GeezerVison

Recognize the linux/arm64 platform so the CodeQL CLI is accepted on
Arm64 Linux runners and the native per-platform bundle
codeql-bundle-linux-arm64.tar.zst is resolved, rather than falling
through to the combined all-platforms gzip fallback (which deliberately
omits arm64).

Add ["linux", "arm64"] to the supported platforms and make the linux
bundle name arch-aware. Keep the download mock faithful and cover the
new arch branch with tests.

Co-authored-by: Copilot App <[email protected]>

- Add darwin/x64 case to linked bundle tests and disambiguate the
  parametrized test title by platform/arch
- Reword CHANGELOG entry to clarify the CLI supports Linux Arm64
- Add a dedicated Linux Arm64 end-to-end PR check on ubuntu-24.04-arm

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: 308c78bb-53a3-4877-a373-70fab87543f1

…support

Bumps [@octokit/types](https://github.com/octokit/types.ts) from 16.0.0 to 17.0.0.
- [Release notes](https://github.com/octokit/types.ts/releases)
- [Commits](octokit/types.ts@v16.0.0...v17.0.0)

---
updated-dependencies:
- dependency-name: "@octokit/types"
  dependency-version: 17.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>

As well as fixup a few other problems.

…utput-cache`

This makes it easier to test. Credit to @mbg.

…support

The streaming path reported no timings at all, so we have no data for the
path that most runs take. It now reports a total duration, which is also
populated on the download-then-extract path.

That path additionally reports the extraction duration, which was
previously computed but only logged.

`downloadDurationMs` keeps its existing meaning of time spent downloading
alone, so existing telemetry stays comparable.

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: 628ce334-991a-4578-9c1b-93d2e96bbddb

Surface `tools_extraction_duration_ms` and `tools_total_duration_ms` from
both the `init` and `setup-codeql` actions.

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: 628ce334-991a-4578-9c1b-93d2e96bbddb

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: 628ce334-991a-4578-9c1b-93d2e96bbddb

…to redsun82-linux-arm64-support

Release, mergeback, and backport PRs must be merged with a merge commit
so the branch linkage the release automation depends on is preserved
(the mergeback tags the release using the merge commit of the
"Merge main into releases/vN" PR, so squashing or rebasing breaks
tagging).

Add a path-scoped Copilot instructions file scoped to the files that
reliably change in these PRs (CHANGELOG.md, src/defaults.json,
lib/defaults.json, src/api-compatibility.json), and add an explicit note
to the Releasing runbook in CONTRIBUTING.md so the rule is enforced
regardless of who merges.

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: 0dae6e42-7fc6-4fb1-b1ea-15dc17e402a2

…etry

Improve CodeQL tools download time telemetry

Mergeback v4.37.9 refs/heads/releases/v4 into main

Bumps [actions/setup-java](https://github.com/actions/setup-java) from 5.7.0 to 6.0.0.
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](actions/setup-java@b6effb0...dd06d9c)

---
updated-dependencies:
- dependency-name: actions/setup-java
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>

Bumps the npm-minor group with 2 updates in the / directory: [js-yaml](https://github.com/nodeca/js-yaml) and [uuid](https://github.com/uuidjs/uuid).


Updates `js-yaml` from 5.2.3 to 5.3.0
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@5.2.3...5.3.0)

Updates `uuid` from 14.0.1 to 14.0.2
- [Release notes](https://github.com/uuidjs/uuid/releases)
- [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md)
- [Commits](uuidjs/uuid@v14.0.1...v14.0.2)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 5.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor
- dependency-name: uuid
  dependency-version: 14.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor
...

Signed-off-by: dependabot[bot] <[email protected]>

Run the cleanup even when the download will not be cached in the toolcache, since the toolcache shares a filesystem with the directory we extract to, so freeing it helps either way, and report an error other than the toolcache being absent as a failure rather than as an empty toolcache.

Co-authored-by: Copilot App <[email protected]>

Some runner images keep the toolcache on a different volume to the workspace, so deleting the tools there frees up disk space that the analysis cannot use, and costs a later step that wanted them in the toolcache a download. Windows runners are laid out this way, with the toolcache on `C:` and the workspace on `D:`.

Co-authored-by: Copilot App <[email protected]>

Log a success line for each language database found in the Linux Arm64 PR check.

Co-authored-by: Copilot App <[email protected]>

Co-authored-by: Copilot App <[email protected]>

Co-authored-by: Copilot App <[email protected]>

Co-authored-by: Copilot App <[email protected]>

…load-flake

Don't upload the ESLint SARIF from merge queue refs

Analyze all supported languages in the Linux Arm64 check

Delete each version directory individually so that a symlinked one is skipped rather than removed, take an `ActionState` so the environment is read through `ReadOnlyEnv` rather than the deprecated `getOptionalEnvVar`, let `deleteToolcacheBundles` report its own failure to locate the toolcache instead of having the caller catch it, quote paths in log messages, and rename `HAS_OBTAINED_CODEQL_TOOLS` to `HAS_SET_UP_CODEQL`, which is also set when we find the tools in the toolcache rather than downloading them.

Co-authored-by: Copilot App <[email protected]>

Don't record an overlay status when the job was cancelled

…-bundle-cleanup

Co-authored-by: henrymercer <[email protected]>

Co-authored-by: Copilot App <[email protected]>

…anup

Delete unused CodeQL bundles from the toolcache before downloading

Update default bundle to 2.27.0

Co-authored-by: Copilot App <[email protected]>

Run slow macOS checks on larger runners