From b63386c3d837cbc23d61b46863530ff01b622ada Mon Sep 17 00:00:00 2001
From: "Michael B. Gale" <mbg@github.com>
Date: Mon, 26 Oct 2026 12:48:51 +0000
Subject: [PATCH 01/13] Update `setup-kotlin` to the latest version

---
 .github/actions/prepare-test/action.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/actions/prepare-test/action.yml b/.github/actions/prepare-test/action.yml
index 5e2b5028f7..4eb840d2d8 100644
--- a/.github/actions/prepare-test/action.yml
+++ b/.github/actions/prepare-test/action.yml
@@ -6,11 +6,11 @@ inputs:
     required: true
   use-all-platform-bundle:
     description: "If true, we output a tools URL with codeql-bundle.tar.gz file rather than platform-specific URL"
-    default: 'false'
+    default: "false"
     required: false
   setup-kotlin:
     description: "If true, we setup kotlin"
-    default: 'true'
+    default: "true"
     required: true
 outputs:
   tools-url:
@@ -73,7 +73,7 @@ runs:
           exit 1
         fi
 
-    - uses: fwilhe2/setup-kotlin@9c245a6425255f5e98ba1ce6c15d31fce7eca9da
+    - uses: fwilhe2/setup-kotlin@b325539ca8f6e1d9ee04efed06f49bdbf5426dbb # v2.1
       if: ${{ inputs.setup-kotlin == 'true' }}
       with:
         version: 1.8.21

From b913bf6353dc29e7f1ab45d4de642092f88d5410 Mon Sep 17 00:00:00 2001
From: "Michael B. Gale" <mbg@github.com>
Date: Mon, 26 Oct 2026 12:51:54 +0000
Subject: [PATCH 02/13] Point Dependabot at subdirectories in `.github/actions`

---
 .github/dependabot.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 0e0dd0cce1..ae4a4476e4 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -26,7 +26,7 @@ updates:
   - package-ecosystem: github-actions
     directories:
       - "/.github/workflows"
-      - "/.github/actions"
+      - "/.github/actions/*/"
     schedule:
       interval: weekly
     cooldown:

From ce7d3f77388f81bd5b1be6172533542b055f88de Mon Sep 17 00:00:00 2001
From: "Michael B. Gale" <mbg@github.com>
Date: Mon, 26 Oct 2026 13:04:50 +0000
Subject: [PATCH 03/13] Install newer Kotlin version

---
 .github/actions/prepare-test/action.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/actions/prepare-test/action.yml b/.github/actions/prepare-test/action.yml
index 4eb840d2d8..e2a55a24e4 100644
--- a/.github/actions/prepare-test/action.yml
+++ b/.github/actions/prepare-test/action.yml
@@ -76,4 +76,4 @@ runs:
     - uses: fwilhe2/setup-kotlin@b325539ca8f6e1d9ee04efed06f49bdbf5426dbb # v2.1
       if: ${{ inputs.setup-kotlin == 'true' }}
       with:
-        version: 1.8.21
+        version: 2.1.20

From dd68f130c6e73ecc739579bdc27ccfae957da78a Mon Sep 17 00:00:00 2001
From: "Michael B. Gale" <mbg@github.com>
Date: Mon, 26 Oct 2026 13:10:50 +0000
Subject: [PATCH 04/13] Install a newer Ruby version

---
 .github/workflows/__rubocop-multi-language.yml | 3 ++-
 pr-checks/checks/rubocop-multi-language.yml    | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/__rubocop-multi-language.yml b/.github/workflows/__rubocop-multi-language.yml
index c3348db6cf..f2c1c3e401 100644
--- a/.github/workflows/__rubocop-multi-language.yml
+++ b/.github/workflows/__rubocop-multi-language.yml
@@ -56,7 +56,8 @@ jobs:
       - name: Set up Ruby
         uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
         with:
-          ruby-version: 2.6
+          ruby-version: 3.4
+
       - name: Install Code Scanning integration
         run: bundle add code-scanning-rubocop --version 0.3.0 --skip-install
       - name: Install dependencies
diff --git a/pr-checks/checks/rubocop-multi-language.yml b/pr-checks/checks/rubocop-multi-language.yml
index eec3aa8335..cc0e493a80 100644
--- a/pr-checks/checks/rubocop-multi-language.yml
+++ b/pr-checks/checks/rubocop-multi-language.yml
@@ -7,7 +7,8 @@ steps:
   - name: Set up Ruby
     uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
     with:
-      ruby-version: 2.6
+      ruby-version: 3.4
+
   - name: Install Code Scanning integration
     run: bundle add code-scanning-rubocop --version 0.3.0 --skip-install
   - name: Install dependencies

From eac0005d0c1946432e5427f1fa0eb3abfccb84ee Mon Sep 17 00:00:00 2001
From: "Michael B. Gale" <mbg@github.com>
Date: Mon, 26 Oct 2026 13:15:15 +0000
Subject: [PATCH 05/13] Temporarily switch old CLI checks to older Ubuntu
 runner

---
 .github/workflows/__go-tracing-autobuilder.yml |  2 +-
 .../__go-tracing-custom-build-steps.yml        |  2 +-
 .../workflows/__go-tracing-legacy-workflow.yml |  2 +-
 .../workflows/__multi-language-autodetect.yml  |  2 +-
 .github/workflows/__rust.yml                   |  2 +-
 .../workflows/debug-artifacts-failure-safe.yml | 18 +++++++++---------
 .github/workflows/debug-artifacts-safe.yml     | 18 +++++++++---------
 pr-checks/sync.ts                              | 12 ++++++++----
 8 files changed, 31 insertions(+), 27 deletions(-)

diff --git a/.github/workflows/__go-tracing-autobuilder.yml b/.github/workflows/__go-tracing-autobuilder.yml
index fb471c5eac..a36cc43a7b 100644
--- a/.github/workflows/__go-tracing-autobuilder.yml
+++ b/.github/workflows/__go-tracing-autobuilder.yml
@@ -44,7 +44,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-24.04
             version: stable-v2.20.7
           - os: ubuntu-latest
             version: stable-v2.21.4
diff --git a/.github/workflows/__go-tracing-custom-build-steps.yml b/.github/workflows/__go-tracing-custom-build-steps.yml
index b3b043def9..05fedfb035 100644
--- a/.github/workflows/__go-tracing-custom-build-steps.yml
+++ b/.github/workflows/__go-tracing-custom-build-steps.yml
@@ -44,7 +44,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-24.04
             version: stable-v2.20.7
           - os: ubuntu-latest
             version: stable-v2.21.4
diff --git a/.github/workflows/__go-tracing-legacy-workflow.yml b/.github/workflows/__go-tracing-legacy-workflow.yml
index 20bdea6955..276d4cfda5 100644
--- a/.github/workflows/__go-tracing-legacy-workflow.yml
+++ b/.github/workflows/__go-tracing-legacy-workflow.yml
@@ -44,7 +44,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-24.04
             version: stable-v2.20.7
           - os: ubuntu-latest
             version: stable-v2.21.4
diff --git a/.github/workflows/__multi-language-autodetect.yml b/.github/workflows/__multi-language-autodetect.yml
index a388e57342..d54b24a1ef 100644
--- a/.github/workflows/__multi-language-autodetect.yml
+++ b/.github/workflows/__multi-language-autodetect.yml
@@ -54,7 +54,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-24.04
             version: stable-v2.20.7
           - os: macos-15-xlarge
             version: stable-v2.20.7
diff --git a/.github/workflows/__rust.yml b/.github/workflows/__rust.yml
index f26b4eb2eb..d3b5a8a5b8 100644
--- a/.github/workflows/__rust.yml
+++ b/.github/workflows/__rust.yml
@@ -34,7 +34,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-24.04
             version: stable-v2.20.7
           - os: ubuntu-latest
             version: stable-v2.22.1
diff --git a/.github/workflows/debug-artifacts-failure-safe.yml b/.github/workflows/debug-artifacts-failure-safe.yml
index c61bd6b177..dd4e98797d 100644
--- a/.github/workflows/debug-artifacts-failure-safe.yml
+++ b/.github/workflows/debug-artifacts-failure-safe.yml
@@ -6,13 +6,13 @@ env:
 on:
   push:
     branches:
-    - main
-    - releases/v*
+      - main
+      - releases/v*
   pull_request:
   merge_group:
     types: [checks_requested]
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
 
 concurrency:
@@ -30,10 +30,10 @@ jobs:
       fail-fast: false
       matrix:
         version:
-        - stable-v2.20.7
-        - default
-        - linked
-        - nightly-latest
+          - stable-v2.20.7
+          - default
+          - linked
+          - nightly-latest
     name: Upload debug artifacts after failure in analyze
     continue-on-error: true
     env:
@@ -43,7 +43,7 @@ jobs:
       # We currently need `security-events: read` to access feature flags.
       security-events: read
     timeout-minutes: 45
-    runs-on: ubuntu-latest
+    runs-on: ${{ case(matrix.version == 'stable-v2.20.7', 'ubuntu-24.04', 'ubuntu-latest') }}
     steps:
       - name: Dump GitHub event
         run: cat "${GITHUB_EVENT_PATH}"
@@ -60,7 +60,7 @@ jobs:
       - name: Install .NET
         uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
-          dotnet-version: '9.x'
+          dotnet-version: "9.x"
       - name: Assert best-effort artifact scan completed
         uses: ./../action/.github/actions/verify-debug-artifact-scan-completed
       - uses: ./../action/init
diff --git a/.github/workflows/debug-artifacts-safe.yml b/.github/workflows/debug-artifacts-safe.yml
index 6d162d9c0c..1e723a45c0 100644
--- a/.github/workflows/debug-artifacts-safe.yml
+++ b/.github/workflows/debug-artifacts-safe.yml
@@ -5,13 +5,13 @@ env:
 on:
   push:
     branches:
-    - main
-    - releases/v*
+      - main
+      - releases/v*
   pull_request:
   merge_group:
     types: [checks_requested]
   schedule:
-    - cron: '0 5 * * *'
+    - cron: "0 5 * * *"
   workflow_dispatch:
 
 concurrency:
@@ -29,10 +29,10 @@ jobs:
       fail-fast: false
       matrix:
         version:
-        - stable-v2.20.7
-        - default
-        - linked
-        - nightly-latest
+          - stable-v2.20.7
+          - default
+          - linked
+          - nightly-latest
     name: Upload debug artifacts
     env:
       CODEQL_ACTION_TEST_MODE: true
@@ -41,7 +41,7 @@ jobs:
       contents: read
       # We currently need `security-events: read` to access feature flags.
       security-events: read
-    runs-on: ubuntu-latest
+    runs-on: ${{ case(matrix.version == 'stable-v2.20.7', 'ubuntu-24.04', 'ubuntu-latest') }}
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -56,7 +56,7 @@ jobs:
       - name: Install .NET
         uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
-          dotnet-version: '9.x'
+          dotnet-version: "9.x"
       - name: Assert best-effort artifact scan completed
         uses: ./../action/.github/actions/verify-debug-artifact-scan-completed
       - uses: ./../action/init
diff --git a/pr-checks/sync.ts b/pr-checks/sync.ts
index 1729f5409b..afbc7fc43d 100755
--- a/pr-checks/sync.ts
+++ b/pr-checks/sync.ts
@@ -442,10 +442,14 @@ function generateJobMatrix(
           : [operatingSystemConfig["runner-image"]];
 
       for (const runnerImage of runnerImagesForOs) {
-        matrix.push({
-          os: runnerImage,
-          version,
-        });
+        if (runnerImage === "ubuntu-latest" && version === "stable-v2.20.7") {
+          matrix.push({ os: "ubuntu-24.04", version });
+        } else {
+          matrix.push({
+            os: runnerImage,
+            version,
+          });
+        }
       }
     }
   }

From ab743b6301b244dcdfa64cde84442cc86b5ebf11 Mon Sep 17 00:00:00 2001
From: "Michael B. Gale" <mbg@github.com>
Date: Mon, 26 Oct 2026 13:29:56 +0000
Subject: [PATCH 06/13] Install newer version of `code-scanning-rubocop`

---
 .github/workflows/__rubocop-multi-language.yml | 5 ++++-
 pr-checks/checks/rubocop-multi-language.yml    | 5 ++++-
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/__rubocop-multi-language.yml b/.github/workflows/__rubocop-multi-language.yml
index f2c1c3e401..6128561335 100644
--- a/.github/workflows/__rubocop-multi-language.yml
+++ b/.github/workflows/__rubocop-multi-language.yml
@@ -59,15 +59,18 @@ jobs:
           ruby-version: 3.4
 
       - name: Install Code Scanning integration
-        run: bundle add code-scanning-rubocop --version 0.3.0 --skip-install
+        run: bundle add code-scanning-rubocop --version 0.6.1 --skip-install
+
       - name: Install dependencies
         run: bundle install
+
       - name: RuboCop run
         run: |
           bash -c "
             bundle exec rubocop --require code_scanning --format CodeScanning::SarifFormatter -o rubocop.sarif
             [[ $? -ne 2 ]]
           "
+
       - uses: ./../action/upload-sarif
         with:
           sarif_file: rubocop.sarif
diff --git a/pr-checks/checks/rubocop-multi-language.yml b/pr-checks/checks/rubocop-multi-language.yml
index cc0e493a80..0839d38b0b 100644
--- a/pr-checks/checks/rubocop-multi-language.yml
+++ b/pr-checks/checks/rubocop-multi-language.yml
@@ -10,15 +10,18 @@ steps:
       ruby-version: 3.4
 
   - name: Install Code Scanning integration
-    run: bundle add code-scanning-rubocop --version 0.3.0 --skip-install
+    run: bundle add code-scanning-rubocop --version 0.6.1 --skip-install
+
   - name: Install dependencies
     run: bundle install
+
   - name: RuboCop run
     run: |
       bash -c "
         bundle exec rubocop --require code_scanning --format CodeScanning::SarifFormatter -o rubocop.sarif
         [[ $? -ne 2 ]]
       "
+
   - uses: ./../action/upload-sarif
     with:
       sarif_file: rubocop.sarif

From 171607b66f68b1dc4e7dc4358bdf3ad2b4009abb Mon Sep 17 00:00:00 2001
From: "Michael B. Gale" <mbg@github.com>
Date: Mon, 26 Oct 2026 13:45:49 +0000
Subject: [PATCH 07/13] Remove Rubocop workflow

---
 .../workflows/__rubocop-multi-language.yml    | 78 -------------------
 pr-checks/checks/rubocop-multi-language.yml   | 27 -------
 2 files changed, 105 deletions(-)
 delete mode 100644 .github/workflows/__rubocop-multi-language.yml
 delete mode 100644 pr-checks/checks/rubocop-multi-language.yml

diff --git a/.github/workflows/__rubocop-multi-language.yml b/.github/workflows/__rubocop-multi-language.yml
deleted file mode 100644
index 6128561335..0000000000
--- a/.github/workflows/__rubocop-multi-language.yml
+++ /dev/null
@@ -1,78 +0,0 @@
-# Warning: This file is generated automatically, and should not be modified.
-# Instead, please modify the template in the pr-checks directory and run:
-#     pr-checks/sync.sh
-# to regenerate this file.
-
-name: PR Check - RuboCop multi-language
-env:
-  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-  GO111MODULE: auto
-on:
-  push:
-    branches:
-      - main
-      - releases/v*
-  pull_request: {}
-  merge_group:
-    types:
-      - checks_requested
-  schedule:
-    - cron: '0 5 * * *'
-  workflow_dispatch:
-    inputs: {}
-  workflow_call:
-    inputs: {}
-defaults:
-  run:
-    shell: bash
-concurrency:
-  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
-  group: rubocop-multi-language-${{github.ref}}
-jobs:
-  rubocop-multi-language:
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - os: ubuntu-latest
-            version: default
-    name: RuboCop multi-language
-    if: github.triggering_actor != 'dependabot[bot]'
-    permissions:
-      contents: read
-      security-events: read
-    timeout-minutes: 45
-    runs-on: ${{ matrix.os }}
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Prepare test
-        id: prepare-test
-        uses: ./.github/actions/prepare-test
-        with:
-          version: ${{ matrix.version }}
-          use-all-platform-bundle: 'false'
-          setup-kotlin: 'true'
-      - name: Set up Ruby
-        uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
-        with:
-          ruby-version: 3.4
-
-      - name: Install Code Scanning integration
-        run: bundle add code-scanning-rubocop --version 0.6.1 --skip-install
-
-      - name: Install dependencies
-        run: bundle install
-
-      - name: RuboCop run
-        run: |
-          bash -c "
-            bundle exec rubocop --require code_scanning --format CodeScanning::SarifFormatter -o rubocop.sarif
-            [[ $? -ne 2 ]]
-          "
-
-      - uses: ./../action/upload-sarif
-        with:
-          sarif_file: rubocop.sarif
-    env:
-      CODEQL_ACTION_TEST_MODE: true
diff --git a/pr-checks/checks/rubocop-multi-language.yml b/pr-checks/checks/rubocop-multi-language.yml
deleted file mode 100644
index 0839d38b0b..0000000000
--- a/pr-checks/checks/rubocop-multi-language.yml
+++ /dev/null
@@ -1,27 +0,0 @@
-name: "RuboCop multi-language"
-description: "Tests using RuboCop to analyze a multi-language repository and then using the CodeQL Action to upload the resulting SARIF"
-# This check doesn't use CodeQL, so the `version` matrix variable is unused.
-versions:
-  - default
-steps:
-  - name: Set up Ruby
-    uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
-    with:
-      ruby-version: 3.4
-
-  - name: Install Code Scanning integration
-    run: bundle add code-scanning-rubocop --version 0.6.1 --skip-install
-
-  - name: Install dependencies
-    run: bundle install
-
-  - name: RuboCop run
-    run: |
-      bash -c "
-        bundle exec rubocop --require code_scanning --format CodeScanning::SarifFormatter -o rubocop.sarif
-        [[ $? -ne 2 ]]
-      "
-
-  - uses: ./../action/upload-sarif
-    with:
-      sarif_file: rubocop.sarif

From 34b4917832d4628b18fa4a53cb09fec2677d4207 Mon Sep 17 00:00:00 2001
From: "Michael B. Gale" <mbg@github.com>
Date: Mon, 26 Oct 2026 14:26:53 +0000
Subject: [PATCH 08/13] Add comment to `sync.ts`

---
 pr-checks/sync.ts | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pr-checks/sync.ts b/pr-checks/sync.ts
index afbc7fc43d..25b4623587 100755
--- a/pr-checks/sync.ts
+++ b/pr-checks/sync.ts
@@ -442,6 +442,9 @@ function generateJobMatrix(
           : [operatingSystemConfig["runner-image"]];
 
       for (const runnerImage of runnerImagesForOs) {
+        // stable-v2.20.7 requires an older version of Java than the default on `ubuntu-latest`.
+        // We could install that older version on the newer runners, or use the older runner.
+        // We do the latter here. This can be removed once we stop supporting `v2.20.7`.
         if (runnerImage === "ubuntu-latest" && version === "stable-v2.20.7") {
           matrix.push({ os: "ubuntu-24.04", version });
         } else {

From 63b184d4bcdf843072170158e7f3902930d3a50d Mon Sep 17 00:00:00 2001
From: "Michael B. Gale" <mbg@github.com>
Date: Mon, 26 Oct 2026 14:33:26 +0000
Subject: [PATCH 09/13] Improve `sync.ts` version typing so that check constant
 becomes an error once removed

---
 pr-checks/sync.ts | 21 +++++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

diff --git a/pr-checks/sync.ts b/pr-checks/sync.ts
index 25b4623587..7824ef890b 100755
--- a/pr-checks/sync.ts
+++ b/pr-checks/sync.ts
@@ -137,6 +137,14 @@ interface LanguageSetup {
 /** Describes partial mappings from built-in languages to their specific setup information. */
 type LanguageSetups = Partial<Record<BuiltInLanguage, LanguageSetup>>;
 
+// A type representing version identifiers.
+type Version =
+  | "default"
+  | "linked"
+  | "nightly-latest"
+  // This is an approximation, but sufficient validation for our needs here.
+  | `stable-v${number}.${number}.${number}`;
+
 // The default set of CodeQL Bundle versions to use for the PR checks.
 const defaultTestVersions = [
   // The oldest supported CodeQL version. If bumping, update `CODEQL_MINIMUM_VERSION` in `codeql.ts`
@@ -159,7 +167,10 @@ const defaultTestVersions = [
   "linked",
   // A nightly build directly from the our private repo, built in the last 24 hours.
   "nightly-latest",
-];
+] as const satisfies Version[];
+
+/** A type representing the default test versions. */
+type DefaultTestVersion = (typeof defaultTestVersions)[number];
 
 /** The default versions we use for languages / frameworks, if not specified as a workflow input. */
 const defaultLanguageVersions = {
@@ -445,7 +456,13 @@ function generateJobMatrix(
         // stable-v2.20.7 requires an older version of Java than the default on `ubuntu-latest`.
         // We could install that older version on the newer runners, or use the older runner.
         // We do the latter here. This can be removed once we stop supporting `v2.20.7`.
-        if (runnerImage === "ubuntu-latest" && version === "stable-v2.20.7") {
+        // Since this is typed as `DefaultTestVersion`, it will become an error once `stable-v2.20.7`
+        // is removed from `defaultTestVersions`.
+        const requiresOlderRunnerImage: DefaultTestVersion = "stable-v2.20.7";
+        if (
+          runnerImage === "ubuntu-latest" &&
+          version === requiresOlderRunnerImage
+        ) {
           matrix.push({ os: "ubuntu-24.04", version });
         } else {
           matrix.push({

From 8fb8b475a9e826e5dafd0d7d8e4623b75d23364e Mon Sep 17 00:00:00 2001
From: "Michael B. Gale" <mbg@github.com>
Date: Tue, 27 Oct 2026 10:20:12 +0000
Subject: [PATCH 10/13] Consistently use JSDocs in `sync.ts`

---
 pr-checks/sync.ts | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/pr-checks/sync.ts b/pr-checks/sync.ts
index 7824ef890b..c205e94a72 100755
--- a/pr-checks/sync.ts
+++ b/pr-checks/sync.ts
@@ -137,7 +137,7 @@ interface LanguageSetup {
 /** Describes partial mappings from built-in languages to their specific setup information. */
 type LanguageSetups = Partial<Record<BuiltInLanguage, LanguageSetup>>;
 
-// A type representing version identifiers.
+/** A type representing version identifiers. */
 type Version =
   | "default"
   | "linked"
@@ -145,7 +145,7 @@ type Version =
   // This is an approximation, but sufficient validation for our needs here.
   | `stable-v${number}.${number}.${number}`;
 
-// The default set of CodeQL Bundle versions to use for the PR checks.
+/** The default set of CodeQL Bundle versions to use for the PR checks. */
 const defaultTestVersions = [
   // The oldest supported CodeQL version. If bumping, update `CODEQL_MINIMUM_VERSION` in `codeql.ts`
   "stable-v2.20.7",
@@ -324,9 +324,11 @@ const languageSetups: LanguageSetups = {
   },
 };
 
-// This is essentially an arbitrary version of `yq`, which happened to be the one that
-// `choco` fetched when we moved away from using that here.
-// See https://github.com/github/codeql-action/pull/3423
+/**
+ * This is essentially an arbitrary version of `yq`, which happened to be the one that
+ * `choco` fetched when we moved away from using that here.
+ * See https://github.com/github/codeql-action/pull/3423
+ */
 const YQ_VERSION = "v4.50.1";
 
 const CHECKS_DIR = path.join(PR_CHECKS_DIR, "checks");

From 0b8f4560ec77a80d118a37596c7573e5dbd0a20b Mon Sep 17 00:00:00 2001
From: "Michael B. Gale" <mbg@github.com>
Date: Tue, 27 Oct 2026 10:23:02 +0000
Subject: [PATCH 11/13] Add comment for the Kotlin version

---
 .github/actions/prepare-test/action.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/actions/prepare-test/action.yml b/.github/actions/prepare-test/action.yml
index e2a55a24e4..4c11ec4929 100644
--- a/.github/actions/prepare-test/action.yml
+++ b/.github/actions/prepare-test/action.yml
@@ -76,4 +76,7 @@ runs:
     - uses: fwilhe2/setup-kotlin@b325539ca8f6e1d9ee04efed06f49bdbf5426dbb # v2.1
       if: ${{ inputs.setup-kotlin == 'true' }}
       with:
+        # Kotlin is installed on the runners by default, but the version that is pre-installed is too new
+        # to be supported by CodeQL. This Kotlin version is selected to be compatible with both the default Java
+        # version on the `ubuntu-latest` runners and CodeQL.
         version: 2.1.20

From bcc1fbe153f97bb8a2de9b8a418983821c22a678 Mon Sep 17 00:00:00 2001
From: "Michael B. Gale" <mbg@github.com>
Date: Tue, 27 Oct 2026 11:18:33 +0000
Subject: [PATCH 12/13] Add comment to `debug-artifacts` workflows

---
 .github/workflows/debug-artifacts-failure-safe.yml | 5 +++++
 .github/workflows/debug-artifacts-safe.yml         | 5 +++++
 2 files changed, 10 insertions(+)

diff --git a/.github/workflows/debug-artifacts-failure-safe.yml b/.github/workflows/debug-artifacts-failure-safe.yml
index dd4e98797d..4f9082acd2 100644
--- a/.github/workflows/debug-artifacts-failure-safe.yml
+++ b/.github/workflows/debug-artifacts-failure-safe.yml
@@ -43,7 +43,12 @@ jobs:
       # We currently need `security-events: read` to access feature flags.
       security-events: read
     timeout-minutes: 45
+
+    # stable-v2.20.7 requires an older version of Java than the default on `ubuntu-latest` (`ubuntu-26.04`).
+    # We could install that older version on the newer runners, or use the older runner.
+    # We do the latter here. This can be removed once we stop supporting `v2.20.7`.
     runs-on: ${{ case(matrix.version == 'stable-v2.20.7', 'ubuntu-24.04', 'ubuntu-latest') }}
+
     steps:
       - name: Dump GitHub event
         run: cat "${GITHUB_EVENT_PATH}"
diff --git a/.github/workflows/debug-artifacts-safe.yml b/.github/workflows/debug-artifacts-safe.yml
index 1e723a45c0..610e1aab8a 100644
--- a/.github/workflows/debug-artifacts-safe.yml
+++ b/.github/workflows/debug-artifacts-safe.yml
@@ -41,7 +41,12 @@ jobs:
       contents: read
       # We currently need `security-events: read` to access feature flags.
       security-events: read
+
+    # stable-v2.20.7 requires an older version of Java than the default on `ubuntu-latest` (`ubuntu-26.04`).
+    # We could install that older version on the newer runners, or use the older runner.
+    # We do the latter here. This can be removed once we stop supporting `v2.20.7`.
     runs-on: ${{ case(matrix.version == 'stable-v2.20.7', 'ubuntu-24.04', 'ubuntu-latest') }}
+
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

From 2908c78a829e4056d419fed8aadbf64237c9023e Mon Sep 17 00:00:00 2001
From: "Michael B. Gale" <mbg@github.com>
Date: Tue, 27 Oct 2026 11:19:11 +0000
Subject: [PATCH 13/13] Remove Rubocop from deflake workflow

---
 .github/workflows/deflake.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/deflake.yml b/.github/workflows/deflake.yml
index 158dc6c96d..27024b3780 100644
--- a/.github/workflows/deflake.yml
+++ b/.github/workflows/deflake.yml
@@ -60,7 +60,6 @@ on:
       - "PR Check - Proxy test"
       - "PR Check - Remote config file"
       - "PR Check - Resolve environment"
-      - "PR Check - RuboCop multi-language"
       - "PR Check - Ruby analysis"
       - "PR Check - Rust analysis"
       - "PR Check - Split workflow"