJS2(httpClientAdapter_exports);
     var import_response = require_response2();
-    var import_util59 = require_util9();
+    var import_util62 = require_util9();
     function convertHttpClient2(requestPolicyClient) {
       return {
         sendRequest: async (request3) => {
           const response = await requestPolicyClient.sendRequest(
-            (0, import_util59.toWebResourceLike)(request3, { createProxy: true })
+            (0, import_util62.toWebResourceLike)(request3, { createProxy: true })
           );
           return (0, import_response.toPipelineResponse)(response);
         }
@@ -46858,7 +46858,7 @@ var require_commonjs9 = __commonJS({
       disableKeepAlivePolicyName: () => import_disableKeepAlivePolicy.disableKeepAlivePolicyName,
       requestPolicyFactoryPolicyName: () => import_requestPolicyFactoryPolicy.requestPolicyFactoryPolicyName,
       toCompatResponse: () => import_response.toCompatResponse,
-      toHttpHeadersLike: () => import_util59.toHttpHeadersLike
+      toHttpHeadersLike: () => import_util62.toHttpHeadersLike
     });
     module2.exports = __toCommonJS2(src_exports);
     var import_extendedClient = require_extendedClient();
@@ -46866,7 +46866,7 @@ var require_commonjs9 = __commonJS({
     var import_requestPolicyFactoryPolicy = require_requestPolicyFactoryPolicy();
     var import_disableKeepAlivePolicy = require_disableKeepAlivePolicy();
     var import_httpClientAdapter = require_httpClientAdapter();
-    var import_util59 = require_util9();
+    var import_util62 = require_util9();
   }
 });
 
@@ -99550,7 +99550,7 @@ var require_downloadUtils = __commonJS({
     var http_client_1 = require_lib();
     var storage_blob_1 = require_commonjs15();
     var buffer = __importStar2(require("buffer"));
-    var fs33 = __importStar2(require("fs"));
+    var fs34 = __importStar2(require("fs"));
     var stream2 = __importStar2(require("stream"));
     var util4 = __importStar2(require("util"));
     var utils = __importStar2(require_cacheUtils());
@@ -99661,7 +99661,7 @@ var require_downloadUtils = __commonJS({
     exports2.DownloadProgress = DownloadProgress;
     function downloadCacheHttpClient(archiveLocation, archivePath) {
       return __awaiter2(this, void 0, void 0, function* () {
-        const writeStream = fs33.createWriteStream(archivePath);
+        const writeStream = fs34.createWriteStream(archivePath);
         const httpClient = new http_client_1.HttpClient("actions/cache");
         const downloadResponse = yield (0, requestUtils_1.retryHttpClientResponse)("downloadCache", () => __awaiter2(this, void 0, void 0, function* () {
           return httpClient.get(archiveLocation);
@@ -99686,7 +99686,7 @@ var require_downloadUtils = __commonJS({
     function downloadCacheHttpClientConcurrent(archiveLocation, archivePath, options) {
       return __awaiter2(this, void 0, void 0, function* () {
         var _a6;
-        const archiveDescriptor = yield fs33.promises.open(archivePath, "w");
+        const archiveDescriptor = yield fs34.promises.open(archivePath, "w");
         const httpClient = new http_client_1.HttpClient("actions/cache", void 0, {
           socketTimeout: options.timeoutInMs,
           keepAlive: true
@@ -99802,7 +99802,7 @@ var require_downloadUtils = __commonJS({
         } else {
           const maxSegmentSize = Math.min(134217728, buffer.constants.MAX_LENGTH);
           const downloadProgress = new DownloadProgress(contentLength);
-          const fd = fs33.openSync(archivePath, "w");
+          const fd = fs34.openSync(archivePath, "w");
           try {
             downloadProgress.startDisplayTimer();
             const controller = new abort_controller_1.AbortController();
@@ -99820,12 +99820,12 @@ var require_downloadUtils = __commonJS({
                 controller.abort();
                 throw new Error("Aborting cache download as the download time exceeded the timeout.");
               } else if (Buffer.isBuffer(result)) {
-                fs33.writeFileSync(fd, result);
+                fs34.writeFileSync(fd, result);
               }
             }
           } finally {
             downloadProgress.stopDisplayTimer();
-            fs33.closeSync(fd);
+            fs34.closeSync(fd);
           }
         }
       });
@@ -100164,7 +100164,7 @@ var require_cacheHttpClient = __commonJS({
     var core29 = __importStar2(require_core());
     var http_client_1 = require_lib();
     var auth_1 = require_auth();
-    var fs33 = __importStar2(require("fs"));
+    var fs34 = __importStar2(require("fs"));
     var url_1 = require("url");
     var utils = __importStar2(require_cacheUtils());
     var uploadUtils_1 = require_uploadUtils();
@@ -100305,7 +100305,7 @@ Other caches with similar key:`);
       return __awaiter2(this, void 0, void 0, function* () {
         const fileSize = utils.getArchiveFileSizeInBytes(archivePath);
         const resourceUrl = getCacheApiUrl(`caches/${cacheId.toString()}`);
-        const fd = fs33.openSync(archivePath, "r");
+        const fd = fs34.openSync(archivePath, "r");
         const uploadOptions = (0, options_1.getUploadOptions)(options);
         const concurrency = utils.assertDefined("uploadConcurrency", uploadOptions.uploadConcurrency);
         const maxChunkSize = utils.assertDefined("uploadChunkSize", uploadOptions.uploadChunkSize);
@@ -100319,7 +100319,7 @@ Other caches with similar key:`);
               const start = offset;
               const end = offset + chunkSize - 1;
               offset += maxChunkSize;
-              yield uploadChunk(httpClient, resourceUrl, () => fs33.createReadStream(archivePath, {
+              yield uploadChunk(httpClient, resourceUrl, () => fs34.createReadStream(archivePath, {
                 fd,
                 start,
                 end,
@@ -100330,7 +100330,7 @@ Other caches with similar key:`);
             }
           })));
         } finally {
-          fs33.closeSync(fd);
+          fs34.closeSync(fd);
         }
         return;
       });
@@ -106361,21 +106361,21 @@ var require_manifest = __commonJS({
     exports2._findMatch = _findMatch;
     exports2._getOsVersion = _getOsVersion;
     exports2._readLinuxVersionFile = _readLinuxVersionFile;
-    var semver11 = __importStar2(require_semver2());
+    var semver12 = __importStar2(require_semver2());
     var core_1 = require_core();
-    var os7 = require("os");
+    var os8 = require("os");
     var cp = require("child_process");
-    var fs33 = require("fs");
+    var fs34 = require("fs");
     function _findMatch(versionSpec, stable, candidates, archFilter) {
       return __awaiter2(this, void 0, void 0, function* () {
-        const platFilter = os7.platform();
+        const platFilter = os8.platform();
         let result;
         let match2;
         let file;
         for (const candidate of candidates) {
           const version = candidate.version;
           (0, core_1.debug)(`check ${version} satisfies ${versionSpec}`);
-          if (semver11.satisfies(version, versionSpec) && (!stable || candidate.stable === stable)) {
+          if (semver12.satisfies(version, versionSpec) && (!stable || candidate.stable === stable)) {
             file = candidate.files.find((item) => {
               (0, core_1.debug)(`${item.arch}===${archFilter} && ${item.platform}===${platFilter}`);
               let chk = item.arch === archFilter && item.platform === platFilter;
@@ -106384,7 +106384,7 @@ var require_manifest = __commonJS({
                 if (osVersion === item.platform_version) {
                   chk = true;
                 } else {
-                  chk = semver11.satisfies(osVersion, item.platform_version);
+                  chk = semver12.satisfies(osVersion, item.platform_version);
                 }
               }
               return chk;
@@ -106404,7 +106404,7 @@ var require_manifest = __commonJS({
       });
     }
     function _getOsVersion() {
-      const plat = os7.platform();
+      const plat = os8.platform();
       let version = "";
       if (plat === "darwin") {
         version = cp.execSync("sw_vers -productVersion").toString();
@@ -106427,10 +106427,10 @@ var require_manifest = __commonJS({
       const lsbReleaseFile = "/etc/lsb-release";
       const osReleaseFile = "/etc/os-release";
       let contents = "";
-      if (fs33.existsSync(lsbReleaseFile)) {
-        contents = fs33.readFileSync(lsbReleaseFile).toString();
-      } else if (fs33.existsSync(osReleaseFile)) {
-        contents = fs33.readFileSync(osReleaseFile).toString();
+      if (fs34.existsSync(lsbReleaseFile)) {
+        contents = fs34.readFileSync(lsbReleaseFile).toString();
+      } else if (fs34.existsSync(osReleaseFile)) {
+        contents = fs34.readFileSync(osReleaseFile).toString();
       }
       return contents;
     }
@@ -106639,12 +106639,12 @@ var require_tool_cache = __commonJS({
     var core29 = __importStar2(require_core());
     var io9 = __importStar2(require_io());
     var crypto3 = __importStar2(require("crypto"));
-    var fs33 = __importStar2(require("fs"));
+    var fs34 = __importStar2(require("fs"));
     var mm = __importStar2(require_manifest());
-    var os7 = __importStar2(require("os"));
+    var os8 = __importStar2(require("os"));
     var path30 = __importStar2(require("path"));
     var httpm = __importStar2(require_lib());
-    var semver11 = __importStar2(require_semver2());
+    var semver12 = __importStar2(require_semver2());
     var stream2 = __importStar2(require("stream"));
     var util4 = __importStar2(require("util"));
     var assert_1 = require("assert");
@@ -106685,7 +106685,7 @@ var require_tool_cache = __commonJS({
     }
     function downloadToolAttempt(url2, dest, auth2, headers) {
       return __awaiter2(this, void 0, void 0, function* () {
-        if (fs33.existsSync(dest)) {
+        if (fs34.existsSync(dest)) {
           throw new Error(`Destination file path ${dest} already exists`);
         }
         const http = new httpm.HttpClient(userAgent2, [], {
@@ -106709,7 +106709,7 @@ var require_tool_cache = __commonJS({
         const readStream = responseMessageFactory();
         let succeeded = false;
         try {
-          yield pipeline2(readStream, fs33.createWriteStream(dest));
+          yield pipeline2(readStream, fs34.createWriteStream(dest));
           core29.debug("download complete");
           succeeded = true;
           return dest;
@@ -106917,15 +106917,15 @@ var require_tool_cache = __commonJS({
     }
     function cacheDir2(sourceDir, tool, version, arch2) {
       return __awaiter2(this, void 0, void 0, function* () {
-        version = semver11.clean(version) || version;
-        arch2 = arch2 || os7.arch();
+        version = semver12.clean(version) || version;
+        arch2 = arch2 || os8.arch();
         core29.debug(`Caching tool ${tool} ${version} ${arch2}`);
         core29.debug(`source dir: ${sourceDir}`);
-        if (!fs33.statSync(sourceDir).isDirectory()) {
+        if (!fs34.statSync(sourceDir).isDirectory()) {
           throw new Error("sourceDir is not a directory");
         }
         const destPath = yield _createToolPath(tool, version, arch2);
-        for (const itemName of fs33.readdirSync(sourceDir)) {
+        for (const itemName of fs34.readdirSync(sourceDir)) {
           const s = path30.join(sourceDir, itemName);
           yield io9.cp(s, destPath, { recursive: true });
         }
@@ -106935,11 +106935,11 @@ var require_tool_cache = __commonJS({
     }
     function cacheFile(sourceFile, targetFile, tool, version, arch2) {
       return __awaiter2(this, void 0, void 0, function* () {
-        version = semver11.clean(version) || version;
-        arch2 = arch2 || os7.arch();
+        version = semver12.clean(version) || version;
+        arch2 = arch2 || os8.arch();
         core29.debug(`Caching tool ${tool} ${version} ${arch2}`);
         core29.debug(`source file: ${sourceFile}`);
-        if (!fs33.statSync(sourceFile).isFile()) {
+        if (!fs34.statSync(sourceFile).isFile()) {
           throw new Error("sourceFile is not a file");
         }
         const destFolder = yield _createToolPath(tool, version, arch2);
@@ -106957,7 +106957,7 @@ var require_tool_cache = __commonJS({
       if (!versionSpec) {
         throw new Error("versionSpec parameter is required");
       }
-      arch2 = arch2 || os7.arch();
+      arch2 = arch2 || os8.arch();
       if (!isExplicitVersion(versionSpec)) {
         const localVersions = findAllVersions2(toolName, arch2);
         const match2 = evaluateVersions(localVersions, versionSpec);
@@ -106965,10 +106965,10 @@ var require_tool_cache = __commonJS({
       }
       let toolPath = "";
       if (versionSpec) {
-        versionSpec = semver11.clean(versionSpec) || "";
+        versionSpec = semver12.clean(versionSpec) || "";
         const cachePath = path30.join(_getCacheDirectory(), toolName, versionSpec, arch2);
         core29.debug(`checking cache: ${cachePath}`);
-        if (fs33.existsSync(cachePath) && fs33.existsSync(`${cachePath}.complete`)) {
+        if (fs34.existsSync(cachePath) && fs34.existsSync(`${cachePath}.complete`)) {
           core29.debug(`Found tool in cache ${toolName} ${versionSpec} ${arch2}`);
           toolPath = cachePath;
         } else {
@@ -106979,14 +106979,14 @@ var require_tool_cache = __commonJS({
     }
     function findAllVersions2(toolName, arch2) {
       const versions = [];
-      arch2 = arch2 || os7.arch();
+      arch2 = arch2 || os8.arch();
       const toolPath = path30.join(_getCacheDirectory(), toolName);
-      if (fs33.existsSync(toolPath)) {
-        const children = fs33.readdirSync(toolPath);
+      if (fs34.existsSync(toolPath)) {
+        const children = fs34.readdirSync(toolPath);
         for (const child of children) {
           if (isExplicitVersion(child)) {
             const fullPath = path30.join(toolPath, child, arch2 || "");
-            if (fs33.existsSync(fullPath) && fs33.existsSync(`${fullPath}.complete`)) {
+            if (fs34.existsSync(fullPath) && fs34.existsSync(`${fullPath}.complete`)) {
               versions.push(child);
             }
           }
@@ -107029,7 +107029,7 @@ var require_tool_cache = __commonJS({
       });
     }
     function findFromManifest(versionSpec_1, stable_1, manifest_1) {
-      return __awaiter2(this, arguments, void 0, function* (versionSpec, stable, manifest, archFilter = os7.arch()) {
+      return __awaiter2(this, arguments, void 0, function* (versionSpec, stable, manifest, archFilter = os8.arch()) {
         const match2 = yield mm._findMatch(versionSpec, stable, manifest, archFilter);
         return match2;
       });
@@ -107045,7 +107045,7 @@ var require_tool_cache = __commonJS({
     }
     function _createToolPath(tool, version, arch2) {
       return __awaiter2(this, void 0, void 0, function* () {
-        const folderPath = path30.join(_getCacheDirectory(), tool, semver11.clean(version) || version, arch2 || "");
+        const folderPath = path30.join(_getCacheDirectory(), tool, semver12.clean(version) || version, arch2 || "");
         core29.debug(`destination ${folderPath}`);
         const markerPath = `${folderPath}.complete`;
         yield io9.rmRF(folderPath);
@@ -107055,15 +107055,15 @@ var require_tool_cache = __commonJS({
       });
     }
     function _completeToolPath(tool, version, arch2) {
-      const folderPath = path30.join(_getCacheDirectory(), tool, semver11.clean(version) || version, arch2 || "");
+      const folderPath = path30.join(_getCacheDirectory(), tool, semver12.clean(version) || version, arch2 || "");
       const markerPath = `${folderPath}.complete`;
-      fs33.writeFileSync(markerPath, "");
+      fs34.writeFileSync(markerPath, "");
       core29.debug("finished caching tool");
     }
     function isExplicitVersion(versionSpec) {
-      const c = semver11.clean(versionSpec) || "";
+      const c = semver12.clean(versionSpec) || "";
       core29.debug(`isExplicit: ${c}`);
-      const valid4 = semver11.valid(c) != null;
+      const valid4 = semver12.valid(c) != null;
       core29.debug(`explicit? ${valid4}`);
       return valid4;
     }
@@ -107071,14 +107071,14 @@ var require_tool_cache = __commonJS({
       let version = "";
       core29.debug(`evaluating ${versions.length} versions`);
       versions = versions.sort((a, b) => {
-        if (semver11.gt(a, b)) {
+        if (semver12.gt(a, b)) {
           return 1;
         }
         return -1;
       });
       for (let i = versions.length - 1; i >= 0; i--) {
         const potential = versions[i];
-        const satisfied = semver11.satisfies(potential, versionSpec);
+        const satisfied = semver12.satisfies(potential, versionSpec);
         if (satisfied) {
           version = potential;
           break;
@@ -113270,15 +113270,15 @@ var require_upload_zip_specification = __commonJS({
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.getUploadZipSpecification = exports2.validateRootDirectory = void 0;
-    var fs33 = __importStar2(require("fs"));
+    var fs34 = __importStar2(require("fs"));
     var core_1 = require_core();
     var path_1 = require("path");
     var path_and_artifact_name_validation_1 = require_path_and_artifact_name_validation();
     function validateRootDirectory(rootDirectory) {
-      if (!fs33.existsSync(rootDirectory)) {
+      if (!fs34.existsSync(rootDirectory)) {
         throw new Error(`The provided rootDirectory ${rootDirectory} does not exist`);
       }
-      if (!fs33.statSync(rootDirectory).isDirectory()) {
+      if (!fs34.statSync(rootDirectory).isDirectory()) {
         throw new Error(`The provided rootDirectory ${rootDirectory} is not a valid directory`);
       }
       (0, core_1.info)(`Root directory input is valid!`);
@@ -113289,7 +113289,7 @@ var require_upload_zip_specification = __commonJS({
       rootDirectory = (0, path_1.normalize)(rootDirectory);
       rootDirectory = (0, path_1.resolve)(rootDirectory);
       for (let file of filesToZip) {
-        const stats = fs33.lstatSync(file, { throwIfNoEntry: false });
+        const stats = fs34.lstatSync(file, { throwIfNoEntry: false });
         if (!stats) {
           throw new Error(`File ${file} does not exist`);
         }
@@ -114364,13 +114364,13 @@ var require_minimatch2 = __commonJS({
 var require_readdir_glob = __commonJS({
   "node_modules/@actions/artifact/node_modules/readdir-glob/index.js"(exports2, module2) {
     module2.exports = readdirGlob2;
-    var fs33 = require("fs");
+    var fs34 = require("fs");
     var { EventEmitter: EventEmitter2 } = require("events");
     var { Minimatch: Minimatch2 } = require_minimatch2();
     var { resolve: resolve15 } = require("path");
     function readdir3(dir, strict) {
       return new Promise((resolve16, reject) => {
-        fs33.readdir(dir, { withFileTypes: true }, (err, files) => {
+        fs34.readdir(dir, { withFileTypes: true }, (err, files) => {
           if (err) {
             switch (err.code) {
               case "ENOTDIR":
@@ -114403,7 +114403,7 @@ var require_readdir_glob = __commonJS({
     }
     function stat2(file, followSymlinks) {
       return new Promise((resolve16, reject) => {
-        const statFunc = followSymlinks ? fs33.stat : fs33.lstat;
+        const statFunc = followSymlinks ? fs34.stat : fs34.lstat;
         statFunc(file, (err, stats) => {
           if (err) {
             switch (err.code) {
@@ -116468,54 +116468,54 @@ var require_polyfills = __commonJS({
     }
     var chdir;
     module2.exports = patch;
-    function patch(fs33) {
+    function patch(fs34) {
       if (constants.hasOwnProperty("O_SYMLINK") && process.version.match(/^v0\.6\.[0-2]|^v0\.5\./)) {
-        patchLchmod(fs33);
-      }
-      if (!fs33.lutimes) {
-        patchLutimes(fs33);
-      }
-      fs33.chown = chownFix(fs33.chown);
-      fs33.fchown = chownFix(fs33.fchown);
-      fs33.lchown = chownFix(fs33.lchown);
-      fs33.chmod = chmodFix(fs33.chmod);
-      fs33.fchmod = chmodFix(fs33.fchmod);
-      fs33.lchmod = chmodFix(fs33.lchmod);
-      fs33.chownSync = chownFixSync(fs33.chownSync);
-      fs33.fchownSync = chownFixSync(fs33.fchownSync);
-      fs33.lchownSync = chownFixSync(fs33.lchownSync);
-      fs33.chmodSync = chmodFixSync(fs33.chmodSync);
-      fs33.fchmodSync = chmodFixSync(fs33.fchmodSync);
-      fs33.lchmodSync = chmodFixSync(fs33.lchmodSync);
-      fs33.stat = statFix(fs33.stat);
-      fs33.fstat = statFix(fs33.fstat);
-      fs33.lstat = statFix(fs33.lstat);
-      fs33.statSync = statFixSync(fs33.statSync);
-      fs33.fstatSync = statFixSync(fs33.fstatSync);
-      fs33.lstatSync = statFixSync(fs33.lstatSync);
-      if (fs33.chmod && !fs33.lchmod) {
-        fs33.lchmod = function(path30, mode, cb) {
+        patchLchmod(fs34);
+      }
+      if (!fs34.lutimes) {
+        patchLutimes(fs34);
+      }
+      fs34.chown = chownFix(fs34.chown);
+      fs34.fchown = chownFix(fs34.fchown);
+      fs34.lchown = chownFix(fs34.lchown);
+      fs34.chmod = chmodFix(fs34.chmod);
+      fs34.fchmod = chmodFix(fs34.fchmod);
+      fs34.lchmod = chmodFix(fs34.lchmod);
+      fs34.chownSync = chownFixSync(fs34.chownSync);
+      fs34.fchownSync = chownFixSync(fs34.fchownSync);
+      fs34.lchownSync = chownFixSync(fs34.lchownSync);
+      fs34.chmodSync = chmodFixSync(fs34.chmodSync);
+      fs34.fchmodSync = chmodFixSync(fs34.fchmodSync);
+      fs34.lchmodSync = chmodFixSync(fs34.lchmodSync);
+      fs34.stat = statFix(fs34.stat);
+      fs34.fstat = statFix(fs34.fstat);
+      fs34.lstat = statFix(fs34.lstat);
+      fs34.statSync = statFixSync(fs34.statSync);
+      fs34.fstatSync = statFixSync(fs34.fstatSync);
+      fs34.lstatSync = statFixSync(fs34.lstatSync);
+      if (fs34.chmod && !fs34.lchmod) {
+        fs34.lchmod = function(path30, mode, cb) {
           if (cb) process.nextTick(cb);
         };
-        fs33.lchmodSync = function() {
+        fs34.lchmodSync = function() {
         };
       }
-      if (fs33.chown && !fs33.lchown) {
-        fs33.lchown = function(path30, uid, gid, cb) {
+      if (fs34.chown && !fs34.lchown) {
+        fs34.lchown = function(path30, uid, gid, cb) {
           if (cb) process.nextTick(cb);
         };
-        fs33.lchownSync = function() {
+        fs34.lchownSync = function() {
         };
       }
       if (platform2 === "win32") {
-        fs33.rename = typeof fs33.rename !== "function" ? fs33.rename : (function(fs$rename) {
+        fs34.rename = typeof fs34.rename !== "function" ? fs34.rename : (function(fs$rename) {
           function rename(from, to, cb) {
             var start = Date.now();
             var backoff = 0;
             fs$rename(from, to, function CB(er) {
               if (er && (er.code === "EACCES" || er.code === "EPERM") && Date.now() - start < 6e4) {
                 setTimeout(function() {
-                  fs33.stat(to, function(stater, st) {
+                  fs34.stat(to, function(stater, st) {
                     if (stater && stater.code === "ENOENT")
                       fs$rename(from, to, CB);
                     else
@@ -116531,9 +116531,9 @@ var require_polyfills = __commonJS({
           }
           if (Object.setPrototypeOf) Object.setPrototypeOf(rename, fs$rename);
           return rename;
-        })(fs33.rename);
+        })(fs34.rename);
       }
-      fs33.read = typeof fs33.read !== "function" ? fs33.read : (function(fs$read) {
+      fs34.read = typeof fs34.read !== "function" ? fs34.read : (function(fs$read) {
         function read(fd, buffer, offset, length, position, callback_) {
           var callback;
           if (callback_ && typeof callback_ === "function") {
@@ -116541,22 +116541,22 @@ var require_polyfills = __commonJS({
             callback = function(er, _2, __) {
               if (er && er.code === "EAGAIN" && eagCounter < 10) {
                 eagCounter++;
-                return fs$read.call(fs33, fd, buffer, offset, length, position, callback);
+                return fs$read.call(fs34, fd, buffer, offset, length, position, callback);
               }
               callback_.apply(this, arguments);
             };
           }
-          return fs$read.call(fs33, fd, buffer, offset, length, position, callback);
+          return fs$read.call(fs34, fd, buffer, offset, length, position, callback);
         }
         if (Object.setPrototypeOf) Object.setPrototypeOf(read, fs$read);
         return read;
-      })(fs33.read);
-      fs33.readSync = typeof fs33.readSync !== "function" ? fs33.readSync : /* @__PURE__ */ (function(fs$readSync) {
+      })(fs34.read);
+      fs34.readSync = typeof fs34.readSync !== "function" ? fs34.readSync : /* @__PURE__ */ (function(fs$readSync) {
         return function(fd, buffer, offset, length, position) {
           var eagCounter = 0;
           while (true) {
             try {
-              return fs$readSync.call(fs33, fd, buffer, offset, length, position);
+              return fs$readSync.call(fs34, fd, buffer, offset, length, position);
             } catch (er) {
               if (er.code === "EAGAIN" && eagCounter < 10) {
                 eagCounter++;
@@ -116566,10 +116566,10 @@ var require_polyfills = __commonJS({
             }
           }
         };
-      })(fs33.readSync);
-      function patchLchmod(fs34) {
-        fs34.lchmod = function(path30, mode, callback) {
-          fs34.open(
+      })(fs34.readSync);
+      function patchLchmod(fs35) {
+        fs35.lchmod = function(path30, mode, callback) {
+          fs35.open(
             path30,
             constants.O_WRONLY | constants.O_SYMLINK,
             mode,
@@ -116578,80 +116578,80 @@ var require_polyfills = __commonJS({
                 if (callback) callback(err);
                 return;
               }
-              fs34.fchmod(fd, mode, function(err2) {
-                fs34.close(fd, function(err22) {
+              fs35.fchmod(fd, mode, function(err2) {
+                fs35.close(fd, function(err22) {
                   if (callback) callback(err2 || err22);
                 });
               });
             }
           );
         };
-        fs34.lchmodSync = function(path30, mode) {
-          var fd = fs34.openSync(path30, constants.O_WRONLY | constants.O_SYMLINK, mode);
+        fs35.lchmodSync = function(path30, mode) {
+          var fd = fs35.openSync(path30, constants.O_WRONLY | constants.O_SYMLINK, mode);
           var threw = true;
           var ret;
           try {
-            ret = fs34.fchmodSync(fd, mode);
+            ret = fs35.fchmodSync(fd, mode);
             threw = false;
           } finally {
             if (threw) {
               try {
-                fs34.closeSync(fd);
+                fs35.closeSync(fd);
               } catch (er) {
               }
             } else {
-              fs34.closeSync(fd);
+              fs35.closeSync(fd);
             }
           }
           return ret;
         };
       }
-      function patchLutimes(fs34) {
-        if (constants.hasOwnProperty("O_SYMLINK") && fs34.futimes) {
-          fs34.lutimes = function(path30, at, mt, cb) {
-            fs34.open(path30, constants.O_SYMLINK, function(er, fd) {
+      function patchLutimes(fs35) {
+        if (constants.hasOwnProperty("O_SYMLINK") && fs35.futimes) {
+          fs35.lutimes = function(path30, at, mt, cb) {
+            fs35.open(path30, constants.O_SYMLINK, function(er, fd) {
               if (er) {
                 if (cb) cb(er);
                 return;
               }
-              fs34.futimes(fd, at, mt, function(er2) {
-                fs34.close(fd, function(er22) {
+              fs35.futimes(fd, at, mt, function(er2) {
+                fs35.close(fd, function(er22) {
                   if (cb) cb(er2 || er22);
                 });
               });
             });
           };
-          fs34.lutimesSync = function(path30, at, mt) {
-            var fd = fs34.openSync(path30, constants.O_SYMLINK);
+          fs35.lutimesSync = function(path30, at, mt) {
+            var fd = fs35.openSync(path30, constants.O_SYMLINK);
             var ret;
             var threw = true;
             try {
-              ret = fs34.futimesSync(fd, at, mt);
+              ret = fs35.futimesSync(fd, at, mt);
               threw = false;
             } finally {
               if (threw) {
                 try {
-                  fs34.closeSync(fd);
+                  fs35.closeSync(fd);
                 } catch (er) {
                 }
               } else {
-                fs34.closeSync(fd);
+                fs35.closeSync(fd);
               }
             }
             return ret;
           };
-        } else if (fs34.futimes) {
-          fs34.lutimes = function(_a6, _b2, _c2, cb) {
+        } else if (fs35.futimes) {
+          fs35.lutimes = function(_a6, _b2, _c2, cb) {
             if (cb) process.nextTick(cb);
           };
-          fs34.lutimesSync = function() {
+          fs35.lutimesSync = function() {
           };
         }
       }
       function chmodFix(orig) {
         if (!orig) return orig;
         return function(target, mode, cb) {
-          return orig.call(fs33, target, mode, function(er) {
+          return orig.call(fs34, target, mode, function(er) {
             if (chownErOk(er)) er = null;
             if (cb) cb.apply(this, arguments);
           });
@@ -116661,7 +116661,7 @@ var require_polyfills = __commonJS({
         if (!orig) return orig;
         return function(target, mode) {
           try {
-            return orig.call(fs33, target, mode);
+            return orig.call(fs34, target, mode);
           } catch (er) {
             if (!chownErOk(er)) throw er;
           }
@@ -116670,7 +116670,7 @@ var require_polyfills = __commonJS({
       function chownFix(orig) {
         if (!orig) return orig;
         return function(target, uid, gid, cb) {
-          return orig.call(fs33, target, uid, gid, function(er) {
+          return orig.call(fs34, target, uid, gid, function(er) {
             if (chownErOk(er)) er = null;
             if (cb) cb.apply(this, arguments);
           });
@@ -116680,7 +116680,7 @@ var require_polyfills = __commonJS({
         if (!orig) return orig;
         return function(target, uid, gid) {
           try {
-            return orig.call(fs33, target, uid, gid);
+            return orig.call(fs34, target, uid, gid);
           } catch (er) {
             if (!chownErOk(er)) throw er;
           }
@@ -116700,13 +116700,13 @@ var require_polyfills = __commonJS({
             }
             if (cb) cb.apply(this, arguments);
           }
-          return options ? orig.call(fs33, target, options, callback) : orig.call(fs33, target, callback);
+          return options ? orig.call(fs34, target, options, callback) : orig.call(fs34, target, callback);
         };
       }
       function statFixSync(orig) {
         if (!orig) return orig;
         return function(target, options) {
-          var stats = options ? orig.call(fs33, target, options) : orig.call(fs33, target);
+          var stats = options ? orig.call(fs34, target, options) : orig.call(fs34, target);
           if (stats) {
             if (stats.uid < 0) stats.uid += 4294967296;
             if (stats.gid < 0) stats.gid += 4294967296;
@@ -116735,7 +116735,7 @@ var require_legacy_streams = __commonJS({
   "node_modules/graceful-fs/legacy-streams.js"(exports2, module2) {
     var Stream = require("stream").Stream;
     module2.exports = legacy;
-    function legacy(fs33) {
+    function legacy(fs34) {
       return {
         ReadStream,
         WriteStream
@@ -116778,7 +116778,7 @@ var require_legacy_streams = __commonJS({
           });
           return;
         }
-        fs33.open(this.path, this.flags, this.mode, function(err, fd) {
+        fs34.open(this.path, this.flags, this.mode, function(err, fd) {
           if (err) {
             self2.emit("error", err);
             self2.readable = false;
@@ -116817,7 +116817,7 @@ var require_legacy_streams = __commonJS({
         this.busy = false;
         this._queue = [];
         if (this.fd === null) {
-          this._open = fs33.open;
+          this._open = fs34.open;
           this._queue.push([this._open, this.path, this.flags, this.mode, void 0]);
           this.flush();
         }
@@ -116852,7 +116852,7 @@ var require_clone = __commonJS({
 // node_modules/graceful-fs/graceful-fs.js
 var require_graceful_fs = __commonJS({
   "node_modules/graceful-fs/graceful-fs.js"(exports2, module2) {
-    var fs33 = require("fs");
+    var fs34 = require("fs");
     var polyfills = require_polyfills();
     var legacy = require_legacy_streams();
     var clone = require_clone();
@@ -116884,12 +116884,12 @@ var require_graceful_fs = __commonJS({
         m = "GFS4: " + m.split(/\n/).join("\nGFS4: ");
         console.error(m);
       };
-    if (!fs33[gracefulQueue]) {
+    if (!fs34[gracefulQueue]) {
       queue2 = global[gracefulQueue] || [];
-      publishQueue(fs33, queue2);
-      fs33.close = (function(fs$close) {
+      publishQueue(fs34, queue2);
+      fs34.close = (function(fs$close) {
         function close(fd, cb) {
-          return fs$close.call(fs33, fd, function(err) {
+          return fs$close.call(fs34, fd, function(err) {
             if (!err) {
               resetQueue();
             }
@@ -116901,40 +116901,40 @@ var require_graceful_fs = __commonJS({
           value: fs$close
         });
         return close;
-      })(fs33.close);
-      fs33.closeSync = (function(fs$closeSync) {
+      })(fs34.close);
+      fs34.closeSync = (function(fs$closeSync) {
         function closeSync(fd) {
-          fs$closeSync.apply(fs33, arguments);
+          fs$closeSync.apply(fs34, arguments);
           resetQueue();
         }
         Object.defineProperty(closeSync, previousSymbol, {
           value: fs$closeSync
         });
         return closeSync;
-      })(fs33.closeSync);
+      })(fs34.closeSync);
       if (/\bgfs4\b/i.test(process.env.NODE_DEBUG || "")) {
         process.on("exit", function() {
-          debug6(fs33[gracefulQueue]);
-          require("assert").equal(fs33[gracefulQueue].length, 0);
+          debug6(fs34[gracefulQueue]);
+          require("assert").equal(fs34[gracefulQueue].length, 0);
         });
       }
     }
     var queue2;
     if (!global[gracefulQueue]) {
-      publishQueue(global, fs33[gracefulQueue]);
-    }
-    module2.exports = patch(clone(fs33));
-    if (process.env.TEST_GRACEFUL_FS_GLOBAL_PATCH && !fs33.__patched) {
-      module2.exports = patch(fs33);
-      fs33.__patched = true;
-    }
-    function patch(fs34) {
-      polyfills(fs34);
-      fs34.gracefulify = patch;
-      fs34.createReadStream = createReadStream4;
-      fs34.createWriteStream = createWriteStream3;
-      var fs$readFile = fs34.readFile;
-      fs34.readFile = readFile;
+      publishQueue(global, fs34[gracefulQueue]);
+    }
+    module2.exports = patch(clone(fs34));
+    if (process.env.TEST_GRACEFUL_FS_GLOBAL_PATCH && !fs34.__patched) {
+      module2.exports = patch(fs34);
+      fs34.__patched = true;
+    }
+    function patch(fs35) {
+      polyfills(fs35);
+      fs35.gracefulify = patch;
+      fs35.createReadStream = createReadStream4;
+      fs35.createWriteStream = createWriteStream3;
+      var fs$readFile = fs35.readFile;
+      fs35.readFile = readFile;
       function readFile(path30, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
@@ -116950,8 +116950,8 @@ var require_graceful_fs = __commonJS({
           });
         }
       }
-      var fs$writeFile = fs34.writeFile;
-      fs34.writeFile = writeFile;
+      var fs$writeFile = fs35.writeFile;
+      fs35.writeFile = writeFile;
       function writeFile(path30, data, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
@@ -116967,9 +116967,9 @@ var require_graceful_fs = __commonJS({
           });
         }
       }
-      var fs$appendFile = fs34.appendFile;
+      var fs$appendFile = fs35.appendFile;
       if (fs$appendFile)
-        fs34.appendFile = appendFile;
+        fs35.appendFile = appendFile;
       function appendFile(path30, data, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
@@ -116985,9 +116985,9 @@ var require_graceful_fs = __commonJS({
           });
         }
       }
-      var fs$copyFile = fs34.copyFile;
+      var fs$copyFile = fs35.copyFile;
       if (fs$copyFile)
-        fs34.copyFile = copyFile2;
+        fs35.copyFile = copyFile2;
       function copyFile2(src, dest, flags, cb) {
         if (typeof flags === "function") {
           cb = flags;
@@ -117005,8 +117005,8 @@ var require_graceful_fs = __commonJS({
           });
         }
       }
-      var fs$readdir = fs34.readdir;
-      fs34.readdir = readdir3;
+      var fs$readdir = fs35.readdir;
+      fs35.readdir = readdir3;
       var noReaddirOptionVersions = /^v[0-5]\./;
       function readdir3(path30, options, cb) {
         if (typeof options === "function")
@@ -117047,21 +117047,21 @@ var require_graceful_fs = __commonJS({
         }
       }
       if (process.version.substr(0, 4) === "v0.8") {
-        var legStreams = legacy(fs34);
+        var legStreams = legacy(fs35);
         ReadStream = legStreams.ReadStream;
         WriteStream = legStreams.WriteStream;
       }
-      var fs$ReadStream = fs34.ReadStream;
+      var fs$ReadStream = fs35.ReadStream;
       if (fs$ReadStream) {
         ReadStream.prototype = Object.create(fs$ReadStream.prototype);
         ReadStream.prototype.open = ReadStream$open;
       }
-      var fs$WriteStream = fs34.WriteStream;
+      var fs$WriteStream = fs35.WriteStream;
       if (fs$WriteStream) {
         WriteStream.prototype = Object.create(fs$WriteStream.prototype);
         WriteStream.prototype.open = WriteStream$open;
       }
-      Object.defineProperty(fs34, "ReadStream", {
+      Object.defineProperty(fs35, "ReadStream", {
         get: function() {
           return ReadStream;
         },
@@ -117071,7 +117071,7 @@ var require_graceful_fs = __commonJS({
         enumerable: true,
         configurable: true
       });
-      Object.defineProperty(fs34, "WriteStream", {
+      Object.defineProperty(fs35, "WriteStream", {
         get: function() {
           return WriteStream;
         },
@@ -117082,7 +117082,7 @@ var require_graceful_fs = __commonJS({
         configurable: true
       });
       var FileReadStream = ReadStream;
-      Object.defineProperty(fs34, "FileReadStream", {
+      Object.defineProperty(fs35, "FileReadStream", {
         get: function() {
           return FileReadStream;
         },
@@ -117093,7 +117093,7 @@ var require_graceful_fs = __commonJS({
         configurable: true
       });
       var FileWriteStream = WriteStream;
-      Object.defineProperty(fs34, "FileWriteStream", {
+      Object.defineProperty(fs35, "FileWriteStream", {
         get: function() {
           return FileWriteStream;
         },
@@ -117142,13 +117142,13 @@ var require_graceful_fs = __commonJS({
         });
       }
       function createReadStream4(path30, options) {
-        return new fs34.ReadStream(path30, options);
+        return new fs35.ReadStream(path30, options);
       }
       function createWriteStream3(path30, options) {
-        return new fs34.WriteStream(path30, options);
+        return new fs35.WriteStream(path30, options);
       }
-      var fs$open = fs34.open;
-      fs34.open = open;
+      var fs$open = fs35.open;
+      fs35.open = open;
       function open(path30, flags, mode, cb) {
         if (typeof mode === "function")
           cb = mode, mode = null;
@@ -117164,20 +117164,20 @@ var require_graceful_fs = __commonJS({
           });
         }
       }
-      return fs34;
+      return fs35;
     }
     function enqueue(elem) {
       debug6("ENQUEUE", elem[0].name, elem[1]);
-      fs33[gracefulQueue].push(elem);
+      fs34[gracefulQueue].push(elem);
       retry2();
     }
     var retryTimer;
     function resetQueue() {
       var now = Date.now();
-      for (var i = 0; i < fs33[gracefulQueue].length; ++i) {
-        if (fs33[gracefulQueue][i].length > 2) {
-          fs33[gracefulQueue][i][3] = now;
-          fs33[gracefulQueue][i][4] = now;
+      for (var i = 0; i < fs34[gracefulQueue].length; ++i) {
+        if (fs34[gracefulQueue][i].length > 2) {
+          fs34[gracefulQueue][i][3] = now;
+          fs34[gracefulQueue][i][4] = now;
         }
       }
       retry2();
@@ -117185,9 +117185,9 @@ var require_graceful_fs = __commonJS({
     function retry2() {
       clearTimeout(retryTimer);
       retryTimer = void 0;
-      if (fs33[gracefulQueue].length === 0)
+      if (fs34[gracefulQueue].length === 0)
         return;
-      var elem = fs33[gracefulQueue].shift();
+      var elem = fs34[gracefulQueue].shift();
       var fn = elem[0];
       var args = elem[1];
       var err = elem[2];
@@ -117209,7 +117209,7 @@ var require_graceful_fs = __commonJS({
           debug6("RETRY", fn.name, args);
           fn.apply(null, args.concat([startTime]));
         } else {
-          fs33[gracefulQueue].push(elem);
+          fs34[gracefulQueue].push(elem);
         }
       }
       if (retryTimer === void 0) {
@@ -128032,15 +128032,15 @@ globstar while`, t, d, e, u, m), this.matchOne(t.slice(d), e.slice(u), s)) retur
       g.minimatch.escape = vi.escape;
       g.minimatch.unescape = Ei.unescape;
     });
-    var fs33 = R((Wt) => {
+    var fs34 = R((Wt) => {
       "use strict";
       Object.defineProperty(Wt, "__esModule", { value: true });
       Wt.LRUCache = void 0;
       var er = typeof performance == "object" && performance && typeof performance.now == "function" ? performance : Date, as = /* @__PURE__ */ new Set(), ge = typeof process == "object" && process ? process : {}, ls = (n, t, e, s) => {
         typeof ge.emitWarning == "function" ? ge.emitWarning(n, t, e, s) : console.error(`[${e}] ${t}: ${n}`);
-      }, Lt = globalThis.AbortController, os7 = globalThis.AbortSignal;
+      }, Lt = globalThis.AbortController, os8 = globalThis.AbortSignal;
       if (typeof Lt > "u") {
-        os7 = class {
+        os8 = class {
           onabort;
           _onabort = [];
           reason;
@@ -128052,7 +128052,7 @@ globstar while`, t, d, e, u, m), this.matchOne(t.slice(d), e.slice(u), s)) retur
           constructor() {
             t();
           }
-          signal = new os7();
+          signal = new os8();
           abort(e) {
             if (!this.signal.aborted) {
               this.signal.reason = e, this.signal.aborted = true;
@@ -128901,7 +128901,7 @@ globstar while`, t, d, e, u, m), this.matchOne(t.slice(d), e.slice(u), s)) retur
       };
       Object.defineProperty(_2, "__esModule", { value: true });
       _2.PathScurry = _2.Path = _2.PathScurryDarwin = _2.PathScurryPosix = _2.PathScurryWin32 = _2.PathScurryBase = _2.PathPosix = _2.PathWin32 = _2.PathBase = _2.ChildrenCache = _2.ResolveCache = void 0;
-      var Qt = fs33(), Yt = require("node:path"), yr = require("node:url"), pt = require("fs"), Sr = br(require("node:fs")), vr = pt.realpathSync.native, Ht = require("node:fs/promises"), bs = Oe(), mt = { lstatSync: pt.lstatSync, readdir: pt.readdir, readdirSync: pt.readdirSync, readlinkSync: pt.readlinkSync, realpathSync: vr, promises: { lstat: Ht.lstat, readdir: Ht.readdir, readlink: Ht.readlink, realpath: Ht.realpath } }, _s2 = (n) => !n || n === mt || n === Sr ? mt : { ...mt, ...n, promises: { ...mt.promises, ...n.promises || {} } }, Os = /^\\\\\?\\([a-z]:)\\?$/i, Er = (n) => n.replace(/\//g, "\\").replace(Os, "$1\\"), _r2 = /[\\\/]/, N = 0, xs = 1, Ts = 2, G = 4, Cs = 6, Rs = 8, Q = 10, As = 12, j = 15, dt = ~j, xe = 16, ys = 32, gt = 64, W = 128, Vt = 256, Xt = 512, Ss = gt | W | Xt, Or = 1023, Te = (n) => n.isFile() ? Rs : n.isDirectory() ? G : n.isSymbolicLink() ? Q : n.isCharacterDevice() ? Ts : n.isBlockDevice() ? Cs : n.isSocket() ? As : n.isFIFO() ? xs : N, vs = new Qt.LRUCache({ max: 2 ** 12 }), wt = (n) => {
+      var Qt = fs34(), Yt = require("node:path"), yr = require("node:url"), pt = require("fs"), Sr = br(require("node:fs")), vr = pt.realpathSync.native, Ht = require("node:fs/promises"), bs = Oe(), mt = { lstatSync: pt.lstatSync, readdir: pt.readdir, readdirSync: pt.readdirSync, readlinkSync: pt.readlinkSync, realpathSync: vr, promises: { lstat: Ht.lstat, readdir: Ht.readdir, readlink: Ht.readlink, realpath: Ht.realpath } }, _s2 = (n) => !n || n === mt || n === Sr ? mt : { ...mt, ...n, promises: { ...mt.promises, ...n.promises || {} } }, Os = /^\\\\\?\\([a-z]:)\\?$/i, Er = (n) => n.replace(/\//g, "\\").replace(Os, "$1\\"), _r2 = /[\\\/]/, N = 0, xs = 1, Ts = 2, G = 4, Cs = 6, Rs = 8, Q = 10, As = 12, j = 15, dt = ~j, xe = 16, ys = 32, gt = 64, W = 128, Vt = 256, Xt = 512, Ss = gt | W | Xt, Or = 1023, Te = (n) => n.isFile() ? Rs : n.isDirectory() ? G : n.isSymbolicLink() ? Q : n.isCharacterDevice() ? Ts : n.isBlockDevice() ? Cs : n.isSocket() ? As : n.isFIFO() ? xs : N, vs = new Qt.LRUCache({ max: 2 ** 12 }), wt = (n) => {
         let t = vs.get(n);
         if (t) return t;
         let e = n.normalize("NFKD");
@@ -130279,7 +130279,7 @@ globstar while`, t, d, e, u, m), this.matchOne(t.slice(d), e.slice(u), s)) retur
 // node_modules/archiver-utils/file.js
 var require_file3 = __commonJS({
   "node_modules/archiver-utils/file.js"(exports2, module2) {
-    var fs33 = require_graceful_fs();
+    var fs34 = require_graceful_fs();
     var path30 = require("path");
     var flatten = require_flatten();
     var difference = require_difference();
@@ -130306,7 +130306,7 @@ var require_file3 = __commonJS({
     };
     file.exists = function() {
       var filepath = path30.join.apply(path30, arguments);
-      return fs33.existsSync(filepath);
+      return fs34.existsSync(filepath);
     };
     file.expand = function(...args) {
       var options = isPlainObject4(args[0]) ? args.shift() : {};
@@ -130324,7 +130324,7 @@ var require_file3 = __commonJS({
             if (typeof options.filter === "function") {
               return options.filter(filepath);
             } else {
-              return fs33.statSync(filepath)[options.filter]();
+              return fs34.statSync(filepath)[options.filter]();
             }
           } catch (e) {
             return false;
@@ -130432,7 +130432,7 @@ var require_file3 = __commonJS({
 // node_modules/archiver-utils/index.js
 var require_archiver_utils = __commonJS({
   "node_modules/archiver-utils/index.js"(exports2, module2) {
-    var fs33 = require_graceful_fs();
+    var fs34 = require_graceful_fs();
     var path30 = require("path");
     var isStream2 = require_is_stream();
     var lazystream = require_lazystream();
@@ -130481,7 +130481,7 @@ var require_archiver_utils = __commonJS({
     };
     utils.lazyReadStream = function(filepath) {
       return new lazystream.Readable(function() {
-        return fs33.createReadStream(filepath);
+        return fs34.createReadStream(filepath);
       });
     };
     utils.normalizeInputSource = function(source) {
@@ -130509,7 +130509,7 @@ var require_archiver_utils = __commonJS({
         callback = base;
         base = dirpath;
       }
-      fs33.readdir(dirpath, function(err, list) {
+      fs34.readdir(dirpath, function(err, list) {
         var i = 0;
         var file;
         var filepath;
@@ -130522,7 +130522,7 @@ var require_archiver_utils = __commonJS({
             return callback(null, results);
           }
           filepath = path30.join(dirpath, file);
-          fs33.stat(filepath, function(err2, stats) {
+          fs34.stat(filepath, function(err2, stats) {
             results.push({
               path: filepath,
               relative: path30.relative(base, filepath).replace(/\\/g, "/"),
@@ -130584,7 +130584,7 @@ var require_error3 = __commonJS({
 // node_modules/@actions/artifact/node_modules/archiver/lib/core.js
 var require_core2 = __commonJS({
   "node_modules/@actions/artifact/node_modules/archiver/lib/core.js"(exports2, module2) {
-    var fs33 = require("fs");
+    var fs34 = require("fs");
     var glob2 = require_readdir_glob();
     var async = require_async();
     var path30 = require("path");
@@ -130648,7 +130648,7 @@ var require_core2 = __commonJS({
       data.sourcePath = filepath;
       task.data = data;
       this._entriesCount++;
-      if (data.stats && data.stats instanceof fs33.Stats) {
+      if (data.stats && data.stats instanceof fs34.Stats) {
         task = this._updateQueueTaskWithStats(task, data.stats);
         if (task) {
           if (data.stats.size) {
@@ -130819,7 +130819,7 @@ var require_core2 = __commonJS({
         callback();
         return;
       }
-      fs33.lstat(task.filepath, function(err, stats) {
+      fs34.lstat(task.filepath, function(err, stats) {
         if (this._state.aborted) {
           setImmediate(callback);
           return;
@@ -130862,7 +130862,7 @@ var require_core2 = __commonJS({
         task.data.sourceType = "buffer";
         task.source = Buffer.concat([]);
       } else if (stats.isSymbolicLink() && this._moduleSupports("symlink")) {
-        var linkPath = fs33.readlinkSync(task.filepath);
+        var linkPath = fs34.readlinkSync(task.filepath);
         var dirName = path30.dirname(task.filepath);
         task.data.type = "symlink";
         task.data.linkname = path30.relative(dirName, path30.resolve(dirName, linkPath));
@@ -136579,7 +136579,7 @@ var require_dist_node2 = __commonJS({
         return template.replace(/\/$/, "");
       }
     }
-    function parse3(options) {
+    function parse4(options) {
       let method = options.method.toUpperCase();
       let url2 = (options.url || "/").replace(/:([a-z]\w+)/g, "{$1}");
       let headers = Object.assign({}, options.headers);
@@ -136643,7 +136643,7 @@ var require_dist_node2 = __commonJS({
       );
     }
     function endpointWithDefaults2(defaults3, route, options) {
-      return parse3(merge2(defaults3, route, options));
+      return parse4(merge2(defaults3, route, options));
     }
     function withDefaults4(oldDefaults, newDefaults) {
       const DEFAULTS22 = merge2(oldDefaults, newDefaults);
@@ -136652,7 +136652,7 @@ var require_dist_node2 = __commonJS({
         DEFAULTS: DEFAULTS22,
         defaults: withDefaults4.bind(null, DEFAULTS22),
         merge: merge2.bind(null, DEFAULTS22),
-        parse: parse3
+        parse: parse4
       });
     }
     var endpoint2 = withDefaults4(null, DEFAULTS2);
@@ -140884,7 +140884,7 @@ var require_binary = __commonJS({
       });
       return stream2;
     };
-    exports2.parse = function parse3(buffer) {
+    exports2.parse = function parse4(buffer) {
       var self2 = words(function(bytes, cb) {
         return function(name) {
           if (offset + bytes <= buffer.length) {
@@ -141764,7 +141764,7 @@ var require_parser_stream = __commonJS({
 var require_mkdirp = __commonJS({
   "node_modules/mkdirp/index.js"(exports2, module2) {
     var path30 = require("path");
-    var fs33 = require("fs");
+    var fs34 = require("fs");
     var _0777 = parseInt("0777", 8);
     module2.exports = mkdirP.mkdirp = mkdirP.mkdirP = mkdirP;
     function mkdirP(p, opts, f, made) {
@@ -141775,7 +141775,7 @@ var require_mkdirp = __commonJS({
         opts = { mode: opts };
       }
       var mode = opts.mode;
-      var xfs = opts.fs || fs33;
+      var xfs = opts.fs || fs34;
       if (mode === void 0) {
         mode = _0777;
       }
@@ -141814,7 +141814,7 @@ var require_mkdirp = __commonJS({
         opts = { mode: opts };
       }
       var mode = opts.mode;
-      var xfs = opts.fs || fs33;
+      var xfs = opts.fs || fs34;
       if (mode === void 0) {
         mode = _0777;
       }
@@ -141851,7 +141851,7 @@ var require_mkdirp = __commonJS({
 // node_modules/unzip-stream/lib/extract.js
 var require_extract2 = __commonJS({
   "node_modules/unzip-stream/lib/extract.js"(exports2, module2) {
-    var fs33 = require("fs");
+    var fs34 = require("fs");
     var path30 = require("path");
     var util4 = require("util");
     var mkdirp = require_mkdirp();
@@ -141898,7 +141898,7 @@ var require_extract2 = __commonJS({
       var directory = entry.isDirectory ? destPath : path30.dirname(destPath);
       this.unfinishedEntries++;
       var writeFileFn = function() {
-        var pipedStream = fs33.createWriteStream(destPath);
+        var pipedStream = fs34.createWriteStream(destPath);
         pipedStream.on("close", function() {
           self2.unfinishedEntries--;
           self2._notifyAwaiter();
@@ -143009,11 +143009,11 @@ var require_command2 = __commonJS({
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.issue = exports2.issueCommand = void 0;
-    var os7 = __importStar2(require("os"));
+    var os8 = __importStar2(require("os"));
     var utils_1 = require_utils11();
     function issueCommand(command, properties, message) {
       const cmd = new Command(command, properties, message);
-      process.stdout.write(cmd.toString() + os7.EOL);
+      process.stdout.write(cmd.toString() + os8.EOL);
     }
     exports2.issueCommand = issueCommand;
     function issue(name, message = "") {
@@ -143096,18 +143096,18 @@ var require_file_command2 = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.prepareKeyValueMessage = exports2.issueFileCommand = void 0;
     var crypto3 = __importStar2(require("crypto"));
-    var fs33 = __importStar2(require("fs"));
-    var os7 = __importStar2(require("os"));
+    var fs34 = __importStar2(require("fs"));
+    var os8 = __importStar2(require("os"));
     var utils_1 = require_utils11();
     function issueFileCommand(command, message) {
       const filePath = process.env[`GITHUB_${command}`];
       if (!filePath) {
         throw new Error(`Unable to find environment variable for file command ${command}`);
       }
-      if (!fs33.existsSync(filePath)) {
+      if (!fs34.existsSync(filePath)) {
         throw new Error(`Missing file at path: ${filePath}`);
       }
-      fs33.appendFileSync(filePath, `${(0, utils_1.toCommandValue)(message)}${os7.EOL}`, {
+      fs34.appendFileSync(filePath, `${(0, utils_1.toCommandValue)(message)}${os8.EOL}`, {
         encoding: "utf8"
       });
     }
@@ -143121,7 +143121,7 @@ var require_file_command2 = __commonJS({
       if (convertedValue.includes(delimiter)) {
         throw new Error(`Unexpected input: value should not contain the delimiter "${delimiter}"`);
       }
-      return `${key}<<${delimiter}${os7.EOL}${convertedValue}${os7.EOL}${delimiter}`;
+      return `${key}<<${delimiter}${os8.EOL}${convertedValue}${os8.EOL}${delimiter}`;
     }
     exports2.prepareKeyValueMessage = prepareKeyValueMessage;
   }
@@ -144430,12 +144430,12 @@ var require_io_util2 = __commonJS({
     var _a6;
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.getCmdPath = exports2.tryGetExecutablePath = exports2.isRooted = exports2.isDirectory = exports2.exists = exports2.READONLY = exports2.UV_FS_O_EXLOCK = exports2.IS_WINDOWS = exports2.unlink = exports2.symlink = exports2.stat = exports2.rmdir = exports2.rm = exports2.rename = exports2.readlink = exports2.readdir = exports2.open = exports2.mkdir = exports2.lstat = exports2.copyFile = exports2.chmod = void 0;
-    var fs33 = __importStar2(require("fs"));
+    var fs34 = __importStar2(require("fs"));
     var path30 = __importStar2(require("path"));
-    _a6 = fs33.promises, exports2.chmod = _a6.chmod, exports2.copyFile = _a6.copyFile, exports2.lstat = _a6.lstat, exports2.mkdir = _a6.mkdir, exports2.open = _a6.open, exports2.readdir = _a6.readdir, exports2.readlink = _a6.readlink, exports2.rename = _a6.rename, exports2.rm = _a6.rm, exports2.rmdir = _a6.rmdir, exports2.stat = _a6.stat, exports2.symlink = _a6.symlink, exports2.unlink = _a6.unlink;
+    _a6 = fs34.promises, exports2.chmod = _a6.chmod, exports2.copyFile = _a6.copyFile, exports2.lstat = _a6.lstat, exports2.mkdir = _a6.mkdir, exports2.open = _a6.open, exports2.readdir = _a6.readdir, exports2.readlink = _a6.readlink, exports2.rename = _a6.rename, exports2.rm = _a6.rm, exports2.rmdir = _a6.rmdir, exports2.stat = _a6.stat, exports2.symlink = _a6.symlink, exports2.unlink = _a6.unlink;
     exports2.IS_WINDOWS = process.platform === "win32";
     exports2.UV_FS_O_EXLOCK = 268435456;
-    exports2.READONLY = fs33.constants.O_RDONLY;
+    exports2.READONLY = fs34.constants.O_RDONLY;
     function exists(fsPath) {
       return __awaiter2(this, void 0, void 0, function* () {
         try {
@@ -144850,7 +144850,7 @@ var require_toolrunner2 = __commonJS({
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.argStringToArray = exports2.ToolRunner = void 0;
-    var os7 = __importStar2(require("os"));
+    var os8 = __importStar2(require("os"));
     var events = __importStar2(require("events"));
     var child = __importStar2(require("child_process"));
     var path30 = __importStar2(require("path"));
@@ -144905,12 +144905,12 @@ var require_toolrunner2 = __commonJS({
       _processLineBuffer(data, strBuffer, onLine) {
         try {
           let s = strBuffer + data.toString();
-          let n = s.indexOf(os7.EOL);
+          let n = s.indexOf(os8.EOL);
           while (n > -1) {
             const line = s.substring(0, n);
             onLine(line);
-            s = s.substring(n + os7.EOL.length);
-            n = s.indexOf(os7.EOL);
+            s = s.substring(n + os8.EOL.length);
+            n = s.indexOf(os8.EOL);
           }
           return s;
         } catch (err) {
@@ -145079,7 +145079,7 @@ var require_toolrunner2 = __commonJS({
             }
             const optionsNonNull = this._cloneExecOptions(this.options);
             if (!optionsNonNull.silent && optionsNonNull.outStream) {
-              optionsNonNull.outStream.write(this._getCommandString(optionsNonNull) + os7.EOL);
+              optionsNonNull.outStream.write(this._getCommandString(optionsNonNull) + os8.EOL);
             }
             const state = new ExecState(optionsNonNull, this.toolPath);
             state.on("debug", (message) => {
@@ -145567,7 +145567,7 @@ var require_core3 = __commonJS({
     var command_1 = require_command2();
     var file_command_1 = require_file_command2();
     var utils_1 = require_utils11();
-    var os7 = __importStar2(require("os"));
+    var os8 = __importStar2(require("os"));
     var path30 = __importStar2(require("path"));
     var oidc_utils_1 = require_oidc_utils2();
     var ExitCode;
@@ -145635,7 +145635,7 @@ Support boolean input list: \`true | True | TRUE | false | False | FALSE\``);
       if (filePath) {
         return (0, file_command_1.issueFileCommand)("OUTPUT", (0, file_command_1.prepareKeyValueMessage)(name, value));
       }
-      process.stdout.write(os7.EOL);
+      process.stdout.write(os8.EOL);
       (0, command_1.issueCommand)("set-output", { name }, (0, utils_1.toCommandValue)(value));
     }
     exports2.setOutput = setOutput7;
@@ -145669,7 +145669,7 @@ Support boolean input list: \`true | True | TRUE | false | False | FALSE\``);
     }
     exports2.notice = notice;
     function info8(message) {
-      process.stdout.write(message + os7.EOL);
+      process.stdout.write(message + os8.EOL);
     }
     exports2.info = info8;
     function startGroup3(name) {
@@ -145824,25 +145824,25 @@ var require_upload_specification = __commonJS({
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.getUploadSpecification = void 0;
-    var fs33 = __importStar2(require("fs"));
+    var fs34 = __importStar2(require("fs"));
     var core_1 = require_core3();
     var path_1 = require("path");
     var path_and_artifact_name_validation_1 = require_path_and_artifact_name_validation2();
     function getUploadSpecification(artifactName, rootDirectory, artifactFiles) {
       const specifications = [];
-      if (!fs33.existsSync(rootDirectory)) {
+      if (!fs34.existsSync(rootDirectory)) {
         throw new Error(`Provided rootDirectory ${rootDirectory} does not exist`);
       }
-      if (!fs33.statSync(rootDirectory).isDirectory()) {
+      if (!fs34.statSync(rootDirectory).isDirectory()) {
         throw new Error(`Provided rootDirectory ${rootDirectory} is not a valid directory`);
       }
       rootDirectory = (0, path_1.normalize)(rootDirectory);
       rootDirectory = (0, path_1.resolve)(rootDirectory);
       for (let file of artifactFiles) {
-        if (!fs33.existsSync(file)) {
+        if (!fs34.existsSync(file)) {
           throw new Error(`File ${file} does not exist`);
         }
-        if (!fs33.statSync(file).isDirectory()) {
+        if (!fs34.statSync(file).isDirectory()) {
           file = (0, path_1.normalize)(file);
           file = (0, path_1.resolve)(file);
           if (!file.startsWith(rootDirectory)) {
@@ -145867,29 +145867,29 @@ var require_upload_specification = __commonJS({
 // node_modules/tmp/lib/tmp.js
 var require_tmp = __commonJS({
   "node_modules/tmp/lib/tmp.js"(exports2, module2) {
-    var fs33 = require("fs");
-    var os7 = require("os");
+    var fs34 = require("fs");
+    var os8 = require("os");
     var path30 = require("path");
     var crypto3 = require("crypto");
-    var _c2 = { fs: fs33.constants, os: os7.constants };
+    var _c2 = { fs: fs34.constants, os: os8.constants };
     var RANDOM_CHARS = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
     var TEMPLATE_PATTERN = /XXXXXX/;
     var DEFAULT_TRIES = 3;
     var CREATE_FLAGS = (_c2.O_CREAT || _c2.fs.O_CREAT) | (_c2.O_EXCL || _c2.fs.O_EXCL) | (_c2.O_RDWR || _c2.fs.O_RDWR);
-    var IS_WIN32 = os7.platform() === "win32";
+    var IS_WIN32 = os8.platform() === "win32";
     var EBADF = _c2.EBADF || _c2.os.errno.EBADF;
     var ENOENT = _c2.ENOENT || _c2.os.errno.ENOENT;
     var DIR_MODE = 448;
     var FILE_MODE = 384;
     var EXIT = "exit";
     var _removeObjects = [];
-    var FN_RMDIR_SYNC = fs33.rmdirSync.bind(fs33);
+    var FN_RMDIR_SYNC = fs34.rmdirSync.bind(fs34);
     var _gracefulCleanup = false;
     function rimraf(dirPath, callback) {
-      return fs33.rm(dirPath, { recursive: true }, callback);
+      return fs34.rm(dirPath, { recursive: true }, callback);
     }
     function FN_RIMRAF_SYNC(dirPath) {
-      return fs33.rmSync(dirPath, { recursive: true });
+      return fs34.rmSync(dirPath, { recursive: true });
     }
     function tmpName(options, callback) {
       const args = _parseArguments(options, callback), opts = args[0], cb = args[1];
@@ -145899,7 +145899,7 @@ var require_tmp = __commonJS({
         (function _getUniqueName() {
           try {
             const name = _generateTmpName(sanitizedOptions);
-            fs33.stat(name, function(err2) {
+            fs34.stat(name, function(err2) {
               if (!err2) {
                 if (tries-- > 0) return _getUniqueName();
                 return cb(new Error("Could not get a unique tmp filename, max tries reached " + name));
@@ -145919,7 +145919,7 @@ var require_tmp = __commonJS({
       do {
         const name = _generateTmpName(sanitizedOptions);
         try {
-          fs33.statSync(name);
+          fs34.statSync(name);
         } catch (e) {
           return name;
         }
@@ -145930,10 +145930,10 @@ var require_tmp = __commonJS({
       const args = _parseArguments(options, callback), opts = args[0], cb = args[1];
       tmpName(opts, function _tmpNameCreated(err, name) {
         if (err) return cb(err);
-        fs33.open(name, CREATE_FLAGS, opts.mode || FILE_MODE, function _fileCreated(err2, fd) {
+        fs34.open(name, CREATE_FLAGS, opts.mode || FILE_MODE, function _fileCreated(err2, fd) {
           if (err2) return cb(err2);
           if (opts.discardDescriptor) {
-            return fs33.close(fd, function _discardCallback(possibleErr) {
+            return fs34.close(fd, function _discardCallback(possibleErr) {
               return cb(possibleErr, name, void 0, _prepareTmpFileRemoveCallback(name, -1, opts, false));
             });
           } else {
@@ -145947,9 +145947,9 @@ var require_tmp = __commonJS({
       const args = _parseArguments(options), opts = args[0];
       const discardOrDetachDescriptor = opts.discardDescriptor || opts.detachDescriptor;
       const name = tmpNameSync(opts);
-      let fd = fs33.openSync(name, CREATE_FLAGS, opts.mode || FILE_MODE);
+      let fd = fs34.openSync(name, CREATE_FLAGS, opts.mode || FILE_MODE);
       if (opts.discardDescriptor) {
-        fs33.closeSync(fd);
+        fs34.closeSync(fd);
         fd = void 0;
       }
       return {
@@ -145962,7 +145962,7 @@ var require_tmp = __commonJS({
       const args = _parseArguments(options, callback), opts = args[0], cb = args[1];
       tmpName(opts, function _tmpNameCreated(err, name) {
         if (err) return cb(err);
-        fs33.mkdir(name, opts.mode || DIR_MODE, function _dirCreated(err2) {
+        fs34.mkdir(name, opts.mode || DIR_MODE, function _dirCreated(err2) {
           if (err2) return cb(err2);
           cb(null, name, _prepareTmpDirRemoveCallback(name, opts, false));
         });
@@ -145971,7 +145971,7 @@ var require_tmp = __commonJS({
     function dirSync(options) {
       const args = _parseArguments(options), opts = args[0];
       const name = tmpNameSync(opts);
-      fs33.mkdirSync(name, opts.mode || DIR_MODE);
+      fs34.mkdirSync(name, opts.mode || DIR_MODE);
       return {
         name,
         removeCallback: _prepareTmpDirRemoveCallback(name, opts, true)
@@ -145985,20 +145985,20 @@ var require_tmp = __commonJS({
         next();
       };
       if (0 <= fdPath[0])
-        fs33.close(fdPath[0], function() {
-          fs33.unlink(fdPath[1], _handler);
+        fs34.close(fdPath[0], function() {
+          fs34.unlink(fdPath[1], _handler);
         });
-      else fs33.unlink(fdPath[1], _handler);
+      else fs34.unlink(fdPath[1], _handler);
     }
     function _removeFileSync(fdPath) {
       let rethrownException = null;
       try {
-        if (0 <= fdPath[0]) fs33.closeSync(fdPath[0]);
+        if (0 <= fdPath[0]) fs34.closeSync(fdPath[0]);
       } catch (e) {
         if (!_isEBADF(e) && !_isENOENT(e)) throw e;
       } finally {
         try {
-          fs33.unlinkSync(fdPath[1]);
+          fs34.unlinkSync(fdPath[1]);
         } catch (e) {
           if (!_isENOENT(e)) rethrownException = e;
         }
@@ -146014,7 +146014,7 @@ var require_tmp = __commonJS({
       return sync ? removeCallbackSync : removeCallback;
     }
     function _prepareTmpDirRemoveCallback(name, opts, sync) {
-      const removeFunction = opts.unsafeCleanup ? rimraf : fs33.rmdir.bind(fs33);
+      const removeFunction = opts.unsafeCleanup ? rimraf : fs34.rmdir.bind(fs34);
       const removeFunctionSync = opts.unsafeCleanup ? FN_RIMRAF_SYNC : FN_RMDIR_SYNC;
       const removeCallbackSync = _prepareRemoveCallback(removeFunctionSync, name, sync);
       const removeCallback = _prepareRemoveCallback(removeFunction, name, sync, removeCallbackSync);
@@ -146077,24 +146077,24 @@ var require_tmp = __commonJS({
     }
     function _resolvePath(name, tmpDir, cb) {
       const pathToResolve = path30.isAbsolute(name) ? name : path30.join(tmpDir, name);
-      fs33.stat(pathToResolve, function(err) {
+      fs34.stat(pathToResolve, function(err) {
         if (err) {
-          fs33.realpath(path30.dirname(pathToResolve), function(err2, parentDir) {
+          fs34.realpath(path30.dirname(pathToResolve), function(err2, parentDir) {
             if (err2) return cb(err2);
             cb(null, path30.join(parentDir, path30.basename(pathToResolve)));
           });
         } else {
-          fs33.realpath(pathToResolve, cb);
+          fs34.realpath(pathToResolve, cb);
         }
       });
     }
     function _resolvePathSync(name, tmpDir) {
       const pathToResolve = path30.isAbsolute(name) ? name : path30.join(tmpDir, name);
       try {
-        fs33.statSync(pathToResolve);
-        return fs33.realpathSync(pathToResolve);
+        fs34.statSync(pathToResolve);
+        return fs34.realpathSync(pathToResolve);
       } catch (_err) {
-        const parentDir = fs33.realpathSync(path30.dirname(pathToResolve));
+        const parentDir = fs34.realpathSync(path30.dirname(pathToResolve));
         return path30.join(parentDir, path30.basename(pathToResolve));
       }
     }
@@ -146215,10 +146215,10 @@ var require_tmp = __commonJS({
       _gracefulCleanup = true;
     }
     function _getTmpDir(options, cb) {
-      return fs33.realpath(options && options.tmpdir || os7.tmpdir(), cb);
+      return fs34.realpath(options && options.tmpdir || os8.tmpdir(), cb);
     }
     function _getTmpDirSync(options) {
-      return fs33.realpathSync(options && options.tmpdir || os7.tmpdir());
+      return fs34.realpathSync(options && options.tmpdir || os8.tmpdir());
     }
     process.addListener(EXIT, _garbageCollector);
     Object.defineProperty(module2.exports, "tmpdir", {
@@ -147072,10 +147072,10 @@ var require_upload_gzip = __commonJS({
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.createGZipFileInBuffer = exports2.createGZipFileOnDisk = void 0;
-    var fs33 = __importStar2(require("fs"));
+    var fs34 = __importStar2(require("fs"));
     var zlib3 = __importStar2(require("zlib"));
     var util_1 = require("util");
-    var stat2 = (0, util_1.promisify)(fs33.stat);
+    var stat2 = (0, util_1.promisify)(fs34.stat);
     var gzipExemptFileExtensions = [
       ".gz",
       ".gzip",
@@ -147108,9 +147108,9 @@ var require_upload_gzip = __commonJS({
           }
         }
         return new Promise((resolve15, reject) => {
-          const inputStream = fs33.createReadStream(originalFilePath);
+          const inputStream = fs34.createReadStream(originalFilePath);
           const gzip = zlib3.createGzip();
-          const outputStream = fs33.createWriteStream(tempFilePath);
+          const outputStream = fs34.createWriteStream(tempFilePath);
           inputStream.pipe(gzip).pipe(outputStream);
           outputStream.on("finish", () => __awaiter2(this, void 0, void 0, function* () {
             const size = (yield stat2(tempFilePath)).size;
@@ -147128,7 +147128,7 @@ var require_upload_gzip = __commonJS({
       return __awaiter2(this, void 0, void 0, function* () {
         return new Promise((resolve15) => __awaiter2(this, void 0, void 0, function* () {
           var _a6, e_1, _b2, _c2;
-          const inputStream = fs33.createReadStream(originalFilePath);
+          const inputStream = fs34.createReadStream(originalFilePath);
           const gzip = zlib3.createGzip();
           inputStream.pipe(gzip);
           const chunks = [];
@@ -147337,7 +147337,7 @@ var require_upload_http_client = __commonJS({
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.UploadHttpClient = void 0;
-    var fs33 = __importStar2(require("fs"));
+    var fs34 = __importStar2(require("fs"));
     var core29 = __importStar2(require_core3());
     var tmp2 = __importStar2(require_tmp_promise());
     var stream2 = __importStar2(require("stream"));
@@ -147351,7 +147351,7 @@ var require_upload_http_client = __commonJS({
     var http_manager_1 = require_http_manager();
     var upload_gzip_1 = require_upload_gzip();
     var requestUtils_1 = require_requestUtils2();
-    var stat2 = (0, util_1.promisify)(fs33.stat);
+    var stat2 = (0, util_1.promisify)(fs34.stat);
     var UploadHttpClient = class {
       constructor() {
         this.uploadHttpManager = new http_manager_1.HttpManager((0, config_variables_1.getUploadFileConcurrency)(), "@actions/artifact-upload");
@@ -147488,7 +147488,7 @@ var require_upload_http_client = __commonJS({
             let openUploadStream;
             if (totalFileSize < buffer.byteLength) {
               core29.debug(`The gzip file created for ${parameters.file} did not help with reducing the size of the file. The original file will be uploaded as-is`);
-              openUploadStream = () => fs33.createReadStream(parameters.file);
+              openUploadStream = () => fs34.createReadStream(parameters.file);
               isGzip = false;
               uploadFileSize = totalFileSize;
             } else {
@@ -147534,7 +147534,7 @@ var require_upload_http_client = __commonJS({
                 failedChunkSizes += chunkSize;
                 continue;
               }
-              const result = yield this.uploadChunk(httpClientIndex, parameters.resourceUrl, () => fs33.createReadStream(uploadFilePath, {
+              const result = yield this.uploadChunk(httpClientIndex, parameters.resourceUrl, () => fs34.createReadStream(uploadFilePath, {
                 start: startChunkIndex,
                 end: endChunkIndex,
                 autoClose: false
@@ -147729,7 +147729,7 @@ var require_download_http_client = __commonJS({
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.DownloadHttpClient = void 0;
-    var fs33 = __importStar2(require("fs"));
+    var fs34 = __importStar2(require("fs"));
     var core29 = __importStar2(require_core3());
     var zlib3 = __importStar2(require("zlib"));
     var utils_1 = require_utils12();
@@ -147820,7 +147820,7 @@ var require_download_http_client = __commonJS({
         return __awaiter2(this, void 0, void 0, function* () {
           let retryCount = 0;
           const retryLimit = (0, config_variables_1.getRetryLimit)();
-          let destinationStream = fs33.createWriteStream(downloadPath);
+          let destinationStream = fs34.createWriteStream(downloadPath);
           const headers = (0, utils_1.getDownloadHeaders)("application/json", true, true);
           const makeDownloadRequest = () => __awaiter2(this, void 0, void 0, function* () {
             const client = this.downloadHttpManager.getClient(httpClientIndex);
@@ -147862,7 +147862,7 @@ var require_download_http_client = __commonJS({
               }
             });
             yield (0, utils_1.rmFile)(fileDownloadPath);
-            destinationStream = fs33.createWriteStream(fileDownloadPath);
+            destinationStream = fs34.createWriteStream(fileDownloadPath);
           });
           while (retryCount <= retryLimit) {
             let response;
@@ -166068,12 +166068,13 @@ __export(entry_points_exports, {
 module.exports = __toCommonJS(entry_points_exports);
 
 // src/analyze-action.ts
-var fs24 = __toESM(require("fs"));
+var fs25 = __toESM(require("fs"));
 var import_path5 = __toESM(require("path"));
 var import_perf_hooks6 = require("perf_hooks");
 var core14 = __toESM(require_core());
 
 // src/action-common.ts
+var os4 = __toESM(require("os"));
 var core9 = __toESM(require_core());
 
 // src/actions-util.ts
@@ -166124,6 +166125,17 @@ var ReadOnlyEnv = class {
   get() {
     return { ...this.vars };
   }
+  /** Gets a copy of the underlying environment, where the values are not `undefined`. */
+  getDefined() {
+    const result = {};
+    for (const [key, val] of Object.entries(this.vars)) {
+      if (val === void 0) {
+        continue;
+      }
+      result[key] = val;
+    }
+    return result;
+  }
   /** Tries to get the value for `name` and throws if there isn't one. */
   getRequired(name) {
     return getRequiredEnvVar(this.vars, name);
@@ -166219,21 +166231,21 @@ async function getFolderSize(itemPath, options) {
 getFolderSize.loose = async (itemPath, options) => await core2(itemPath, options);
 getFolderSize.strict = async (itemPath, options) => await core2(itemPath, options, { strict: true });
 async function core2(rootItemPath, options = {}, returnType = {}) {
-  const fs33 = options.fs || await import("node:fs/promises");
+  const fs34 = options.fs || await import("node:fs/promises");
   let folderSize = 0n;
   const foundInos = /* @__PURE__ */ new Set();
   const errors = [];
   await processItem(rootItemPath);
   async function processItem(itemPath) {
     if (options.ignore?.test(itemPath)) return;
-    const stats = returnType.strict ? await fs33.lstat(itemPath, { bigint: true }) : await fs33.lstat(itemPath, { bigint: true }).catch((error3) => errors.push(error3));
+    const stats = returnType.strict ? await fs34.lstat(itemPath, { bigint: true }) : await fs34.lstat(itemPath, { bigint: true }).catch((error3) => errors.push(error3));
     if (typeof stats !== "object") return;
     if (!foundInos.has(stats.ino)) {
       foundInos.add(stats.ino);
       folderSize += stats.size;
     }
     if (stats.isDirectory()) {
-      const directoryItems = returnType.strict ? await fs33.readdir(itemPath) : await fs33.readdir(itemPath).catch((error3) => errors.push(error3));
+      const directoryItems = returnType.strict ? await fs34.readdir(itemPath) : await fs34.readdir(itemPath).catch((error3) => errors.push(error3));
       if (typeof directoryItems !== "object") return;
       await Promise.all(
         directoryItems.map(
@@ -170350,7 +170362,7 @@ function ensureEndsInPeriod(text) {
   return text[text.length - 1] === "." ? text : `${text}.`;
 }
 var MAX_STDERR_BUFFER_SIZE = 2e4;
-async function runTool(cmd, args = [], opts = {}) {
+async function runTool(env, cmd, args = [], opts = {}) {
   let stdout = "";
   let stderr = "";
   if (!opts.noStreamStdout) {
@@ -170358,6 +170370,7 @@ async function runTool(cmd, args = [], opts = {}) {
 `);
   }
   const exitCode = await new toolrunner.ToolRunner(cmd, args, {
+    env: env.getDefined(),
     ignoreReturnCode: true,
     listeners: {
       stdout: (data) => {
@@ -171780,6 +171793,7 @@ async function runInActions(action) {
       startedAt,
       platform: process.platform,
       arch: process.arch,
+      osRelease: os4.release(),
       logger: logger2,
       env,
       actions: actionsEnv
@@ -172161,6 +172175,11 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_START_PROXY_USE_FEATURES_RELEASE",
     minimumVersion: void 0
   },
+  ["skip_unsupported_traced_analysis" /* SkipUnsupportedTracedAnalysis */]: {
+    defaultValue: false,
+    envVar: "CODEQL_ACTION_SKIP_UNSUPPORTED_TRACED_ANALYSIS",
+    minimumVersion: void 0
+  },
   ["tools_repository_property" /* ToolsRepositoryProperty */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_TOOLS_REPOSITORY_PROPERTY",
@@ -172652,13 +172671,13 @@ var SarifScanOrder = [
 ];
 
 // src/analyze.ts
-var fs18 = __toESM(require("fs"));
+var fs19 = __toESM(require("fs"));
 var path16 = __toESM(require("path"));
 var import_perf_hooks5 = require("perf_hooks");
 var io5 = __toESM(require_io());
 
 // src/codeql.ts
-var fs17 = __toESM(require("fs"));
+var fs18 = __toESM(require("fs"));
 var path15 = __toESM(require("path"));
 var core12 = __toESM(require_core());
 var toolrunner3 = __toESM(require_toolrunner());
@@ -175293,11 +175312,11 @@ async function logGeneratedFilesTelemetry(config, duration, generatedFilesCount)
 }
 
 // src/setup-codeql.ts
-var fs15 = __toESM(require("fs"));
+var fs16 = __toESM(require("fs"));
 var path13 = __toESM(require("path"));
 var import_perf_hooks4 = require("perf_hooks");
 var toolcache3 = __toESM(require_tool_cache());
-var semver9 = __toESM(require_semver2());
+var semver10 = __toESM(require_semver2());
 
 // src/codeql-bundle.ts
 function getCodeQLBundleName(compressionMethod, platform2, language) {
@@ -175626,9 +175645,11 @@ async function getCodeQlVersionsForOverlayBaseDatabases(rawLanguages, logger2) {
 }
 
 // src/per-language-bundles.ts
-var semver6 = __toESM(require_semver2());
+var semver7 = __toESM(require_semver2());
 
 // src/platform.ts
+var import_fs = __toESM(require("fs"));
+var semver6 = __toESM(require_semver2());
 function getBundlePlatform(platform2 = process.platform, arch2 = process.arch) {
   switch (platform2) {
     case "win32":
@@ -175641,6 +175662,65 @@ function getBundlePlatform(platform2 = process.platform, arch2 = process.arch) {
       return void 0;
   }
 }
+function macOSVersion(action) {
+  if (action.platform !== "darwin") {
+    return void 0;
+  }
+  const version = semver6.parse(action.osRelease);
+  if (version === null) {
+    return action.osRelease;
+  }
+  return version;
+}
+var XCODE_SELECT_LINK_PATH = "/private/var/db/xcode_select_link";
+var XCODE_APP_FILENAME_PATTERN = new RegExp(
+  /(?<filename>Xcode_(?<majorMinor>\d+(\.\d+)?)\.app)/
+);
+function xcodeVersion(logger2) {
+  try {
+    const stats = import_fs.default.lstatSync(XCODE_SELECT_LINK_PATH, {
+      throwIfNoEntry: false
+    });
+    if (stats === void 0) {
+      logger2.debug(
+        `'${XCODE_SELECT_LINK_PATH}' does not exist. Xcode is probably not installed.`
+      );
+      return void 0;
+    }
+    if (!stats.isSymbolicLink()) {
+      logger2.warning(
+        `${XCODE_SELECT_LINK_PATH} exists, but is not a symbolic link.`
+      );
+      return void 0;
+    }
+    const xcodePath = import_fs.default.readlinkSync(XCODE_SELECT_LINK_PATH);
+    if (xcodePath === "") {
+      logger2.warning(
+        `Resolving ${XCODE_SELECT_LINK_PATH} unexpectedly returned nothing.`
+      );
+      return void 0;
+    }
+    const matchResult = xcodePath.match(XCODE_APP_FILENAME_PATTERN);
+    if (matchResult?.groups === void 0) {
+      logger2.warning(
+        `Xcode path '${xcodePath}' does not contain expected pattern.`
+      );
+      return void 0;
+    }
+    const majorMinor = matchResult.groups["majorMinor"];
+    const version = semver6.coerce(majorMinor);
+    if (version === null) {
+      logger2.warning(`Couldn't parse '${majorMinor}' as a semantic version.`);
+      return void 0;
+    }
+    return version;
+  } catch (err) {
+    logger2.warning(
+      `Unable to determine Xcode version: ${getErrorMessage(err)}`
+    );
+    return void 0;
+  }
+}
 
 // src/per-language-bundles.ts
 var MIN_PER_LANGUAGE_BUNDLE_CLI_VERSION = "2.27.1";
@@ -175728,7 +175808,7 @@ function getPerLanguageBundleLanguage(action, options) {
     if (cliVersion2 === void 0) {
       return explain("the requested CLI version is unknown");
     }
-    if (!semver6.gte(cliVersion2, MIN_PER_LANGUAGE_BUNDLE_CLI_VERSION)) {
+    if (!semver7.gte(cliVersion2, MIN_PER_LANGUAGE_BUNDLE_CLI_VERSION)) {
       return explain(
         `the requested CodeQL version ${cliVersion2} is older than ${MIN_PER_LANGUAGE_BUNDLE_CLI_VERSION}, which is the first version for which per-language bundles are published`
       );
@@ -175797,12 +175877,12 @@ async function getCodeQLAssetDownloadURL(action, apiDetails, tagName, assetName,
     }
     const { owner: repositoryOwner, repo: repositoryName } = parseRepositoryNwo(repository);
     try {
-      const release2 = await getApiClient().rest.repos.getReleaseByTag({
+      const release3 = await getApiClient().rest.repos.getReleaseByTag({
         owner: repositoryOwner,
         repo: repositoryName,
         tag: tagName
       });
-      for (const asset of release2.data.assets) {
+      for (const asset of release3.data.assets) {
         if (asset.name === assetName) {
           action.logger.info(
             `Found ${assetKind} ${assetName} in ${repository} on ${instanceURL} with URL ${asset.url}.`
@@ -175821,12 +175901,12 @@ async function getCodeQLAssetDownloadURL(action, apiDetails, tagName, assetName,
 
 // src/tar.ts
 var import_child_process = require("child_process");
-var fs13 = __toESM(require("fs"));
+var fs14 = __toESM(require("fs"));
 var stream = __toESM(require("stream"));
 var import_toolrunner = __toESM(require_toolrunner());
 var io4 = __toESM(require_io());
 var toolcache = __toESM(require_tool_cache());
-var semver7 = __toESM(require_semver2());
+var semver8 = __toESM(require_semver2());
 var MIN_REQUIRED_BSD_TAR_VERSION = "3.4.3";
 var MIN_REQUIRED_GNU_TAR_VERSION = "1.31";
 async function getTarVersion() {
@@ -175868,9 +175948,9 @@ async function isZstdAvailable(logger2) {
       case "gnu":
         return {
           available: foundZstdBinary && // GNU tar only uses major and minor version numbers
-          semver7.gte(
-            semver7.coerce(version),
-            semver7.coerce(MIN_REQUIRED_GNU_TAR_VERSION)
+          semver8.gte(
+            semver8.coerce(version),
+            semver8.coerce(MIN_REQUIRED_GNU_TAR_VERSION)
           ),
           foundZstdBinary,
           version: tarVersion
@@ -175879,7 +175959,7 @@ async function isZstdAvailable(logger2) {
         return {
           available: foundZstdBinary && // Do a loose comparison since these version numbers don't contain
           // a patch version number.
-          semver7.gte(version, MIN_REQUIRED_BSD_TAR_VERSION),
+          semver8.gte(version, MIN_REQUIRED_BSD_TAR_VERSION),
           foundZstdBinary,
           version: tarVersion
         };
@@ -175894,7 +175974,7 @@ async function isZstdAvailable(logger2) {
   }
 }
 async function extract(tarPath, dest, compressionMethod, tarVersion, logger2) {
-  fs13.mkdirSync(dest, { recursive: true });
+  fs14.mkdirSync(dest, { recursive: true });
   switch (compressionMethod) {
     case "gzip":
       return await toolcache.extractTar(tarPath, dest);
@@ -175980,15 +176060,15 @@ function inferCompressionMethod(tarPath) {
 }
 
 // src/tools-download.ts
-var fs14 = __toESM(require("fs"));
-var os4 = __toESM(require("os"));
+var fs15 = __toESM(require("fs"));
+var os5 = __toESM(require("os"));
 var path12 = __toESM(require("path"));
 var import_perf_hooks3 = require("perf_hooks");
 var core11 = __toESM(require_core());
 var import_http_client = __toESM(require_lib());
 var toolcache2 = __toESM(require_tool_cache());
 var import_follow_redirects = __toESM(require_follow_redirects());
-var semver8 = __toESM(require_semver2());
+var semver9 = __toESM(require_semver2());
 var STREAMING_HIGH_WATERMARK_BYTES = 4 * 1024 * 1024;
 var STREAMING_STALL_TIMEOUT_MS = 5 * 60 * 1e3;
 var TOOLCACHE_TOOL_NAME = "CodeQL";
@@ -176066,7 +176146,7 @@ async function downloadAndExtract(codeqlURL, compressionMethod, dest, authorizat
   };
 }
 async function downloadAndExtractZstdWithStreaming(codeqlURL, dest, authorization, headers, tarVersion, logger2) {
-  fs14.mkdirSync(dest, { recursive: true });
+  fs15.mkdirSync(dest, { recursive: true });
   const agent = new import_http_client.HttpClient().getAgent(codeqlURL);
   headers = Object.assign(
     { "User-Agent": "CodeQL Action" },
@@ -176114,18 +176194,18 @@ function getToolcacheToolDirectory(env) {
   );
 }
 function getToolcacheVersionDirectoryName(version) {
-  return semver8.clean(version) || version;
+  return semver9.clean(version) || version;
 }
 function getToolcacheDirectory(version) {
   return path12.join(
     getToolcacheToolDirectory(getEnv()),
     getToolcacheVersionDirectoryName(version),
-    os4.arch() || ""
+    os5.arch() || ""
   );
 }
 function isToolcacheOnWorkspaceFilesystem(logger2) {
   try {
-    return fs14.statSync(getRequiredEnvParam("RUNNER_TOOL_CACHE")).dev === fs14.statSync(getRequiredEnvParam("GITHUB_WORKSPACE")).dev;
+    return fs15.statSync(getRequiredEnvParam("RUNNER_TOOL_CACHE")).dev === fs15.statSync(getRequiredEnvParam("GITHUB_WORKSPACE")).dev;
   } catch (e) {
     logger2.debug(
       `Could not determine whether the toolcache is on the same filesystem as the workspace: ${getErrorMessage(e)}`
@@ -176147,7 +176227,7 @@ async function deleteToolcacheBundles({
     return { deletedVersions: [], failed: true };
   }
   try {
-    if ((await fs14.promises.lstat(toolDirectory)).isSymbolicLink()) {
+    if ((await fs15.promises.lstat(toolDirectory)).isSymbolicLink()) {
       logger2.info(
         `Not deleting the CodeQL tools from the toolcache since '${toolDirectory}' is a symlink.`
       );
@@ -176166,7 +176246,7 @@ async function deleteToolcacheBundles({
     return { deletedVersions: [], failed: true };
   }
   try {
-    const entries = await fs14.promises.readdir(toolDirectory, {
+    const entries = await fs15.promises.readdir(toolDirectory, {
       withFileTypes: true
     });
     const deletedVersions = [];
@@ -176180,7 +176260,7 @@ async function deleteToolcacheBundles({
       }
       const versionDirectory = path12.join(toolDirectory, entry.name);
       try {
-        await fs14.promises.rm(versionDirectory, {
+        await fs15.promises.rm(versionDirectory, {
           force: true,
           recursive: true
         });
@@ -176205,7 +176285,7 @@ async function deleteToolcacheBundles({
 }
 function writeToolcacheMarkerFile(extractedPath, logger2) {
   const markerFilePath = `${extractedPath}.complete`;
-  fs14.writeFileSync(markerFilePath, "");
+  fs15.writeFileSync(markerFilePath, "");
   logger2.info(`Created toolcache marker file ${markerFilePath}`);
 }
 
@@ -176241,13 +176321,13 @@ function tryGetTagNameFromUrl(url2, logger2) {
   return match2[1];
 }
 function convertToSemVer(version, logger2) {
-  if (!semver9.valid(version)) {
+  if (!semver10.valid(version)) {
     logger2.debug(
       `Bundle version ${version} is not in SemVer format. Will treat it as pre-release 0.0.0-${version}.`
     );
     version = `0.0.0-${version}`;
   }
-  const s = semver9.clean(version);
+  const s = semver10.clean(version);
   if (!s) {
     throw new Error(`Bundle version ${version} is not in SemVer format.`);
   }
@@ -176257,7 +176337,7 @@ async function findOverridingToolsInCache(humanReadableVersion, logger2) {
   const candidates = toolcache3.findAllVersions("CodeQL").filter(isGoodVersion).map((version) => ({
     folder: toolcache3.find("CodeQL", version),
     version
-  })).filter(({ folder }) => fs15.existsSync(path13.join(folder, "pinned-version")));
+  })).filter(({ folder }) => fs16.existsSync(path13.join(folder, "pinned-version")));
   if (candidates.length === 1) {
     const candidate = candidates[0];
     logger2.debug(
@@ -176427,7 +176507,7 @@ async function getCodeQLSource(toolsInput, defaultCliVersion, rawLanguages, othe
     url2 = toolsInput;
     if (tagName) {
       const bundleVersion3 = tryGetBundleVersionFromTagName(tagName, logger2);
-      if (bundleVersion3 !== void 0 && semver9.valid(bundleVersion3)) {
+      if (bundleVersion3 !== void 0 && semver10.valid(bundleVersion3)) {
         cliVersion2 = convertToSemVer(bundleVersion3, logger2);
       }
     }
@@ -176805,7 +176885,7 @@ async function downloadCodeQLBundle(action, source, apiDetails, tarVersion, temp
 async function useZstdBundle(cliVersion2, tarSupportsZstd) {
   return (
     // In testing, gzip performs better than zstd on Windows.
-    process.platform !== "win32" && tarSupportsZstd && semver9.gte(cliVersion2, CODEQL_VERSION_ZSTD_BUNDLE)
+    process.platform !== "win32" && tarSupportsZstd && semver10.gte(cliVersion2, CODEQL_VERSION_ZSTD_BUNDLE)
   );
 }
 function getTempExtractionDir(tempDir) {
@@ -176829,14 +176909,14 @@ async function getLatestNightlyBundle(action, rawLanguages, otherLanguagePacksRe
     isLatestNightly: true
   });
   try {
-    const release2 = await getApiClient().rest.repos.listReleases({
+    const release3 = await getApiClient().rest.repos.listReleases({
       owner: CODEQL_NIGHTLIES_REPOSITORY_OWNER,
       repo: CODEQL_NIGHTLIES_REPOSITORY_NAME,
       per_page: 1,
       page: 1,
       prerelease: true
     });
-    const latestRelease = release2.data[0];
+    const latestRelease = release3.data[0];
     if (!latestRelease) {
       throw new Error("Could not find the latest nightly release.");
     }
@@ -176859,7 +176939,7 @@ async function getLatestNightlyBundle(action, rawLanguages, otherLanguagePacksRe
   }
 }
 function getLatestToolcacheVersion(logger2) {
-  const allVersions = toolcache3.findAllVersions("CodeQL").sort((a, b) => semver9.compare(b, a));
+  const allVersions = toolcache3.findAllVersions("CodeQL").sort((a, b) => semver10.compare(b, a));
   logger2.debug(
     `Found the following versions of the CodeQL tools in the toolcache: ${JSON.stringify(
       allVersions
@@ -176879,7 +176959,7 @@ function isReservedToolsValue(tools) {
 }
 
 // src/tracer-config.ts
-var fs16 = __toESM(require("fs"));
+var fs17 = __toESM(require("fs"));
 var path14 = __toESM(require("path"));
 async function shouldEnableIndirectTracing(codeql, config) {
   if (config.buildMode === "none" /* None */) {
@@ -176899,14 +176979,14 @@ async function endTracingForCluster(codeql, config, logger2) {
     config.dbLocation,
     "temp/tracingEnvironment/end-tracing.json"
   );
-  if (!fs16.existsSync(envVariablesFile)) {
+  if (!fs17.existsSync(envVariablesFile)) {
     throw new Error(
       `Environment file for ending tracing not found: ${envVariablesFile}`
     );
   }
   try {
     const endTracingEnvVariables = JSON.parse(
-      fs16.readFileSync(envVariablesFile, "utf8")
+      fs17.readFileSync(envVariablesFile, "utf8")
     );
     for (const [key, value] of Object.entries(endTracingEnvVariables)) {
       if (value !== null) {
@@ -176927,7 +177007,7 @@ async function getTracerConfigForCluster(logger2, config) {
     "temp/tracingEnvironment/start-tracing.json"
   );
   try {
-    const tracingEnvVariables = JSON.parse(fs16.readFileSync(filePath, "utf8"));
+    const tracingEnvVariables = JSON.parse(fs17.readFileSync(filePath, "utf8"));
     return {
       env: tracingEnvVariables
     };
@@ -177012,13 +177092,13 @@ async function getCodeQL(logger2, cmd) {
   }
   return cachedCodeQL;
 }
-async function getCodeQLForCmd(logger2, cmd, checkVersion) {
+async function getCodeQLForCmd(logger2, cmd, checkVersion, env = getEnv()) {
   const codeql = {
     getPath() {
       return cmd;
     },
     async getVersion() {
-      const cacheFilePath = getCommandCacheFilePath(getEnv());
+      const cacheFilePath = getCommandCacheFilePath(env);
       let result = getCachedCodeQlVersion(
         logger2,
         cacheFilePath,
@@ -177026,6 +177106,7 @@ async function getCodeQLForCmd(logger2, cmd, checkVersion) {
       );
       if (result === void 0) {
         result = await runCliJson(
+          env,
           cmd,
           ["version", "--format=json"],
           {
@@ -177049,7 +177130,7 @@ async function getCodeQLForCmd(logger2, cmd, checkVersion) {
         "tools",
         "tracing-config.lua"
       );
-      return fs17.existsSync(tracingConfigPath);
+      return fs18.existsSync(tracingConfigPath);
     },
     async isScannedLanguage(language) {
       return !await this.isTracedLanguage(language);
@@ -177096,6 +177177,7 @@ async function getCodeQLForCmd(logger2, cmd, checkVersion) {
         "--sublanguage-file-coverage"
       ] : ["--no-calculate-baseline"];
       await runCli(
+        env,
         cmd,
         [
           "database",
@@ -177128,19 +177210,22 @@ async function getCodeQLForCmd(logger2, cmd, checkVersion) {
       }
     },
     async runAutobuild(config, language) {
-      applyAutobuildAzurePipelinesTimeoutFix();
+      applyAutobuildAzurePipelinesTimeoutFix(env);
       const autobuildCmd = path15.join(
         await this.resolveExtractor(language),
         "tools",
         process.platform === "win32" ? "autobuild.cmd" : "autobuild.sh"
       );
       if (config.debugMode) {
-        process.env["CODEQL_VERBOSITY" /* CLI_VERBOSITY */] = process.env["CODEQL_VERBOSITY" /* CLI_VERBOSITY */] || EXTRACTION_DEBUG_MODE_VERBOSITY;
+        env.set(
+          "CODEQL_VERBOSITY" /* CLI_VERBOSITY */,
+          env.getOptional("CODEQL_VERBOSITY" /* CLI_VERBOSITY */) ?? EXTRACTION_DEBUG_MODE_VERBOSITY
+        );
       }
-      await runCli(autobuildCmd);
+      await runCli(env, autobuildCmd);
     },
     async extractScannedLanguage(config, language) {
-      await runCli(cmd, [
+      await runCli(env, cmd, [
         "database",
         "trace-command",
         "--index-traceless-dbs",
@@ -177152,10 +177237,10 @@ async function getCodeQLForCmd(logger2, cmd, checkVersion) {
     },
     async extractUsingBuildMode(config, language) {
       if (config.buildMode === "autobuild" /* Autobuild */) {
-        applyAutobuildAzurePipelinesTimeoutFix();
+        applyAutobuildAzurePipelinesTimeoutFix(env);
       }
       try {
-        await runCli(cmd, [
+        await runCli(env, cmd, [
           "database",
           "trace-command",
           "--use-build-mode",
@@ -177186,12 +177271,12 @@ async function getCodeQLForCmd(logger2, cmd, checkVersion) {
         ...getExtraOptionsFromEnv(["database", "finalize"]),
         databasePath
       ];
-      await runCli(cmd, args);
+      await runCli(env, cmd, args);
     },
     async resolveLanguages({
       filterToLanguagesWithQueries
     } = { filterToLanguagesWithQueries: false }) {
-      return runCliJson(cmd, [
+      return runCliJson(env, cmd, [
         "resolve",
         "languages",
         "--format=betterjson",
@@ -177215,7 +177300,11 @@ async function getCodeQLForCmd(logger2, cmd, checkVersion) {
       if (workingDir !== void 0) {
         codeqlArgs.push("--working-dir", workingDir);
       }
-      return await runCliJson(cmd, codeqlArgs);
+      return await runCliJson(
+        env,
+        cmd,
+        codeqlArgs
+      );
     },
     async databaseRunQueries(databasePath, flags, queries = []) {
       const codeqlArgs = [
@@ -177231,7 +177320,7 @@ async function getCodeQLForCmd(logger2, cmd, checkVersion) {
           ignoringOptions: ["--expect-discarded-cache"]
         })
       ];
-      await runCli(cmd, codeqlArgs);
+      await runCli(env, cmd, codeqlArgs);
     },
     async databaseInterpretResults(databasePath, querySuitePaths, sarifFile, threadsFlag, verbosityFlag, sarifRunPropertyFlag, automationDetailsId, config, features) {
       const shouldExportDiagnostics = await features.getValue(
@@ -177254,7 +177343,7 @@ async function getCodeQLForCmd(logger2, cmd, checkVersion) {
         "--sarif-group-rules-by-pack",
         "--sarif-include-query-help=always",
         "--sublanguage-file-coverage",
-        ...await getJobRunUuidSarifOptions(),
+        ...await getJobRunUuidSarifOptions(env),
         ...getExtraOptionsFromEnv(["database", "interpret-results"])
       ];
       if (sarifRunPropertyFlag !== void 0) {
@@ -177272,7 +177361,7 @@ async function getCodeQLForCmd(logger2, cmd, checkVersion) {
       if (querySuitePaths) {
         codeqlArgs.push(...querySuitePaths);
       }
-      return await runCli(cmd, codeqlArgs, {
+      return await runCli(env, cmd, codeqlArgs, {
         noStreamStdout: true
       });
     },
@@ -177286,7 +177375,7 @@ async function getCodeQLForCmd(logger2, cmd, checkVersion) {
           `--cache-cleanup=${cleanupLevel}`,
           ...getExtraOptionsFromEnv(["database", "cleanup"])
         ];
-        await runCli(cmd, codeqlArgs);
+        await runCli(env, cmd, codeqlArgs);
       }
     },
     async databaseBundle(databasePath, outputFilePath, databaseName, includeDiagnostics, alsoIncludeRelativePaths) {
@@ -177333,7 +177422,7 @@ async function getCodeQLForCmd(logger2, cmd, checkVersion) {
     },
     async diagnosticsExport(sarifFile, automationDetailsId, config, diagnosticDir) {
       let configPath = getGeneratedCodeScanningConfigPath(config);
-      if (!fs17.existsSync(configPath)) {
+      if (!fs18.existsSync(configPath)) {
         if (config.successfullyInitialised) {
           logger2.warning(
             [
@@ -177400,7 +177489,7 @@ Output was: ${extractorPath}`
         ...getExtraOptionsFromEnv(["resolve", "queries"]),
         ...queries
       ];
-      return await runCliJson(cmd, codeqlArgs, {
+      return await runCliJson(env, cmd, codeqlArgs, {
         noStreamStdout: true
       });
     },
@@ -177412,7 +177501,7 @@ Output was: ${extractorPath}`
         "--format=json",
         ...getExtraOptionsFromEnv(["resolve", "database"])
       ];
-      return await runCliJson(cmd, codeqlArgs, {
+      return await runCliJson(env, cmd, codeqlArgs, {
         noStreamStdout: true
       });
     },
@@ -177432,21 +177521,21 @@ Output was: ${extractorPath}`
       if (mergeRunsFromEqualCategory) {
         args.push("--sarif-merge-runs-from-equal-category");
       }
-      await runCli(cmd, args);
+      await runCli(env, cmd, args);
     }
   };
   if (checkVersion && !await codeQlVersionAtLeast(codeql, CODEQL_MINIMUM_VERSION)) {
     throw new ConfigurationError(
       `Expected a CodeQL CLI with version at least ${CODEQL_MINIMUM_VERSION} but got version ${(await codeql.getVersion()).version}`
     );
-  } else if (checkVersion && process.env["CODEQL_ACTION_SUPPRESS_DEPRECATED_SOON_WARNING" /* SUPPRESS_DEPRECATED_SOON_WARNING */] !== "true" && !await codeQlVersionAtLeast(codeql, CODEQL_NEXT_MINIMUM_VERSION)) {
+  } else if (checkVersion && env.getOptional("CODEQL_ACTION_SUPPRESS_DEPRECATED_SOON_WARNING" /* SUPPRESS_DEPRECATED_SOON_WARNING */) !== "true" && !await codeQlVersionAtLeast(codeql, CODEQL_NEXT_MINIMUM_VERSION)) {
     const result = await codeql.getVersion();
     core12.warning(
       `CodeQL CLI version ${result.version} was discontinued on ${GHES_MOST_RECENT_DEPRECATION_DATE} alongside GitHub Enterprise Server ${GHES_VERSION_MOST_RECENTLY_DEPRECATED} and will not be supported by the next minor release of the CodeQL Action. Please update to CodeQL CLI version ${CODEQL_NEXT_MINIMUM_VERSION} or later. For instance, if you have specified a custom version of the CLI using the 'tools' input to the 'init' Action, you can remove this input to use the default version.
 
 Alternatively, if you want to continue using CodeQL CLI version ${result.version}, you can replace 'github/codeql-action/*@v${getActionVersion().split(".")[0]}' by 'github/codeql-action/*@v${getActionVersion()}' in your code scanning workflow to continue using this version of the CodeQL Action.`
     );
-    exportEnvVar("CODEQL_ACTION_SUPPRESS_DEPRECATED_SOON_WARNING" /* SUPPRESS_DEPRECATED_SOON_WARNING */, "true");
+    env.export("CODEQL_ACTION_SUPPRESS_DEPRECATED_SOON_WARNING" /* SUPPRESS_DEPRECATED_SOON_WARNING */, "true");
   }
   return codeql;
 }
@@ -177486,9 +177575,9 @@ function getExtraOptions(options, paths, pathInfo) {
   );
   return all.concat(specific);
 }
-async function runCli(cmd, args = [], opts = {}) {
+async function runCli(env, cmd, args = [], opts = {}) {
   try {
-    return await runTool(cmd, args, opts);
+    return await runTool(env, cmd, args, opts);
   } catch (e) {
     if (e instanceof CommandInvocationError) {
       throw wrapCliConfigurationError(new CliError(e));
@@ -177496,8 +177585,8 @@ async function runCli(cmd, args = [], opts = {}) {
     throw e;
   }
 }
-async function runCliJson(cmd, args = [], opts = {}) {
-  const output = await runCli(cmd, args, opts);
+async function runCliJson(env, cmd, args = [], opts = {}) {
+  const output = await runCli(env, cmd, args, opts);
   try {
     return JSON.parse(output);
   } catch (e) {
@@ -177518,7 +177607,7 @@ async function writeCodeScanningConfigFile(config, logger2) {
   logger2.startGroup("Augmented user configuration file contents");
   logger2.info(dump(augmentedConfig));
   logger2.endGroup();
-  fs17.writeFileSync(codeScanningConfigFile, dump(augmentedConfig));
+  fs18.writeFileSync(codeScanningConfigFile, dump(augmentedConfig));
   return codeScanningConfigFile;
 }
 var TRAP_CACHE_SIZE_MB = 1024;
@@ -177546,16 +177635,19 @@ function getGeneratedCodeScanningConfigPath(config) {
 function getExtractionVerbosityArguments(enableDebugLogging) {
   return enableDebugLogging ? [`--verbosity=${EXTRACTION_DEBUG_MODE_VERBOSITY}`] : [];
 }
-function applyAutobuildAzurePipelinesTimeoutFix() {
-  const javaToolOptions = process.env["JAVA_TOOL_OPTIONS"] || "";
-  process.env["JAVA_TOOL_OPTIONS"] = [
-    ...javaToolOptions.split(/\s+/),
-    "-Dhttp.keepAlive=false",
-    "-Dmaven.wagon.http.pool=false"
-  ].join(" ");
+function applyAutobuildAzurePipelinesTimeoutFix(env) {
+  const javaToolOptions = env.getOptional("JAVA_TOOL_OPTIONS") ?? "";
+  env.set(
+    "JAVA_TOOL_OPTIONS",
+    [
+      ...javaToolOptions.split(/\s+/),
+      "-Dhttp.keepAlive=false",
+      "-Dmaven.wagon.http.pool=false"
+    ].join(" ")
+  );
 }
-async function getJobRunUuidSarifOptions() {
-  const jobRunUuid = process.env["CODEQL_ACTION_JOB_RUN_UUID" /* JOB_RUN_UUID */];
+async function getJobRunUuidSarifOptions(env) {
+  const jobRunUuid = env.getOptional("CODEQL_ACTION_JOB_RUN_UUID" /* JOB_RUN_UUID */);
   return jobRunUuid ? [`--sarif-run-property=jobRunUuid=${jobRunUuid}`] : [];
 }
 
@@ -177645,7 +177737,7 @@ async function runAutobuild(config, language, logger2) {
 }
 
 // src/dependency-caching.ts
-var os5 = __toESM(require("os"));
+var os6 = __toESM(require("os"));
 var import_path3 = require("path");
 var actionsCache4 = __toESM(require_cache4());
 var glob = __toESM(require_glob());
@@ -177657,9 +177749,9 @@ function getJavaTempDependencyDir() {
 async function getJavaDependencyDirs() {
   return [
     // Maven
-    (0, import_path3.join)(os5.homedir(), ".m2", "repository"),
+    (0, import_path3.join)(os6.homedir(), ".m2", "repository"),
     // Gradle
-    (0, import_path3.join)(os5.homedir(), ".gradle", "caches"),
+    (0, import_path3.join)(os6.homedir(), ".gradle", "caches"),
     // CodeQL Java build-mode: none
     getJavaTempDependencyDir()
   ];
@@ -177670,7 +177762,7 @@ function getCsharpTempDependencyDir() {
 async function getCsharpDependencyDirs(codeql, features) {
   const dirs = [
     // Nuget
-    (0, import_path3.join)(os5.homedir(), ".nuget", "packages")
+    (0, import_path3.join)(os6.homedir(), ".nuget", "packages")
   ];
   if (await features.getValue("csharp_cache_bmn" /* CsharpCacheBuildModeNone */, codeql)) {
     dirs.push(getCsharpTempDependencyDir());
@@ -177725,7 +177817,7 @@ var defaultCacheConfigs = {
     getHashPatterns: getCsharpHashPatterns
   },
   go: {
-    getDependencyPaths: async () => [(0, import_path3.join)(os5.homedir(), "go", "pkg", "mod")],
+    getDependencyPaths: async () => [(0, import_path3.join)(os6.homedir(), "go", "pkg", "mod")],
     getHashPatterns: async () => internal.makePatternCheck(["**/go.sum"])
   }
 };
@@ -178011,7 +178103,7 @@ function dbIsFinalized(config, language, logger2) {
   const dbPath = getCodeQLDatabasePath(config, language);
   try {
     const dbInfo = load(
-      fs18.readFileSync(path16.resolve(dbPath, "codeql-database.yml"), "utf8")
+      fs19.readFileSync(path16.resolve(dbPath, "codeql-database.yml"), "utf8")
     );
     return !("inProgress" in dbInfo);
   } catch {
@@ -178095,8 +178187,8 @@ function writeDiffRangeDataExtensionPack(logger2, ranges, checkoutPath) {
     ranges = [{ path: "", startLine: 0, endLine: 0 }];
   }
   const diffRangeDir = path16.join(getTemporaryDirectory(), "pr-diff-range");
-  fs18.mkdirSync(diffRangeDir, { recursive: true });
-  fs18.writeFileSync(
+  fs19.mkdirSync(diffRangeDir, { recursive: true });
+  fs19.writeFileSync(
     path16.join(diffRangeDir, "qlpack.yml"),
     `
 name: codeql-action/pr-diff-range
@@ -178113,7 +178205,7 @@ dataExtensions:
     checkoutPath
   );
   const extensionFilePath = path16.join(diffRangeDir, "pr-diff-range.yml");
-  fs18.writeFileSync(extensionFilePath, extensionContents);
+  fs19.writeFileSync(extensionFilePath, extensionContents);
   logger2.debug(
     `Wrote pr-diff-range extension pack to ${extensionFilePath}:
 ${extensionContents}`
@@ -178258,7 +178350,7 @@ async function runQueries(sarifFolder, memoryFlag, threadsFlag, diffRangePackDir
   }
   function getPerQueryAlertCounts(sarifPath) {
     const sarifObject = JSON.parse(
-      fs18.readFileSync(sarifPath, "utf8")
+      fs19.readFileSync(sarifPath, "utf8")
     );
     const perQueryAlertCounts = {};
     for (const sarifRun of sarifObject.runs) {
@@ -178276,13 +178368,13 @@ async function runQueries(sarifFolder, memoryFlag, threadsFlag, diffRangePackDir
 }
 async function runFinalize(features, outputDir, threadsFlag, memoryFlag, codeql, config, logger2) {
   try {
-    await fs18.promises.rm(outputDir, { force: true, recursive: true });
+    await fs19.promises.rm(outputDir, { force: true, recursive: true });
   } catch (error3) {
     if (error3?.code !== "ENOENT") {
       throw error3;
     }
   }
-  await fs18.promises.mkdir(outputDir, { recursive: true });
+  await fs19.promises.mkdir(outputDir, { recursive: true });
   const timings = await finalizeDatabaseCreation(
     codeql,
     features,
@@ -178326,7 +178418,7 @@ async function warnIfGoInstalledAfterInit(config, logger2) {
 }
 
 // src/database-upload.ts
-var fs19 = __toESM(require("fs"));
+var fs20 = __toESM(require("fs"));
 async function cleanupAndUploadDatabases(action, repositoryNwo, codeql, config, apiDetails, checkoutPath) {
   const logger2 = action.logger;
   if (getRequiredInput("upload-database") !== "true") {
@@ -178363,7 +178455,7 @@ async function cleanupAndUploadDatabases(action, repositoryNwo, codeql, config,
       const bundledDb = await bundleDb(config, language, codeql, language, {
         includeDiagnostics: false
       });
-      bundledDbSize = fs19.statSync(bundledDb).size;
+      bundledDbSize = fs20.statSync(bundledDb).size;
       const commitOid = await getCommitOid(action.env, checkoutPath);
       const maxAttempts = 4;
       let uploadDurationMs;
@@ -178441,7 +178533,7 @@ async function recordClearCleanupSizes(codeql, config, reports, logger2) {
       const bundledDb = await bundleDb(config, language, codeql, language, {
         includeDiagnostics: false
       });
-      report.clear_cleanup_zipped_size_bytes = fs19.statSync(bundledDb).size;
+      report.clear_cleanup_zipped_size_bytes = fs20.statSync(bundledDb).size;
       logger2.debug(
         `Database for ${language} is ${report.clear_cleanup_zipped_size_bytes} bytes zipped at the '${"clear" /* Clear */}' cleanup level (vs. ${report.zipped_upload_size_bytes ?? "unknown"} bytes at the '${"overlay" /* Overlay */}' level).`
       );
@@ -178464,7 +178556,7 @@ async function uploadBundledDatabase(repositoryNwo, language, commitOid, bundled
   if (uploadsBaseUrl.endsWith("/")) {
     uploadsBaseUrl = uploadsBaseUrl.slice(0, -1);
   }
-  const bundledDbReadStream = fs19.createReadStream(bundledDb);
+  const bundledDbReadStream = fs20.createReadStream(bundledDb);
   try {
     const startTime = performance.now();
     await client.request(
@@ -178516,7 +178608,7 @@ __export(upload_lib_exports, {
   waitForProcessing: () => waitForProcessing,
   writePostProcessedFiles: () => writePostProcessedFiles
 });
-var fs23 = __toESM(require("fs"));
+var fs24 = __toESM(require("fs"));
 var path19 = __toESM(require("path"));
 var url = __toESM(require("url"));
 var import_zlib = __toESM(require("zlib"));
@@ -178524,7 +178616,7 @@ var core13 = __toESM(require_core());
 var jsonschema2 = __toESM(require_lib2());
 
 // src/fingerprints.ts
-var fs20 = __toESM(require("fs"));
+var fs21 = __toESM(require("fs"));
 var import_path4 = __toESM(require("path"));
 
 // node_modules/long/index.js
@@ -179512,7 +179604,7 @@ async function hash(callback, filepath) {
     }
     updateHash(current);
   };
-  const readStream = fs20.createReadStream(filepath, "utf8");
+  const readStream = fs21.createReadStream(filepath, "utf8");
   for await (const data of readStream) {
     for (let i = 0; i < data.length; ++i) {
       processCharacter(data.charCodeAt(i));
@@ -179587,11 +179679,11 @@ function resolveUriToFile(location, artifacts, sourceRoot, logger2) {
   if (!import_path4.default.isAbsolute(uri)) {
     uri = srcRootPrefix + uri;
   }
-  if (!fs20.existsSync(uri)) {
+  if (!fs21.existsSync(uri)) {
     logger2.debug(`Unable to compute fingerprint for non-existent file: ${uri}`);
     return void 0;
   }
-  if (fs20.statSync(uri).isDirectory()) {
+  if (fs21.statSync(uri).isDirectory()) {
     logger2.debug(`Unable to compute fingerprint for directory: ${uri}`);
     return void 0;
   }
@@ -179646,7 +179738,7 @@ async function addFingerprints(sarifLog, sourceRoot, logger2) {
 }
 
 // src/init.ts
-var fs21 = __toESM(require("fs"));
+var fs22 = __toESM(require("fs"));
 var path18 = __toESM(require("path"));
 var toolrunner4 = __toESM(require_toolrunner());
 var github3 = __toESM(require_github());
@@ -179681,7 +179773,7 @@ async function initConfig2(actionState, inputs) {
   });
 }
 async function runDatabaseInitCluster(databaseInitEnvironment, codeql, config, sourceRoot, processName, qlconfigFile) {
-  fs21.mkdirSync(config.dbLocation, { recursive: true });
+  fs22.mkdirSync(config.dbLocation, { recursive: true });
   await wrapEnvironment(
     databaseInitEnvironment,
     async () => await codeql.databaseInitCluster(
@@ -179716,24 +179808,24 @@ async function checkPacksForOverlayCompatibility(codeql, config, logger2) {
 function checkPackForOverlayCompatibility(packDir, codeQlOverlayVersion, logger2) {
   try {
     let qlpackPath = path18.join(packDir, "qlpack.yml");
-    if (!fs21.existsSync(qlpackPath)) {
+    if (!fs22.existsSync(qlpackPath)) {
       qlpackPath = path18.join(packDir, "codeql-pack.yml");
     }
     const qlpackContents = load(
-      fs21.readFileSync(qlpackPath, "utf8")
+      fs22.readFileSync(qlpackPath, "utf8")
     );
     if (!qlpackContents.buildMetadata) {
       return true;
     }
     const packInfoPath = path18.join(packDir, ".packinfo");
-    if (!fs21.existsSync(packInfoPath)) {
+    if (!fs22.existsSync(packInfoPath)) {
       logger2.warning(
         `The query pack at ${packDir} does not have a .packinfo file, so it cannot support overlay analysis. Recompiling the query pack with the latest CodeQL CLI should solve this problem.`
       );
       return false;
     }
     const packInfoFileContents = JSON.parse(
-      fs21.readFileSync(packInfoPath, "utf8")
+      fs22.readFileSync(packInfoPath, "utf8")
     );
     const packOverlayVersion = packInfoFileContents.overlayVersion;
     if (typeof packOverlayVersion !== "number") {
@@ -179768,8 +179860,8 @@ async function checkInstallPython311(languages, codeql) {
     ]).exec();
   }
 }
-function cleanupDatabaseClusterDirectory(config, logger2, options = {}, rmSync5 = fs21.rmSync) {
-  if (fs21.existsSync(config.dbLocation) && (fs21.statSync(config.dbLocation).isFile() || fs21.readdirSync(config.dbLocation).length > 0)) {
+function cleanupDatabaseClusterDirectory(config, logger2, options = {}, rmSync5 = fs22.rmSync) {
+  if (fs22.existsSync(config.dbLocation) && (fs22.statSync(config.dbLocation).isFile() || fs22.readdirSync(config.dbLocation).length > 0)) {
     if (!options.disableExistingDirectoryWarning) {
       logger2.warning(
         `The database cluster directory ${config.dbLocation} must be empty. Attempting to clean it up.`
@@ -179874,7 +179966,7 @@ To opt out of this change, ${envVarOptOut}`;
 }
 
 // src/sarif/index.ts
-var fs22 = __toESM(require("fs"));
+var fs23 = __toESM(require("fs"));
 var InvalidSarifUploadError = class extends Error {
 };
 function getToolNames(sarifFile) {
@@ -179890,7 +179982,7 @@ function getToolNames(sarifFile) {
 }
 function readSarifFile(sarifFilePath) {
   try {
-    return JSON.parse(fs22.readFileSync(sarifFilePath, "utf8"));
+    return JSON.parse(fs23.readFileSync(sarifFilePath, "utf8"));
   } catch (err) {
     throw new Error(
       `Parsing SARIF file at '${sarifFilePath}' failed: ${getErrorMessage(err)}`
@@ -180031,8 +180123,8 @@ async function combineSarifFilesUsingCLI(sarifFiles, gitHubVersion, features, lo
     codeQL = initCodeQLResult.codeql;
   }
   const baseTempDir = path19.resolve(tempDir, "combined-sarif");
-  fs23.mkdirSync(baseTempDir, { recursive: true });
-  const outputDirectory = fs23.mkdtempSync(path19.resolve(baseTempDir, "output-"));
+  fs24.mkdirSync(baseTempDir, { recursive: true });
+  const outputDirectory = fs24.mkdtempSync(path19.resolve(baseTempDir, "output-"));
   const outputFile = path19.resolve(outputDirectory, "combined-sarif.sarif");
   await codeQL.mergeResults(sarifFiles, outputFile, {
     mergeRunsFromEqualCategory: true
@@ -180077,7 +180169,7 @@ async function uploadPayload(payload, repositoryNwo, logger2, analysis) {
       `SARIF upload disabled by an environment variable. Saving to ${payloadSaveFile}`
     );
     logger2.info(`Payload: ${JSON.stringify(payload, null, 2)}`);
-    fs23.writeFileSync(payloadSaveFile, JSON.stringify(payload, null, 2));
+    fs24.writeFileSync(payloadSaveFile, JSON.stringify(payload, null, 2));
     return "dummy-sarif-id";
   }
   const client = getApiClient();
@@ -180111,7 +180203,7 @@ async function uploadPayload(payload, repositoryNwo, logger2, analysis) {
 function findSarifFilesInDir(sarifPath, isSarif) {
   const sarifFiles = [];
   const walkSarifFiles = (dir) => {
-    const entries = fs23.readdirSync(dir, { withFileTypes: true });
+    const entries = fs24.readdirSync(dir, { withFileTypes: true });
     for (const entry of entries) {
       if (entry.isFile() && isSarif(entry.name)) {
         sarifFiles.push(path19.resolve(dir, entry.name));
@@ -180124,11 +180216,11 @@ function findSarifFilesInDir(sarifPath, isSarif) {
   return sarifFiles;
 }
 function getSarifFilePaths(sarifPath, isSarif) {
-  if (!fs23.existsSync(sarifPath)) {
+  if (!fs24.existsSync(sarifPath)) {
     throw new ConfigurationError(`Path does not exist: ${sarifPath}`);
   }
   let sarifFiles;
-  if (fs23.lstatSync(sarifPath).isDirectory()) {
+  if (fs24.lstatSync(sarifPath).isDirectory()) {
     sarifFiles = findSarifFilesInDir(sarifPath, isSarif);
     if (sarifFiles.length === 0) {
       throw new ConfigurationError(
@@ -180141,7 +180233,7 @@ function getSarifFilePaths(sarifPath, isSarif) {
   return sarifFiles;
 }
 async function getGroupedSarifFilePaths(logger2, sarifPath) {
-  const stats = fs23.statSync(sarifPath, { throwIfNoEntry: false });
+  const stats = fs24.statSync(sarifPath, { throwIfNoEntry: false });
   if (stats === void 0) {
     throw new ConfigurationError(`Path does not exist: ${sarifPath}`);
   }
@@ -180276,7 +180368,7 @@ function buildPayload(commitOid, ref, analysisKey, analysisName, zippedSarif, wo
       payloadObj.base_sha = mergeBaseCommitOid;
     } else if (process.env.GITHUB_EVENT_PATH) {
       const githubEvent = JSON.parse(
-        fs23.readFileSync(process.env.GITHUB_EVENT_PATH, "utf8")
+        fs24.readFileSync(process.env.GITHUB_EVENT_PATH, "utf8")
       );
       payloadObj.base_ref = `refs/heads/${githubEvent.pull_request.base.ref}`;
       payloadObj.base_sha = githubEvent.pull_request.base.sha;
@@ -180414,9 +180506,9 @@ async function uploadPostProcessedFiles(logger2, checkoutPath, uploadTarget, pos
   };
 }
 function dumpSarifFile(sarifPayload, outputDir, logger2, uploadTarget) {
-  if (!fs23.existsSync(outputDir)) {
-    fs23.mkdirSync(outputDir, { recursive: true });
-  } else if (!fs23.lstatSync(outputDir).isDirectory()) {
+  if (!fs24.existsSync(outputDir)) {
+    fs24.mkdirSync(outputDir, { recursive: true });
+  } else if (!fs24.lstatSync(outputDir).isDirectory()) {
     throw new ConfigurationError(
       `The path that processed SARIF files should be written to exists, but is not a directory: ${outputDir}`
     );
@@ -180426,7 +180518,7 @@ function dumpSarifFile(sarifPayload, outputDir, logger2, uploadTarget) {
     `upload${uploadTarget.sarifExtension}`
   );
   logger2.info(`Writing processed SARIF file to ${outputFile}`);
-  fs23.writeFileSync(outputFile, sarifPayload);
+  fs24.writeFileSync(outputFile, sarifPayload);
 }
 var STATUS_CHECK_INITIAL_BACKOFF_MILLISECONDS = 5 * 1e3;
 var STATUS_CHECK_BACKOFF_MULTIPLIER = 2;
@@ -180672,7 +180764,7 @@ function doesGoExtractionOutputExist(config) {
     "trap",
     "go" /* go */
   );
-  return fs24.existsSync(trapDirectory) && fs24.readdirSync(trapDirectory).some(
+  return fs25.existsSync(trapDirectory) && fs25.readdirSync(trapDirectory).some(
     (fileName) => [
       ".trap",
       ".trap.gz",
@@ -180968,18 +181060,18 @@ async function runWrapper() {
 }
 
 // src/analyze-action-post.ts
-var fs28 = __toESM(require("fs"));
+var fs29 = __toESM(require("fs"));
 var core16 = __toESM(require_core());
 
 // src/debug-artifacts.ts
-var fs27 = __toESM(require("fs"));
+var fs28 = __toESM(require("fs"));
 var path23 = __toESM(require("path"));
 var artifact = __toESM(require_artifact2());
 var artifactLegacy = __toESM(require_artifact_client2());
 var core15 = __toESM(require_core());
 
 // node_modules/archiver/lib/core.js
-var import_fs = require("fs");
+var import_fs2 = require("fs");
 
 // node_modules/is-stream/index.js
 function isStream(stream2, { checkOpen = true } = {}) {
@@ -180987,7 +181079,7 @@ function isStream(stream2, { checkOpen = true } = {}) {
 }
 
 // node_modules/readdir-glob/dist/index.mjs
-var fs25 = __toESM(require("fs"), 1);
+var fs26 = __toESM(require("fs"), 1);
 var import_events = require("events");
 
 // node_modules/readdir-glob/node_modules/balanced-match/dist/esm/index.js
@@ -182864,7 +182956,7 @@ minimatch.unescape = unescape2;
 var import_path6 = require("path");
 function readdir2(dir, strict) {
   return new Promise((resolve$1, reject) => {
-    fs25.readdir(dir, { withFileTypes: true }, (err, files) => {
+    fs26.readdir(dir, { withFileTypes: true }, (err, files) => {
       if (err) switch (err.code) {
         case "ENOTDIR":
           if (strict) reject(err);
@@ -182887,7 +182979,7 @@ function readdir2(dir, strict) {
 }
 function getStat(file, followSymlinks) {
   return new Promise((resolve$1) => {
-    const statFunc = followSymlinks ? fs25.stat : fs25.lstat;
+    const statFunc = followSymlinks ? fs26.stat : fs26.lstat;
     statFunc(file, (err, stats) => {
       if (err) switch (err.code) {
         case "ENOENT":
@@ -183057,7 +183149,7 @@ var import_async = __toESM(require_async(), 1);
 var import_path7 = require("path");
 
 // node_modules/archiver/lib/error.js
-var import_util37 = __toESM(require("util"), 1);
+var import_util38 = __toESM(require("util"), 1);
 var ERROR_CODES = {
   ABORTED: "archive was aborted",
   DIRECTORYDIRPATHREQUIRED: "diretory dirpath argument must be a non-empty string value",
@@ -183082,7 +183174,7 @@ function ArchiverError(code, data) {
   this.code = code;
   this.data = data;
 }
-import_util37.default.inherits(ArchiverError, Error);
+import_util38.default.inherits(ArchiverError, Error);
 
 // node_modules/archiver/lib/core.js
 var import_readable_stream2 = __toESM(require_ours(), 1);
@@ -183195,7 +183287,7 @@ var Archiver = class extends import_readable_stream2.Transform {
     data.sourcePath = filepath;
     task.data = data;
     this._entriesCount++;
-    if (data.stats && data.stats instanceof import_fs.Stats) {
+    if (data.stats && data.stats instanceof import_fs2.Stats) {
       task = this._updateQueueTaskWithStats(task, data.stats);
       if (task) {
         if (data.stats.size) {
@@ -183443,7 +183535,7 @@ var Archiver = class extends import_readable_stream2.Transform {
       callback();
       return;
     }
-    (0, import_fs.lstat)(
+    (0, import_fs2.lstat)(
       task.filepath,
       function(err, stats) {
         if (this._state.aborted) {
@@ -183505,7 +183597,7 @@ var Archiver = class extends import_readable_stream2.Transform {
       task.data.type = "file";
       task.data.sourceType = "stream";
       task.source = new import_lazystream.Readable(function() {
-        return (0, import_fs.createReadStream)(task.filepath);
+        return (0, import_fs2.createReadStream)(task.filepath);
       });
     } else if (stats.isDirectory() && this._supportsDirectory) {
       task.data.name = trailingSlashIt(task.data.name);
@@ -183514,7 +183606,7 @@ var Archiver = class extends import_readable_stream2.Transform {
       task.data.sourceType = "buffer";
       task.source = Buffer.concat([]);
     } else if (stats.isSymbolicLink() && this._supportsSymlink) {
-      const linkPath = (0, import_fs.readlinkSync)(task.filepath);
+      const linkPath = (0, import_fs2.readlinkSync)(task.filepath);
       const dirName = (0, import_path7.dirname)(task.filepath);
       task.data.type = "symlink";
       task.data.linkname = (0, import_path7.relative)(
@@ -185357,8 +185449,8 @@ var ZipArchive = class extends Archiver {
 };
 
 // src/artifact-scanner.ts
-var fs26 = __toESM(require("fs"));
-var os6 = __toESM(require("os"));
+var fs27 = __toESM(require("fs"));
+var os7 = __toESM(require("os"));
 var path22 = __toESM(require("path"));
 var exec = __toESM(require_exec());
 var GITHUB_PAT_CLASSIC_PATTERN = {
@@ -185404,7 +185496,7 @@ function isAuthToken(value, patterns = GITHUB_TOKEN_PATTERNS) {
 function scanFileForTokens(filePath, relativePath2, logger2) {
   const findings = [];
   try {
-    const content = fs26.readFileSync(filePath, "utf8");
+    const content = fs27.readFileSync(filePath, "utf8");
     for (const { type, pattern } of GITHUB_TOKEN_PATTERNS) {
       const matches = content.match(pattern);
       if (matches) {
@@ -185437,7 +185529,7 @@ async function scanArchiveFile(archivePath, relativeArchivePath, extractDir, log
     findings: []
   };
   try {
-    const tempExtractDir = fs26.mkdtempSync(
+    const tempExtractDir = fs27.mkdtempSync(
       path22.join(extractDir, `extract-${depth}-`)
     );
     const fileName = path22.basename(archivePath).toLowerCase();
@@ -185471,7 +185563,7 @@ async function scanArchiveFile(archivePath, relativeArchivePath, extractDir, log
         path22.basename(archivePath, ".gz")
       );
       await exec.exec("gunzip", ["-c", archivePath], {
-        outStream: fs26.createWriteStream(outputFile),
+        outStream: fs27.createWriteStream(outputFile),
         silent: true
       });
     } else if (fileName.endsWith(".zip")) {
@@ -185492,7 +185584,7 @@ async function scanArchiveFile(archivePath, relativeArchivePath, extractDir, log
     );
     result.scannedFiles += scanResult.scannedFiles;
     result.findings.push(...scanResult.findings);
-    fs26.rmSync(tempExtractDir, { recursive: true, force: true });
+    fs27.rmSync(tempExtractDir, { recursive: true, force: true });
   } catch (e) {
     logger2.debug(
       `Could not extract or scan archive file ${archivePath}: ${getErrorMessage(e)}`
@@ -185527,7 +185619,7 @@ async function scanDirectory(dirPath, baseRelativePath, logger2, depth = 0) {
     scannedFiles: 0,
     findings: []
   };
-  const entries = fs26.readdirSync(dirPath, { withFileTypes: true });
+  const entries = fs27.readdirSync(dirPath, { withFileTypes: true });
   for (const entry of entries) {
     const fullPath = path22.join(dirPath, entry.name);
     const relativePath2 = path22.join(baseRelativePath, entry.name);
@@ -185562,10 +185654,10 @@ async function scanArtifactsForTokens(filesToScan, logger2) {
     scannedFiles: 0,
     findings: []
   };
-  const tempScanDir = fs26.mkdtempSync(path22.join(os6.tmpdir(), "artifact-scan-"));
+  const tempScanDir = fs27.mkdtempSync(path22.join(os7.tmpdir(), "artifact-scan-"));
   try {
     for (const filePath of filesToScan) {
-      const stats = fs26.statSync(filePath);
+      const stats = fs27.statSync(filePath);
       const fileName = path22.basename(filePath);
       if (stats.isDirectory()) {
         const dirResult = await scanDirectory(filePath, fileName, logger2);
@@ -185603,7 +185695,7 @@ async function scanArtifactsForTokens(filesToScan, logger2) {
     }
   } finally {
     try {
-      fs26.rmSync(tempScanDir, { recursive: true, force: true });
+      fs27.rmSync(tempScanDir, { recursive: true, force: true });
     } catch (e) {
       logger2.debug(
         `Could not clean up temporary scan directory: ${getErrorMessage(e)}`
@@ -185625,10 +185717,10 @@ async function uploadCombinedSarifArtifacts(logger2, gitHubVariant) {
       );
       const baseTempDir = path23.resolve(tempDir, "combined-sarif");
       const toUpload = [];
-      if (fs27.existsSync(baseTempDir)) {
-        const outputDirs = fs27.readdirSync(baseTempDir);
+      if (fs28.existsSync(baseTempDir)) {
+        const outputDirs = fs28.readdirSync(baseTempDir);
         for (const outputDir of outputDirs) {
-          const sarifFiles = fs27.readdirSync(path23.resolve(baseTempDir, outputDir)).filter((f) => path23.extname(f) === ".sarif");
+          const sarifFiles = fs28.readdirSync(path23.resolve(baseTempDir, outputDir)).filter((f) => path23.extname(f) === ".sarif");
           for (const sarifFile of sarifFiles) {
             toUpload.push(path23.resolve(baseTempDir, outputDir, sarifFile));
           }
@@ -185655,17 +185747,17 @@ async function uploadCombinedSarifArtifacts(logger2, gitHubVariant) {
 function tryPrepareSarifDebugArtifact(config, language, logger2) {
   try {
     const analyzeActionOutputDir = process.env["CODEQL_ACTION_SARIF_RESULTS_OUTPUT_DIR" /* SARIF_RESULTS_OUTPUT_DIR */];
-    if (analyzeActionOutputDir !== void 0 && fs27.existsSync(analyzeActionOutputDir) && fs27.lstatSync(analyzeActionOutputDir).isDirectory()) {
+    if (analyzeActionOutputDir !== void 0 && fs28.existsSync(analyzeActionOutputDir) && fs28.lstatSync(analyzeActionOutputDir).isDirectory()) {
       const sarifFile = path23.resolve(
         analyzeActionOutputDir,
         `${language}.sarif`
       );
-      if (fs27.existsSync(sarifFile)) {
+      if (fs28.existsSync(sarifFile)) {
         const sarifInDbLocation = path23.resolve(
           config.dbLocation,
           `${language}.sarif`
         );
-        fs27.copyFileSync(sarifFile, sarifInDbLocation);
+        fs28.copyFileSync(sarifFile, sarifInDbLocation);
         return sarifInDbLocation;
       }
     }
@@ -185833,10 +185925,10 @@ async function createPartialDatabaseBundle(config, language) {
   core15.info(
     `${config.debugDatabaseName}-${language} is not finalized. Uploading partial database bundle at ${databaseBundlePath}...`
   );
-  if (fs27.existsSync(databaseBundlePath)) {
-    await fs27.promises.rm(databaseBundlePath, { force: true });
+  if (fs28.existsSync(databaseBundlePath)) {
+    await fs28.promises.rm(databaseBundlePath, { force: true });
   }
-  const output = fs27.createWriteStream(databaseBundlePath);
+  const output = fs28.createWriteStream(databaseBundlePath);
   const zip = new ZipArchive();
   zip.on("error", (err) => {
     throw err;
@@ -185886,9 +185978,9 @@ async function runWrapper2() {
       getCsharpTempDependencyDir()
     ];
     for (const tempDependencyDir of tempDependencyDirs) {
-      if (fs28.existsSync(tempDependencyDir)) {
+      if (fs29.existsSync(tempDependencyDir)) {
         try {
-          fs28.rmSync(tempDependencyDir, { recursive: true });
+          fs29.rmSync(tempDependencyDir, { recursive: true });
         } catch (error3) {
           logger2.info(
             `Failed to remove temporary dependencies directory: ${getErrorMessage(error3)}`
@@ -185999,11 +186091,11 @@ async function runWrapper3() {
 }
 
 // src/init-action.ts
-var fs30 = __toESM(require("fs"));
+var fs31 = __toESM(require("fs"));
 var path25 = __toESM(require("path"));
 var core19 = __toESM(require_core());
 var io7 = __toESM(require_io());
-var semver10 = __toESM(require_semver2());
+var semver11 = __toESM(require_semver2());
 
 // src/config/inputs.ts
 async function getToolsInput(action, repositoryProperties) {
@@ -186039,6 +186131,112 @@ async function getToolsInput(action, repositoryProperties) {
   return void 0;
 }
 
+// src/languages/swift.ts
+async function checkSwiftCompatibility(config, codeql, macosVersion) {
+  if (!config.languages.includes("swift" /* swift */)) {
+    return;
+  }
+  if (await codeql.supportsFeature("swiftSupportsAllPlatforms" /* SwiftSupportsAllPlatforms */)) {
+    return;
+  }
+  if (macosVersion === void 0) {
+    throw new ConfigurationError(
+      `Swift analysis is only supported on macOS runner images. Please migrate to a macOS runner.`
+    );
+  }
+}
+
+// src/languages/traced.ts
+var UNSUPPORTED_MACOS_FOR_TRACED = 27;
+var UNSUPPORTED_XCODE_FOR_TRACED = 27;
+function handleUnsupportedVersion(logger2, config, skipUnsupportedTracedAnalysis, product, version) {
+  const baseMessage = [
+    `Traced analysis is not supported on ${product} ${UNSUPPORTED_MACOS_FOR_TRACED} or above.`,
+    `Configure your analysis to run on macOS ${UNSUPPORTED_MACOS_FOR_TRACED - 1} or below`,
+    `and XCode ${UNSUPPORTED_XCODE_FOR_TRACED - 1} or below.`
+  ].join(" ");
+  const attributeName = product === "macOS" ? "macOSVersion" : "xcodeVersion";
+  for (const language of config.languages) {
+    addDiagnostic(
+      config,
+      language,
+      makeDiagnostic(
+        `codeql-action/unsupported-traced-analysis-${product.toLowerCase()}`,
+        `Traced analysis is not supported on this version of ${product}`,
+        {
+          attributes: {
+            languages: config.languages,
+            [attributeName]: version.toString()
+          },
+          markdownMessage: [
+            baseMessage,
+            `For more information, see [this announcement](${"https://github.blog/changelog/2026-10-19-codeql-changes-for-macos-27-xcode-27-and-swift-6-4/" /* UNSUPPORTED_TRACED_ANALYSIS_MACOS27 */}).`
+          ].join(" "),
+          severity: skipUnsupportedTracedAnalysis ? "error" : "warning",
+          visibility: {
+            cliSummaryTable: true,
+            statusPage: true,
+            telemetry: true
+          }
+        }
+      )
+    );
+  }
+  const logMessage = [
+    baseMessage,
+    `For more information, see ${"https://github.blog/changelog/2026-10-19-codeql-changes-for-macos-27-xcode-27-and-swift-6-4/" /* UNSUPPORTED_TRACED_ANALYSIS_MACOS27 */}`
+  ].join(" ");
+  if (skipUnsupportedTracedAnalysis) {
+    throw new ConfigurationError(logMessage);
+  } else {
+    logger2.warning(logMessage);
+  }
+}
+async function hasTracedLanguages(config, codeql) {
+  for (const language of config.languages) {
+    if (await codeql.isTracedLanguage(language)) {
+      return true;
+    }
+  }
+  return false;
+}
+async function checkRunnerSupportsTracedAnalysis(action, config, codeql) {
+  const version = macOSVersion(action);
+  await checkSwiftCompatibility(config, codeql, version);
+  if (config.buildMode !== void 0 && config.buildMode === "none") {
+    return;
+  }
+  if (!await hasTracedLanguages(config, codeql)) {
+    return;
+  }
+  const skipUnsupportedTracedAnalysis = await action.features.getValue(
+    "skip_unsupported_traced_analysis" /* SkipUnsupportedTracedAnalysis */
+  );
+  if (typeof version === "string") {
+    action.logger.warning(
+      `Unable to determine version of macOS, got: ${version}`
+    );
+  } else if (version !== void 0 && version.major >= UNSUPPORTED_MACOS_FOR_TRACED) {
+    handleUnsupportedVersion(
+      action.logger,
+      config,
+      skipUnsupportedTracedAnalysis,
+      "macOS",
+      version
+    );
+  }
+  const xcodeVer = xcodeVersion(action.logger);
+  if (xcodeVer !== void 0 && xcodeVer.major >= UNSUPPORTED_XCODE_FOR_TRACED) {
+    handleUnsupportedVersion(
+      action.logger,
+      config,
+      skipUnsupportedTracedAnalysis,
+      "Xcode",
+      xcodeVer
+    );
+  }
+}
+
 // src/status-report/tools-download.ts
 function createInitToolsDownloadFields(report, toolsFeatureFlagsValid) {
   const fields = { ...report?.perLanguage };
@@ -186058,7 +186256,7 @@ function createInitToolsDownloadFields(report, toolsFeatureFlagsValid) {
 }
 
 // src/workflow.ts
-var fs29 = __toESM(require("fs"));
+var fs30 = __toESM(require("fs"));
 var path24 = __toESM(require("path"));
 var import_zlib3 = __toESM(require("zlib"));
 var core18 = __toESM(require_core());
@@ -186210,7 +186408,7 @@ async function getWorkflow(logger2) {
     );
   }
   const workflowPath = await getWorkflowAbsolutePath(logger2);
-  return load(fs29.readFileSync(workflowPath, "utf-8"));
+  return load(fs30.readFileSync(workflowPath, "utf-8"));
 }
 async function getWorkflowAbsolutePath(logger2) {
   const relativePath2 = await getWorkflowRelativePath();
@@ -186218,7 +186416,7 @@ async function getWorkflowAbsolutePath(logger2) {
     getRequiredEnvParam("GITHUB_WORKSPACE"),
     relativePath2
   );
-  if (fs29.existsSync(absolutePath)) {
+  if (fs30.existsSync(absolutePath)) {
     logger2.debug(
       `Derived the following absolute path for the currently executing workflow: ${absolutePath}.`
     );
@@ -186513,7 +186711,7 @@ async function run3(actionState) {
     ) {
       const publicPreview = "2.22.1";
       const actualVer = (await codeql.getVersion()).version;
-      if (semver10.lt(actualVer, publicPreview)) {
+      if (semver11.lt(actualVer, publicPreview)) {
         actionState.env.export("CODEQL_ENABLE_EXPERIMENTAL_FEATURES" /* EXPERIMENTAL_FEATURES */, "true");
         logger2.info("Experimental Rust analysis enabled");
       }
@@ -186558,11 +186756,11 @@ async function run3(actionState) {
       enableFileCoverageInformation: fileCoverageResult.enabled,
       logger: logger2
     });
-    if (config.languages.includes("swift" /* swift */) && process.platform !== "darwin") {
-      throw new ConfigurationError(
-        `Swift analysis is only supported on macOS runner images. Please migrate to a macOS runner.`
-      );
-    }
+    await checkRunnerSupportsTracedAnalysis(
+      actionStateWithFeatures,
+      config,
+      codeql
+    );
     if (repositoryPropertiesResult.isFailure()) {
       addNoLanguageDiagnostic(
         config,
@@ -186662,16 +186860,16 @@ async function run3(actionState) {
               "codeql-action-go-tracing",
               "bin"
             );
-            fs30.mkdirSync(tempBinPath, { recursive: true });
+            fs31.mkdirSync(tempBinPath, { recursive: true });
             core19.addPath(tempBinPath);
             const goWrapperPath = path25.resolve(tempBinPath, "go");
-            fs30.writeFileSync(
+            fs31.writeFileSync(
               goWrapperPath,
               `#!/bin/bash
 
 exec ${goBinaryPath} "$@"`
             );
-            fs30.chmodSync(goWrapperPath, "755");
+            fs31.chmodSync(goWrapperPath, "755");
             actionState.env.export("CODEQL_ACTION_GO_BINARY" /* GO_BINARY_LOCATION */, goWrapperPath);
           } catch (e) {
             logger2.warning(
@@ -186854,7 +187052,7 @@ async function runWrapper4() {
 var core20 = __toESM(require_core());
 
 // src/init-action-post-helper.ts
-var fs31 = __toESM(require("fs"));
+var fs32 = __toESM(require("fs"));
 var import_path8 = __toESM(require("path"));
 var github4 = __toESM(require_github());
 function createFailedUploadFailedSarifResult(error3) {
@@ -186936,7 +187134,7 @@ async function generateFailedSarif(logger2, features, config, category, checkout
     let diagnosticDir = getTempDiagnosticsRoot(
       config.tempDir
     );
-    if (!exportDiagnosticsEnabled || !fs31.existsSync(diagnosticDir)) {
+    if (!exportDiagnosticsEnabled || !fs32.existsSync(diagnosticDir)) {
       diagnosticDir = void 0;
     }
     await codeql.diagnosticsExport(sarifFile, category, config, diagnosticDir);
@@ -187063,7 +187261,7 @@ async function uploadFailureInfo(uploadAllAvailableDebugArtifacts, printDebugLog
   }
   if (isSelfHostedRunner() && config.dbLocation) {
     try {
-      fs31.rmSync(config.dbLocation, {
+      fs32.rmSync(config.dbLocation, {
         recursive: true,
         force: true,
         maxRetries: 3
@@ -188003,7 +188201,7 @@ function generateCertificateAuthority() {
 }
 
 // src/start-proxy/environment.ts
-var fs32 = __toESM(require("fs"));
+var fs33 = __toESM(require("fs"));
 var path28 = __toESM(require("path"));
 var toolrunner5 = __toESM(require_toolrunner());
 var io8 = __toESM(require_io());
@@ -188076,9 +188274,9 @@ function checkJdkSettings(logger2, jdkHome) {
   for (const fileToCheck of filesToCheck) {
     const file = path28.join(jdkHome, fileToCheck);
     try {
-      if (fs32.existsSync(file)) {
+      if (fs33.existsSync(file)) {
         logger2.debug(`Found '${file}'.`);
-        const lines = String(fs32.readFileSync(file)).split("\n");
+        const lines = String(fs33.readFileSync(file)).split("\n");
         for (const line of lines) {
           for (const property of javaProperties) {
             if (line.startsWith(`${property}=`)) {
diff --git a/package-lock.json b/package-lock.json
index c06678b604..ec0adc691a 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -10488,6 +10488,7 @@
         "@octokit/core": "^7.0.8",
         "@octokit/plugin-paginate-rest": ">=16.0.0",
         "@octokit/plugin-rest-endpoint-methods": "^18.0.0",
+        "glob": "^13.0.6",
         "lite-matter": "^0.1.2",
         "mdast-util-from-markdown": "^2.1.0",
         "semver": "^7.8.5",
diff --git a/pr-checks/check-diagnostics.ts b/pr-checks/check-diagnostics.ts
index 6e9d0ba82c..cc619aa9c3 100644
--- a/pr-checks/check-diagnostics.ts
+++ b/pr-checks/check-diagnostics.ts
@@ -1,6 +1,8 @@
 import fs from "fs";
+import path from "path";
 
 import * as core from "@actions/core";
+import { globSync } from "glob";
 
 import * as sarif from "../src/sarif";
 
@@ -34,59 +36,83 @@ function checkStatusPageNotification(n: sarif.Notification) {
   }
 }
 
-const sarifPath = process.env["SARIF_PATH"];
+function checkSarif(sarifFile: string) {
+  core.info(`Checking SARIF file at '${sarifFile}'`);
 
-if (sarifPath === undefined) {
-  throw new Error("The path to a SARIF file must be set in 'SARIF_PATH'.");
-}
+  const log = JSON.parse(fs.readFileSync(sarifFile, "utf8")) as sarif.Log;
+  const run = log.runs[0];
 
-const log = JSON.parse(fs.readFileSync(sarifPath, "utf8")) as sarif.Log;
-const run = log.runs[0];
+  if (run.invocations === undefined) {
+    throw new Error("run.invocations is undefined");
+  }
 
-if (run.invocations === undefined) {
-  throw new Error("run.invocations is undefined");
-}
+  const toolExecutionNotifications =
+    run.invocations[0].toolExecutionNotifications;
 
-const toolExecutionNotifications =
-  run.invocations[0].toolExecutionNotifications;
+  if (toolExecutionNotifications === undefined) {
+    throw new Error("toolExecutionNotifications is undefined");
+  }
 
-if (toolExecutionNotifications === undefined) {
-  throw new Error("toolExecutionNotifications is undefined");
-}
+  const statusPageNotifications = toolExecutionNotifications.filter(
+    (n) =>
+      n.descriptor?.id === DIAGNOSTIC_ID &&
+      n.properties?.visibility?.statusPage,
+  );
+  if (statusPageNotifications.length !== 1) {
+    core.setFailed(
+      "Expected exactly one status page reporting descriptor for this diagnostic in the " +
+        `'runs[].invocations[].toolExecutionNotifications[]' SARIF property, but found ` +
+        `${statusPageNotifications.length}. All notification reporting descriptors: ` +
+        `${JSON.stringify(toolExecutionNotifications)}.`,
+    );
+  }
+  checkStatusPageNotification(statusPageNotifications[0]);
 
-const statusPageNotifications = toolExecutionNotifications.filter(
-  (n) =>
-    n.descriptor?.id === DIAGNOSTIC_ID && n.properties?.visibility?.statusPage,
-);
-if (statusPageNotifications.length !== 1) {
-  core.setFailed(
-    "Expected exactly one status page reporting descriptor for this diagnostic in the " +
-      `'runs[].invocations[].toolExecutionNotifications[]' SARIF property, but found ` +
-      `${statusPageNotifications.length}. All notification reporting descriptors: ` +
-      `${JSON.stringify(toolExecutionNotifications)}.`,
+  const notifications = run.tool.driver.notifications;
+
+  if (notifications === undefined) {
+    throw new Error("notifications is undefined");
+  }
+
+  const diagnosticNotification = notifications.filter(
+    (n) =>
+      n.id === DIAGNOSTIC_ID &&
+      n.name === DIAGNOSTIC_ID &&
+      n.fullDescription?.text === DIAGNOSTIC_NAME,
   );
+  if (diagnosticNotification.length !== 1) {
+    core.setFailed(
+      "Expected exactly one notification for this diagnostic in the " +
+        `'runs[].tool.driver.notifications[]' SARIF property, but found ` +
+        `${diagnosticNotification.length}. All notifications: ` +
+        `${JSON.stringify(notifications)}.`,
+    );
+  }
 }
-checkStatusPageNotification(statusPageNotifications[0]);
 
-const notifications = run.tool.driver.notifications;
+const sarifPath = process.env["SARIF_PATH"];
 
-if (notifications === undefined) {
-  throw new Error("notifications is undefined");
+if (sarifPath === undefined) {
+  throw new Error(
+    "The path to a SARIF file or directory must be set in 'SARIF_PATH'.",
+  );
 }
 
-const diagnosticNotification = notifications.filter(
-  (n) =>
-    n.id === DIAGNOSTIC_ID &&
-    n.name === DIAGNOSTIC_ID &&
-    n.fullDescription?.text === DIAGNOSTIC_NAME,
-);
-if (diagnosticNotification.length !== 1) {
-  core.setFailed(
-    "Expected exactly one notification for this diagnostic in the " +
-      `'runs[].tool.driver.notifications[]' SARIF property, but found ` +
-      `${diagnosticNotification.length}. All notifications: ` +
-      `${JSON.stringify(notifications)}.`,
-  );
+if (fs.statSync(sarifPath).isDirectory()) {
+  const sarifFiles = globSync("**/*.sarif", {
+    cwd: path.resolve(sarifPath),
+    absolute: true,
+  });
+
+  if (sarifFiles.length < 1) {
+    throw new Error(`Unable to find any .sarif files in '${sarifPath}'.`);
+  }
+
+  for (const sarifFile of sarifFiles) {
+    checkSarif(sarifFile);
+  }
+} else {
+  checkSarif(sarifPath);
 }
 
 core.info("Finished diagnostic export test");
diff --git a/pr-checks/checks/unsupported-macos.yml b/pr-checks/checks/unsupported-macos.yml
new file mode 100644
index 0000000000..86b919c2aa
--- /dev/null
+++ b/pr-checks/checks/unsupported-macos.yml
@@ -0,0 +1,63 @@
+name: "Unsupported macOS"
+description: "Tests that unsupported macOS versions are detected and result in appropriate diagnostics."
+versions:
+  - linked
+  - nightly-latest
+installNode: true
+
+operatingSystems:
+  - os: macos
+    runner-image: xcode-27
+
+env:
+  # Allow the failed SARIF file to be generated.
+  CODEQL_ACTION_SKIP_GENERATE_FAILED_SARIF: false
+  # But don't actually upload it.
+  CODEQL_ACTION_SKIP_SARIF_UPLOAD: true
+  # Mark telemetry for this workflow so it can be treated separately.
+  CODEQL_ACTION_TESTING_ENVIRONMENT: codeql-action-pr-checks
+
+steps:
+  - name: Check xcode_select_link
+    run: |
+      readlink /private/var/db/xcode_select_link
+      file -h /private/var/db/xcode_select_link
+
+  - uses: ./../action/init
+    id: init
+    with:
+      languages: swift
+      tools: ${{ steps.prepare-test.outputs.tools-url }}
+
+  - name: Analyze
+    # We could run `analyze` here from `./../analyze`, but `getAnalyzeActionName` in `workflow.ts`
+    # can't cope with that unless we introduce a different testing environment. Since this step
+    # would just fail on `xcode-27` anyway, we just skip it instead.
+    if: false
+    uses: ./analyze
+    with:
+      category: "/test-codeql-version:${{ matrix.version }}"
+
+validationJobs:
+  unsupported-macos-sarif-checks:
+    checkout: true
+    installNode: true
+    steps:
+      - name: Download workflow artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          pattern: test-mode-sarif-*
+          path: sarif
+
+      - name: List artifact contents
+        run: ls -laR ./sarif
+
+      - name: Check diagnostics appear in SARIF
+        env:
+          SARIF_PATH: "./sarif/"
+          DIAGNOSTIC_ID: "codeql-action/unsupported-traced-analysis-macos"
+          DIAGNOSTIC_NAME: "Traced analysis is not supported on this version of macOS"
+          EXPECTED_LOCATIONS: "0"
+          EXPECTED_MESSAGE: |
+            Traced analysis is not supported on macOS 27 or above.
+        run: npx tsx ./pr-checks/check-diagnostics.ts
diff --git a/pr-checks/package.json b/pr-checks/package.json
index 343f943814..a29428b9fd 100644
--- a/pr-checks/package.json
+++ b/pr-checks/package.json
@@ -9,6 +9,7 @@
     "@octokit/core": "^7.0.8",
     "@octokit/plugin-paginate-rest": ">=16.0.0",
     "@octokit/plugin-rest-endpoint-methods": "^18.0.0",
+    "glob": "^13.0.6",
     "lite-matter": "^0.1.2",
     "mdast-util-from-markdown": "^2.1.0",
     "semver": "^7.8.5",
diff --git a/pr-checks/sync.ts b/pr-checks/sync.ts
index 1729f5409b..7dde338b6a 100755
--- a/pr-checks/sync.ts
+++ b/pr-checks/sync.ts
@@ -124,6 +124,8 @@ interface JobSpecification {
 
 type ValidationJobSpecification = JobSpecification & {
   checkout?: boolean;
+  /** Optional condition for the validation job. */
+  if?: string;
 };
 
 /** Describes language/framework-specific steps and inputs. */
@@ -640,9 +642,14 @@ function generateValidationJob(
   // Add the generated steps in front of the ones from the specification.
   specSteps.items.unshift(...checkoutStep, ...steps);
 
+  const baseCondition = "github.triggering_actor != 'dependabot[bot]'";
+
   const validationJob: Record<string, any> = {
     name: jobSpecification.name,
-    if: "github.triggering_actor != 'dependabot[bot]'",
+    if:
+      jobSpecification.if !== undefined
+        ? `${baseCondition} && ${jobSpecification.if}`
+        : baseCondition,
     needs: [checkName],
     permissions: {
       contents: "read",
diff --git a/src/action-common.ts b/src/action-common.ts
index 79f1901f22..efb0bd97a0 100644
--- a/src/action-common.ts
+++ b/src/action-common.ts
@@ -1,3 +1,5 @@
+import * as os from "os";
+
 import * as core from "@actions/core";
 
 import { ActionsEnv, getActionsEnv } from "./actions-util";
@@ -13,6 +15,8 @@ import {
 } from "./status-report";
 import { getEnv, getErrorMessage, wrapError } from "./util";
 
+export type { Logger } from "./logging";
+
 /** Base state that is available to an Action on startup. */
 export interface BaseState {
   /** The name of the Action. */
@@ -23,6 +27,8 @@ export interface BaseState {
   platform: NodeJS.Platform;
   /** The architecture of the host. */
   arch: NodeJS.Architecture;
+  /** The version of the operating system. */
+  osRelease: string;
 }
 
 /** Describes different state features that an Action may have. */
@@ -173,6 +179,7 @@ export async function runInActions(action: Action) {
       startedAt,
       platform: process.platform,
       arch: process.arch,
+      osRelease: os.release(),
       logger,
       env,
       actions: actionsEnv,
diff --git a/src/actions-util.ts b/src/actions-util.ts
index 13e33a8e9d..096bdd8f15 100644
--- a/src/actions-util.ts
+++ b/src/actions-util.ts
@@ -72,7 +72,7 @@ export const getOptionalInput = function (name: string): string | undefined {
  * directory that has been set in `CODEQL_ACTION_TEMP` by e.g. a previous step, or the
  * value of `RUNNER_TEMP` otherwise.
  */
-export function getTemporaryDirectory(env: Env = getEnv()): string {
+export function getTemporaryDirectory(env: ReadOnlyEnv = getEnv()): string {
   return (
     env.getOptional(EnvVar.TEMP) ?? env.getRequired(ActionsEnvVars.RUNNER_TEMP)
   );
@@ -361,9 +361,10 @@ const MAX_STDERR_BUFFER_SIZE = 20000;
  * Runs a CLI tool.
  *
  * @returns Standard output produced by the tool.
- * @throws A `CommandInvocationError` if the tool exits with a non-zero status code.
+ * @throws A {@link CommandInvocationError} if the tool exits with a non-zero status code.
  */
 export async function runTool(
+  env: Env,
   cmd: string,
   args: string[] = [],
   opts: { stdin?: string; noStreamStdout?: boolean } = {},
@@ -374,6 +375,7 @@ export async function runTool(
     process.stdout.write(`[command]${cmd} ${args.join(" ")}\n`);
   }
   const exitCode = await new toolrunner.ToolRunner(cmd, args, {
+    env: env.getDefined(),
     ignoreReturnCode: true,
     listeners: {
       stdout: (data: Buffer) => {
diff --git a/src/cli/output-cache.ts b/src/cli/output-cache.ts
index fb5deb1ad6..209df575db 100644
--- a/src/cli/output-cache.ts
+++ b/src/cli/output-cache.ts
@@ -2,7 +2,7 @@ import * as fs from "fs";
 import path from "path";
 
 import { getTemporaryDirectory } from "../actions-util";
-import { Env } from "../environment";
+import { ReadOnlyEnv } from "../environment";
 import * as json from "../json";
 import { Logger } from "../logging";
 
@@ -51,7 +51,7 @@ export function resetCachedCodeQlVersion(): void {
  * Returns the path to the temporary file that backs the
  * on-disk cache of CLI responses between workflow steps.
  */
-export function getCommandCacheFilePath(env: Env): string {
+export function getCommandCacheFilePath(env: ReadOnlyEnv): string {
   return path.join(getTemporaryDirectory(env), COMMAND_CACHE_FILENAME);
 }
 
diff --git a/src/codeql.ts b/src/codeql.ts
index 28ba2243e9..9f7b4b5b85 100644
--- a/src/codeql.ts
+++ b/src/codeql.ts
@@ -18,7 +18,7 @@ import { CliError, wrapCliConfigurationError } from "./cli-errors";
 import type { ActionConfig } from "./config/action-config";
 import { appendExtraQueryExclusions, type Config } from "./config-utils";
 import { DocUrl } from "./doc-url";
-import { EnvVar, getEnv, exportEnvVar } from "./environment";
+import { EnvVar, getEnv, Env, ReadOnlyEnv } from "./environment";
 import {
   CodeQLDefaultVersionInfo,
   Feature,
@@ -499,13 +499,14 @@ export async function getCodeQLForCmd(
   logger: Logger,
   cmd: string,
   checkVersion: boolean,
+  env: Env = getEnv(),
 ): Promise<CodeQL> {
   const codeql: CodeQL = {
     getPath() {
       return cmd;
     },
     async getVersion() {
-      const cacheFilePath = outputCache.getCommandCacheFilePath(getEnv());
+      const cacheFilePath = outputCache.getCommandCacheFilePath(env);
       let result = outputCache.getCachedCodeQlVersion(
         logger,
         cacheFilePath,
@@ -513,6 +514,7 @@ export async function getCodeQLForCmd(
       );
       if (result === undefined) {
         result = await runCliJson<VersionInfo>(
+          env,
           cmd,
           ["version", "--format=json"],
           {
@@ -596,6 +598,7 @@ export async function getCodeQLForCmd(
         : ["--no-calculate-baseline"];
 
       await runCli(
+        env,
         cmd,
         [
           "database",
@@ -631,7 +634,7 @@ export async function getCodeQLForCmd(
       }
     },
     async runAutobuild(config: Config, language: Language) {
-      applyAutobuildAzurePipelinesTimeoutFix();
+      applyAutobuildAzurePipelinesTimeoutFix(env);
 
       const autobuildCmd = path.join(
         await this.resolveExtractor(language),
@@ -641,8 +644,11 @@ export async function getCodeQLForCmd(
 
       // Bump the verbosity of the autobuild command if we're in debug mode
       if (config.debugMode) {
-        process.env[EnvVar.CLI_VERBOSITY] =
-          process.env[EnvVar.CLI_VERBOSITY] || EXTRACTION_DEBUG_MODE_VERBOSITY;
+        env.set(
+          EnvVar.CLI_VERBOSITY,
+          env.getOptional(EnvVar.CLI_VERBOSITY) ??
+            EXTRACTION_DEBUG_MODE_VERBOSITY,
+        );
       }
 
       // On macOS, System Integrity Protection (SIP) typically interferes with
@@ -659,10 +665,10 @@ export async function getCodeQLForCmd(
       // When `DYLD_INSERT_LIBRARIES` is set in the environment for a step,
       // the Actions runtime introduces its own workaround for SIP
       // (https://github.com/actions/runner/pull/416).
-      await runCli(autobuildCmd);
+      await runCli(env, autobuildCmd);
     },
     async extractScannedLanguage(config: Config, language: Language) {
-      await runCli(cmd, [
+      await runCli(env, cmd, [
         "database",
         "trace-command",
         "--index-traceless-dbs",
@@ -674,10 +680,10 @@ export async function getCodeQLForCmd(
     },
     async extractUsingBuildMode(config: Config, language: Language) {
       if (config.buildMode === BuildMode.Autobuild) {
-        applyAutobuildAzurePipelinesTimeoutFix();
+        applyAutobuildAzurePipelinesTimeoutFix(env);
       }
       try {
-        await runCli(cmd, [
+        await runCli(env, cmd, [
           "database",
           "trace-command",
           "--use-build-mode",
@@ -716,7 +722,7 @@ export async function getCodeQLForCmd(
         ...getExtraOptionsFromEnv(["database", "finalize"]),
         databasePath,
       ];
-      await runCli(cmd, args);
+      await runCli(env, cmd, args);
     },
     async resolveLanguages(
       {
@@ -725,7 +731,7 @@ export async function getCodeQLForCmd(
         filterToLanguagesWithQueries: boolean;
       } = { filterToLanguagesWithQueries: false },
     ) {
-      return runCliJson<ResolveLanguagesOutput>(cmd, [
+      return runCliJson<ResolveLanguagesOutput>(env, cmd, [
         "resolve",
         "languages",
         "--format=betterjson",
@@ -754,7 +760,11 @@ export async function getCodeQLForCmd(
       if (workingDir !== undefined) {
         codeqlArgs.push("--working-dir", workingDir);
       }
-      return await runCliJson<ResolveBuildEnvironmentOutput>(cmd, codeqlArgs);
+      return await runCliJson<ResolveBuildEnvironmentOutput>(
+        env,
+        cmd,
+        codeqlArgs,
+      );
     },
     async databaseRunQueries(
       databasePath: string,
@@ -773,7 +783,7 @@ export async function getCodeQLForCmd(
           ignoringOptions: ["--expect-discarded-cache"],
         }),
       ];
-      await runCli(cmd, codeqlArgs);
+      await runCli(env, cmd, codeqlArgs);
     },
     async databaseInterpretResults(
       databasePath: string,
@@ -806,7 +816,7 @@ export async function getCodeQLForCmd(
         "--sarif-group-rules-by-pack",
         "--sarif-include-query-help=always",
         "--sublanguage-file-coverage",
-        ...(await getJobRunUuidSarifOptions()),
+        ...(await getJobRunUuidSarifOptions(env)),
         ...getExtraOptionsFromEnv(["database", "interpret-results"]),
       ];
       if (sarifRunPropertyFlag !== undefined) {
@@ -826,7 +836,7 @@ export async function getCodeQLForCmd(
       }
       // Capture the stdout, which contains the analysis summary. Don't stream it to the Actions
       // logs to avoid printing it twice.
-      return await runCli(cmd, codeqlArgs, {
+      return await runCli(env, cmd, codeqlArgs, {
         noStreamStdout: true,
       });
     },
@@ -843,7 +853,7 @@ export async function getCodeQLForCmd(
           `--cache-cleanup=${cleanupLevel}`,
           ...getExtraOptionsFromEnv(["database", "cleanup"]),
         ];
-        await runCli(cmd, codeqlArgs);
+        await runCli(env, cmd, codeqlArgs);
       }
     },
     async databaseBundle(
@@ -991,7 +1001,7 @@ export async function getCodeQLForCmd(
         ...getExtraOptionsFromEnv(["resolve", "queries"]),
         ...queries,
       ];
-      return await runCliJson<string[]>(cmd, codeqlArgs, {
+      return await runCliJson<string[]>(env, cmd, codeqlArgs, {
         noStreamStdout: true,
       });
     },
@@ -1005,7 +1015,7 @@ export async function getCodeQLForCmd(
         "--format=json",
         ...getExtraOptionsFromEnv(["resolve", "database"]),
       ];
-      return await runCliJson<ResolveDatabaseOutput>(cmd, codeqlArgs, {
+      return await runCliJson<ResolveDatabaseOutput>(env, cmd, codeqlArgs, {
         noStreamStdout: true,
       });
     },
@@ -1032,7 +1042,7 @@ export async function getCodeQLForCmd(
         args.push("--sarif-merge-runs-from-equal-category");
       }
 
-      await runCli(cmd, args);
+      await runCli(env, cmd, args);
     },
   };
   // To ensure that status reports include the CodeQL CLI version wherever
@@ -1054,7 +1064,7 @@ export async function getCodeQLForCmd(
     );
   } else if (
     checkVersion &&
-    process.env[EnvVar.SUPPRESS_DEPRECATED_SOON_WARNING] !== "true" &&
+    env.getOptional(EnvVar.SUPPRESS_DEPRECATED_SOON_WARNING) !== "true" &&
     !(await util.codeQlVersionAtLeast(codeql, CODEQL_NEXT_MINIMUM_VERSION))
   ) {
     const result = await codeql.getVersion();
@@ -1072,7 +1082,7 @@ export async function getCodeQLForCmd(
         }' by 'github/codeql-action/*@v${getActionVersion()}' in your code scanning workflow to ` +
         "continue using this version of the CodeQL Action.",
     );
-    exportEnvVar(EnvVar.SUPPRESS_DEPRECATED_SOON_WARNING, "true");
+    env.export(EnvVar.SUPPRESS_DEPRECATED_SOON_WARNING, "true");
   }
   return codeql;
 }
@@ -1149,12 +1159,13 @@ export function getExtraOptions(
 }
 
 async function runCli(
+  env: Env,
   cmd: string,
   args: string[] = [],
   opts: { stdin?: string; noStreamStdout?: boolean } = {},
 ): Promise<string> {
   try {
-    return await runTool(cmd, args, opts);
+    return await runTool(env, cmd, args, opts);
   } catch (e) {
     if (e instanceof CommandInvocationError) {
       throw wrapCliConfigurationError(new CliError(e));
@@ -1165,6 +1176,8 @@ async function runCli(
 
 /**
  * Wraps the command executor {@link runCli} and tries to parse the output as JSON.
+ *
+ * @param env The environment variables.
  * @param cmd The command to run.
  * @param args The arguments to pass to the command.
  * @param opts The options for running the command.
@@ -1173,11 +1186,12 @@ async function runCli(
  * @returns The parsed JSON output from the command.
  */
 async function runCliJson<T>(
+  env: Env,
   cmd: string,
   args: string[] = [],
   opts: { stdin?: string; noStreamStdout?: boolean } = {},
 ): Promise<T> {
-  const output = await runCli(cmd, args, opts);
+  const output = await runCli(env, cmd, args, opts);
   try {
     return JSON.parse(output) as T;
   } catch (e) {
@@ -1276,17 +1290,20 @@ function getExtractionVerbosityArguments(
  * Without the fix, long build processes will timeout when pulling down Java packages
  * https://developercommunity.visualstudio.com/content/problem/292284/maven-hosted-agent-connection-timeout.html
  */
-function applyAutobuildAzurePipelinesTimeoutFix() {
-  const javaToolOptions = process.env["JAVA_TOOL_OPTIONS"] || "";
-  process.env["JAVA_TOOL_OPTIONS"] = [
-    ...javaToolOptions.split(/\s+/),
-    "-Dhttp.keepAlive=false",
-    "-Dmaven.wagon.http.pool=false",
-  ].join(" ");
+function applyAutobuildAzurePipelinesTimeoutFix(env: Env) {
+  const javaToolOptions = env.getOptional("JAVA_TOOL_OPTIONS") ?? "";
+  env.set(
+    "JAVA_TOOL_OPTIONS",
+    [
+      ...javaToolOptions.split(/\s+/),
+      "-Dhttp.keepAlive=false",
+      "-Dmaven.wagon.http.pool=false",
+    ].join(" "),
+  );
 }
 
-async function getJobRunUuidSarifOptions() {
-  const jobRunUuid = process.env[EnvVar.JOB_RUN_UUID];
+async function getJobRunUuidSarifOptions(env: ReadOnlyEnv) {
+  const jobRunUuid = env.getOptional(EnvVar.JOB_RUN_UUID);
 
   return jobRunUuid ? [`--sarif-run-property=jobRunUuid=${jobRunUuid}`] : [];
 }
diff --git a/src/diagnostics.ts b/src/diagnostics.ts
index bec1d28abf..f2d3a152a8 100644
--- a/src/diagnostics.ts
+++ b/src/diagnostics.ts
@@ -3,7 +3,7 @@ import path from "path";
 
 import type { ActionState } from "./action-common";
 import { getTemporaryDirectory } from "./actions-util";
-import type { Config } from "./config-utils";
+import type { ActionConfig } from "./config/action-config";
 import { Language } from "./languages";
 import { getActionsLogger, type Logger } from "./logging";
 import {
@@ -177,7 +177,10 @@ export function getTempLanguageDiagnosticsPath(
 }
 
 /** Gets the path where diagnostics for {@link language} should be stored in the database. */
-export function getDatabaseDiagnosticsPath(config: Config, language: Language) {
+export function getDatabaseDiagnosticsPath(
+  config: ActionConfig<"dbLocation">,
+  language: Language,
+) {
   return getLanguageDiagnosticsPath(config.dbLocation, language);
 }
 
@@ -190,7 +193,7 @@ export function getDatabaseDiagnosticsPath(config: Config, language: Language) {
  * @param diagnostic The diagnostic message to add to the database.
  */
 export function addDiagnostic(
-  config: Config,
+  config: ActionConfig<"dbLocation" | "tempDir">,
   language: Language,
   diagnostic: DiagnosticMessage,
   logger: Logger = getActionsLogger(),
@@ -215,7 +218,7 @@ export function addDiagnostic(
 
 /** Adds a diagnostic that is not specific to any language. */
 export function addNoLanguageDiagnostic(
-  config: Config | undefined,
+  config: ActionConfig<"dbLocation" | "languages" | "tempDir"> | undefined,
   diagnostic: DiagnosticMessage,
   logger: Logger = getActionsLogger(),
 ) {
@@ -305,7 +308,7 @@ function writeDiagnosticFile(
  */
 function writeDiagnostic(
   action: ActionState<["Logger"]>,
-  config: Config,
+  config: ActionConfig<"dbLocation">,
   language: Language,
   diagnostic: DiagnosticMessage,
 ) {
@@ -348,7 +351,7 @@ export function logTemporaryDiagnostics(action: ActionState<["Logger"]>) {
 /** Relocates all temporary diagnostics to the respective databases. */
 export function flushDiagnostics(
   action: ActionState<["Logger"]>,
-  config: Config,
+  config: ActionConfig<"dbLocation" | "languages">,
 ) {
   const diagnosticsCount = temporaryDiagnostics.length;
   action.logger.debug(
diff --git a/src/doc-url.ts b/src/doc-url.ts
index 97f5451d85..c75d47a68d 100644
--- a/src/doc-url.ts
+++ b/src/doc-url.ts
@@ -12,4 +12,6 @@ export enum DocUrl {
   SPECIFY_BUILD_STEPS_MANUALLY = "https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages#about-specifying-build-steps-manually",
   SYSTEM_REQUIREMENTS = "https://codeql.github.com/docs/codeql-overview/system-requirements/",
   TRACK_CODE_SCANNING_ALERTS_ACROSS_RUNS = "https://docs.github.com/en/code-security/reference/code-scanning/sarif-support-for-code-scanning#data-for-preventing-duplicated-alerts",
+  /** Blog post about traced analysis being unsupported on macOS 27 and with Xcode 27. */
+  UNSUPPORTED_TRACED_ANALYSIS_MACOS27 = "https://github.blog/changelog/2026-10-19-codeql-changes-for-macos-27-xcode-27-and-swift-6-4/",
 }
diff --git a/src/environment.ts b/src/environment.ts
index ffc3f305ad..7776238e5d 100644
--- a/src/environment.ts
+++ b/src/environment.ts
@@ -293,8 +293,8 @@ export function getOptionalEnvVar(paramName: string): string | undefined {
  * in tests, while clearly signalling in regular code that the consumer of the `ReadOnlyEnv` instance
  * will only read from it.
  */
-export class ReadOnlyEnv<T extends string | undefined = string | undefined> {
-  constructor(protected readonly vars: Record<string, T>) {}
+export class ReadOnlyEnv {
+  constructor(protected readonly vars: Record<string, string | undefined>) {}
 
   /** Clones the object while detaching the underlying environment from the original. */
   public clone(): this {
@@ -302,10 +302,24 @@ export class ReadOnlyEnv<T extends string | undefined = string | undefined> {
   }
 
   /** Gets a copy of the underlying environment. */
-  public get(): Record<string, T> {
+  public get(): Record<string, string | undefined> {
     return { ...this.vars };
   }
 
+  /** Gets a copy of the underlying environment, where the values are not `undefined`. */
+  public getDefined(): Record<string, string> {
+    const result: Record<string, string> = {};
+
+    for (const [key, val] of Object.entries(this.vars)) {
+      if (val === undefined) {
+        continue;
+      }
+      result[key] = val;
+    }
+
+    return result;
+  }
+
   /** Tries to get the value for `name` and throws if there isn't one. */
   public getRequired(name: string): string {
     return getRequiredEnvVar(this.vars, name);
@@ -317,7 +331,7 @@ export class ReadOnlyEnv<T extends string | undefined = string | undefined> {
   }
 
   /** Gets the entries of the underlying `ProcessEnv`. */
-  public entries(): Array<[string, T]> {
+  public entries(): Array<[string, string | undefined]> {
     return Object.entries(this.vars);
   }
 
@@ -347,19 +361,17 @@ export class ReadOnlyEnv<T extends string | undefined = string | undefined> {
  * Use `ReadOnlyEnv` instead if you only plan to read from the environment.
  * This type allows writing to the environment.
  */
-export class Env<
-  T extends string | undefined = string | undefined,
-> extends ReadOnlyEnv<T> {
+export class Env extends ReadOnlyEnv {
   private changed: boolean = false;
 
   /** Sets an environment variable. */
-  public set(name: string, value: T): void {
+  public set(name: string, value: string | undefined): void {
     this.vars[name] = value;
     this.changed = true;
   }
 
   /** Sets all environment variables given by `vars`. */
-  public setAll(vars: Record<string, T>): void {
+  public setAll(vars: Record<string, string | undefined>): void {
     for (const [key, val] of Object.entries(vars)) {
       this.set(key, val);
     }
@@ -373,7 +385,7 @@ export class Env<
    * @param name The name of the environment variable to set and export.
    * @param val The value to set and export for the environment variable.
    */
-  public export(name: string, val: T): void {
+  public export(name: string, val: string): void {
     // Setting the environment variable for this instance is always OK, including
     // in tests, since we use fresh `Env` instances whenever needed. This allows
     // tests to pass that rely on that part of the `core.exportVariable` behaviour.
diff --git a/src/feature-flags.ts b/src/feature-flags.ts
index f0fbcd3233..e326b08e6e 100644
--- a/src/feature-flags.ts
+++ b/src/feature-flags.ts
@@ -144,6 +144,8 @@ export enum Feature {
   /** Controls whether overlay build failures on the default branch are stored in the Actions cache. */
   OverlayAnalysisStatusSave = "overlay_analysis_status_save",
   QaTelemetryEnabled = "qa_telemetry_enabled",
+  /** Whether we should fail early if we detect that traced analysis is unsupported. */
+  SkipUnsupportedTracedAnalysis = "skip_unsupported_traced_analysis",
   /** Routes (some) API requests through the registry proxy. */
   ProxyApiRequests = "proxy_api_requests",
   /** Note that this currently only disables baseline file coverage information. */
@@ -410,6 +412,11 @@ export const featureConfig = {
     envVar: "CODEQL_ACTION_START_PROXY_USE_FEATURES_RELEASE",
     minimumVersion: undefined,
   },
+  [Feature.SkipUnsupportedTracedAnalysis]: {
+    defaultValue: false,
+    envVar: "CODEQL_ACTION_SKIP_UNSUPPORTED_TRACED_ANALYSIS",
+    minimumVersion: undefined,
+  },
   [Feature.ToolsRepositoryProperty]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_TOOLS_REPOSITORY_PROPERTY",
diff --git a/src/init-action.ts b/src/init-action.ts
index ceffe9d6e3..af95e8ffab 100644
--- a/src/init-action.ts
+++ b/src/init-action.ts
@@ -62,6 +62,7 @@ import {
   runDatabaseInitCluster,
 } from "./init";
 import { JavaEnvVars, BuiltInLanguage } from "./languages";
+import { checkRunnerSupportsTracedAnalysis } from "./languages/traced";
 import { Logger, withGroupAsync } from "./logging";
 import {
   downloadOverlayBaseDatabaseFromCache,
@@ -418,14 +419,11 @@ async function run(
       logger,
     });
 
-    if (
-      config.languages.includes(BuiltInLanguage.swift) &&
-      process.platform !== "darwin"
-    ) {
-      throw new ConfigurationError(
-        `Swift analysis is only supported on macOS runner images. Please migrate to a macOS runner.`,
-      );
-    }
+    await checkRunnerSupportsTracedAnalysis(
+      actionStateWithFeatures,
+      config,
+      codeql,
+    );
 
     if (repositoryPropertiesResult.isFailure()) {
       addNoLanguageDiagnostic(
diff --git a/src/languages/swift.test.ts b/src/languages/swift.test.ts
new file mode 100644
index 0000000000..465f782c16
--- /dev/null
+++ b/src/languages/swift.test.ts
@@ -0,0 +1,89 @@
+import test from "ava";
+import sinon from "sinon";
+
+import { ActionsEnvVars } from "../environment";
+import {
+  createTestConfig,
+  getCodeQLForTesting,
+  getTestEnv,
+  makeVersionInfo,
+  RecordingLogger,
+  setupTests,
+} from "../testing-utils";
+import { ToolsFeature } from "../tools-features";
+import { withTmpDir } from "../util";
+
+import { checkSwiftCompatibility } from "./swift";
+
+import { BuiltInLanguage } from ".";
+
+setupTests(test);
+
+test("checkSwiftCompatibility doesn't throw for non-Swift languages", async (t) => {
+  for (const language of Object.values(BuiltInLanguage)) {
+    if (language === BuiltInLanguage.swift) {
+      continue;
+    }
+
+    const codeql = await getCodeQLForTesting();
+    await t.notThrowsAsync(
+      checkSwiftCompatibility(
+        createTestConfig({ languages: [language] }),
+        codeql,
+        // A value of `undefined` should make `isSwiftCompatible` throw for Swift by default
+        // since it means we are on a platform other than macOS
+        undefined,
+      ),
+    );
+  }
+});
+
+test("checkSwiftCompatibility doesn't throw for Swift if CLI supports swiftSupportsAllPlatforms", async (t) =>
+  withTmpDir(async (tmpDir) => {
+    const logger = new RecordingLogger();
+    const env = getTestEnv();
+    env.set(ActionsEnvVars.RUNNER_TEMP, tmpDir);
+
+    const codeql = await getCodeQLForTesting("codeql-for-testing", logger, env);
+    const supportsFeature = sinon
+      .stub(codeql, "supportsFeature")
+      .withArgs(ToolsFeature.SwiftSupportsAllPlatforms)
+      .resolves(true);
+
+    await t.notThrowsAsync(
+      checkSwiftCompatibility(
+        createTestConfig({ languages: [BuiltInLanguage.swift] }),
+        codeql,
+        // A value of `undefined` should make `isSwiftCompatible` throw for Swift by default
+        // since it means we are on a platform other than macOS
+        undefined,
+      ),
+    );
+
+    t.is(supportsFeature.callCount, 1);
+    t.deepEqual(supportsFeature.args[0], [
+      ToolsFeature.SwiftSupportsAllPlatforms,
+    ]);
+  }));
+
+test("checkSwiftCompatibility doesn't throw for Swift on darwin", async (t) =>
+  withTmpDir(async (tmpDir) => {
+    const logger = new RecordingLogger();
+    const env = getTestEnv();
+    env.set(ActionsEnvVars.RUNNER_TEMP, tmpDir);
+
+    const codeql = await getCodeQLForTesting("codeql-for-testing", logger, env);
+    sinon.stub(codeql, "getVersion").resolves(makeVersionInfo("2.27.0"));
+
+    await t.notThrowsAsync(
+      checkSwiftCompatibility(
+        createTestConfig({
+          tempDir: tmpDir,
+          languages: [BuiltInLanguage.swift],
+        }),
+        codeql,
+        // A value other than `undefined` means we are on macOS.
+        "some-macos-version",
+      ),
+    );
+  }));
diff --git a/src/languages/swift.ts b/src/languages/swift.ts
new file mode 100644
index 0000000000..45ca87416a
--- /dev/null
+++ b/src/languages/swift.ts
@@ -0,0 +1,42 @@
+import type { SemVer } from "semver";
+
+import { CodeQL } from "../codeql";
+import type { ActionConfig } from "../config/action-config";
+import { ToolsFeature } from "../tools-features";
+import { ConfigurationError } from "../util";
+
+import { BuiltInLanguage } from ".";
+
+/**
+ * Determines whether we can run a Swift analysis on the current runner.
+ *
+ * @param config The Action configuration.
+ * @param codeql The {@link CodeQL} CLI instance.
+ * @param macosVersion The version of macOS, if any.
+ *
+ * @throws {ConfigurationError} If Swift analysis is not possible on the current runner.
+ */
+export async function checkSwiftCompatibility(
+  config: ActionConfig<"languages">,
+  codeql: CodeQL,
+  macosVersion: SemVer | string | undefined,
+) {
+  // The checks are not relevant if we are not trying to analyse Swift.
+  if (!config.languages.includes(BuiltInLanguage.swift)) {
+    return;
+  }
+
+  // Skip the checks if the `swiftSupportsAllPlatforms` feature is supported by the CLI.
+  // This is a forward-looking measure that allows a future CLI update to disable these
+  // platform checks in the Action when they shouldn't be enforced anymore.
+  if (await codeql.supportsFeature(ToolsFeature.SwiftSupportsAllPlatforms)) {
+    return;
+  }
+
+  // If `macosVersion` is undefined, then we are not on macOS and Swift analysis is unsupported.
+  if (macosVersion === undefined) {
+    throw new ConfigurationError(
+      `Swift analysis is only supported on macOS runner images. Please migrate to a macOS runner.`,
+    );
+  }
+}
diff --git a/src/languages/traced.test.ts b/src/languages/traced.test.ts
new file mode 100644
index 0000000000..777fdccc35
--- /dev/null
+++ b/src/languages/traced.test.ts
@@ -0,0 +1,486 @@
+import fs from "fs";
+
+import test from "ava";
+import * as sinon from "sinon";
+
+import { type CodeQL } from "../codeql";
+import * as diagnostics from "../diagnostics";
+import { ActionsEnvVars, type Env } from "../environment";
+import { Feature } from "../feature-flags";
+import type { Logger } from "../logging";
+import { XCODE_SELECT_LINK_PATH } from "../platform";
+import {
+  checkExpectedLogMessages,
+  checkUnexpectedLogMessages,
+  createFeatures,
+  createTestConfig,
+  getCodeQLForTesting,
+  getTestEnv,
+  initAllState,
+  makeVersionInfo,
+  RecordingLogger,
+  setupTests,
+} from "../testing-utils";
+import { BuildMode, ConfigurationError, withTmpDir } from "../util";
+
+import { checkRunnerSupportsTracedAnalysis } from "./traced";
+
+import { BuiltInLanguage } from ".";
+
+setupTests(test);
+
+const TEST_DEFAULT_TRACED_LANGUAGES = {
+  [BuiltInLanguage.swift]: true,
+  [BuiltInLanguage.go]: true,
+};
+
+async function getCodeQLWithTracedStub(
+  cmd: string,
+  logger: Logger,
+  env: Env,
+  tracedLanguages: Partial<
+    Record<BuiltInLanguage, boolean>
+  > = TEST_DEFAULT_TRACED_LANGUAGES,
+): Promise<CodeQL> {
+  const codeql = await getCodeQLForTesting(cmd, logger, env);
+  sinon.stub(codeql, "isTracedLanguage").callsFake(async (language) => {
+    return tracedLanguages[language] === true;
+  });
+  return codeql;
+}
+
+const nonDarwinPlatforms: NodeJS.Platform[] = ["linux", "win32"];
+for (const nonDarwinPlatform of nonDarwinPlatforms) {
+  test(`checkRunnerSupportsTracedAnalysis throws for Swift on ${nonDarwinPlatform}`, async (t) =>
+    withTmpDir(async (tmpDir) => {
+      const logger = new RecordingLogger();
+      const env = getTestEnv();
+      env.set(ActionsEnvVars.RUNNER_TEMP, tmpDir);
+
+      const codeql = await getCodeQLWithTracedStub(
+        "codeql-for-testing",
+        logger,
+        env,
+      );
+      sinon.stub(codeql, "getVersion").resolves(makeVersionInfo("2.27.0"));
+
+      await t.throwsAsync(
+        checkRunnerSupportsTracedAnalysis(
+          initAllState({ platform: nonDarwinPlatform, env, logger }),
+          createTestConfig({ languages: [BuiltInLanguage.swift] }),
+          codeql,
+        ),
+        {
+          instanceOf: ConfigurationError,
+          message: /^Swift analysis is only supported on macOS runner images/,
+        },
+      );
+    }));
+}
+
+test(`checkRunnerSupportsTracedAnalysis doesn't throw for BMN`, async (t) =>
+  withTmpDir(async (tmpDir) => {
+    const logger = new RecordingLogger();
+    const env = getTestEnv();
+    env.set(ActionsEnvVars.RUNNER_TEMP, tmpDir);
+
+    const codeql = await getCodeQLWithTracedStub(
+      "codeql-for-testing",
+      logger,
+      env,
+    );
+    sinon.stub(codeql, "getVersion").resolves(makeVersionInfo("2.27.0"));
+
+    await t.notThrowsAsync(
+      checkRunnerSupportsTracedAnalysis(
+        initAllState({
+          platform: "darwin",
+          osRelease: "27.0.0",
+          env,
+          logger,
+        }),
+        createTestConfig({ buildMode: BuildMode.None }),
+        codeql,
+      ),
+    );
+  }));
+
+// Some languages not in `TEST_DEFAULT_TRACED_LANGUAGES`.
+const nonTracedLanguages: BuiltInLanguage[] = [
+  BuiltInLanguage.javascript,
+  BuiltInLanguage.actions,
+];
+for (const nonTracedLanguage of nonTracedLanguages) {
+  test(`checkRunnerSupportsTracedAnalysis doesn't throw for ${nonTracedLanguage} on unsupported macOS`, async (t) =>
+    withTmpDir(async (tmpDir) => {
+      const logger = new RecordingLogger();
+      const env = getTestEnv();
+      env.set(ActionsEnvVars.RUNNER_TEMP, tmpDir);
+
+      const codeql = await getCodeQLWithTracedStub(
+        "codeql-for-testing",
+        logger,
+        env,
+      );
+      sinon.stub(codeql, "getVersion").resolves(makeVersionInfo("2.27.0"));
+
+      await t.notThrowsAsync(
+        checkRunnerSupportsTracedAnalysis(
+          initAllState({
+            platform: "darwin",
+            osRelease: "27.0.0",
+            env,
+            logger,
+          }),
+          createTestConfig({ languages: [nonTracedLanguage] }),
+          codeql,
+        ),
+      );
+    }));
+}
+
+test("checkRunnerSupportsTracedAnalysis warns if version string is not a semver", async (t) =>
+  withTmpDir(async (tmpDir) => {
+    const logger = new RecordingLogger();
+    const env = getTestEnv();
+    env.set(ActionsEnvVars.RUNNER_TEMP, tmpDir);
+
+    const codeql = await getCodeQLWithTracedStub(
+      "codeql-for-testing",
+      logger,
+      env,
+    );
+    sinon.stub(codeql, "getVersion").resolves(makeVersionInfo("2.27.0"));
+
+    await checkRunnerSupportsTracedAnalysis(
+      initAllState({
+        logger,
+        platform: "darwin",
+        osRelease: "unexpected",
+        env,
+      }),
+      createTestConfig({ languages: [BuiltInLanguage.go] }),
+      codeql,
+    );
+
+    checkExpectedLogMessages(t, logger.messages, [
+      "Unable to determine version of macOS, got: unexpected",
+    ]);
+  }));
+
+// `addDiagnostic` changes global state and we must stub it, so this test must be serial.
+test.serial(
+  "checkRunnerSupportsTracedAnalysis logs and adds diagnostic if macOS version is unsupported",
+  async (t) =>
+    withTmpDir(async (tmpDir) => {
+      const logger = new RecordingLogger();
+      const env = getTestEnv();
+      env.set(ActionsEnvVars.RUNNER_TEMP, tmpDir);
+
+      const codeql = await getCodeQLWithTracedStub(
+        "codeql-for-testing",
+        logger,
+        env,
+      );
+      sinon.stub(codeql, "getVersion").resolves(makeVersionInfo("2.27.0"));
+
+      const addDiagnostic = sinon.stub(diagnostics, "addDiagnostic");
+
+      const config = createTestConfig({ languages: [BuiltInLanguage.swift] });
+      await checkRunnerSupportsTracedAnalysis(
+        initAllState({
+          logger,
+          platform: "darwin",
+          osRelease: "27.0.0",
+          env,
+        }),
+        config,
+        codeql,
+      );
+
+      checkExpectedLogMessages(t, logger.messages, [
+        "Traced analysis is not supported on macOS 27",
+      ]);
+
+      t.is(addDiagnostic.callCount, 1);
+      t.like(addDiagnostic.args[0], [
+        config,
+        BuiltInLanguage.swift,
+        {
+          attributes: {
+            languages: [BuiltInLanguage.swift],
+            macOSVersion: "27.0.0",
+          },
+          severity: "warning",
+          source: {
+            id: "codeql-action/unsupported-traced-analysis-macos",
+            name: "Traced analysis is not supported on this version of macOS",
+          },
+          visibility: {
+            cliSummaryTable: true,
+            statusPage: true,
+            telemetry: true,
+          },
+        } satisfies Partial<diagnostics.DiagnosticMessage>,
+      ]);
+    }),
+);
+
+// `addDiagnostic` changes global state and we must stub it, so this test must be serial.
+test.serial(
+  "checkRunnerSupportsTracedAnalysis throws if macOS version is unsupported and FF is enabled",
+  async (t) =>
+    withTmpDir(async (tmpDir) => {
+      const logger = new RecordingLogger();
+      const env = getTestEnv();
+      env.set(ActionsEnvVars.RUNNER_TEMP, tmpDir);
+
+      const features = createFeatures([Feature.SkipUnsupportedTracedAnalysis]);
+
+      const codeql = await getCodeQLWithTracedStub(
+        "codeql-for-testing",
+        logger,
+        env,
+      );
+      sinon.stub(codeql, "getVersion").resolves(makeVersionInfo("2.27.0"));
+
+      const addDiagnostic = sinon.stub(diagnostics, "addDiagnostic");
+
+      const config = createTestConfig({ languages: [BuiltInLanguage.swift] });
+      await t.throwsAsync(
+        checkRunnerSupportsTracedAnalysis(
+          initAllState({
+            logger,
+            platform: "darwin",
+            osRelease: "27.0.0",
+            env,
+            features,
+          }),
+          config,
+          codeql,
+        ),
+      );
+
+      t.is(addDiagnostic.callCount, 1);
+      t.like(addDiagnostic.args[0], [
+        config,
+        BuiltInLanguage.swift,
+        {
+          attributes: {
+            languages: [BuiltInLanguage.swift],
+            macOSVersion: "27.0.0",
+          },
+          severity: "error",
+          source: {
+            id: "codeql-action/unsupported-traced-analysis-macos",
+            name: "Traced analysis is not supported on this version of macOS",
+          },
+          visibility: {
+            cliSummaryTable: true,
+            statusPage: true,
+            telemetry: true,
+          },
+        } satisfies Partial<diagnostics.DiagnosticMessage>,
+      ]);
+    }),
+);
+
+// `addDiagnostic` changes global state and we must stub it, so this test must be serial.
+test.serial(
+  "checkRunnerSupportsTracedAnalysis doesn't add a diagnostic if Xcode version is supported",
+  async (t) =>
+    withTmpDir(async (tmpDir) => {
+      const logger = new RecordingLogger();
+      const env = getTestEnv();
+      env.set(ActionsEnvVars.RUNNER_TEMP, tmpDir);
+
+      const lstatSync = sinon
+        .stub(fs, "lstatSync")
+        .returns({ isSymbolicLink: () => true } as fs.Stats);
+      const readlinkSync = sinon
+        .stub(fs, "readlinkSync")
+        .returns("/Applications/Xcode_26.0.app/Contents/Developer");
+
+      const codeql = await getCodeQLWithTracedStub(
+        "codeql-for-testing",
+        logger,
+        env,
+      );
+      sinon.stub(codeql, "getVersion").resolves(makeVersionInfo("2.27.0"));
+
+      const addDiagnostic = sinon.stub(diagnostics, "addDiagnostic");
+
+      const config = createTestConfig({ languages: [BuiltInLanguage.swift] });
+      await checkRunnerSupportsTracedAnalysis(
+        initAllState({
+          logger,
+          platform: "darwin",
+          osRelease: "26.0.0",
+          env,
+        }),
+        config,
+        codeql,
+      );
+
+      t.is(lstatSync.callCount, 1);
+      t.deepEqual(lstatSync.args[0], [
+        XCODE_SELECT_LINK_PATH,
+        { throwIfNoEntry: false },
+      ]);
+      t.is(readlinkSync.callCount, 1);
+      t.deepEqual(readlinkSync.args[0], [XCODE_SELECT_LINK_PATH]);
+
+      checkUnexpectedLogMessages(t, logger.messages, [
+        "Traced analysis is not supported on Xcode 27",
+      ]);
+
+      t.is(addDiagnostic.callCount, 0);
+    }),
+);
+
+// `addDiagnostic` changes global state and we must stub it, so this test must be serial.
+test.serial(
+  "checkRunnerSupportsTracedAnalysis logs and adds diagnostic if Xcode version is unsupported",
+  async (t) =>
+    withTmpDir(async (tmpDir) => {
+      const logger = new RecordingLogger();
+      const env = getTestEnv();
+      env.set(ActionsEnvVars.RUNNER_TEMP, tmpDir);
+
+      const lstatSync = sinon
+        .stub(fs, "lstatSync")
+        .returns({ isSymbolicLink: () => true } as fs.Stats);
+      const readlinkSync = sinon
+        .stub(fs, "readlinkSync")
+        .returns("/Applications/Xcode_27.0.app/Contents/Developer");
+
+      const codeql = await getCodeQLWithTracedStub(
+        "codeql-for-testing",
+        logger,
+        env,
+      );
+      sinon.stub(codeql, "getVersion").resolves(makeVersionInfo("2.27.0"));
+
+      const addDiagnostic = sinon.stub(diagnostics, "addDiagnostic");
+
+      const config = createTestConfig({ languages: [BuiltInLanguage.swift] });
+      await checkRunnerSupportsTracedAnalysis(
+        initAllState({
+          logger,
+          platform: "darwin",
+          osRelease: "26.0.0",
+          env,
+        }),
+        config,
+        codeql,
+      );
+
+      t.is(lstatSync.callCount, 1);
+      t.deepEqual(lstatSync.args[0], [
+        XCODE_SELECT_LINK_PATH,
+        { throwIfNoEntry: false },
+      ]);
+      t.is(readlinkSync.callCount, 1);
+      t.deepEqual(readlinkSync.args[0], [XCODE_SELECT_LINK_PATH]);
+
+      checkExpectedLogMessages(t, logger.messages, [
+        "Traced analysis is not supported on Xcode 27",
+      ]);
+
+      t.is(addDiagnostic.callCount, 1);
+      t.like(addDiagnostic.args[0], [
+        config,
+        BuiltInLanguage.swift,
+        {
+          attributes: {
+            languages: [BuiltInLanguage.swift],
+            xcodeVersion: "27.0.0",
+          },
+          severity: "warning",
+          source: {
+            id: "codeql-action/unsupported-traced-analysis-xcode",
+            name: "Traced analysis is not supported on this version of Xcode",
+          },
+          visibility: {
+            cliSummaryTable: true,
+            statusPage: true,
+            telemetry: true,
+          },
+        } satisfies Partial<diagnostics.DiagnosticMessage>,
+      ]);
+    }),
+);
+
+// `addDiagnostic` changes global state and we must stub it, so this test must be serial.
+test.serial(
+  "checkRunnerSupportsTracedAnalysis throws if Xcode version is unsupported and FF is enabled",
+  async (t) =>
+    withTmpDir(async (tmpDir) => {
+      const logger = new RecordingLogger();
+      const env = getTestEnv();
+      env.set(ActionsEnvVars.RUNNER_TEMP, tmpDir);
+
+      const lstatSync = sinon
+        .stub(fs, "lstatSync")
+        .returns({ isSymbolicLink: () => true } as fs.Stats);
+      const readlinkSync = sinon
+        .stub(fs, "readlinkSync")
+        .returns("/Applications/Xcode_27.0.app/Contents/Developer");
+
+      const features = createFeatures([Feature.SkipUnsupportedTracedAnalysis]);
+
+      const codeql = await getCodeQLWithTracedStub(
+        "codeql-for-testing",
+        logger,
+        env,
+      );
+      sinon.stub(codeql, "getVersion").resolves(makeVersionInfo("2.27.0"));
+
+      const addDiagnostic = sinon.stub(diagnostics, "addDiagnostic");
+
+      const config = createTestConfig({ languages: [BuiltInLanguage.swift] });
+      await t.throwsAsync(
+        checkRunnerSupportsTracedAnalysis(
+          initAllState({
+            logger,
+            platform: "darwin",
+            osRelease: "26.0.0",
+            env,
+            features,
+          }),
+          config,
+          codeql,
+        ),
+      );
+
+      t.is(lstatSync.callCount, 1);
+      t.deepEqual(lstatSync.args[0], [
+        XCODE_SELECT_LINK_PATH,
+        { throwIfNoEntry: false },
+      ]);
+      t.is(readlinkSync.callCount, 1);
+      t.deepEqual(readlinkSync.args[0], [XCODE_SELECT_LINK_PATH]);
+
+      t.is(addDiagnostic.callCount, 1);
+      t.like(addDiagnostic.args[0], [
+        config,
+        BuiltInLanguage.swift,
+        {
+          attributes: {
+            languages: [BuiltInLanguage.swift],
+            xcodeVersion: "27.0.0",
+          },
+          severity: "error",
+          source: {
+            id: "codeql-action/unsupported-traced-analysis-xcode",
+            name: "Traced analysis is not supported on this version of Xcode",
+          },
+          visibility: {
+            cliSummaryTable: true,
+            statusPage: true,
+            telemetry: true,
+          },
+        } satisfies Partial<diagnostics.DiagnosticMessage>,
+      ]);
+    }),
+);
diff --git a/src/languages/traced.ts b/src/languages/traced.ts
new file mode 100644
index 0000000000..0de35b589e
--- /dev/null
+++ b/src/languages/traced.ts
@@ -0,0 +1,171 @@
+import * as semver from "semver";
+
+import type { ActionState, Logger } from "../action-common";
+import type { CodeQL } from "../codeql";
+import type { ActionConfig } from "../config/action-config";
+import { addDiagnostic, makeDiagnostic } from "../diagnostics";
+import { DocUrl } from "../doc-url";
+import { Feature } from "../feature-flags";
+import { macOSVersion, xcodeVersion } from "../platform";
+import { ConfigurationError } from "../util";
+
+import { checkSwiftCompatibility } from "./swift";
+
+/** macOS 27 and above do not support traced extraction. */
+export const UNSUPPORTED_MACOS_FOR_TRACED = 27;
+
+/** Xcode 27 and above do not support traced extraction. */
+export const UNSUPPORTED_XCODE_FOR_TRACED = 27;
+
+/**
+ * Creates a diagnostic indicating that `version` of `product` is unsupported for traced  analysis.
+ * Depending on `skipUnsupportedTracedAnalysis`, this function then either throws a {@link ConfigurationError}
+ * or logs the problem as a warning.
+ *
+ * @param logger The logger to use.
+ * @param config The CodeQL Action configuration.
+ * @param skipUnsupportedTracedAnalysis Whether this is a fatal error.
+ * @param product The product that the version is unsupported of.
+ * @param version The unsupported version.
+ */
+function handleUnsupportedVersion(
+  logger: Logger,
+  config: ActionConfig<"languages" | "dbLocation" | "tempDir">,
+  skipUnsupportedTracedAnalysis: boolean,
+  product: "macOS" | "Xcode",
+  version: semver.SemVer,
+) {
+  const baseMessage = [
+    `Traced analysis is not supported on ${product} ${UNSUPPORTED_MACOS_FOR_TRACED} or above.`,
+    `Configure your analysis to run on macOS ${UNSUPPORTED_MACOS_FOR_TRACED - 1} or below`,
+    `and XCode ${UNSUPPORTED_XCODE_FOR_TRACED - 1} or below.`,
+  ].join(" ");
+
+  const attributeName = product === "macOS" ? "macOSVersion" : "xcodeVersion";
+
+  // Create a diagnostic that will show up on the TSP.
+  for (const language of config.languages) {
+    addDiagnostic(
+      config,
+      language,
+      makeDiagnostic(
+        `codeql-action/unsupported-traced-analysis-${product.toLowerCase()}`,
+        `Traced analysis is not supported on this version of ${product}`,
+        {
+          attributes: {
+            languages: config.languages,
+            [attributeName]: version.toString(),
+          },
+          markdownMessage: [
+            baseMessage,
+            `For more information, see [this announcement](${DocUrl.UNSUPPORTED_TRACED_ANALYSIS_MACOS27}).`,
+          ].join(" "),
+          severity: skipUnsupportedTracedAnalysis ? "error" : "warning",
+          visibility: {
+            cliSummaryTable: true,
+            statusPage: true,
+            telemetry: true,
+          },
+        },
+      ),
+    );
+  }
+
+  // Log messages generally don't render as markdown, so we include the URL verbatim there.
+  const logMessage = [
+    baseMessage,
+    `For more information, see ${DocUrl.UNSUPPORTED_TRACED_ANALYSIS_MACOS27}`,
+  ].join(" ");
+
+  // Throw an error to abort the analysis if the FF is enabled or log the message.
+  if (skipUnsupportedTracedAnalysis) {
+    // ConfigurationErrors are converted to the "aborted" status by the exception handler
+    // in `init-action.ts` that guards the call to `checkRunnerSupportsTracedAnalysis`.
+    throw new ConfigurationError(logMessage);
+  } else {
+    // This will also show up as a workflow annotation.
+    logger.warning(logMessage);
+  }
+}
+
+/**
+ * Decides whether {@link config} has any traced languages by looking for tracer
+ * configurations in the {@link codeql} CLI installation.
+ */
+export async function hasTracedLanguages(
+  config: ActionConfig<"languages">,
+  codeql: CodeQL,
+): Promise<boolean> {
+  for (const language of config.languages) {
+    if (await codeql.isTracedLanguage(language)) {
+      return true;
+    }
+  }
+
+  return false;
+}
+
+/**
+ * Determines whether we can run a traced analysis on the current runner.
+ *
+ * @throws {ConfigurationError} If traced analysis is not possible on the current runner.
+ */
+export async function checkRunnerSupportsTracedAnalysis(
+  action: ActionState<["Base", "Logger", "FeatureFlags"]>,
+  config: ActionConfig<"languages" | "dbLocation" | "tempDir">,
+  codeql: CodeQL,
+) {
+  // Try to get the macOS version.
+  const version = macOSVersion(action);
+
+  // Perform some initial, Swift-specific checks.
+  await checkSwiftCompatibility(config, codeql, version);
+
+  // `build-mode: none` doesn't use the tracer, so it is always supported.
+  if (config.buildMode !== undefined && config.buildMode === "none") {
+    return;
+  }
+
+  // If none of the languages are traced, then we can skip the compatibility checks below as well.
+  if (!(await hasTracedLanguages(config, codeql))) {
+    return;
+  }
+
+  const skipUnsupportedTracedAnalysis = await action.features.getValue(
+    Feature.SkipUnsupportedTracedAnalysis,
+  );
+  if (typeof version === "string") {
+    // If we got a string, we are on macOS but couldn't parse the version string.
+    action.logger.warning(
+      `Unable to determine version of macOS, got: ${version}`,
+    );
+  } else if (
+    version !== undefined &&
+    version.major >= UNSUPPORTED_MACOS_FOR_TRACED
+  ) {
+    handleUnsupportedVersion(
+      action.logger,
+      config,
+      skipUnsupportedTracedAnalysis,
+      "macOS",
+      version,
+    );
+  }
+
+  // Determining whether the Xcode version is supported only makes sense on macOS, so we only do it
+  // after determining that we are running on macOS.
+  const xcodeVer = xcodeVersion(action.logger);
+
+  if (
+    xcodeVer !== undefined &&
+    xcodeVer.major >= UNSUPPORTED_XCODE_FOR_TRACED
+  ) {
+    handleUnsupportedVersion(
+      action.logger,
+      config,
+      skipUnsupportedTracedAnalysis,
+      "Xcode",
+      xcodeVer,
+    );
+  }
+}
diff --git a/src/platform.test.ts b/src/platform.test.ts
index c8a6a7955d..6688f66af8 100644
--- a/src/platform.test.ts
+++ b/src/platform.test.ts
@@ -1,6 +1,23 @@
+import fs from "fs";
+
 import test from "ava";
+import * as sinon from "sinon";
+
+import {
+  BundlePlatform,
+  getBundlePlatform,
+  macOSVersion,
+  XCODE_SELECT_LINK_PATH,
+  xcodeVersion,
+} from "./platform";
+import {
+  checkExpectedLogMessages,
+  initAllState,
+  RecordingLogger,
+  setupTests,
+} from "./testing-utils";
 
-import { BundlePlatform, getBundlePlatform } from "./platform";
+setupTests(test);
 
 for (const [platform, arch, expected] of [
   ["linux", "x64", BundlePlatform.Linux64],
@@ -16,3 +33,221 @@ for (const [platform, arch, expected] of [
     t.is(getBundlePlatform(platform, arch), expected);
   });
 }
+
+const platforms: NodeJS.Platform[] = ["linux", "win32", "freebsd"];
+for (const platform of platforms) {
+  test(`macOSVersion returns undefined on ${platform}`, (t) => {
+    t.is(macOSVersion(initAllState({ platform })), undefined);
+  });
+}
+
+test("macOSVersion returns raw string if semver parsing fails", (t) => {
+  const invalidSemVer = "sealOS-2026";
+  t.is(
+    macOSVersion(
+      initAllState({ platform: "darwin", osRelease: invalidSemVer }),
+    ),
+    invalidSemVer,
+  );
+});
+
+test("macOSVersion returns semver if parsing succeeds", (t) => {
+  const validSemVer = "27.0.1";
+
+  const version = macOSVersion(
+    initAllState({ platform: "darwin", osRelease: validSemVer }),
+  );
+
+  // Check that `version` is not undefined and narrow the type; throws if undefined.
+  if (t.truthy(version)) {
+    // Check that it's also not just a string.
+    t.not(typeof version, "string");
+
+    // Should be an object with the expected properties.
+    t.is(typeof version, "object");
+    t.is(version["major"], 27);
+    t.is(version["minor"], 0);
+    t.is(version["patch"], 1);
+  }
+});
+
+test.serial("xcodeVersion returns undefined if symlink doesn't exist", (t) => {
+  const logger = new RecordingLogger();
+
+  const lstatSync = sinon.stub(fs, "lstatSync").returns(undefined);
+
+  t.is(xcodeVersion(logger), undefined);
+  t.is(lstatSync.callCount, 1);
+  t.deepEqual(lstatSync.args[0], [
+    XCODE_SELECT_LINK_PATH,
+    { throwIfNoEntry: false },
+  ]);
+
+  checkExpectedLogMessages(t, logger.messages, [
+    "Xcode is probably not installed.",
+  ]);
+});
+
+test.serial("xcodeVersion returns undefined if lstatSync throws", (t) => {
+  const logger = new RecordingLogger();
+
+  const lstatSync = sinon.stub(fs, "lstatSync").throws(new Error("ENOENT"));
+
+  t.is(xcodeVersion(logger), undefined);
+  t.is(lstatSync.callCount, 1);
+  t.deepEqual(lstatSync.args[0], [
+    XCODE_SELECT_LINK_PATH,
+    { throwIfNoEntry: false },
+  ]);
+
+  checkExpectedLogMessages(t, logger.messages, [
+    "Unable to determine Xcode version: ENOENT",
+  ]);
+});
+
+test.serial("xcodeVersion returns undefined if file is not a symlink", (t) => {
+  const logger = new RecordingLogger();
+
+  const lstatSync = sinon
+    .stub(fs, "lstatSync")
+    .returns({ isSymbolicLink: () => false } as fs.Stats);
+
+  t.is(xcodeVersion(logger), undefined);
+  t.is(lstatSync.callCount, 1);
+  t.deepEqual(lstatSync.args[0], [
+    XCODE_SELECT_LINK_PATH,
+    { throwIfNoEntry: false },
+  ]);
+
+  checkExpectedLogMessages(t, logger.messages, [
+    "exists, but is not a symbolic link",
+  ]);
+});
+
+test.serial(
+  "xcodeVersion returns undefined if resolving the symlink returns nothing",
+  (t) => {
+    const logger = new RecordingLogger();
+
+    const lstatSync = sinon
+      .stub(fs, "lstatSync")
+      .returns({ isSymbolicLink: () => true } as fs.Stats);
+    const readlinkSync = sinon.stub(fs, "readlinkSync").returns("");
+
+    t.is(xcodeVersion(logger), undefined);
+    t.is(lstatSync.callCount, 1);
+    t.deepEqual(lstatSync.args[0], [
+      XCODE_SELECT_LINK_PATH,
+      { throwIfNoEntry: false },
+    ]);
+    t.is(readlinkSync.callCount, 1);
+    t.deepEqual(readlinkSync.args[0], [XCODE_SELECT_LINK_PATH]);
+
+    checkExpectedLogMessages(t, logger.messages, [
+      "unexpectedly returned nothing",
+    ]);
+  },
+);
+
+test.serial(
+  "xcodeVersion returns undefined if resolved path doesn't include pattern",
+  (t) => {
+    const logger = new RecordingLogger();
+
+    const lstatSync = sinon
+      .stub(fs, "lstatSync")
+      .returns({ isSymbolicLink: () => true } as fs.Stats);
+    const readlinkSync = sinon
+      .stub(fs, "readlinkSync")
+      .returns("/Applications/Xcode.app/Contents/Developer");
+
+    t.is(xcodeVersion(logger), undefined);
+    t.is(lstatSync.callCount, 1);
+    t.deepEqual(lstatSync.args[0], [
+      XCODE_SELECT_LINK_PATH,
+      { throwIfNoEntry: false },
+    ]);
+    t.is(readlinkSync.callCount, 1);
+    t.deepEqual(readlinkSync.args[0], [XCODE_SELECT_LINK_PATH]);
+
+    checkExpectedLogMessages(t, logger.messages, [
+      "does not contain expected pattern",
+    ]);
+  },
+);
+
+test.serial("xcodeVersion returns undefined if match can't be parsed", (t) => {
+  const logger = new RecordingLogger();
+
+  const lstatSync = sinon
+    .stub(fs, "lstatSync")
+    .returns({ isSymbolicLink: () => true } as fs.Stats);
+  const readlinkSync = sinon
+    .stub(fs, "readlinkSync")
+    .returns("/Applications/Xcode_00.0.app/Contents/Developer");
+
+  t.is(xcodeVersion(logger), undefined);
+  t.is(lstatSync.callCount, 1);
+  t.deepEqual(lstatSync.args[0], [
+    XCODE_SELECT_LINK_PATH,
+    { throwIfNoEntry: false },
+  ]);
+  t.is(readlinkSync.callCount, 1);
+  t.deepEqual(readlinkSync.args[0], [XCODE_SELECT_LINK_PATH]);
+
+  checkExpectedLogMessages(t, logger.messages, [
+    "Couldn't parse '00.0' as a semantic version.",
+  ]);
+});
+
+test.serial("xcodeVersion returns version from resolved path", (t) => {
+  const logger = new RecordingLogger();
+
+  const lstatSync = sinon
+    .stub(fs, "lstatSync")
+    .returns({ isSymbolicLink: () => true } as fs.Stats);
+  const readlinkSync = sinon
+    .stub(fs, "readlinkSync")
+    .returns("/Applications/Xcode_16.4.app/Contents/Developer");
+
+  const result = xcodeVersion(logger);
+
+  if (t.truthy(result)) {
+    t.is(result.major, 16);
+    t.is(result.minor, 4);
+  }
+
+  t.is(lstatSync.callCount, 1);
+  t.deepEqual(lstatSync.args[0], [
+    XCODE_SELECT_LINK_PATH,
+    { throwIfNoEntry: false },
+  ]);
+  t.is(readlinkSync.callCount, 1);
+  t.deepEqual(readlinkSync.args[0], [XCODE_SELECT_LINK_PATH]);
+});
+
+test.serial("xcodeVersion returns major version from resolved path", (t) => {
+  const logger = new RecordingLogger();
+
+  const lstatSync = sinon
+    .stub(fs, "lstatSync")
+    .returns({ isSymbolicLink: () => true } as fs.Stats);
+  const readlinkSync = sinon
+    .stub(fs, "readlinkSync")
+    .returns("/Applications/Xcode_16.app/Contents/Developer");
+
+  const result = xcodeVersion(logger);
+
+  if (t.truthy(result)) {
+    t.is(result.major, 16);
+    t.is(result.minor, 0);
+  }
+
+  t.is(lstatSync.callCount, 1);
+  t.deepEqual(lstatSync.args[0], [
+    XCODE_SELECT_LINK_PATH,
+    { throwIfNoEntry: false },
+  ]);
+  t.is(readlinkSync.callCount, 1);
+  t.deepEqual(readlinkSync.args[0], [XCODE_SELECT_LINK_PATH]);
+});
diff --git a/src/platform.ts b/src/platform.ts
index 1cc085d6ab..9492dff192 100644
--- a/src/platform.ts
+++ b/src/platform.ts
@@ -1,3 +1,10 @@
+import fs from "fs";
+
+import * as semver from "semver";
+
+import type { ActionState, Logger } from "./action-common";
+import { getErrorMessage } from "./util";
+
 /** Platform identifiers used in CodeQL bundle asset names. */
 export enum BundlePlatform {
   Linux64 = "linux64",
@@ -24,3 +31,100 @@ export function getBundlePlatform(
       return undefined;
   }
 }
+
+/**
+ * Tries to determine the version of macOS.
+ *
+ * @returns
+ *  The version as either a semantic version object, the raw version string
+ *  if it is not a semantic version, or `undefined` if we are not on macOS.
+ */
+export function macOSVersion(
+  action: ActionState<["Base"]>,
+): semver.SemVer | string | undefined {
+  // Skip if we are not running on macOS.
+  if (action.platform !== "darwin") {
+    return undefined;
+  }
+
+  // Try to parse the OS version string.
+  const version = semver.parse(action.osRelease);
+
+  if (version === null) {
+    return action.osRelease;
+  }
+
+  return version;
+}
+
+/** The static path we check for a symbolic link to the (dynamic) Xcode location. */
+export const XCODE_SELECT_LINK_PATH = "/private/var/db/xcode_select_link";
+
+/** The pattern we expect to find in the Xcode path. */
+export const XCODE_APP_FILENAME_PATTERN = new RegExp(
+  /(?<filename>Xcode_(?<majorMinor>\d+(\.\d+)?)\.app)/,
+);
+
+/**
+ * Tries to determine the version of Xcode that is installed.
+ *
+ * @param logger The logger to use.
+ * @returns The Xcode version or `undefined` if it couldn't be determined.
+ */
+export function xcodeVersion(logger: Logger): semver.SemVer | undefined {
+  try {
+    // Stat the expected symbolic link to check that it exists and is a symbolic link.
+    // The `readlinkSync` call below returns an empty string in either case and so
+    // this check allows us to distinguish between the two cases.
+    const stats = fs.lstatSync(XCODE_SELECT_LINK_PATH, {
+      throwIfNoEntry: false,
+    });
+
+    if (stats === undefined) {
+      logger.debug(
+        `'${XCODE_SELECT_LINK_PATH}' does not exist. Xcode is probably not installed.`,
+      );
+      return undefined;
+    }
+    if (!stats.isSymbolicLink()) {
+      logger.warning(
+        `${XCODE_SELECT_LINK_PATH} exists, but is not a symbolic link.`,
+      );
+      return undefined;
+    }
+
+    // Read what the symbolic link points to.
+    const xcodePath = fs.readlinkSync(XCODE_SELECT_LINK_PATH);
+
+    if (xcodePath === "") {
+      logger.warning(
+        `Resolving ${XCODE_SELECT_LINK_PATH} unexpectedly returned nothing.`,
+      );
+      return undefined;
+    }
+
+    // Try to extract the version from the path.
+    const matchResult = xcodePath.match(XCODE_APP_FILENAME_PATTERN);
+
+    if (matchResult?.groups === undefined) {
+      logger.warning(
+        `Xcode path '${xcodePath}' does not contain expected pattern.`,
+      );
+      return undefined;
+    }
+
+    const majorMinor = matchResult.groups["majorMinor"];
+    const version = semver.coerce(majorMinor);
+
+    if (version === null) {
+      logger.warning(`Couldn't parse '${majorMinor}' as a semantic version.`);
+      return undefined;
+    }
+    return version;
+  } catch (err) {
+    logger.warning(
+      `Unable to determine Xcode version: ${getErrorMessage(err)}`,
+    );
+    return undefined;
+  }
+}
diff --git a/src/testing-utils.ts b/src/testing-utils.ts
index 04b1330dbf..2b8e634e9d 100644
--- a/src/testing-utils.ts
+++ b/src/testing-utils.ts
@@ -1,4 +1,5 @@
 import { TextDecoder } from "node:util";
+import * as os from "os";
 import path from "path";
 
 import * as github from "@actions/github";
@@ -34,6 +35,7 @@ import { joinMessageStrings, Loggable, LoggableError, Logger } from "./logging";
 import { OverlayDatabaseMode } from "./overlay/overlay-database-mode";
 import { getBundlePlatform } from "./platform";
 import { ActionName } from "./status-report";
+import { ToolsFeature } from "./tools-features";
 import {
   DEFAULT_DEBUG_ARTIFACT_NAME,
   DEFAULT_DEBUG_DATABASE_NAME,
@@ -272,6 +274,7 @@ export function initAllState(
     startedAt: new Date(),
     platform: process.platform,
     arch: process.arch,
+    osRelease: os.release(),
     logger: new RecordingLogger(),
     env,
     actions: getTestActionsEnv(env),
@@ -911,7 +914,7 @@ export function mockLanguagesInRepo(languages: string[]) {
  */
 export const makeVersionInfo = (
   version: string,
-  features?: { [name: string]: boolean },
+  features?: { [key in ToolsFeature]?: boolean },
   overlayVersion?: number,
 ): VersionInfo => ({
   version,
@@ -1052,6 +1055,7 @@ export function makeTestToken(length: number = 36) {
 export async function getCodeQLForTesting(
   cmd = "codeql-for-testing",
   logger: Logger = new RecordingLogger(),
+  env: Env = getEnv(),
 ): Promise<codeql.CodeQL> {
-  return codeql.getCodeQLForCmd(logger, cmd, false);
+  return codeql.getCodeQLForCmd(logger, cmd, false, env);
 }
diff --git a/src/tools-features.ts b/src/tools-features.ts
index 35e626c887..84dc1d0f44 100644
--- a/src/tools-features.ts
+++ b/src/tools-features.ts
@@ -6,6 +6,7 @@ export enum ToolsFeature {
   BundleSupportsOverlay = "bundleSupportsOverlay",
   IndirectTracingSupportsStaticBinaries = "indirectTracingSupportsStaticBinaries",
   SuppressesMissingFileBaselineWarning = "suppressesMissingFileBaselineWarning",
+  SwiftSupportsAllPlatforms = "swiftSupportsAllPlatforms",
 }
 
 /**