Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Mergeback v4.36.2 refs/heads/releases/v4 into main

Use local `upload-sarif` Action in PR checks job

Only the betterjson option is now used, so remove the old version.

Clean up `codeql.resolveLanguages`

Fix broken log grouping due to nested log group

Bumps the npm-minor group with 4 updates in the / directory: [js-yaml](https://github.com/nodeca/js-yaml), [eslint-import-resolver-typescript](https://github.com/import-js/eslint-import-resolver-typescript), [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) and [tsx](https://github.com/privatenumber/tsx).


Updates `js-yaml` from 4.1.1 to 4.2.0
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nodeca/js-yaml/commits)

Updates `eslint-import-resolver-typescript` from 4.4.4 to 4.4.5
- [Release notes](https://github.com/import-js/eslint-import-resolver-typescript/releases)
- [Changelog](https://github.com/import-js/eslint-import-resolver-typescript/blob/master/CHANGELOG.md)
- [Commits](import-js/eslint-import-resolver-typescript@v4.4.4...v4.4.5)

Updates `typescript-eslint` from 8.60.0 to 8.60.1
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.60.1/packages/typescript-eslint)

Updates `tsx` from 4.22.3 to 4.22.4
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.22.3...v4.22.4)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 4.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor
- dependency-name: eslint-import-resolver-typescript
  dependency-version: 4.4.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor
- dependency-name: typescript-eslint
  dependency-version: 8.60.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor
- dependency-name: tsx
  dependency-version: 4.22.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

…r-94506b9a28

Bump the npm-minor group across 1 directory with 4 updates

`macos-latest-xlarge` now resolves to macOS 26, which ships only Xcode 26
(Swift 6.2) and no longer includes Xcode 16. The Swift-analysing PR checks
select Xcode 16 because CodeQL CLI versions before 2.24.0 only support Swift
up to 6.1, so `xcode-select -s /Applications/Xcode_16.app` fails on macOS 26.

Pin these checks to macOS 15, where Xcode 16 is still available, so we keep
testing the full matrix of supported CodeQL versions. This also pre-empts the
`swift-custom-build` check failing once plain `macos`/`macos-latest` migrates.

See actions/runner-images#14167.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

When a repository requests Code Quality analysis but it is not enabled,
the SARIF upload to `PUT /repos/:owner/:repo/code-quality/analysis`
returns a 403 with the message "Code quality is not enabled for this
repository...". `isEnablementError` did not recognize this wording, so
`wrapApiConfigurationError` left it as a plain Error and the analyze job
was reported with `status=failure` instead of `user-error`.

Add a `/Code Quality is not enabled/i` pattern so the error becomes a
ConfigurationError and `getActionsStatus` categorizes it as `user-error`.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Rather than pinning every macOS job to macOS 15, only run the older CodeQL CLI
versions (which need Xcode 16, and so macOS 15) there. Newer versions, which
support Swift 6.2, run on the latest macOS runner with its default Xcode, so we
keep exercising the common latest-CLI-on-latest-runner combination.

To express this, `sync.ts` now supports an optional per-OS-entry
`codeql-versions` filter, used by `multi-language-autodetect` to send old
versions to `macos-15-xlarge` and new versions to `macos-latest-xlarge`.

`swift-custom-build` only runs `linked`/`default`/`nightly`, which all support
Swift 6.2, so it no longer needs the Xcode 16 step or a macOS 15 pin.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Redesign the per-entry codeql-versions filter so an OS entry without a
version list catches all versions not claimed by its siblings. This lets
new CodeQL versions flow to macos-latest-xlarge automatically. Move
v2.23.9 (which supports Swift 6.2) off the macOS 15 list and simplify the
matrix filter logic.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Pin Swift macOS PR checks to macOS 15 for Xcode 16

…zation

Remove `ready_for_review` triggers from workflows

…ror-categorization

Categorize Code Quality "not enabled" upload failure as user-error

Update `glob` to at least `13.0.6`

Bumps the npm-minor group with 3 updates in the / directory: [@actions/cache](https://github.com/actions/toolkit/tree/HEAD/packages/cache), [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) and [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint).


Updates `@actions/cache` from 5.0.5 to 5.1.0
- [Changelog](https://github.com/actions/toolkit/blob/main/packages/cache/RELEASES.md)
- [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/cache)

Updates `@types/node` from 20.19.42 to 20.19.43
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `typescript-eslint` from 8.61.0 to 8.61.1
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.61.1/packages/typescript-eslint)

---
updated-dependencies:
- dependency-name: "@actions/cache"
  dependency-version: 5.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor
- dependency-name: "@types/node"
  dependency-version: 20.19.43
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor
- dependency-name: typescript-eslint
  dependency-version: 8.61.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Bumps the actions-minor group with 3 updates in the /.github/workflows directory: [actions/setup-go](https://github.com/actions/setup-go), [actions/setup-python](https://github.com/actions/setup-python) and [ruby/setup-ruby](https://github.com/ruby/setup-ruby).


Updates `actions/setup-go` from 6.4.0 to 6.5.0
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](actions/setup-go@4a36011...924ae3a)

Updates `actions/setup-python` from 6.2.0 to 6.3.0
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@a309ff8...ece7cb0)

Updates `ruby/setup-ruby` from 1.312.0 to 1.313.0
- [Release notes](https://github.com/ruby/setup-ruby/releases)
- [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb)
- [Commits](ruby/setup-ruby@12fd324...89f9052)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-version: 6.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-minor
- dependency-name: actions/setup-python
  dependency-version: 6.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-minor
- dependency-name: ruby/setup-ruby
  dependency-version: 1.313.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@df4cb1c...9c091bb)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

…r-82bd637a11

Bump the npm-minor group across 1 directory with 3 updates

…thub/workflows/actions-minor-149d5843f4

Bump the actions-minor group across 1 directory with 3 updates

…thub/workflows/actions/checkout-7.0.0

Bump actions/checkout from 6.0.3 to 7.0.0 in /.github/workflows

This lets us compare the storage cost of overlay-base and trimmed databases for the same commit.

…ize-telemetry

Measure overlay-base database size at the clear cleanup level