Mergeback v3.28.9 refs/heads/releases/v3 into main

Bumps the npm group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [long](https://github.com/dcodeIO/long.js) | `5.2.4` | `5.3.0` |
| [semver](https://github.com/npm/node-semver) | `7.7.0` | `7.7.1` |
| [@eslint/js](https://github.com/eslint/eslint/tree/HEAD/packages/js) | `9.19.0` | `9.20.0` |
| [eslint-plugin-github](https://github.com/github/eslint-plugin-github) | `5.1.7` | `5.1.8` |
| [nock](https://github.com/nock/nock) | `14.0.0` | `14.0.1` |


Updates `long` from 5.2.4 to 5.3.0
- [Release notes](https://github.com/dcodeIO/long.js/releases)
- [Commits](dcodeIO/long.js@v5.2.4...v5.3.0)

Updates `semver` from 7.7.0 to 7.7.1
- [Release notes](https://github.com/npm/node-semver/releases)
- [Changelog](https://github.com/npm/node-semver/blob/main/CHANGELOG.md)
- [Commits](npm/node-semver@v7.7.0...v7.7.1)

Updates `@eslint/js` from 9.19.0 to 9.20.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Changelog](https://github.com/eslint/eslint/blob/main/CHANGELOG.md)
- [Commits](https://github.com/eslint/eslint/commits/v9.20.0/packages/js)

Updates `eslint-plugin-github` from 5.1.7 to 5.1.8
- [Release notes](https://github.com/github/eslint-plugin-github/releases)
- [Commits](github/eslint-plugin-github@v5.1.7...v5.1.8)

Updates `nock` from 14.0.0 to 14.0.1
- [Release notes](https://github.com/nock/nock/releases)
- [Changelog](https://github.com/nock/nock/blob/main/CHANGELOG.md)
- [Commits](nock/nock@v14.0.0...v14.0.1)

---
updated-dependencies:
- dependency-name: long
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: semver
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@eslint/js"
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: eslint-plugin-github
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: nock
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
...

Signed-off-by: dependabot[bot] <support@github.com>

Bumps the actions group with 2 updates: [ruby/setup-ruby](https://github.com/ruby/setup-ruby) and [actions/create-github-app-token](https://github.com/actions/create-github-app-token).


Updates `ruby/setup-ruby` from 1.215.0 to 1.218.0
- [Release notes](https://github.com/ruby/setup-ruby/releases)
- [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb)
- [Commits](ruby/setup-ruby@2654679...d781c1b)

Updates `actions/create-github-app-token` from 1.11.2 to 1.11.3
- [Release notes](https://github.com/actions/create-github-app-token/releases)
- [Commits](actions/create-github-app-token@136412a...67e27a7)

---
updated-dependencies:
- dependency-name: ruby/setup-ruby
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: actions/create-github-app-token
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>

…17fb19

build(deps): bump the npm group with 5 updates

…s-ee85065439

build(deps): bump the actions group with 2 updates

Go: Use Go `1.24` in PR checks

Don't start a "Uploading combined SARIF debug artifact" log group if we aren't going to do the upload.

Improve logs for combined SARIF debug artifact

This refactoring commit records the name of the tar program in the new
TarVersion.name field and makes extractTarZst() use the new field
instead of the hardcoded name "tar". Code behavior remains unchanged
because currently TarVersion.name is always "tar".

This is the first step toward supporting a tar program under a different
executable name.

This commit changes getTarVersion() so that it receives the name of the
tar program from the caller instead of using the hardcoded string "tar".

Prefer gtar if available

…arballs

See comment in the diff for full explanation.

Bumps the actions group with 2 updates: [ruby/setup-ruby](https://github.com/ruby/setup-ruby) and [actions/create-github-app-token](https://github.com/actions/create-github-app-token).


Updates `ruby/setup-ruby` from 1.218.0 to 1.221.0
- [Release notes](https://github.com/ruby/setup-ruby/releases)
- [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb)
- [Commits](ruby/setup-ruby@d781c1b...32110d4)

Updates `actions/create-github-app-token` from 1.11.3 to 1.11.5
- [Release notes](https://github.com/actions/create-github-app-token/releases)
- [Commits](actions/create-github-app-token@67e27a7...0d56448)

---
updated-dependencies:
- dependency-name: ruby/setup-ruby
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: actions/create-github-app-token
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>

Bumps the npm group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [@actions/cache](https://github.com/actions/toolkit/tree/HEAD/packages/cache) | `4.0.0` | `4.0.1` |
| [long](https://github.com/dcodeIO/long.js) | `5.3.0` | `5.3.1` |
| [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) | `8.23.0` | `8.24.1` |
| [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) | `8.23.0` | `8.24.1` |
| [eslint-import-resolver-typescript](https://github.com/import-js/eslint-import-resolver-typescript) | `3.7.0` | `3.8.1` |


Updates `@actions/cache` from 4.0.0 to 4.0.1
- [Changelog](https://github.com/actions/toolkit/blob/main/packages/cache/RELEASES.md)
- [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/cache)

Updates `long` from 5.3.0 to 5.3.1
- [Release notes](https://github.com/dcodeIO/long.js/releases)
- [Commits](dcodeIO/long.js@v5.3.0...v5.3.1)

Updates `@typescript-eslint/eslint-plugin` from 8.23.0 to 8.24.1
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.24.1/packages/eslint-plugin)

Updates `@typescript-eslint/parser` from 8.23.0 to 8.24.1
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.24.1/packages/parser)

Updates `eslint-import-resolver-typescript` from 3.7.0 to 3.8.1
- [Release notes](https://github.com/import-js/eslint-import-resolver-typescript/releases)
- [Changelog](https://github.com/import-js/eslint-import-resolver-typescript/blob/master/CHANGELOG.md)
- [Commits](import-js/eslint-import-resolver-typescript@v3.7.0...v3.8.1)

---
updated-dependencies:
- dependency-name: "@actions/cache"
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: long
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@typescript-eslint/eslint-plugin"
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: "@typescript-eslint/parser"
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: eslint-import-resolver-typescript
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
...

Signed-off-by: dependabot[bot] <support@github.com>

Revert "Prefer gtar if available"

This is supposed to enable rust analysis for the staff ship only.

Both the justfile and the pre-commit configuration for the `pr-check`
sync were broken:
* justfiles run recipes one line at a time in a fresh shell, so the venv
  activation was not working
* the pre-commit config was relying on an installed `ruamel.yaml`
  pakcage, but the default one installable via `apt` on Ubuntu 24.04 is
  old and generates different output (with formatting differences).

Now:
* the venv dance is put in a separate bash script
* both just and pre-commit will use that same script, so both problems
  will be fixed

As a bonus, a root `justfile` is added exposing the `update-pr-checks`
recipes plus a `build` one. Running `just` without arguments will also
now call the default `sync` recipes that will call both of the above.

Fix sync recipes and add base `justfile`

Perform consistent diff-informed alert filtering in the action

Upgrade `octokit` to v4.1.2

Update default bundle to 2.20.5

Support rust analysis