diff --git a/.github/workflows/__unsupported-macos.yml b/.github/workflows/__unsupported-macos.yml
new file mode 100644
index 0000000000..fabd42d2cd
--- /dev/null
+++ b/.github/workflows/__unsupported-macos.yml
@@ -0,0 +1,122 @@
+# Warning: This file is generated automatically, and should not be modified.
+# Instead, please modify the template in the pr-checks directory and run:
+#     pr-checks/sync.sh
+# to regenerate this file.
+
+name: PR Check - Unsupported macOS
+env:
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  GO111MODULE: auto
+on:
+  push:
+    branches:
+      - main
+      - releases/v*
+  pull_request: {}
+  merge_group:
+    types:
+      - checks_requested
+  schedule:
+    - cron: '0 5 * * *'
+  workflow_dispatch:
+    inputs: {}
+  workflow_call:
+    inputs: {}
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
+  group: unsupported-macos-${{github.ref}}
+jobs:
+  unsupported-macos:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: xcode-27
+            version: linked
+          - os: xcode-27
+            version: nightly-latest
+    name: Unsupported macOS
+    if: github.triggering_actor != 'dependabot[bot]'
+    permissions:
+      contents: read
+      security-events: read
+    timeout-minutes: 45
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Node.js
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 20.x
+          cache: npm
+      - name: Install newer npm
+        run: npm install -g npm@11.19.1
+      - name: Install dependencies
+        run: npm ci
+      - name: Prepare test
+        id: prepare-test
+        uses: ./.github/actions/prepare-test
+        with:
+          version: ${{ matrix.version }}
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
+      - uses: ./../action/init
+        id: init
+        with:
+          languages: swift
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
+
+      - name: Analyze
+        uses: ./../action/analyze
+        with:
+          category: '/test-codeql-version:${{ matrix.version }}'
+    env:
+      CODEQL_ACTION_SKIP_GENERATE_FAILED_SARIF: false
+      CODEQL_ACTION_SKIP_SARIF_UPLOAD: true
+      CODEQL_ACTION_TESTING_ENVIRONMENT: codeql-action-pr-checks
+      CODEQL_ACTION_TEST_MODE: true
+  unsupported-macos-sarif-checks:
+    if: github.triggering_actor != 'dependabot[bot]'
+    needs:
+      - unsupported-macos
+    permissions:
+      contents: read
+      security-events: read
+    timeout-minutes: 5
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Node.js
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 20.x
+          cache: npm
+      - name: Install newer npm
+        run: npm install -g npm@11.19.1
+      - name: Install dependencies
+        run: npm ci
+      - name: Download workflow artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          pattern: test-mode-sarif-*
+          path: sarif
+
+      - name: List artifact contents
+        run: ls -laR ./sarif
+
+      - name: Check diagnostics appear in SARIF
+        env:
+          SARIF_PATH: "./sarif/codeql-failed-run.sarif"
+          DIAGNOSTIC_ID: "codeql-action/unsupported-traced-analysis-macos"
+          DIAGNOSTIC_NAME: "Traced analysis is not supported on this version of macOS"
+          EXPECTED_LOCATIONS: "0"
+          EXPECTED_MESSAGE: |
+            Traced analysis is not supported on macOS 27 or above.
+        run: npx tsx ./pr-checks/check-diagnostics.ts
+    env:
+      CODEQL_ACTION_TEST_MODE: true
diff --git a/lib/entry-points.js b/lib/entry-points.js
index 1a405187f5..d25bdb1ea6 100644
--- a/lib/entry-points.js
+++ b/lib/entry-points.js
@@ -117,11 +117,11 @@ var require_command = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.issueCommand = issueCommand;
     exports2.issue = issue;
-    var os7 = __importStar2(require("os"));
+    var os8 = __importStar2(require("os"));
     var utils_1 = require_utils();
     function issueCommand(command, properties, message) {
       const cmd = new Command(command, properties, message);
-      process.stdout.write(cmd.toString() + os7.EOL);
+      process.stdout.write(cmd.toString() + os8.EOL);
     }
     function issue(name, message = "") {
       issueCommand(name, {}, message);
@@ -213,18 +213,18 @@ var require_file_command = __commonJS({
     exports2.issueFileCommand = issueFileCommand;
     exports2.prepareKeyValueMessage = prepareKeyValueMessage;
     var crypto3 = __importStar2(require("crypto"));
-    var fs33 = __importStar2(require("fs"));
-    var os7 = __importStar2(require("os"));
+    var fs34 = __importStar2(require("fs"));
+    var os8 = __importStar2(require("os"));
     var utils_1 = require_utils();
     function issueFileCommand(command, message) {
       const filePath = process.env[`GITHUB_${command}`];
       if (!filePath) {
         throw new Error(`Unable to find environment variable for file command ${command}`);
       }
-      if (!fs33.existsSync(filePath)) {
+      if (!fs34.existsSync(filePath)) {
         throw new Error(`Missing file at path: ${filePath}`);
       }
-      fs33.appendFileSync(filePath, `${(0, utils_1.toCommandValue)(message)}${os7.EOL}`, {
+      fs34.appendFileSync(filePath, `${(0, utils_1.toCommandValue)(message)}${os8.EOL}`, {
         encoding: "utf8"
       });
     }
@@ -237,7 +237,7 @@ var require_file_command = __commonJS({
       if (convertedValue.includes(delimiter)) {
         throw new Error(`Unexpected input: value should not contain the delimiter "${delimiter}"`);
       }
-      return `${key}<<${delimiter}${os7.EOL}${convertedValue}${os7.EOL}${delimiter}`;
+      return `${key}<<${delimiter}${os8.EOL}${convertedValue}${os8.EOL}${delimiter}`;
     }
   }
 });
@@ -20443,13 +20443,13 @@ var require_io_util = __commonJS({
     exports2.isRooted = isRooted;
     exports2.tryGetExecutablePath = tryGetExecutablePath;
     exports2.getCmdPath = getCmdPath;
-    var fs33 = __importStar2(require("fs"));
+    var fs34 = __importStar2(require("fs"));
     var path30 = __importStar2(require("path"));
-    _a6 = fs33.promises, exports2.chmod = _a6.chmod, exports2.copyFile = _a6.copyFile, exports2.lstat = _a6.lstat, exports2.mkdir = _a6.mkdir, exports2.open = _a6.open, exports2.readdir = _a6.readdir, exports2.rename = _a6.rename, exports2.rm = _a6.rm, exports2.rmdir = _a6.rmdir, exports2.stat = _a6.stat, exports2.symlink = _a6.symlink, exports2.unlink = _a6.unlink;
+    _a6 = fs34.promises, exports2.chmod = _a6.chmod, exports2.copyFile = _a6.copyFile, exports2.lstat = _a6.lstat, exports2.mkdir = _a6.mkdir, exports2.open = _a6.open, exports2.readdir = _a6.readdir, exports2.rename = _a6.rename, exports2.rm = _a6.rm, exports2.rmdir = _a6.rmdir, exports2.stat = _a6.stat, exports2.symlink = _a6.symlink, exports2.unlink = _a6.unlink;
     exports2.IS_WINDOWS = process.platform === "win32";
     function readlink(fsPath) {
       return __awaiter2(this, void 0, void 0, function* () {
-        const result = yield fs33.promises.readlink(fsPath);
+        const result = yield fs34.promises.readlink(fsPath);
         if (exports2.IS_WINDOWS && !result.endsWith("\\")) {
           return `${result}\\`;
         }
@@ -20457,7 +20457,7 @@ var require_io_util = __commonJS({
       });
     }
     exports2.UV_FS_O_EXLOCK = 268435456;
-    exports2.READONLY = fs33.constants.O_RDONLY;
+    exports2.READONLY = fs34.constants.O_RDONLY;
     function exists(fsPath) {
       return __awaiter2(this, void 0, void 0, function* () {
         try {
@@ -20895,7 +20895,7 @@ var require_toolrunner = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.ToolRunner = void 0;
     exports2.argStringToArray = argStringToArray;
-    var os7 = __importStar2(require("os"));
+    var os8 = __importStar2(require("os"));
     var events = __importStar2(require("events"));
     var child = __importStar2(require("child_process"));
     var path30 = __importStar2(require("path"));
@@ -20950,12 +20950,12 @@ var require_toolrunner = __commonJS({
       _processLineBuffer(data, strBuffer, onLine) {
         try {
           let s = strBuffer + data.toString();
-          let n = s.indexOf(os7.EOL);
+          let n = s.indexOf(os8.EOL);
           while (n > -1) {
             const line = s.substring(0, n);
             onLine(line);
-            s = s.substring(n + os7.EOL.length);
-            n = s.indexOf(os7.EOL);
+            s = s.substring(n + os8.EOL.length);
+            n = s.indexOf(os8.EOL);
           }
           return s;
         } catch (err) {
@@ -21124,7 +21124,7 @@ var require_toolrunner = __commonJS({
             }
             const optionsNonNull = this._cloneExecOptions(this.options);
             if (!optionsNonNull.silent && optionsNonNull.outStream) {
-              optionsNonNull.outStream.write(this._getCommandString(optionsNonNull) + os7.EOL);
+              optionsNonNull.outStream.write(this._getCommandString(optionsNonNull) + os8.EOL);
             }
             const state = new ExecState(optionsNonNull, this.toolPath);
             state.on("debug", (message) => {
@@ -21665,7 +21665,7 @@ var require_core = __commonJS({
     var command_1 = require_command();
     var file_command_1 = require_file_command();
     var utils_1 = require_utils();
-    var os7 = __importStar2(require("os"));
+    var os8 = __importStar2(require("os"));
     var path30 = __importStar2(require("path"));
     var oidc_utils_1 = require_oidc_utils();
     var ExitCode;
@@ -21727,7 +21727,7 @@ Support boolean input list: \`true | True | TRUE | false | False | FALSE\``);
       if (filePath) {
         return (0, file_command_1.issueFileCommand)("OUTPUT", (0, file_command_1.prepareKeyValueMessage)(name, value));
       }
-      process.stdout.write(os7.EOL);
+      process.stdout.write(os8.EOL);
       (0, command_1.issueCommand)("set-output", { name }, (0, utils_1.toCommandValue)(value));
     }
     function setCommandEcho(enabled) {
@@ -21753,7 +21753,7 @@ Support boolean input list: \`true | True | TRUE | false | False | FALSE\``);
       (0, command_1.issueCommand)("notice", (0, utils_1.toCommandProperties)(properties), message instanceof Error ? message.toString() : message);
     }
     function info8(message) {
-      process.stdout.write(message + os7.EOL);
+      process.stdout.write(message + os8.EOL);
     }
     function startGroup3(name) {
       (0, command_1.issue)("group", name);
@@ -26831,8 +26831,8 @@ var require_semver = __commonJS({
       }
       // preminor will bump the version up to the next minor release, and immediately
       // down to pre-release. premajor and prepatch work the same way.
-      inc(release2, identifier, identifierBase) {
-        if (release2.startsWith("pre")) {
+      inc(release3, identifier, identifierBase) {
+        if (release3.startsWith("pre")) {
           if (!identifier && identifierBase === false) {
             throw new Error("invalid increment argument: identifier is empty");
           }
@@ -26843,7 +26843,7 @@ var require_semver = __commonJS({
             }
           }
         }
-        switch (release2) {
+        switch (release3) {
           case "premajor":
             this.prerelease.length = 0;
             this.patch = 0;
@@ -26935,7 +26935,7 @@ var require_semver = __commonJS({
             break;
           }
           default:
-            throw new Error(`invalid increment argument: ${release2}`);
+            throw new Error(`invalid increment argument: ${release3}`);
         }
         this.raw = this.format();
         if (this.build.length) {
@@ -26953,7 +26953,7 @@ var require_parse2 = __commonJS({
   "node_modules/semver/functions/parse.js"(exports2, module2) {
     "use strict";
     var SemVer = require_semver();
-    var parse3 = (version, options, throwErrors = false) => {
+    var parse4 = (version, options, throwErrors = false) => {
       if (version instanceof SemVer) {
         return version;
       }
@@ -26966,7 +26966,7 @@ var require_parse2 = __commonJS({
         throw er;
       }
     };
-    module2.exports = parse3;
+    module2.exports = parse4;
   }
 });
 
@@ -26974,9 +26974,9 @@ var require_parse2 = __commonJS({
 var require_valid = __commonJS({
   "node_modules/semver/functions/valid.js"(exports2, module2) {
     "use strict";
-    var parse3 = require_parse2();
+    var parse4 = require_parse2();
     var valid4 = (version, options) => {
-      const v = parse3(version, options);
+      const v = parse4(version, options);
       return v ? v.version : null;
     };
     module2.exports = valid4;
@@ -26987,9 +26987,9 @@ var require_valid = __commonJS({
 var require_clean = __commonJS({
   "node_modules/semver/functions/clean.js"(exports2, module2) {
     "use strict";
-    var parse3 = require_parse2();
+    var parse4 = require_parse2();
     var clean3 = (version, options) => {
-      const s = parse3(version.trim().replace(/^[=v]+/, ""), options);
+      const s = parse4(version.trim().replace(/^[=v]+/, ""), options);
       return s ? s.version : null;
     };
     module2.exports = clean3;
@@ -27001,7 +27001,7 @@ var require_inc = __commonJS({
   "node_modules/semver/functions/inc.js"(exports2, module2) {
     "use strict";
     var SemVer = require_semver();
-    var inc = (version, release2, options, identifier, identifierBase) => {
+    var inc = (version, release3, options, identifier, identifierBase) => {
       if (typeof options === "string") {
         identifierBase = identifier;
         identifier = options;
@@ -27011,7 +27011,7 @@ var require_inc = __commonJS({
         return new SemVer(
           version instanceof SemVer ? version.version : version,
           options
-        ).inc(release2, identifier, identifierBase).version;
+        ).inc(release3, identifier, identifierBase).version;
       } catch (er) {
         return null;
       }
@@ -27024,10 +27024,10 @@ var require_inc = __commonJS({
 var require_diff = __commonJS({
   "node_modules/semver/functions/diff.js"(exports2, module2) {
     "use strict";
-    var parse3 = require_parse2();
+    var parse4 = require_parse2();
     var diff = (version1, version2) => {
-      const v1 = parse3(version1, null, true);
-      const v2 = parse3(version2, null, true);
+      const v1 = parse4(version1, null, true);
+      const v2 = parse4(version2, null, true);
       const comparison = v1.compare(v2);
       if (comparison === 0) {
         return null;
@@ -27098,9 +27098,9 @@ var require_patch = __commonJS({
 var require_prerelease = __commonJS({
   "node_modules/semver/functions/prerelease.js"(exports2, module2) {
     "use strict";
-    var parse3 = require_parse2();
+    var parse4 = require_parse2();
     var prerelease = (version, options) => {
-      const parsed = parse3(version, options);
+      const parsed = parse4(version, options);
       return parsed && parsed.prerelease.length ? parsed.prerelease : null;
     };
     module2.exports = prerelease;
@@ -27286,9 +27286,9 @@ var require_coerce = __commonJS({
   "node_modules/semver/functions/coerce.js"(exports2, module2) {
     "use strict";
     var SemVer = require_semver();
-    var parse3 = require_parse2();
+    var parse4 = require_parse2();
     var { safeRe: re, t } = require_re();
-    var coerce3 = (version, options) => {
+    var coerce4 = (version, options) => {
       if (version instanceof SemVer) {
         return version;
       }
@@ -27321,9 +27321,9 @@ var require_coerce = __commonJS({
       const patch = match2[4] || "0";
       const prerelease = options.includePrerelease && match2[5] ? `-${match2[5]}` : "";
       const build2 = options.includePrerelease && match2[6] ? `+${match2[6]}` : "";
-      return parse3(`${major}.${minor}.${patch}${prerelease}${build2}`, options);
+      return parse4(`${major}.${minor}.${patch}${prerelease}${build2}`, options);
     };
-    module2.exports = coerce3;
+    module2.exports = coerce4;
   }
 });
 
@@ -27331,7 +27331,7 @@ var require_coerce = __commonJS({
 var require_truncate = __commonJS({
   "node_modules/semver/functions/truncate.js"(exports2, module2) {
     "use strict";
-    var parse3 = require_parse2();
+    var parse4 = require_parse2();
     var constants = require_constants6();
     var SemVer = require_semver();
     var truncate = (version, truncation, options) => {
@@ -27343,7 +27343,7 @@ var require_truncate = __commonJS({
     };
     var cloneInputVersion = (version, options) => {
       const versionStringToParse = version instanceof SemVer ? version.version : version;
-      return parse3(versionStringToParse, options);
+      return parse4(versionStringToParse, options);
     };
     var doTruncation = (version, truncation) => {
       if (isPrerelease(truncation)) {
@@ -28387,7 +28387,7 @@ var require_semver2 = __commonJS({
     var constants = require_constants6();
     var SemVer = require_semver();
     var identifiers = require_identifiers();
-    var parse3 = require_parse2();
+    var parse4 = require_parse2();
     var valid4 = require_valid();
     var clean3 = require_clean();
     var inc = require_inc();
@@ -28409,7 +28409,7 @@ var require_semver2 = __commonJS({
     var gte7 = require_gte();
     var lte2 = require_lte();
     var cmp = require_cmp();
-    var coerce3 = require_coerce();
+    var coerce4 = require_coerce();
     var truncate = require_truncate();
     var Comparator = require_comparator();
     var Range2 = require_range();
@@ -28426,7 +28426,7 @@ var require_semver2 = __commonJS({
     var simplifyRange = require_simplify();
     var subset = require_subset();
     module2.exports = {
-      parse: parse3,
+      parse: parse4,
       valid: valid4,
       clean: clean3,
       inc,
@@ -28448,7 +28448,7 @@ var require_semver2 = __commonJS({
       gte: gte7,
       lte: lte2,
       cmp,
-      coerce: coerce3,
+      coerce: coerce4,
       truncate,
       Comparator,
       Range: Range2,
@@ -32109,9 +32109,9 @@ var require_minimatch = __commonJS({
         throw new TypeError("pattern is too long");
       }
     };
-    Minimatch2.prototype.parse = parse3;
+    Minimatch2.prototype.parse = parse4;
     var SUBPARSE = {};
-    function parse3(pattern, isSub) {
+    function parse4(pattern, isSub) {
       assertValidPattern2(pattern);
       var options = this.options;
       if (pattern === "**") {
@@ -32746,7 +32746,7 @@ var require_internal_pattern = __commonJS({
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.Pattern = void 0;
-    var os7 = __importStar2(require("os"));
+    var os8 = __importStar2(require("os"));
     var path30 = __importStar2(require("path"));
     var pathHelper = __importStar2(require_internal_path_helper());
     var assert_1 = __importDefault2(require("assert"));
@@ -32839,7 +32839,7 @@ var require_internal_pattern = __commonJS({
         if (pattern === "." || pattern.startsWith(`.${path30.sep}`)) {
           pattern = _Pattern.globEscape(process.cwd()) + pattern.substr(1);
         } else if (pattern === "~" || pattern.startsWith(`~${path30.sep}`)) {
-          homedir2 = homedir2 || os7.homedir();
+          homedir2 = homedir2 || os8.homedir();
           (0, assert_1.default)(homedir2, "Unable to determine HOME directory");
           (0, assert_1.default)(pathHelper.hasAbsoluteRoot(homedir2), `Expected HOME directory to be a rooted path. Actual '${homedir2}'`);
           pattern = _Pattern.globEscape(homedir2) + pattern.substr(1);
@@ -33065,7 +33065,7 @@ var require_internal_globber = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.DefaultGlobber = void 0;
     var core29 = __importStar2(require_core());
-    var fs33 = __importStar2(require("fs"));
+    var fs34 = __importStar2(require("fs"));
     var globOptionsHelper = __importStar2(require_internal_glob_options_helper());
     var path30 = __importStar2(require("path"));
     var patternHelper = __importStar2(require_internal_pattern_helper());
@@ -33119,7 +33119,7 @@ var require_internal_globber = __commonJS({
           for (const searchPath of patternHelper.getSearchPaths(patterns)) {
             core29.debug(`Search path '${searchPath}'`);
             try {
-              yield __await2(fs33.promises.lstat(searchPath));
+              yield __await2(fs34.promises.lstat(searchPath));
             } catch (err) {
               if (err.code === "ENOENT") {
                 continue;
@@ -33153,7 +33153,7 @@ var require_internal_globber = __commonJS({
                 continue;
               }
               const childLevel = item.level + 1;
-              const childItems = (yield __await2(fs33.promises.readdir(item.path))).map((x) => new internal_search_state_1.SearchState(path30.join(item.path, x), childLevel));
+              const childItems = (yield __await2(fs34.promises.readdir(item.path))).map((x) => new internal_search_state_1.SearchState(path30.join(item.path, x), childLevel));
               stack.push(...childItems.reverse());
             } else if (match2 & internal_match_kind_1.MatchKind.File) {
               yield yield __await2(item.path);
@@ -33188,7 +33188,7 @@ var require_internal_globber = __commonJS({
           let stats;
           if (options.followSymbolicLinks) {
             try {
-              stats = yield fs33.promises.stat(item.path);
+              stats = yield fs34.promises.stat(item.path);
             } catch (err) {
               if (err.code === "ENOENT") {
                 if (options.omitBrokenSymbolicLinks) {
@@ -33200,10 +33200,10 @@ var require_internal_globber = __commonJS({
               throw err;
             }
           } else {
-            stats = yield fs33.promises.lstat(item.path);
+            stats = yield fs34.promises.lstat(item.path);
           }
           if (stats.isDirectory() && options.followSymbolicLinks) {
-            const realPath = yield fs33.promises.realpath(item.path);
+            const realPath = yield fs34.promises.realpath(item.path);
             while (traversalChain.length >= item.level) {
               traversalChain.pop();
             }
@@ -33312,7 +33312,7 @@ var require_internal_hash_files = __commonJS({
     exports2.hashFiles = hashFiles2;
     var crypto3 = __importStar2(require("crypto"));
     var core29 = __importStar2(require_core());
-    var fs33 = __importStar2(require("fs"));
+    var fs34 = __importStar2(require("fs"));
     var stream2 = __importStar2(require("stream"));
     var util4 = __importStar2(require("util"));
     var path30 = __importStar2(require("path"));
@@ -33335,13 +33335,13 @@ var require_internal_hash_files = __commonJS({
               writeDelegate(`Ignore '${file}' since it is not under GITHUB_WORKSPACE.`);
               continue;
             }
-            if (fs33.statSync(file).isDirectory()) {
+            if (fs34.statSync(file).isDirectory()) {
               writeDelegate(`Skip directory '${file}'.`);
               continue;
             }
             const hash2 = crypto3.createHash("sha256");
             const pipeline2 = util4.promisify(stream2.pipeline);
-            yield pipeline2(fs33.createReadStream(file), hash2);
+            yield pipeline2(fs34.createReadStream(file), hash2);
             result.write(hash2.digest());
             count++;
             if (!hasMatch) {
@@ -33561,8 +33561,8 @@ var require_semver3 = __commonJS({
       }
     }
     var i;
-    exports2.parse = parse3;
-    function parse3(version, options) {
+    exports2.parse = parse4;
+    function parse4(version, options) {
       if (!options || typeof options !== "object") {
         options = {
           loose: !!options,
@@ -33590,12 +33590,12 @@ var require_semver3 = __commonJS({
     }
     exports2.valid = valid4;
     function valid4(version, options) {
-      var v = parse3(version, options);
+      var v = parse4(version, options);
       return v ? v.version : null;
     }
     exports2.clean = clean3;
     function clean3(version, options) {
-      var s = parse3(version.trim().replace(/^[=v]+/, ""), options);
+      var s = parse4(version.trim().replace(/^[=v]+/, ""), options);
       return s ? s.version : null;
     }
     exports2.SemVer = SemVer;
@@ -33731,8 +33731,8 @@ var require_semver3 = __commonJS({
         }
       } while (++i2);
     };
-    SemVer.prototype.inc = function(release2, identifier) {
-      switch (release2) {
+    SemVer.prototype.inc = function(release3, identifier) {
+      switch (release3) {
         case "premajor":
           this.prerelease.length = 0;
           this.patch = 0;
@@ -33808,20 +33808,20 @@ var require_semver3 = __commonJS({
           }
           break;
         default:
-          throw new Error("invalid increment argument: " + release2);
+          throw new Error("invalid increment argument: " + release3);
       }
       this.format();
       this.raw = this.version;
       return this;
     };
     exports2.inc = inc;
-    function inc(version, release2, loose, identifier) {
+    function inc(version, release3, loose, identifier) {
       if (typeof loose === "string") {
         identifier = loose;
         loose = void 0;
       }
       try {
-        return new SemVer(version, loose).inc(release2, identifier).version;
+        return new SemVer(version, loose).inc(release3, identifier).version;
       } catch (er) {
         return null;
       }
@@ -33831,8 +33831,8 @@ var require_semver3 = __commonJS({
       if (eq(version1, version2)) {
         return null;
       } else {
-        var v1 = parse3(version1);
-        var v2 = parse3(version2);
+        var v1 = parse4(version1);
+        var v2 = parse4(version2);
         var prefix = "";
         if (v1.prerelease.length || v2.prerelease.length) {
           prefix = "pre";
@@ -34538,7 +34538,7 @@ var require_semver3 = __commonJS({
     }
     exports2.prerelease = prerelease;
     function prerelease(version, options) {
-      var parsed = parse3(version, options);
+      var parsed = parse4(version, options);
       return parsed && parsed.prerelease.length ? parsed.prerelease : null;
     }
     exports2.intersects = intersects;
@@ -34547,8 +34547,8 @@ var require_semver3 = __commonJS({
       r2 = new Range2(r2, options);
       return r1.intersects(r2);
     }
-    exports2.coerce = coerce3;
-    function coerce3(version, options) {
+    exports2.coerce = coerce4;
+    function coerce4(version, options) {
       if (version instanceof SemVer) {
         return version;
       }
@@ -34575,7 +34575,7 @@ var require_semver3 = __commonJS({
       if (match2 === null) {
         return null;
       }
-      return parse3(match2[2] + "." + (match2[3] || "0") + "." + (match2[4] || "0"), options);
+      return parse4(match2[2] + "." + (match2[3] || "0") + "." + (match2[4] || "0"), options);
     }
   }
 });
@@ -34717,9 +34717,9 @@ var require_cacheUtils = __commonJS({
     var glob2 = __importStar2(require_glob());
     var io9 = __importStar2(require_io());
     var crypto3 = __importStar2(require("crypto"));
-    var fs33 = __importStar2(require("fs"));
+    var fs34 = __importStar2(require("fs"));
     var path30 = __importStar2(require("path"));
-    var semver11 = __importStar2(require_semver3());
+    var semver12 = __importStar2(require_semver3());
     var util4 = __importStar2(require("util"));
     var constants_1 = require_constants7();
     var versionSalt = "1.0";
@@ -34746,7 +34746,7 @@ var require_cacheUtils = __commonJS({
       });
     }
     function getArchiveFileSizeInBytes(filePath) {
-      return fs33.statSync(filePath).size;
+      return fs34.statSync(filePath).size;
     }
     function resolvePaths(patterns) {
       return __awaiter2(this, void 0, void 0, function* () {
@@ -34784,7 +34784,7 @@ var require_cacheUtils = __commonJS({
     }
     function unlinkFile(filePath) {
       return __awaiter2(this, void 0, void 0, function* () {
-        return util4.promisify(fs33.unlink)(filePath);
+        return util4.promisify(fs34.unlink)(filePath);
       });
     }
     function getVersion(app_1) {
@@ -34812,7 +34812,7 @@ var require_cacheUtils = __commonJS({
     function getCompressionMethod() {
       return __awaiter2(this, void 0, void 0, function* () {
         const versionOutput = yield getVersion("zstd", ["--quiet"]);
-        const version = semver11.clean(versionOutput);
+        const version = semver12.clean(versionOutput);
         core29.debug(`zstd version: ${version}`);
         if (versionOutput === "") {
           return constants_1.CompressionMethod.Gzip;
@@ -34826,7 +34826,7 @@ var require_cacheUtils = __commonJS({
     }
     function getGnuTarPathOnWindows() {
       return __awaiter2(this, void 0, void 0, function* () {
-        if (fs33.existsSync(constants_1.GnuTarPathOnWindows)) {
+        if (fs34.existsSync(constants_1.GnuTarPathOnWindows)) {
           return constants_1.GnuTarPathOnWindows;
         }
         const versionOutput = yield getVersion("tar");
@@ -37490,7 +37490,7 @@ var require_ms = __commonJS({
       options = options || {};
       var type = typeof val;
       if (type === "string" && val.length > 0) {
-        return parse3(val);
+        return parse4(val);
       } else if (type === "number" && isFinite(val)) {
         return options.long ? fmtLong(val) : fmtShort(val);
       }
@@ -37498,7 +37498,7 @@ var require_ms = __commonJS({
         "val is not a non-empty string or a valid number. val=" + JSON.stringify(val)
       );
     };
-    function parse3(str) {
+    function parse4(str) {
       str = String(str);
       if (str.length > 100) {
         return;
@@ -37599,7 +37599,7 @@ var require_common = __commonJS({
     function setup(env) {
       createDebug.debug = createDebug;
       createDebug.default = createDebug;
-      createDebug.coerce = coerce3;
+      createDebug.coerce = coerce4;
       createDebug.disable = disable;
       createDebug.enable = enable;
       createDebug.enabled = enabled;
@@ -37754,7 +37754,7 @@ var require_common = __commonJS({
         }
         return false;
       }
-      function coerce3(val) {
+      function coerce4(val) {
         if (val instanceof Error) {
           return val.stack || val.message;
         }
@@ -37957,7 +37957,7 @@ var require_has_flag = __commonJS({
 var require_supports_color = __commonJS({
   "node_modules/supports-color/index.js"(exports2, module2) {
     "use strict";
-    var os7 = require("os");
+    var os8 = require("os");
     var tty = require("tty");
     var hasFlag = require_has_flag();
     var { env } = process;
@@ -38005,7 +38005,7 @@ var require_supports_color = __commonJS({
         return min;
       }
       if (process.platform === "win32") {
-        const osRelease = os7.release().split(".");
+        const osRelease = os8.release().split(".");
         if (Number(osRelease[0]) >= 10 && Number(osRelease[2]) >= 10586) {
           return Number(osRelease[2]) >= 14931 ? 3 : 2;
         }
@@ -42967,11 +42967,11 @@ var require_tracingPolicy = __commonJS({
     var import_log = require_log3();
     var import_core_util = require_commonjs4();
     var import_restError = require_restError3();
-    var import_util59 = require_internal3();
+    var import_util62 = require_internal3();
     var tracingPolicyName2 = "tracingPolicy";
     function tracingPolicy2(options = {}) {
       const userAgentPromise = (0, import_userAgent.getUserAgentValue)(options.userAgentPrefix);
-      const sanitizer = new import_util59.Sanitizer({
+      const sanitizer = new import_util62.Sanitizer({
         additionalAllowedQueryParameters: options.additionalAllowedQueryParameters
       });
       const tracingClient = tryCreateTracingClient();
@@ -45399,7 +45399,7 @@ var require_deserializationPolicy = __commonJS({
       return result;
     }
     async function deserializeResponseBody(jsonContentTypes, xmlContentTypes, response, options, parseXML) {
-      const parsedResponse = await parse3(jsonContentTypes, xmlContentTypes, response, options, parseXML);
+      const parsedResponse = await parse4(jsonContentTypes, xmlContentTypes, response, options, parseXML);
       if (!shouldDeserializeResponse(parsedResponse)) {
         return parsedResponse;
       }
@@ -45500,7 +45500,7 @@ var require_deserializationPolicy = __commonJS({
       }
       return { error: error3, shouldReturnResponse: false };
     }
-    async function parse3(jsonContentTypes, xmlContentTypes, operationResponse, opts, parseXML) {
+    async function parse4(jsonContentTypes, xmlContentTypes, operationResponse, opts, parseXML) {
       if (!operationResponse.request.streamResponseStatusCodes?.has(operationResponse.status) && operationResponse.bodyAsText) {
         const text = operationResponse.bodyAsText;
         const contentType = operationResponse.headers.get("Content-Type") || "";
@@ -46597,11 +46597,11 @@ var require_response2 = __commonJS({
     });
     module2.exports = __toCommonJS2(response_exports);
     var import_core_rest_pipeline = require_commonjs6();
-    var import_util59 = require_util9();
+    var import_util62 = require_util9();
     var originalResponse = /* @__PURE__ */ Symbol("Original FullOperationResponse");
     function toCompatResponse2(response, options) {
-      let request3 = (0, import_util59.toWebResourceLike)(response.request);
-      let headers = (0, import_util59.toHttpHeadersLike)(response.headers);
+      let request3 = (0, import_util62.toWebResourceLike)(response.request);
+      let headers = (0, import_util62.toHttpHeadersLike)(response.headers);
       if (options?.createProxy) {
         return new Proxy(response, {
           get(target, prop, receiver) {
@@ -46642,7 +46642,7 @@ var require_response2 = __commonJS({
         return {
           ...compatResponse,
           headers,
-          request: (0, import_util59.toPipelineRequest)(compatResponse.request)
+          request: (0, import_util62.toPipelineRequest)(compatResponse.request)
         };
       }
     }
@@ -46749,7 +46749,7 @@ var require_requestPolicyFactoryPolicy = __commonJS({
       requestPolicyFactoryPolicyName: () => requestPolicyFactoryPolicyName2
     });
     module2.exports = __toCommonJS2(requestPolicyFactoryPolicy_exports);
-    var import_util59 = require_util9();
+    var import_util62 = require_util9();
     var import_response = require_response2();
     var HttpPipelineLogLevel2 = /* @__PURE__ */ ((HttpPipelineLogLevel22) => {
       HttpPipelineLogLevel22[HttpPipelineLogLevel22["ERROR"] = 1] = "ERROR";
@@ -46773,14 +46773,14 @@ var require_requestPolicyFactoryPolicy = __commonJS({
         async sendRequest(request3, next) {
           let httpPipeline = {
             async sendRequest(httpRequest) {
-              const response2 = await next((0, import_util59.toPipelineRequest)(httpRequest));
+              const response2 = await next((0, import_util62.toPipelineRequest)(httpRequest));
               return (0, import_response.toCompatResponse)(response2, { createProxy: true });
             }
           };
           for (const factory of orderedFactories) {
             httpPipeline = factory.create(httpPipeline, mockRequestPolicyOptions);
           }
-          const webResourceLike = (0, import_util59.toWebResourceLike)(request3, { createProxy: true });
+          const webResourceLike = (0, import_util62.toWebResourceLike)(request3, { createProxy: true });
           const response = await httpPipeline.sendRequest(webResourceLike);
           return (0, import_response.toPipelineResponse)(response);
         }
@@ -46815,12 +46815,12 @@ var require_httpClientAdapter = __commonJS({
     });
     module2.exports = __toCommonJS2(httpClientAdapter_exports);
     var import_response = require_response2();
-    var import_util59 = require_util9();
+    var import_util62 = require_util9();
     function convertHttpClient2(requestPolicyClient) {
       return {
         sendRequest: async (request3) => {
           const response = await requestPolicyClient.sendRequest(
-            (0, import_util59.toWebResourceLike)(request3, { createProxy: true })
+            (0, import_util62.toWebResourceLike)(request3, { createProxy: true })
           );
           return (0, import_response.toPipelineResponse)(response);
         }
@@ -46858,7 +46858,7 @@ var require_commonjs9 = __commonJS({
       disableKeepAlivePolicyName: () => import_disableKeepAlivePolicy.disableKeepAlivePolicyName,
       requestPolicyFactoryPolicyName: () => import_requestPolicyFactoryPolicy.requestPolicyFactoryPolicyName,
       toCompatResponse: () => import_response.toCompatResponse,
-      toHttpHeadersLike: () => import_util59.toHttpHeadersLike
+      toHttpHeadersLike: () => import_util62.toHttpHeadersLike
     });
     module2.exports = __toCommonJS2(src_exports);
     var import_extendedClient = require_extendedClient();
@@ -46866,7 +46866,7 @@ var require_commonjs9 = __commonJS({
     var import_requestPolicyFactoryPolicy = require_requestPolicyFactoryPolicy();
     var import_disableKeepAlivePolicy = require_disableKeepAlivePolicy();
     var import_httpClientAdapter = require_httpClientAdapter();
-    var import_util59 = require_util9();
+    var import_util62 = require_util9();
   }
 });
 
@@ -99550,7 +99550,7 @@ var require_downloadUtils = __commonJS({
     var http_client_1 = require_lib();
     var storage_blob_1 = require_commonjs15();
     var buffer = __importStar2(require("buffer"));
-    var fs33 = __importStar2(require("fs"));
+    var fs34 = __importStar2(require("fs"));
     var stream2 = __importStar2(require("stream"));
     var util4 = __importStar2(require("util"));
     var utils = __importStar2(require_cacheUtils());
@@ -99661,7 +99661,7 @@ var require_downloadUtils = __commonJS({
     exports2.DownloadProgress = DownloadProgress;
     function downloadCacheHttpClient(archiveLocation, archivePath) {
       return __awaiter2(this, void 0, void 0, function* () {
-        const writeStream = fs33.createWriteStream(archivePath);
+        const writeStream = fs34.createWriteStream(archivePath);
         const httpClient = new http_client_1.HttpClient("actions/cache");
         const downloadResponse = yield (0, requestUtils_1.retryHttpClientResponse)("downloadCache", () => __awaiter2(this, void 0, void 0, function* () {
           return httpClient.get(archiveLocation);
@@ -99686,7 +99686,7 @@ var require_downloadUtils = __commonJS({
     function downloadCacheHttpClientConcurrent(archiveLocation, archivePath, options) {
       return __awaiter2(this, void 0, void 0, function* () {
         var _a6;
-        const archiveDescriptor = yield fs33.promises.open(archivePath, "w");
+        const archiveDescriptor = yield fs34.promises.open(archivePath, "w");
         const httpClient = new http_client_1.HttpClient("actions/cache", void 0, {
           socketTimeout: options.timeoutInMs,
           keepAlive: true
@@ -99802,7 +99802,7 @@ var require_downloadUtils = __commonJS({
         } else {
           const maxSegmentSize = Math.min(134217728, buffer.constants.MAX_LENGTH);
           const downloadProgress = new DownloadProgress(contentLength);
-          const fd = fs33.openSync(archivePath, "w");
+          const fd = fs34.openSync(archivePath, "w");
           try {
             downloadProgress.startDisplayTimer();
             const controller = new abort_controller_1.AbortController();
@@ -99820,12 +99820,12 @@ var require_downloadUtils = __commonJS({
                 controller.abort();
                 throw new Error("Aborting cache download as the download time exceeded the timeout.");
               } else if (Buffer.isBuffer(result)) {
-                fs33.writeFileSync(fd, result);
+                fs34.writeFileSync(fd, result);
               }
             }
           } finally {
             downloadProgress.stopDisplayTimer();
-            fs33.closeSync(fd);
+            fs34.closeSync(fd);
           }
         }
       });
@@ -100164,7 +100164,7 @@ var require_cacheHttpClient = __commonJS({
     var core29 = __importStar2(require_core());
     var http_client_1 = require_lib();
     var auth_1 = require_auth();
-    var fs33 = __importStar2(require("fs"));
+    var fs34 = __importStar2(require("fs"));
     var url_1 = require("url");
     var utils = __importStar2(require_cacheUtils());
     var uploadUtils_1 = require_uploadUtils();
@@ -100305,7 +100305,7 @@ Other caches with similar key:`);
       return __awaiter2(this, void 0, void 0, function* () {
         const fileSize = utils.getArchiveFileSizeInBytes(archivePath);
         const resourceUrl = getCacheApiUrl(`caches/${cacheId.toString()}`);
-        const fd = fs33.openSync(archivePath, "r");
+        const fd = fs34.openSync(archivePath, "r");
         const uploadOptions = (0, options_1.getUploadOptions)(options);
         const concurrency = utils.assertDefined("uploadConcurrency", uploadOptions.uploadConcurrency);
         const maxChunkSize = utils.assertDefined("uploadChunkSize", uploadOptions.uploadChunkSize);
@@ -100319,7 +100319,7 @@ Other caches with similar key:`);
               const start = offset;
               const end = offset + chunkSize - 1;
               offset += maxChunkSize;
-              yield uploadChunk(httpClient, resourceUrl, () => fs33.createReadStream(archivePath, {
+              yield uploadChunk(httpClient, resourceUrl, () => fs34.createReadStream(archivePath, {
                 fd,
                 start,
                 end,
@@ -100330,7 +100330,7 @@ Other caches with similar key:`);
             }
           })));
         } finally {
-          fs33.closeSync(fd);
+          fs34.closeSync(fd);
         }
         return;
       });
@@ -106361,21 +106361,21 @@ var require_manifest = __commonJS({
     exports2._findMatch = _findMatch;
     exports2._getOsVersion = _getOsVersion;
     exports2._readLinuxVersionFile = _readLinuxVersionFile;
-    var semver11 = __importStar2(require_semver2());
+    var semver12 = __importStar2(require_semver2());
     var core_1 = require_core();
-    var os7 = require("os");
+    var os8 = require("os");
     var cp = require("child_process");
-    var fs33 = require("fs");
+    var fs34 = require("fs");
     function _findMatch(versionSpec, stable, candidates, archFilter) {
       return __awaiter2(this, void 0, void 0, function* () {
-        const platFilter = os7.platform();
+        const platFilter = os8.platform();
         let result;
         let match2;
         let file;
         for (const candidate of candidates) {
           const version = candidate.version;
           (0, core_1.debug)(`check ${version} satisfies ${versionSpec}`);
-          if (semver11.satisfies(version, versionSpec) && (!stable || candidate.stable === stable)) {
+          if (semver12.satisfies(version, versionSpec) && (!stable || candidate.stable === stable)) {
             file = candidate.files.find((item) => {
               (0, core_1.debug)(`${item.arch}===${archFilter} && ${item.platform}===${platFilter}`);
               let chk = item.arch === archFilter && item.platform === platFilter;
@@ -106384,7 +106384,7 @@ var require_manifest = __commonJS({
                 if (osVersion === item.platform_version) {
                   chk = true;
                 } else {
-                  chk = semver11.satisfies(osVersion, item.platform_version);
+                  chk = semver12.satisfies(osVersion, item.platform_version);
                 }
               }
               return chk;
@@ -106404,7 +106404,7 @@ var require_manifest = __commonJS({
       });
     }
     function _getOsVersion() {
-      const plat = os7.platform();
+      const plat = os8.platform();
       let version = "";
       if (plat === "darwin") {
         version = cp.execSync("sw_vers -productVersion").toString();
@@ -106427,10 +106427,10 @@ var require_manifest = __commonJS({
       const lsbReleaseFile = "/etc/lsb-release";
       const osReleaseFile = "/etc/os-release";
       let contents = "";
-      if (fs33.existsSync(lsbReleaseFile)) {
-        contents = fs33.readFileSync(lsbReleaseFile).toString();
-      } else if (fs33.existsSync(osReleaseFile)) {
-        contents = fs33.readFileSync(osReleaseFile).toString();
+      if (fs34.existsSync(lsbReleaseFile)) {
+        contents = fs34.readFileSync(lsbReleaseFile).toString();
+      } else if (fs34.existsSync(osReleaseFile)) {
+        contents = fs34.readFileSync(osReleaseFile).toString();
       }
       return contents;
     }
@@ -106639,12 +106639,12 @@ var require_tool_cache = __commonJS({
     var core29 = __importStar2(require_core());
     var io9 = __importStar2(require_io());
     var crypto3 = __importStar2(require("crypto"));
-    var fs33 = __importStar2(require("fs"));
+    var fs34 = __importStar2(require("fs"));
     var mm = __importStar2(require_manifest());
-    var os7 = __importStar2(require("os"));
+    var os8 = __importStar2(require("os"));
     var path30 = __importStar2(require("path"));
     var httpm = __importStar2(require_lib());
-    var semver11 = __importStar2(require_semver2());
+    var semver12 = __importStar2(require_semver2());
     var stream2 = __importStar2(require("stream"));
     var util4 = __importStar2(require("util"));
     var assert_1 = require("assert");
@@ -106685,7 +106685,7 @@ var require_tool_cache = __commonJS({
     }
     function downloadToolAttempt(url2, dest, auth2, headers) {
       return __awaiter2(this, void 0, void 0, function* () {
-        if (fs33.existsSync(dest)) {
+        if (fs34.existsSync(dest)) {
           throw new Error(`Destination file path ${dest} already exists`);
         }
         const http = new httpm.HttpClient(userAgent2, [], {
@@ -106709,7 +106709,7 @@ var require_tool_cache = __commonJS({
         const readStream = responseMessageFactory();
         let succeeded = false;
         try {
-          yield pipeline2(readStream, fs33.createWriteStream(dest));
+          yield pipeline2(readStream, fs34.createWriteStream(dest));
           core29.debug("download complete");
           succeeded = true;
           return dest;
@@ -106917,15 +106917,15 @@ var require_tool_cache = __commonJS({
     }
     function cacheDir2(sourceDir, tool, version, arch2) {
       return __awaiter2(this, void 0, void 0, function* () {
-        version = semver11.clean(version) || version;
-        arch2 = arch2 || os7.arch();
+        version = semver12.clean(version) || version;
+        arch2 = arch2 || os8.arch();
         core29.debug(`Caching tool ${tool} ${version} ${arch2}`);
         core29.debug(`source dir: ${sourceDir}`);
-        if (!fs33.statSync(sourceDir).isDirectory()) {
+        if (!fs34.statSync(sourceDir).isDirectory()) {
           throw new Error("sourceDir is not a directory");
         }
         const destPath = yield _createToolPath(tool, version, arch2);
-        for (const itemName of fs33.readdirSync(sourceDir)) {
+        for (const itemName of fs34.readdirSync(sourceDir)) {
           const s = path30.join(sourceDir, itemName);
           yield io9.cp(s, destPath, { recursive: true });
         }
@@ -106935,11 +106935,11 @@ var require_tool_cache = __commonJS({
     }
     function cacheFile(sourceFile, targetFile, tool, version, arch2) {
       return __awaiter2(this, void 0, void 0, function* () {
-        version = semver11.clean(version) || version;
-        arch2 = arch2 || os7.arch();
+        version = semver12.clean(version) || version;
+        arch2 = arch2 || os8.arch();
         core29.debug(`Caching tool ${tool} ${version} ${arch2}`);
         core29.debug(`source file: ${sourceFile}`);
-        if (!fs33.statSync(sourceFile).isFile()) {
+        if (!fs34.statSync(sourceFile).isFile()) {
           throw new Error("sourceFile is not a file");
         }
         const destFolder = yield _createToolPath(tool, version, arch2);
@@ -106957,7 +106957,7 @@ var require_tool_cache = __commonJS({
       if (!versionSpec) {
         throw new Error("versionSpec parameter is required");
       }
-      arch2 = arch2 || os7.arch();
+      arch2 = arch2 || os8.arch();
       if (!isExplicitVersion(versionSpec)) {
         const localVersions = findAllVersions2(toolName, arch2);
         const match2 = evaluateVersions(localVersions, versionSpec);
@@ -106965,10 +106965,10 @@ var require_tool_cache = __commonJS({
       }
       let toolPath = "";
       if (versionSpec) {
-        versionSpec = semver11.clean(versionSpec) || "";
+        versionSpec = semver12.clean(versionSpec) || "";
         const cachePath = path30.join(_getCacheDirectory(), toolName, versionSpec, arch2);
         core29.debug(`checking cache: ${cachePath}`);
-        if (fs33.existsSync(cachePath) && fs33.existsSync(`${cachePath}.complete`)) {
+        if (fs34.existsSync(cachePath) && fs34.existsSync(`${cachePath}.complete`)) {
           core29.debug(`Found tool in cache ${toolName} ${versionSpec} ${arch2}`);
           toolPath = cachePath;
         } else {
@@ -106979,14 +106979,14 @@ var require_tool_cache = __commonJS({
     }
     function findAllVersions2(toolName, arch2) {
       const versions = [];
-      arch2 = arch2 || os7.arch();
+      arch2 = arch2 || os8.arch();
       const toolPath = path30.join(_getCacheDirectory(), toolName);
-      if (fs33.existsSync(toolPath)) {
-        const children = fs33.readdirSync(toolPath);
+      if (fs34.existsSync(toolPath)) {
+        const children = fs34.readdirSync(toolPath);
         for (const child of children) {
           if (isExplicitVersion(child)) {
             const fullPath = path30.join(toolPath, child, arch2 || "");
-            if (fs33.existsSync(fullPath) && fs33.existsSync(`${fullPath}.complete`)) {
+            if (fs34.existsSync(fullPath) && fs34.existsSync(`${fullPath}.complete`)) {
               versions.push(child);
             }
           }
@@ -107029,7 +107029,7 @@ var require_tool_cache = __commonJS({
       });
     }
     function findFromManifest(versionSpec_1, stable_1, manifest_1) {
-      return __awaiter2(this, arguments, void 0, function* (versionSpec, stable, manifest, archFilter = os7.arch()) {
+      return __awaiter2(this, arguments, void 0, function* (versionSpec, stable, manifest, archFilter = os8.arch()) {
         const match2 = yield mm._findMatch(versionSpec, stable, manifest, archFilter);
         return match2;
       });
@@ -107045,7 +107045,7 @@ var require_tool_cache = __commonJS({
     }
     function _createToolPath(tool, version, arch2) {
       return __awaiter2(this, void 0, void 0, function* () {
-        const folderPath = path30.join(_getCacheDirectory(), tool, semver11.clean(version) || version, arch2 || "");
+        const folderPath = path30.join(_getCacheDirectory(), tool, semver12.clean(version) || version, arch2 || "");
         core29.debug(`destination ${folderPath}`);
         const markerPath = `${folderPath}.complete`;
         yield io9.rmRF(folderPath);
@@ -107055,15 +107055,15 @@ var require_tool_cache = __commonJS({
       });
     }
     function _completeToolPath(tool, version, arch2) {
-      const folderPath = path30.join(_getCacheDirectory(), tool, semver11.clean(version) || version, arch2 || "");
+      const folderPath = path30.join(_getCacheDirectory(), tool, semver12.clean(version) || version, arch2 || "");
       const markerPath = `${folderPath}.complete`;
-      fs33.writeFileSync(markerPath, "");
+      fs34.writeFileSync(markerPath, "");
       core29.debug("finished caching tool");
     }
     function isExplicitVersion(versionSpec) {
-      const c = semver11.clean(versionSpec) || "";
+      const c = semver12.clean(versionSpec) || "";
       core29.debug(`isExplicit: ${c}`);
-      const valid4 = semver11.valid(c) != null;
+      const valid4 = semver12.valid(c) != null;
       core29.debug(`explicit? ${valid4}`);
       return valid4;
     }
@@ -107071,14 +107071,14 @@ var require_tool_cache = __commonJS({
       let version = "";
       core29.debug(`evaluating ${versions.length} versions`);
       versions = versions.sort((a, b) => {
-        if (semver11.gt(a, b)) {
+        if (semver12.gt(a, b)) {
           return 1;
         }
         return -1;
       });
       for (let i = versions.length - 1; i >= 0; i--) {
         const potential = versions[i];
-        const satisfied = semver11.satisfies(potential, versionSpec);
+        const satisfied = semver12.satisfies(potential, versionSpec);
         if (satisfied) {
           version = potential;
           break;
@@ -113270,15 +113270,15 @@ var require_upload_zip_specification = __commonJS({
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.getUploadZipSpecification = exports2.validateRootDirectory = void 0;
-    var fs33 = __importStar2(require("fs"));
+    var fs34 = __importStar2(require("fs"));
     var core_1 = require_core();
     var path_1 = require("path");
     var path_and_artifact_name_validation_1 = require_path_and_artifact_name_validation();
     function validateRootDirectory(rootDirectory) {
-      if (!fs33.existsSync(rootDirectory)) {
+      if (!fs34.existsSync(rootDirectory)) {
         throw new Error(`The provided rootDirectory ${rootDirectory} does not exist`);
       }
-      if (!fs33.statSync(rootDirectory).isDirectory()) {
+      if (!fs34.statSync(rootDirectory).isDirectory()) {
         throw new Error(`The provided rootDirectory ${rootDirectory} is not a valid directory`);
       }
       (0, core_1.info)(`Root directory input is valid!`);
@@ -113289,7 +113289,7 @@ var require_upload_zip_specification = __commonJS({
       rootDirectory = (0, path_1.normalize)(rootDirectory);
       rootDirectory = (0, path_1.resolve)(rootDirectory);
       for (let file of filesToZip) {
-        const stats = fs33.lstatSync(file, { throwIfNoEntry: false });
+        const stats = fs34.lstatSync(file, { throwIfNoEntry: false });
         if (!stats) {
           throw new Error(`File ${file} does not exist`);
         }
@@ -114364,13 +114364,13 @@ var require_minimatch2 = __commonJS({
 var require_readdir_glob = __commonJS({
   "node_modules/@actions/artifact/node_modules/readdir-glob/index.js"(exports2, module2) {
     module2.exports = readdirGlob2;
-    var fs33 = require("fs");
+    var fs34 = require("fs");
     var { EventEmitter: EventEmitter2 } = require("events");
     var { Minimatch: Minimatch2 } = require_minimatch2();
     var { resolve: resolve15 } = require("path");
     function readdir3(dir, strict) {
       return new Promise((resolve16, reject) => {
-        fs33.readdir(dir, { withFileTypes: true }, (err, files) => {
+        fs34.readdir(dir, { withFileTypes: true }, (err, files) => {
           if (err) {
             switch (err.code) {
               case "ENOTDIR":
@@ -114403,7 +114403,7 @@ var require_readdir_glob = __commonJS({
     }
     function stat2(file, followSymlinks) {
       return new Promise((resolve16, reject) => {
-        const statFunc = followSymlinks ? fs33.stat : fs33.lstat;
+        const statFunc = followSymlinks ? fs34.stat : fs34.lstat;
         statFunc(file, (err, stats) => {
           if (err) {
             switch (err.code) {
@@ -116468,54 +116468,54 @@ var require_polyfills = __commonJS({
     }
     var chdir;
     module2.exports = patch;
-    function patch(fs33) {
+    function patch(fs34) {
       if (constants.hasOwnProperty("O_SYMLINK") && process.version.match(/^v0\.6\.[0-2]|^v0\.5\./)) {
-        patchLchmod(fs33);
-      }
-      if (!fs33.lutimes) {
-        patchLutimes(fs33);
-      }
-      fs33.chown = chownFix(fs33.chown);
-      fs33.fchown = chownFix(fs33.fchown);
-      fs33.lchown = chownFix(fs33.lchown);
-      fs33.chmod = chmodFix(fs33.chmod);
-      fs33.fchmod = chmodFix(fs33.fchmod);
-      fs33.lchmod = chmodFix(fs33.lchmod);
-      fs33.chownSync = chownFixSync(fs33.chownSync);
-      fs33.fchownSync = chownFixSync(fs33.fchownSync);
-      fs33.lchownSync = chownFixSync(fs33.lchownSync);
-      fs33.chmodSync = chmodFixSync(fs33.chmodSync);
-      fs33.fchmodSync = chmodFixSync(fs33.fchmodSync);
-      fs33.lchmodSync = chmodFixSync(fs33.lchmodSync);
-      fs33.stat = statFix(fs33.stat);
-      fs33.fstat = statFix(fs33.fstat);
-      fs33.lstat = statFix(fs33.lstat);
-      fs33.statSync = statFixSync(fs33.statSync);
-      fs33.fstatSync = statFixSync(fs33.fstatSync);
-      fs33.lstatSync = statFixSync(fs33.lstatSync);
-      if (fs33.chmod && !fs33.lchmod) {
-        fs33.lchmod = function(path30, mode, cb) {
+        patchLchmod(fs34);
+      }
+      if (!fs34.lutimes) {
+        patchLutimes(fs34);
+      }
+      fs34.chown = chownFix(fs34.chown);
+      fs34.fchown = chownFix(fs34.fchown);
+      fs34.lchown = chownFix(fs34.lchown);
+      fs34.chmod = chmodFix(fs34.chmod);
+      fs34.fchmod = chmodFix(fs34.fchmod);
+      fs34.lchmod = chmodFix(fs34.lchmod);
+      fs34.chownSync = chownFixSync(fs34.chownSync);
+      fs34.fchownSync = chownFixSync(fs34.fchownSync);
+      fs34.lchownSync = chownFixSync(fs34.lchownSync);
+      fs34.chmodSync = chmodFixSync(fs34.chmodSync);
+      fs34.fchmodSync = chmodFixSync(fs34.fchmodSync);
+      fs34.lchmodSync = chmodFixSync(fs34.lchmodSync);
+      fs34.stat = statFix(fs34.stat);
+      fs34.fstat = statFix(fs34.fstat);
+      fs34.lstat = statFix(fs34.lstat);
+      fs34.statSync = statFixSync(fs34.statSync);
+      fs34.fstatSync = statFixSync(fs34.fstatSync);
+      fs34.lstatSync = statFixSync(fs34.lstatSync);
+      if (fs34.chmod && !fs34.lchmod) {
+        fs34.lchmod = function(path30, mode, cb) {
           if (cb) process.nextTick(cb);
         };
-        fs33.lchmodSync = function() {
+        fs34.lchmodSync = function() {
         };
       }
-      if (fs33.chown && !fs33.lchown) {
-        fs33.lchown = function(path30, uid, gid, cb) {
+      if (fs34.chown && !fs34.lchown) {
+        fs34.lchown = function(path30, uid, gid, cb) {
           if (cb) process.nextTick(cb);
         };
-        fs33.lchownSync = function() {
+        fs34.lchownSync = function() {
         };
       }
       if (platform2 === "win32") {
-        fs33.rename = typeof fs33.rename !== "function" ? fs33.rename : (function(fs$rename) {
+        fs34.rename = typeof fs34.rename !== "function" ? fs34.rename : (function(fs$rename) {
           function rename(from, to, cb) {
             var start = Date.now();
             var backoff = 0;
             fs$rename(from, to, function CB(er) {
               if (er && (er.code === "EACCES" || er.code === "EPERM") && Date.now() - start < 6e4) {
                 setTimeout(function() {
-                  fs33.stat(to, function(stater, st) {
+                  fs34.stat(to, function(stater, st) {
                     if (stater && stater.code === "ENOENT")
                       fs$rename(from, to, CB);
                     else
@@ -116531,9 +116531,9 @@ var require_polyfills = __commonJS({
           }
           if (Object.setPrototypeOf) Object.setPrototypeOf(rename, fs$rename);
           return rename;
-        })(fs33.rename);
+        })(fs34.rename);
       }
-      fs33.read = typeof fs33.read !== "function" ? fs33.read : (function(fs$read) {
+      fs34.read = typeof fs34.read !== "function" ? fs34.read : (function(fs$read) {
         function read(fd, buffer, offset, length, position, callback_) {
           var callback;
           if (callback_ && typeof callback_ === "function") {
@@ -116541,22 +116541,22 @@ var require_polyfills = __commonJS({
             callback = function(er, _2, __) {
               if (er && er.code === "EAGAIN" && eagCounter < 10) {
                 eagCounter++;
-                return fs$read.call(fs33, fd, buffer, offset, length, position, callback);
+                return fs$read.call(fs34, fd, buffer, offset, length, position, callback);
               }
               callback_.apply(this, arguments);
             };
           }
-          return fs$read.call(fs33, fd, buffer, offset, length, position, callback);
+          return fs$read.call(fs34, fd, buffer, offset, length, position, callback);
         }
         if (Object.setPrototypeOf) Object.setPrototypeOf(read, fs$read);
         return read;
-      })(fs33.read);
-      fs33.readSync = typeof fs33.readSync !== "function" ? fs33.readSync : /* @__PURE__ */ (function(fs$readSync) {
+      })(fs34.read);
+      fs34.readSync = typeof fs34.readSync !== "function" ? fs34.readSync : /* @__PURE__ */ (function(fs$readSync) {
         return function(fd, buffer, offset, length, position) {
           var eagCounter = 0;
           while (true) {
             try {
-              return fs$readSync.call(fs33, fd, buffer, offset, length, position);
+              return fs$readSync.call(fs34, fd, buffer, offset, length, position);
             } catch (er) {
               if (er.code === "EAGAIN" && eagCounter < 10) {
                 eagCounter++;
@@ -116566,10 +116566,10 @@ var require_polyfills = __commonJS({
             }
           }
         };
-      })(fs33.readSync);
-      function patchLchmod(fs34) {
-        fs34.lchmod = function(path30, mode, callback) {
-          fs34.open(
+      })(fs34.readSync);
+      function patchLchmod(fs35) {
+        fs35.lchmod = function(path30, mode, callback) {
+          fs35.open(
             path30,
             constants.O_WRONLY | constants.O_SYMLINK,
             mode,
@@ -116578,80 +116578,80 @@ var require_polyfills = __commonJS({
                 if (callback) callback(err);
                 return;
               }
-              fs34.fchmod(fd, mode, function(err2) {
-                fs34.close(fd, function(err22) {
+              fs35.fchmod(fd, mode, function(err2) {
+                fs35.close(fd, function(err22) {
                   if (callback) callback(err2 || err22);
                 });
               });
             }
           );
         };
-        fs34.lchmodSync = function(path30, mode) {
-          var fd = fs34.openSync(path30, constants.O_WRONLY | constants.O_SYMLINK, mode);
+        fs35.lchmodSync = function(path30, mode) {
+          var fd = fs35.openSync(path30, constants.O_WRONLY | constants.O_SYMLINK, mode);
           var threw = true;
           var ret;
           try {
-            ret = fs34.fchmodSync(fd, mode);
+            ret = fs35.fchmodSync(fd, mode);
             threw = false;
           } finally {
             if (threw) {
               try {
-                fs34.closeSync(fd);
+                fs35.closeSync(fd);
               } catch (er) {
               }
             } else {
-              fs34.closeSync(fd);
+              fs35.closeSync(fd);
             }
           }
           return ret;
         };
       }
-      function patchLutimes(fs34) {
-        if (constants.hasOwnProperty("O_SYMLINK") && fs34.futimes) {
-          fs34.lutimes = function(path30, at, mt, cb) {
-            fs34.open(path30, constants.O_SYMLINK, function(er, fd) {
+      function patchLutimes(fs35) {
+        if (constants.hasOwnProperty("O_SYMLINK") && fs35.futimes) {
+          fs35.lutimes = function(path30, at, mt, cb) {
+            fs35.open(path30, constants.O_SYMLINK, function(er, fd) {
               if (er) {
                 if (cb) cb(er);
                 return;
               }
-              fs34.futimes(fd, at, mt, function(er2) {
-                fs34.close(fd, function(er22) {
+              fs35.futimes(fd, at, mt, function(er2) {
+                fs35.close(fd, function(er22) {
                   if (cb) cb(er2 || er22);
                 });
               });
             });
           };
-          fs34.lutimesSync = function(path30, at, mt) {
-            var fd = fs34.openSync(path30, constants.O_SYMLINK);
+          fs35.lutimesSync = function(path30, at, mt) {
+            var fd = fs35.openSync(path30, constants.O_SYMLINK);
             var ret;
             var threw = true;
             try {
-              ret = fs34.futimesSync(fd, at, mt);
+              ret = fs35.futimesSync(fd, at, mt);
               threw = false;
             } finally {
               if (threw) {
                 try {
-                  fs34.closeSync(fd);
+                  fs35.closeSync(fd);
                 } catch (er) {
                 }
               } else {
-                fs34.closeSync(fd);
+                fs35.closeSync(fd);
               }
             }
             return ret;
           };
-        } else if (fs34.futimes) {
-          fs34.lutimes = function(_a6, _b2, _c2, cb) {
+        } else if (fs35.futimes) {
+          fs35.lutimes = function(_a6, _b2, _c2, cb) {
             if (cb) process.nextTick(cb);
           };
-          fs34.lutimesSync = function() {
+          fs35.lutimesSync = function() {
           };
         }
       }
       function chmodFix(orig) {
         if (!orig) return orig;
         return function(target, mode, cb) {
-          return orig.call(fs33, target, mode, function(er) {
+          return orig.call(fs34, target, mode, function(er) {
             if (chownErOk(er)) er = null;
             if (cb) cb.apply(this, arguments);
           });
@@ -116661,7 +116661,7 @@ var require_polyfills = __commonJS({
         if (!orig) return orig;
         return function(target, mode) {
           try {
-            return orig.call(fs33, target, mode);
+            return orig.call(fs34, target, mode);
           } catch (er) {
             if (!chownErOk(er)) throw er;
           }
@@ -116670,7 +116670,7 @@ var require_polyfills = __commonJS({
       function chownFix(orig) {
         if (!orig) return orig;
         return function(target, uid, gid, cb) {
-          return orig.call(fs33, target, uid, gid, function(er) {
+          return orig.call(fs34, target, uid, gid, function(er) {
             if (chownErOk(er)) er = null;
             if (cb) cb.apply(this, arguments);
           });
@@ -116680,7 +116680,7 @@ var require_polyfills = __commonJS({
         if (!orig) return orig;
         return function(target, uid, gid) {
           try {
-            return orig.call(fs33, target, uid, gid);
+            return orig.call(fs34, target, uid, gid);
           } catch (er) {
             if (!chownErOk(er)) throw er;
           }
@@ -116700,13 +116700,13 @@ var require_polyfills = __commonJS({
             }
             if (cb) cb.apply(this, arguments);
           }
-          return options ? orig.call(fs33, target, options, callback) : orig.call(fs33, target, callback);
+          return options ? orig.call(fs34, target, options, callback) : orig.call(fs34, target, callback);
         };
       }
       function statFixSync(orig) {
         if (!orig) return orig;
         return function(target, options) {
-          var stats = options ? orig.call(fs33, target, options) : orig.call(fs33, target);
+          var stats = options ? orig.call(fs34, target, options) : orig.call(fs34, target);
           if (stats) {
             if (stats.uid < 0) stats.uid += 4294967296;
             if (stats.gid < 0) stats.gid += 4294967296;
@@ -116735,7 +116735,7 @@ var require_legacy_streams = __commonJS({
   "node_modules/graceful-fs/legacy-streams.js"(exports2, module2) {
     var Stream = require("stream").Stream;
     module2.exports = legacy;
-    function legacy(fs33) {
+    function legacy(fs34) {
       return {
         ReadStream,
         WriteStream
@@ -116778,7 +116778,7 @@ var require_legacy_streams = __commonJS({
           });
           return;
         }
-        fs33.open(this.path, this.flags, this.mode, function(err, fd) {
+        fs34.open(this.path, this.flags, this.mode, function(err, fd) {
           if (err) {
             self2.emit("error", err);
             self2.readable = false;
@@ -116817,7 +116817,7 @@ var require_legacy_streams = __commonJS({
         this.busy = false;
         this._queue = [];
         if (this.fd === null) {
-          this._open = fs33.open;
+          this._open = fs34.open;
           this._queue.push([this._open, this.path, this.flags, this.mode, void 0]);
           this.flush();
         }
@@ -116852,7 +116852,7 @@ var require_clone = __commonJS({
 // node_modules/graceful-fs/graceful-fs.js
 var require_graceful_fs = __commonJS({
   "node_modules/graceful-fs/graceful-fs.js"(exports2, module2) {
-    var fs33 = require("fs");
+    var fs34 = require("fs");
     var polyfills = require_polyfills();
     var legacy = require_legacy_streams();
     var clone = require_clone();
@@ -116884,12 +116884,12 @@ var require_graceful_fs = __commonJS({
         m = "GFS4: " + m.split(/\n/).join("\nGFS4: ");
         console.error(m);
       };
-    if (!fs33[gracefulQueue]) {
+    if (!fs34[gracefulQueue]) {
       queue2 = global[gracefulQueue] || [];
-      publishQueue(fs33, queue2);
-      fs33.close = (function(fs$close) {
+      publishQueue(fs34, queue2);
+      fs34.close = (function(fs$close) {
         function close(fd, cb) {
-          return fs$close.call(fs33, fd, function(err) {
+          return fs$close.call(fs34, fd, function(err) {
             if (!err) {
               resetQueue();
             }
@@ -116901,40 +116901,40 @@ var require_graceful_fs = __commonJS({
           value: fs$close
         });
         return close;
-      })(fs33.close);
-      fs33.closeSync = (function(fs$closeSync) {
+      })(fs34.close);
+      fs34.closeSync = (function(fs$closeSync) {
         function closeSync(fd) {
-          fs$closeSync.apply(fs33, arguments);
+          fs$closeSync.apply(fs34, arguments);
           resetQueue();
         }
         Object.defineProperty(closeSync, previousSymbol, {
           value: fs$closeSync
         });
         return closeSync;
-      })(fs33.closeSync);
+      })(fs34.closeSync);
       if (/\bgfs4\b/i.test(process.env.NODE_DEBUG || "")) {
         process.on("exit", function() {
-          debug6(fs33[gracefulQueue]);
-          require("assert").equal(fs33[gracefulQueue].length, 0);
+          debug6(fs34[gracefulQueue]);
+          require("assert").equal(fs34[gracefulQueue].length, 0);
         });
       }
     }
     var queue2;
     if (!global[gracefulQueue]) {
-      publishQueue(global, fs33[gracefulQueue]);
-    }
-    module2.exports = patch(clone(fs33));
-    if (process.env.TEST_GRACEFUL_FS_GLOBAL_PATCH && !fs33.__patched) {
-      module2.exports = patch(fs33);
-      fs33.__patched = true;
-    }
-    function patch(fs34) {
-      polyfills(fs34);
-      fs34.gracefulify = patch;
-      fs34.createReadStream = createReadStream4;
-      fs34.createWriteStream = createWriteStream3;
-      var fs$readFile = fs34.readFile;
-      fs34.readFile = readFile;
+      publishQueue(global, fs34[gracefulQueue]);
+    }
+    module2.exports = patch(clone(fs34));
+    if (process.env.TEST_GRACEFUL_FS_GLOBAL_PATCH && !fs34.__patched) {
+      module2.exports = patch(fs34);
+      fs34.__patched = true;
+    }
+    function patch(fs35) {
+      polyfills(fs35);
+      fs35.gracefulify = patch;
+      fs35.createReadStream = createReadStream4;
+      fs35.createWriteStream = createWriteStream3;
+      var fs$readFile = fs35.readFile;
+      fs35.readFile = readFile;
       function readFile(path30, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
@@ -116950,8 +116950,8 @@ var require_graceful_fs = __commonJS({
           });
         }
       }
-      var fs$writeFile = fs34.writeFile;
-      fs34.writeFile = writeFile;
+      var fs$writeFile = fs35.writeFile;
+      fs35.writeFile = writeFile;
       function writeFile(path30, data, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
@@ -116967,9 +116967,9 @@ var require_graceful_fs = __commonJS({
           });
         }
       }
-      var fs$appendFile = fs34.appendFile;
+      var fs$appendFile = fs35.appendFile;
       if (fs$appendFile)
-        fs34.appendFile = appendFile;
+        fs35.appendFile = appendFile;
       function appendFile(path30, data, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
@@ -116985,9 +116985,9 @@ var require_graceful_fs = __commonJS({
           });
         }
       }
-      var fs$copyFile = fs34.copyFile;
+      var fs$copyFile = fs35.copyFile;
       if (fs$copyFile)
-        fs34.copyFile = copyFile2;
+        fs35.copyFile = copyFile2;
       function copyFile2(src, dest, flags, cb) {
         if (typeof flags === "function") {
           cb = flags;
@@ -117005,8 +117005,8 @@ var require_graceful_fs = __commonJS({
           });
         }
       }
-      var fs$readdir = fs34.readdir;
-      fs34.readdir = readdir3;
+      var fs$readdir = fs35.readdir;
+      fs35.readdir = readdir3;
       var noReaddirOptionVersions = /^v[0-5]\./;
       function readdir3(path30, options, cb) {
         if (typeof options === "function")
@@ -117047,21 +117047,21 @@ var require_graceful_fs = __commonJS({
         }
       }
       if (process.version.substr(0, 4) === "v0.8") {
-        var legStreams = legacy(fs34);
+        var legStreams = legacy(fs35);
         ReadStream = legStreams.ReadStream;
         WriteStream = legStreams.WriteStream;
       }
-      var fs$ReadStream = fs34.ReadStream;
+      var fs$ReadStream = fs35.ReadStream;
       if (fs$ReadStream) {
         ReadStream.prototype = Object.create(fs$ReadStream.prototype);
         ReadStream.prototype.open = ReadStream$open;
       }
-      var fs$WriteStream = fs34.WriteStream;
+      var fs$WriteStream = fs35.WriteStream;
       if (fs$WriteStream) {
         WriteStream.prototype = Object.create(fs$WriteStream.prototype);
         WriteStream.prototype.open = WriteStream$open;
       }
-      Object.defineProperty(fs34, "ReadStream", {
+      Object.defineProperty(fs35, "ReadStream", {
         get: function() {
           return ReadStream;
         },
@@ -117071,7 +117071,7 @@ var require_graceful_fs = __commonJS({
         enumerable: true,
         configurable: true
       });
-      Object.defineProperty(fs34, "WriteStream", {
+      Object.defineProperty(fs35, "WriteStream", {
         get: function() {
           return WriteStream;
         },
@@ -117082,7 +117082,7 @@ var require_graceful_fs = __commonJS({
         configurable: true
       });
       var FileReadStream = ReadStream;
-      Object.defineProperty(fs34, "FileReadStream", {
+      Object.defineProperty(fs35, "FileReadStream", {
         get: function() {
           return FileReadStream;
         },
@@ -117093,7 +117093,7 @@ var require_graceful_fs = __commonJS({
         configurable: true
       });
       var FileWriteStream = WriteStream;
-      Object.defineProperty(fs34, "FileWriteStream", {
+      Object.defineProperty(fs35, "FileWriteStream", {
         get: function() {
           return FileWriteStream;
         },
@@ -117142,13 +117142,13 @@ var require_graceful_fs = __commonJS({
         });
       }
       function createReadStream4(path30, options) {
-        return new fs34.ReadStream(path30, options);
+        return new fs35.ReadStream(path30, options);
       }
       function createWriteStream3(path30, options) {
-        return new fs34.WriteStream(path30, options);
+        return new fs35.WriteStream(path30, options);
       }
-      var fs$open = fs34.open;
-      fs34.open = open;
+      var fs$open = fs35.open;
+      fs35.open = open;
       function open(path30, flags, mode, cb) {
         if (typeof mode === "function")
           cb = mode, mode = null;
@@ -117164,20 +117164,20 @@ var require_graceful_fs = __commonJS({
           });
         }
       }
-      return fs34;
+      return fs35;
     }
     function enqueue(elem) {
       debug6("ENQUEUE", elem[0].name, elem[1]);
-      fs33[gracefulQueue].push(elem);
+      fs34[gracefulQueue].push(elem);
       retry2();
     }
     var retryTimer;
     function resetQueue() {
       var now = Date.now();
-      for (var i = 0; i < fs33[gracefulQueue].length; ++i) {
-        if (fs33[gracefulQueue][i].length > 2) {
-          fs33[gracefulQueue][i][3] = now;
-          fs33[gracefulQueue][i][4] = now;
+      for (var i = 0; i < fs34[gracefulQueue].length; ++i) {
+        if (fs34[gracefulQueue][i].length > 2) {
+          fs34[gracefulQueue][i][3] = now;
+          fs34[gracefulQueue][i][4] = now;
         }
       }
       retry2();
@@ -117185,9 +117185,9 @@ var require_graceful_fs = __commonJS({
     function retry2() {
       clearTimeout(retryTimer);
       retryTimer = void 0;
-      if (fs33[gracefulQueue].length === 0)
+      if (fs34[gracefulQueue].length === 0)
         return;
-      var elem = fs33[gracefulQueue].shift();
+      var elem = fs34[gracefulQueue].shift();
       var fn = elem[0];
       var args = elem[1];
       var err = elem[2];
@@ -117209,7 +117209,7 @@ var require_graceful_fs = __commonJS({
           debug6("RETRY", fn.name, args);
           fn.apply(null, args.concat([startTime]));
         } else {
-          fs33[gracefulQueue].push(elem);
+          fs34[gracefulQueue].push(elem);
         }
       }
       if (retryTimer === void 0) {
@@ -128032,15 +128032,15 @@ globstar while`, t, d, e, u, m), this.matchOne(t.slice(d), e.slice(u), s)) retur
       g.minimatch.escape = vi.escape;
       g.minimatch.unescape = Ei.unescape;
     });
-    var fs33 = R((Wt) => {
+    var fs34 = R((Wt) => {
       "use strict";
       Object.defineProperty(Wt, "__esModule", { value: true });
       Wt.LRUCache = void 0;
       var er = typeof performance == "object" && performance && typeof performance.now == "function" ? performance : Date, as = /* @__PURE__ */ new Set(), ge = typeof process == "object" && process ? process : {}, ls = (n, t, e, s) => {
         typeof ge.emitWarning == "function" ? ge.emitWarning(n, t, e, s) : console.error(`[${e}] ${t}: ${n}`);
-      }, Lt = globalThis.AbortController, os7 = globalThis.AbortSignal;
+      }, Lt = globalThis.AbortController, os8 = globalThis.AbortSignal;
       if (typeof Lt > "u") {
-        os7 = class {
+        os8 = class {
           onabort;
           _onabort = [];
           reason;
@@ -128052,7 +128052,7 @@ globstar while`, t, d, e, u, m), this.matchOne(t.slice(d), e.slice(u), s)) retur
           constructor() {
             t();
           }
-          signal = new os7();
+          signal = new os8();
           abort(e) {
             if (!this.signal.aborted) {
               this.signal.reason = e, this.signal.aborted = true;
@@ -128901,7 +128901,7 @@ globstar while`, t, d, e, u, m), this.matchOne(t.slice(d), e.slice(u), s)) retur
       };
       Object.defineProperty(_2, "__esModule", { value: true });
       _2.PathScurry = _2.Path = _2.PathScurryDarwin = _2.PathScurryPosix = _2.PathScurryWin32 = _2.PathScurryBase = _2.PathPosix = _2.PathWin32 = _2.PathBase = _2.ChildrenCache = _2.ResolveCache = void 0;
-      var Qt = fs33(), Yt = require("node:path"), yr = require("node:url"), pt = require("fs"), Sr = br(require("node:fs")), vr = pt.realpathSync.native, Ht = require("node:fs/promises"), bs = Oe(), mt = { lstatSync: pt.lstatSync, readdir: pt.readdir, readdirSync: pt.readdirSync, readlinkSync: pt.readlinkSync, realpathSync: vr, promises: { lstat: Ht.lstat, readdir: Ht.readdir, readlink: Ht.readlink, realpath: Ht.realpath } }, _s2 = (n) => !n || n === mt || n === Sr ? mt : { ...mt, ...n, promises: { ...mt.promises, ...n.promises || {} } }, Os = /^\\\\\?\\([a-z]:)\\?$/i, Er = (n) => n.replace(/\//g, "\\").replace(Os, "$1\\"), _r2 = /[\\\/]/, N = 0, xs = 1, Ts = 2, G = 4, Cs = 6, Rs = 8, Q = 10, As = 12, j = 15, dt = ~j, xe = 16, ys = 32, gt = 64, W = 128, Vt = 256, Xt = 512, Ss = gt | W | Xt, Or = 1023, Te = (n) => n.isFile() ? Rs : n.isDirectory() ? G : n.isSymbolicLink() ? Q : n.isCharacterDevice() ? Ts : n.isBlockDevice() ? Cs : n.isSocket() ? As : n.isFIFO() ? xs : N, vs = new Qt.LRUCache({ max: 2 ** 12 }), wt = (n) => {
+      var Qt = fs34(), Yt = require("node:path"), yr = require("node:url"), pt = require("fs"), Sr = br(require("node:fs")), vr = pt.realpathSync.native, Ht = require("node:fs/promises"), bs = Oe(), mt = { lstatSync: pt.lstatSync, readdir: pt.readdir, readdirSync: pt.readdirSync, readlinkSync: pt.readlinkSync, realpathSync: vr, promises: { lstat: Ht.lstat, readdir: Ht.readdir, readlink: Ht.readlink, realpath: Ht.realpath } }, _s2 = (n) => !n || n === mt || n === Sr ? mt : { ...mt, ...n, promises: { ...mt.promises, ...n.promises || {} } }, Os = /^\\\\\?\\([a-z]:)\\?$/i, Er = (n) => n.replace(/\//g, "\\").replace(Os, "$1\\"), _r2 = /[\\\/]/, N = 0, xs = 1, Ts = 2, G = 4, Cs = 6, Rs = 8, Q = 10, As = 12, j = 15, dt = ~j, xe = 16, ys = 32, gt = 64, W = 128, Vt = 256, Xt = 512, Ss = gt | W | Xt, Or = 1023, Te = (n) => n.isFile() ? Rs : n.isDirectory() ? G : n.isSymbolicLink() ? Q : n.isCharacterDevice() ? Ts : n.isBlockDevice() ? Cs : n.isSocket() ? As : n.isFIFO() ? xs : N, vs = new Qt.LRUCache({ max: 2 ** 12 }), wt = (n) => {
         let t = vs.get(n);
         if (t) return t;
         let e = n.normalize("NFKD");
@@ -130279,7 +130279,7 @@ globstar while`, t, d, e, u, m), this.matchOne(t.slice(d), e.slice(u), s)) retur
 // node_modules/archiver-utils/file.js
 var require_file3 = __commonJS({
   "node_modules/archiver-utils/file.js"(exports2, module2) {
-    var fs33 = require_graceful_fs();
+    var fs34 = require_graceful_fs();
     var path30 = require("path");
     var flatten = require_flatten();
     var difference = require_difference();
@@ -130306,7 +130306,7 @@ var require_file3 = __commonJS({
     };
     file.exists = function() {
       var filepath = path30.join.apply(path30, arguments);
-      return fs33.existsSync(filepath);
+      return fs34.existsSync(filepath);
     };
     file.expand = function(...args) {
       var options = isPlainObject4(args[0]) ? args.shift() : {};
@@ -130324,7 +130324,7 @@ var require_file3 = __commonJS({
             if (typeof options.filter === "function") {
               return options.filter(filepath);
             } else {
-              return fs33.statSync(filepath)[options.filter]();
+              return fs34.statSync(filepath)[options.filter]();
             }
           } catch (e) {
             return false;
@@ -130432,7 +130432,7 @@ var require_file3 = __commonJS({
 // node_modules/archiver-utils/index.js
 var require_archiver_utils = __commonJS({
   "node_modules/archiver-utils/index.js"(exports2, module2) {
-    var fs33 = require_graceful_fs();
+    var fs34 = require_graceful_fs();
     var path30 = require("path");
     var isStream2 = require_is_stream();
     var lazystream = require_lazystream();
@@ -130481,7 +130481,7 @@ var require_archiver_utils = __commonJS({
     };
     utils.lazyReadStream = function(filepath) {
       return new lazystream.Readable(function() {
-        return fs33.createReadStream(filepath);
+        return fs34.createReadStream(filepath);
       });
     };
     utils.normalizeInputSource = function(source) {
@@ -130509,7 +130509,7 @@ var require_archiver_utils = __commonJS({
         callback = base;
         base = dirpath;
       }
-      fs33.readdir(dirpath, function(err, list) {
+      fs34.readdir(dirpath, function(err, list) {
         var i = 0;
         var file;
         var filepath;
@@ -130522,7 +130522,7 @@ var require_archiver_utils = __commonJS({
             return callback(null, results);
           }
           filepath = path30.join(dirpath, file);
-          fs33.stat(filepath, function(err2, stats) {
+          fs34.stat(filepath, function(err2, stats) {
             results.push({
               path: filepath,
               relative: path30.relative(base, filepath).replace(/\\/g, "/"),
@@ -130584,7 +130584,7 @@ var require_error3 = __commonJS({
 // node_modules/@actions/artifact/node_modules/archiver/lib/core.js
 var require_core2 = __commonJS({
   "node_modules/@actions/artifact/node_modules/archiver/lib/core.js"(exports2, module2) {
-    var fs33 = require("fs");
+    var fs34 = require("fs");
     var glob2 = require_readdir_glob();
     var async = require_async();
     var path30 = require("path");
@@ -130648,7 +130648,7 @@ var require_core2 = __commonJS({
       data.sourcePath = filepath;
       task.data = data;
       this._entriesCount++;
-      if (data.stats && data.stats instanceof fs33.Stats) {
+      if (data.stats && data.stats instanceof fs34.Stats) {
         task = this._updateQueueTaskWithStats(task, data.stats);
         if (task) {
           if (data.stats.size) {
@@ -130819,7 +130819,7 @@ var require_core2 = __commonJS({
         callback();
         return;
       }
-      fs33.lstat(task.filepath, function(err, stats) {
+      fs34.lstat(task.filepath, function(err, stats) {
         if (this._state.aborted) {
           setImmediate(callback);
           return;
@@ -130862,7 +130862,7 @@ var require_core2 = __commonJS({
         task.data.sourceType = "buffer";
         task.source = Buffer.concat([]);
       } else if (stats.isSymbolicLink() && this._moduleSupports("symlink")) {
-        var linkPath = fs33.readlinkSync(task.filepath);
+        var linkPath = fs34.readlinkSync(task.filepath);
         var dirName = path30.dirname(task.filepath);
         task.data.type = "symlink";
         task.data.linkname = path30.relative(dirName, path30.resolve(dirName, linkPath));
@@ -136579,7 +136579,7 @@ var require_dist_node2 = __commonJS({
         return template.replace(/\/$/, "");
       }
     }
-    function parse3(options) {
+    function parse4(options) {
       let method = options.method.toUpperCase();
       let url2 = (options.url || "/").replace(/:([a-z]\w+)/g, "{$1}");
       let headers = Object.assign({}, options.headers);
@@ -136643,7 +136643,7 @@ var require_dist_node2 = __commonJS({
       );
     }
     function endpointWithDefaults2(defaults3, route, options) {
-      return parse3(merge2(defaults3, route, options));
+      return parse4(merge2(defaults3, route, options));
     }
     function withDefaults4(oldDefaults, newDefaults) {
       const DEFAULTS22 = merge2(oldDefaults, newDefaults);
@@ -136652,7 +136652,7 @@ var require_dist_node2 = __commonJS({
         DEFAULTS: DEFAULTS22,
         defaults: withDefaults4.bind(null, DEFAULTS22),
         merge: merge2.bind(null, DEFAULTS22),
-        parse: parse3
+        parse: parse4
       });
     }
     var endpoint2 = withDefaults4(null, DEFAULTS2);
@@ -140884,7 +140884,7 @@ var require_binary = __commonJS({
       });
       return stream2;
     };
-    exports2.parse = function parse3(buffer) {
+    exports2.parse = function parse4(buffer) {
       var self2 = words(function(bytes, cb) {
         return function(name) {
           if (offset + bytes <= buffer.length) {
@@ -141764,7 +141764,7 @@ var require_parser_stream = __commonJS({
 var require_mkdirp = __commonJS({
   "node_modules/mkdirp/index.js"(exports2, module2) {
     var path30 = require("path");
-    var fs33 = require("fs");
+    var fs34 = require("fs");
     var _0777 = parseInt("0777", 8);
     module2.exports = mkdirP.mkdirp = mkdirP.mkdirP = mkdirP;
     function mkdirP(p, opts, f, made) {
@@ -141775,7 +141775,7 @@ var require_mkdirp = __commonJS({
         opts = { mode: opts };
       }
       var mode = opts.mode;
-      var xfs = opts.fs || fs33;
+      var xfs = opts.fs || fs34;
       if (mode === void 0) {
         mode = _0777;
       }
@@ -141814,7 +141814,7 @@ var require_mkdirp = __commonJS({
         opts = { mode: opts };
       }
       var mode = opts.mode;
-      var xfs = opts.fs || fs33;
+      var xfs = opts.fs || fs34;
       if (mode === void 0) {
         mode = _0777;
       }
@@ -141851,7 +141851,7 @@ var require_mkdirp = __commonJS({
 // node_modules/unzip-stream/lib/extract.js
 var require_extract2 = __commonJS({
   "node_modules/unzip-stream/lib/extract.js"(exports2, module2) {
-    var fs33 = require("fs");
+    var fs34 = require("fs");
     var path30 = require("path");
     var util4 = require("util");
     var mkdirp = require_mkdirp();
@@ -141898,7 +141898,7 @@ var require_extract2 = __commonJS({
       var directory = entry.isDirectory ? destPath : path30.dirname(destPath);
       this.unfinishedEntries++;
       var writeFileFn = function() {
-        var pipedStream = fs33.createWriteStream(destPath);
+        var pipedStream = fs34.createWriteStream(destPath);
         pipedStream.on("close", function() {
           self2.unfinishedEntries--;
           self2._notifyAwaiter();
@@ -143009,11 +143009,11 @@ var require_command2 = __commonJS({
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.issue = exports2.issueCommand = void 0;
-    var os7 = __importStar2(require("os"));
+    var os8 = __importStar2(require("os"));
     var utils_1 = require_utils11();
     function issueCommand(command, properties, message) {
       const cmd = new Command(command, properties, message);
-      process.stdout.write(cmd.toString() + os7.EOL);
+      process.stdout.write(cmd.toString() + os8.EOL);
     }
     exports2.issueCommand = issueCommand;
     function issue(name, message = "") {
@@ -143096,18 +143096,18 @@ var require_file_command2 = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.prepareKeyValueMessage = exports2.issueFileCommand = void 0;
     var crypto3 = __importStar2(require("crypto"));
-    var fs33 = __importStar2(require("fs"));
-    var os7 = __importStar2(require("os"));
+    var fs34 = __importStar2(require("fs"));
+    var os8 = __importStar2(require("os"));
     var utils_1 = require_utils11();
     function issueFileCommand(command, message) {
       const filePath = process.env[`GITHUB_${command}`];
       if (!filePath) {
         throw new Error(`Unable to find environment variable for file command ${command}`);
       }
-      if (!fs33.existsSync(filePath)) {
+      if (!fs34.existsSync(filePath)) {
         throw new Error(`Missing file at path: ${filePath}`);
       }
-      fs33.appendFileSync(filePath, `${(0, utils_1.toCommandValue)(message)}${os7.EOL}`, {
+      fs34.appendFileSync(filePath, `${(0, utils_1.toCommandValue)(message)}${os8.EOL}`, {
         encoding: "utf8"
       });
     }
@@ -143121,7 +143121,7 @@ var require_file_command2 = __commonJS({
       if (convertedValue.includes(delimiter)) {
         throw new Error(`Unexpected input: value should not contain the delimiter "${delimiter}"`);
       }
-      return `${key}<<${delimiter}${os7.EOL}${convertedValue}${os7.EOL}${delimiter}`;
+      return `${key}<<${delimiter}${os8.EOL}${convertedValue}${os8.EOL}${delimiter}`;
     }
     exports2.prepareKeyValueMessage = prepareKeyValueMessage;
   }
@@ -144430,12 +144430,12 @@ var require_io_util2 = __commonJS({
     var _a6;
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.getCmdPath = exports2.tryGetExecutablePath = exports2.isRooted = exports2.isDirectory = exports2.exists = exports2.READONLY = exports2.UV_FS_O_EXLOCK = exports2.IS_WINDOWS = exports2.unlink = exports2.symlink = exports2.stat = exports2.rmdir = exports2.rm = exports2.rename = exports2.readlink = exports2.readdir = exports2.open = exports2.mkdir = exports2.lstat = exports2.copyFile = exports2.chmod = void 0;
-    var fs33 = __importStar2(require("fs"));
+    var fs34 = __importStar2(require("fs"));
     var path30 = __importStar2(require("path"));
-    _a6 = fs33.promises, exports2.chmod = _a6.chmod, exports2.copyFile = _a6.copyFile, exports2.lstat = _a6.lstat, exports2.mkdir = _a6.mkdir, exports2.open = _a6.open, exports2.readdir = _a6.readdir, exports2.readlink = _a6.readlink, exports2.rename = _a6.rename, exports2.rm = _a6.rm, exports2.rmdir = _a6.rmdir, exports2.stat = _a6.stat, exports2.symlink = _a6.symlink, exports2.unlink = _a6.unlink;
+    _a6 = fs34.promises, exports2.chmod = _a6.chmod, exports2.copyFile = _a6.copyFile, exports2.lstat = _a6.lstat, exports2.mkdir = _a6.mkdir, exports2.open = _a6.open, exports2.readdir = _a6.readdir, exports2.readlink = _a6.readlink, exports2.rename = _a6.rename, exports2.rm = _a6.rm, exports2.rmdir = _a6.rmdir, exports2.stat = _a6.stat, exports2.symlink = _a6.symlink, exports2.unlink = _a6.unlink;
     exports2.IS_WINDOWS = process.platform === "win32";
     exports2.UV_FS_O_EXLOCK = 268435456;
-    exports2.READONLY = fs33.constants.O_RDONLY;
+    exports2.READONLY = fs34.constants.O_RDONLY;
     function exists(fsPath) {
       return __awaiter2(this, void 0, void 0, function* () {
         try {
@@ -144850,7 +144850,7 @@ var require_toolrunner2 = __commonJS({
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.argStringToArray = exports2.ToolRunner = void 0;
-    var os7 = __importStar2(require("os"));
+    var os8 = __importStar2(require("os"));
     var events = __importStar2(require("events"));
     var child = __importStar2(require("child_process"));
     var path30 = __importStar2(require("path"));
@@ -144905,12 +144905,12 @@ var require_toolrunner2 = __commonJS({
       _processLineBuffer(data, strBuffer, onLine) {
         try {
           let s = strBuffer + data.toString();
-          let n = s.indexOf(os7.EOL);
+          let n = s.indexOf(os8.EOL);
           while (n > -1) {
             const line = s.substring(0, n);
             onLine(line);
-            s = s.substring(n + os7.EOL.length);
-            n = s.indexOf(os7.EOL);
+            s = s.substring(n + os8.EOL.length);
+            n = s.indexOf(os8.EOL);
           }
           return s;
         } catch (err) {
@@ -145079,7 +145079,7 @@ var require_toolrunner2 = __commonJS({
             }
             const optionsNonNull = this._cloneExecOptions(this.options);
             if (!optionsNonNull.silent && optionsNonNull.outStream) {
-              optionsNonNull.outStream.write(this._getCommandString(optionsNonNull) + os7.EOL);
+              optionsNonNull.outStream.write(this._getCommandString(optionsNonNull) + os8.EOL);
             }
             const state = new ExecState(optionsNonNull, this.toolPath);
             state.on("debug", (message) => {
@@ -145567,7 +145567,7 @@ var require_core3 = __commonJS({
     var command_1 = require_command2();
     var file_command_1 = require_file_command2();
     var utils_1 = require_utils11();
-    var os7 = __importStar2(require("os"));
+    var os8 = __importStar2(require("os"));
     var path30 = __importStar2(require("path"));
     var oidc_utils_1 = require_oidc_utils2();
     var ExitCode;
@@ -145635,7 +145635,7 @@ Support boolean input list: \`true | True | TRUE | false | False | FALSE\``);
       if (filePath) {
         return (0, file_command_1.issueFileCommand)("OUTPUT", (0, file_command_1.prepareKeyValueMessage)(name, value));
       }
-      process.stdout.write(os7.EOL);
+      process.stdout.write(os8.EOL);
       (0, command_1.issueCommand)("set-output", { name }, (0, utils_1.toCommandValue)(value));
     }
     exports2.setOutput = setOutput7;
@@ -145669,7 +145669,7 @@ Support boolean input list: \`true | True | TRUE | false | False | FALSE\``);
     }
     exports2.notice = notice;
     function info8(message) {
-      process.stdout.write(message + os7.EOL);
+      process.stdout.write(message + os8.EOL);
     }
     exports2.info = info8;
     function startGroup3(name) {
@@ -145824,25 +145824,25 @@ var require_upload_specification = __commonJS({
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.getUploadSpecification = void 0;
-    var fs33 = __importStar2(require("fs"));
+    var fs34 = __importStar2(require("fs"));
     var core_1 = require_core3();
     var path_1 = require("path");
     var path_and_artifact_name_validation_1 = require_path_and_artifact_name_validation2();
     function getUploadSpecification(artifactName, rootDirectory, artifactFiles) {
       const specifications = [];
-      if (!fs33.existsSync(rootDirectory)) {
+      if (!fs34.existsSync(rootDirectory)) {
         throw new Error(`Provided rootDirectory ${rootDirectory} does not exist`);
       }
-      if (!fs33.statSync(rootDirectory).isDirectory()) {
+      if (!fs34.statSync(rootDirectory).isDirectory()) {
         throw new Error(`Provided rootDirectory ${rootDirectory} is not a valid directory`);
       }
       rootDirectory = (0, path_1.normalize)(rootDirectory);
       rootDirectory = (0, path_1.resolve)(rootDirectory);
       for (let file of artifactFiles) {
-        if (!fs33.existsSync(file)) {
+        if (!fs34.existsSync(file)) {
           throw new Error(`File ${file} does not exist`);
         }
-        if (!fs33.statSync(file).isDirectory()) {
+        if (!fs34.statSync(file).isDirectory()) {
           file = (0, path_1.normalize)(file);
           file = (0, path_1.resolve)(file);
           if (!file.startsWith(rootDirectory)) {
@@ -145867,29 +145867,29 @@ var require_upload_specification = __commonJS({
 // node_modules/tmp/lib/tmp.js
 var require_tmp = __commonJS({
   "node_modules/tmp/lib/tmp.js"(exports2, module2) {
-    var fs33 = require("fs");
-    var os7 = require("os");
+    var fs34 = require("fs");
+    var os8 = require("os");
     var path30 = require("path");
     var crypto3 = require("crypto");
-    var _c2 = { fs: fs33.constants, os: os7.constants };
+    var _c2 = { fs: fs34.constants, os: os8.constants };
     var RANDOM_CHARS = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
     var TEMPLATE_PATTERN = /XXXXXX/;
     var DEFAULT_TRIES = 3;
     var CREATE_FLAGS = (_c2.O_CREAT || _c2.fs.O_CREAT) | (_c2.O_EXCL || _c2.fs.O_EXCL) | (_c2.O_RDWR || _c2.fs.O_RDWR);
-    var IS_WIN32 = os7.platform() === "win32";
+    var IS_WIN32 = os8.platform() === "win32";
     var EBADF = _c2.EBADF || _c2.os.errno.EBADF;
     var ENOENT = _c2.ENOENT || _c2.os.errno.ENOENT;
     var DIR_MODE = 448;
     var FILE_MODE = 384;
     var EXIT = "exit";
     var _removeObjects = [];
-    var FN_RMDIR_SYNC = fs33.rmdirSync.bind(fs33);
+    var FN_RMDIR_SYNC = fs34.rmdirSync.bind(fs34);
     var _gracefulCleanup = false;
     function rimraf(dirPath, callback) {
-      return fs33.rm(dirPath, { recursive: true }, callback);
+      return fs34.rm(dirPath, { recursive: true }, callback);
     }
     function FN_RIMRAF_SYNC(dirPath) {
-      return fs33.rmSync(dirPath, { recursive: true });
+      return fs34.rmSync(dirPath, { recursive: true });
     }
     function tmpName(options, callback) {
       const args = _parseArguments(options, callback), opts = args[0], cb = args[1];
@@ -145899,7 +145899,7 @@ var require_tmp = __commonJS({
         (function _getUniqueName() {
           try {
             const name = _generateTmpName(sanitizedOptions);
-            fs33.stat(name, function(err2) {
+            fs34.stat(name, function(err2) {
               if (!err2) {
                 if (tries-- > 0) return _getUniqueName();
                 return cb(new Error("Could not get a unique tmp filename, max tries reached " + name));
@@ -145919,7 +145919,7 @@ var require_tmp = __commonJS({
       do {
         const name = _generateTmpName(sanitizedOptions);
         try {
-          fs33.statSync(name);
+          fs34.statSync(name);
         } catch (e) {
           return name;
         }
@@ -145930,10 +145930,10 @@ var require_tmp = __commonJS({
       const args = _parseArguments(options, callback), opts = args[0], cb = args[1];
       tmpName(opts, function _tmpNameCreated(err, name) {
         if (err) return cb(err);
-        fs33.open(name, CREATE_FLAGS, opts.mode || FILE_MODE, function _fileCreated(err2, fd) {
+        fs34.open(name, CREATE_FLAGS, opts.mode || FILE_MODE, function _fileCreated(err2, fd) {
           if (err2) return cb(err2);
           if (opts.discardDescriptor) {
-            return fs33.close(fd, function _discardCallback(possibleErr) {
+            return fs34.close(fd, function _discardCallback(possibleErr) {
               return cb(possibleErr, name, void 0, _prepareTmpFileRemoveCallback(name, -1, opts, false));
             });
           } else {
@@ -145947,9 +145947,9 @@ var require_tmp = __commonJS({
       const args = _parseArguments(options), opts = args[0];
       const discardOrDetachDescriptor = opts.discardDescriptor || opts.detachDescriptor;
       const name = tmpNameSync(opts);
-      let fd = fs33.openSync(name, CREATE_FLAGS, opts.mode || FILE_MODE);
+      let fd = fs34.openSync(name, CREATE_FLAGS, opts.mode || FILE_MODE);
       if (opts.discardDescriptor) {
-        fs33.closeSync(fd);
+        fs34.closeSync(fd);
         fd = void 0;
       }
       return {
@@ -145962,7 +145962,7 @@ var require_tmp = __commonJS({
       const args = _parseArguments(options, callback), opts = args[0], cb = args[1];
       tmpName(opts, function _tmpNameCreated(err, name) {
         if (err) return cb(err);
-        fs33.mkdir(name, opts.mode || DIR_MODE, function _dirCreated(err2) {
+        fs34.mkdir(name, opts.mode || DIR_MODE, function _dirCreated(err2) {
           if (err2) return cb(err2);
           cb(null, name, _prepareTmpDirRemoveCallback(name, opts, false));
         });
@@ -145971,7 +145971,7 @@ var require_tmp = __commonJS({
     function dirSync(options) {
       const args = _parseArguments(options), opts = args[0];
       const name = tmpNameSync(opts);
-      fs33.mkdirSync(name, opts.mode || DIR_MODE);
+      fs34.mkdirSync(name, opts.mode || DIR_MODE);
       return {
         name,
         removeCallback: _prepareTmpDirRemoveCallback(name, opts, true)
@@ -145985,20 +145985,20 @@ var require_tmp = __commonJS({
         next();
       };
       if (0 <= fdPath[0])
-        fs33.close(fdPath[0], function() {
-          fs33.unlink(fdPath[1], _handler);
+        fs34.close(fdPath[0], function() {
+          fs34.unlink(fdPath[1], _handler);
         });
-      else fs33.unlink(fdPath[1], _handler);
+      else fs34.unlink(fdPath[1], _handler);
     }
     function _removeFileSync(fdPath) {
       let rethrownException = null;
       try {
-        if (0 <= fdPath[0]) fs33.closeSync(fdPath[0]);
+        if (0 <= fdPath[0]) fs34.closeSync(fdPath[0]);
       } catch (e) {
         if (!_isEBADF(e) && !_isENOENT(e)) throw e;
       } finally {
         try {
-          fs33.unlinkSync(fdPath[1]);
+          fs34.unlinkSync(fdPath[1]);
         } catch (e) {
           if (!_isENOENT(e)) rethrownException = e;
         }
@@ -146014,7 +146014,7 @@ var require_tmp = __commonJS({
       return sync ? removeCallbackSync : removeCallback;
     }
     function _prepareTmpDirRemoveCallback(name, opts, sync) {
-      const removeFunction = opts.unsafeCleanup ? rimraf : fs33.rmdir.bind(fs33);
+      const removeFunction = opts.unsafeCleanup ? rimraf : fs34.rmdir.bind(fs34);
       const removeFunctionSync = opts.unsafeCleanup ? FN_RIMRAF_SYNC : FN_RMDIR_SYNC;
       const removeCallbackSync = _prepareRemoveCallback(removeFunctionSync, name, sync);
       const removeCallback = _prepareRemoveCallback(removeFunction, name, sync, removeCallbackSync);
@@ -146077,24 +146077,24 @@ var require_tmp = __commonJS({
     }
     function _resolvePath(name, tmpDir, cb) {
       const pathToResolve = path30.isAbsolute(name) ? name : path30.join(tmpDir, name);
-      fs33.stat(pathToResolve, function(err) {
+      fs34.stat(pathToResolve, function(err) {
         if (err) {
-          fs33.realpath(path30.dirname(pathToResolve), function(err2, parentDir) {
+          fs34.realpath(path30.dirname(pathToResolve), function(err2, parentDir) {
             if (err2) return cb(err2);
             cb(null, path30.join(parentDir, path30.basename(pathToResolve)));
           });
         } else {
-          fs33.realpath(pathToResolve, cb);
+          fs34.realpath(pathToResolve, cb);
         }
       });
     }
     function _resolvePathSync(name, tmpDir) {
       const pathToResolve = path30.isAbsolute(name) ? name : path30.join(tmpDir, name);
       try {
-        fs33.statSync(pathToResolve);
-        return fs33.realpathSync(pathToResolve);
+        fs34.statSync(pathToResolve);
+        return fs34.realpathSync(pathToResolve);
       } catch (_err) {
-        const parentDir = fs33.realpathSync(path30.dirname(pathToResolve));
+        const parentDir = fs34.realpathSync(path30.dirname(pathToResolve));
         return path30.join(parentDir, path30.basename(pathToResolve));
       }
     }
@@ -146215,10 +146215,10 @@ var require_tmp = __commonJS({
       _gracefulCleanup = true;
     }
     function _getTmpDir(options, cb) {
-      return fs33.realpath(options && options.tmpdir || os7.tmpdir(), cb);
+      return fs34.realpath(options && options.tmpdir || os8.tmpdir(), cb);
     }
     function _getTmpDirSync(options) {
-      return fs33.realpathSync(options && options.tmpdir || os7.tmpdir());
+      return fs34.realpathSync(options && options.tmpdir || os8.tmpdir());
     }
     process.addListener(EXIT, _garbageCollector);
     Object.defineProperty(module2.exports, "tmpdir", {
@@ -147072,10 +147072,10 @@ var require_upload_gzip = __commonJS({
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.createGZipFileInBuffer = exports2.createGZipFileOnDisk = void 0;
-    var fs33 = __importStar2(require("fs"));
+    var fs34 = __importStar2(require("fs"));
     var zlib3 = __importStar2(require("zlib"));
     var util_1 = require("util");
-    var stat2 = (0, util_1.promisify)(fs33.stat);
+    var stat2 = (0, util_1.promisify)(fs34.stat);
     var gzipExemptFileExtensions = [
       ".gz",
       ".gzip",
@@ -147108,9 +147108,9 @@ var require_upload_gzip = __commonJS({
           }
         }
         return new Promise((resolve15, reject) => {
-          const inputStream = fs33.createReadStream(originalFilePath);
+          const inputStream = fs34.createReadStream(originalFilePath);
           const gzip = zlib3.createGzip();
-          const outputStream = fs33.createWriteStream(tempFilePath);
+          const outputStream = fs34.createWriteStream(tempFilePath);
           inputStream.pipe(gzip).pipe(outputStream);
           outputStream.on("finish", () => __awaiter2(this, void 0, void 0, function* () {
             const size = (yield stat2(tempFilePath)).size;
@@ -147128,7 +147128,7 @@ var require_upload_gzip = __commonJS({
       return __awaiter2(this, void 0, void 0, function* () {
         return new Promise((resolve15) => __awaiter2(this, void 0, void 0, function* () {
           var _a6, e_1, _b2, _c2;
-          const inputStream = fs33.createReadStream(originalFilePath);
+          const inputStream = fs34.createReadStream(originalFilePath);
           const gzip = zlib3.createGzip();
           inputStream.pipe(gzip);
           const chunks = [];
@@ -147337,7 +147337,7 @@ var require_upload_http_client = __commonJS({
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.UploadHttpClient = void 0;
-    var fs33 = __importStar2(require("fs"));
+    var fs34 = __importStar2(require("fs"));
     var core29 = __importStar2(require_core3());
     var tmp2 = __importStar2(require_tmp_promise());
     var stream2 = __importStar2(require("stream"));
@@ -147351,7 +147351,7 @@ var require_upload_http_client = __commonJS({
     var http_manager_1 = require_http_manager();
     var upload_gzip_1 = require_upload_gzip();
     var requestUtils_1 = require_requestUtils2();
-    var stat2 = (0, util_1.promisify)(fs33.stat);
+    var stat2 = (0, util_1.promisify)(fs34.stat);
     var UploadHttpClient = class {
       constructor() {
         this.uploadHttpManager = new http_manager_1.HttpManager((0, config_variables_1.getUploadFileConcurrency)(), "@actions/artifact-upload");
@@ -147488,7 +147488,7 @@ var require_upload_http_client = __commonJS({
             let openUploadStream;
             if (totalFileSize < buffer.byteLength) {
               core29.debug(`The gzip file created for ${parameters.file} did not help with reducing the size of the file. The original file will be uploaded as-is`);
-              openUploadStream = () => fs33.createReadStream(parameters.file);
+              openUploadStream = () => fs34.createReadStream(parameters.file);
               isGzip = false;
               uploadFileSize = totalFileSize;
             } else {
@@ -147534,7 +147534,7 @@ var require_upload_http_client = __commonJS({
                 failedChunkSizes += chunkSize;
                 continue;
               }
-              const result = yield this.uploadChunk(httpClientIndex, parameters.resourceUrl, () => fs33.createReadStream(uploadFilePath, {
+              const result = yield this.uploadChunk(httpClientIndex, parameters.resourceUrl, () => fs34.createReadStream(uploadFilePath, {
                 start: startChunkIndex,
                 end: endChunkIndex,
                 autoClose: false
@@ -147729,7 +147729,7 @@ var require_download_http_client = __commonJS({
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.DownloadHttpClient = void 0;
-    var fs33 = __importStar2(require("fs"));
+    var fs34 = __importStar2(require("fs"));
     var core29 = __importStar2(require_core3());
     var zlib3 = __importStar2(require("zlib"));
     var utils_1 = require_utils12();
@@ -147820,7 +147820,7 @@ var require_download_http_client = __commonJS({
         return __awaiter2(this, void 0, void 0, function* () {
           let retryCount = 0;
           const retryLimit = (0, config_variables_1.getRetryLimit)();
-          let destinationStream = fs33.createWriteStream(downloadPath);
+          let destinationStream = fs34.createWriteStream(downloadPath);
           const headers = (0, utils_1.getDownloadHeaders)("application/json", true, true);
           const makeDownloadRequest = () => __awaiter2(this, void 0, void 0, function* () {
             const client = this.downloadHttpManager.getClient(httpClientIndex);
@@ -147862,7 +147862,7 @@ var require_download_http_client = __commonJS({
               }
             });
             yield (0, utils_1.rmFile)(fileDownloadPath);
-            destinationStream = fs33.createWriteStream(fileDownloadPath);
+            destinationStream = fs34.createWriteStream(fileDownloadPath);
           });
           while (retryCount <= retryLimit) {
             let response;
@@ -166068,12 +166068,13 @@ __export(entry_points_exports, {
 module.exports = __toCommonJS(entry_points_exports);
 
 // src/analyze-action.ts
-var fs24 = __toESM(require("fs"));
+var fs25 = __toESM(require("fs"));
 var import_path5 = __toESM(require("path"));
 var import_perf_hooks6 = require("perf_hooks");
 var core14 = __toESM(require_core());
 
 // src/action-common.ts
+var os4 = __toESM(require("os"));
 var core9 = __toESM(require_core());
 
 // src/actions-util.ts
@@ -166219,21 +166220,21 @@ async function getFolderSize(itemPath, options) {
 getFolderSize.loose = async (itemPath, options) => await core2(itemPath, options);
 getFolderSize.strict = async (itemPath, options) => await core2(itemPath, options, { strict: true });
 async function core2(rootItemPath, options = {}, returnType = {}) {
-  const fs33 = options.fs || await import("node:fs/promises");
+  const fs34 = options.fs || await import("node:fs/promises");
   let folderSize = 0n;
   const foundInos = /* @__PURE__ */ new Set();
   const errors = [];
   await processItem(rootItemPath);
   async function processItem(itemPath) {
     if (options.ignore?.test(itemPath)) return;
-    const stats = returnType.strict ? await fs33.lstat(itemPath, { bigint: true }) : await fs33.lstat(itemPath, { bigint: true }).catch((error3) => errors.push(error3));
+    const stats = returnType.strict ? await fs34.lstat(itemPath, { bigint: true }) : await fs34.lstat(itemPath, { bigint: true }).catch((error3) => errors.push(error3));
     if (typeof stats !== "object") return;
     if (!foundInos.has(stats.ino)) {
       foundInos.add(stats.ino);
       folderSize += stats.size;
     }
     if (stats.isDirectory()) {
-      const directoryItems = returnType.strict ? await fs33.readdir(itemPath) : await fs33.readdir(itemPath).catch((error3) => errors.push(error3));
+      const directoryItems = returnType.strict ? await fs34.readdir(itemPath) : await fs34.readdir(itemPath).catch((error3) => errors.push(error3));
       if (typeof directoryItems !== "object") return;
       await Promise.all(
         directoryItems.map(
@@ -171776,6 +171777,7 @@ async function runInActions(action) {
       startedAt,
       platform: process.platform,
       arch: process.arch,
+      osRelease: os4.release(),
       logger: logger2,
       env,
       actions: actionsEnv
@@ -172182,6 +172184,11 @@ var featureConfig = {
     envVar: "CODEQL_ACTION_START_PROXY_USE_FEATURES_RELEASE",
     minimumVersion: void 0
   },
+  ["skip_unsupported_traced_analysis" /* SkipUnsupportedTracedAnalysis */]: {
+    defaultValue: false,
+    envVar: "CODEQL_ACTION_SKIP_UNSUPPORTED_TRACED_ANALYSIS",
+    minimumVersion: void 0
+  },
   ["tools_repository_property" /* ToolsRepositoryProperty */]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_TOOLS_REPOSITORY_PROPERTY",
@@ -172673,13 +172680,13 @@ var SarifScanOrder = [
 ];
 
 // src/analyze.ts
-var fs18 = __toESM(require("fs"));
+var fs19 = __toESM(require("fs"));
 var path16 = __toESM(require("path"));
 var import_perf_hooks5 = require("perf_hooks");
 var io5 = __toESM(require_io());
 
 // src/codeql.ts
-var fs17 = __toESM(require("fs"));
+var fs18 = __toESM(require("fs"));
 var path15 = __toESM(require("path"));
 var core12 = __toESM(require_core());
 var toolrunner3 = __toESM(require_toolrunner());
@@ -175359,11 +175366,11 @@ async function logGeneratedFilesTelemetry(config, duration, generatedFilesCount)
 }
 
 // src/setup-codeql.ts
-var fs15 = __toESM(require("fs"));
+var fs16 = __toESM(require("fs"));
 var path13 = __toESM(require("path"));
 var import_perf_hooks4 = require("perf_hooks");
 var toolcache3 = __toESM(require_tool_cache());
-var semver9 = __toESM(require_semver2());
+var semver10 = __toESM(require_semver2());
 
 // src/codeql-bundle.ts
 function getCodeQLBundleName(compressionMethod, platform2, language) {
@@ -175692,9 +175699,11 @@ async function getCodeQlVersionsForOverlayBaseDatabases(rawLanguages, logger2) {
 }
 
 // src/per-language-bundles.ts
-var semver6 = __toESM(require_semver2());
+var semver7 = __toESM(require_semver2());
 
 // src/platform.ts
+var import_fs = __toESM(require("fs"));
+var semver6 = __toESM(require_semver2());
 function getBundlePlatform(platform2 = process.platform, arch2 = process.arch) {
   switch (platform2) {
     case "win32":
@@ -175707,6 +175716,57 @@ function getBundlePlatform(platform2 = process.platform, arch2 = process.arch) {
       return void 0;
   }
 }
+function macOSVersion(action) {
+  if (action.platform !== "darwin") {
+    return void 0;
+  }
+  const version = semver6.parse(action.osRelease);
+  if (version === null) {
+    return action.osRelease;
+  }
+  return version;
+}
+var XCODE_SELECT_LINK_PATH = "/private/var/db/xcode_select_link";
+var XCODE_APP_FILENAME_PATTERN = new RegExp(
+  /(?<filename>Xcode_(?<majorMinor>\d+.\d+).app)/
+);
+function xcodeVersion(logger2) {
+  try {
+    const stats = import_fs.default.statSync(XCODE_SELECT_LINK_PATH);
+    if (!stats.isSymbolicLink()) {
+      logger2.warning(
+        `${XCODE_SELECT_LINK_PATH} exists, but is not a symbolic link.`
+      );
+      return void 0;
+    }
+    const xcodePath = import_fs.default.readlinkSync(XCODE_SELECT_LINK_PATH);
+    if (xcodePath === "") {
+      logger2.warning(
+        `Resolving ${XCODE_SELECT_LINK_PATH} unexpectedly returned nothing.`
+      );
+      return void 0;
+    }
+    const matchResult = xcodePath.match(XCODE_APP_FILENAME_PATTERN);
+    if (matchResult?.groups === void 0) {
+      logger2.warning(
+        `Xcode path '${xcodePath}' does not contain expected pattern.`
+      );
+      return void 0;
+    }
+    const majorMinor = matchResult.groups["majorMinor"];
+    const version = semver6.coerce(majorMinor);
+    if (version === null) {
+      logger2.warning(`Couldn't parse '${majorMinor}' as a semantic version.`);
+      return void 0;
+    }
+    return version;
+  } catch (err) {
+    logger2.warning(
+      `Unable to determine Xcode version: ${getErrorMessage(err)}`
+    );
+    return void 0;
+  }
+}
 
 // src/per-language-bundles.ts
 var MIN_PER_LANGUAGE_BUNDLE_CLI_VERSION = "2.27.1";
@@ -175799,7 +175859,7 @@ async function getPerLanguageBundleLanguage({
     if (cliVersion2 === void 0) {
       return explain("the requested CLI version is unknown");
     }
-    if (!semver6.gte(cliVersion2, MIN_PER_LANGUAGE_BUNDLE_CLI_VERSION)) {
+    if (!semver7.gte(cliVersion2, MIN_PER_LANGUAGE_BUNDLE_CLI_VERSION)) {
       return explain(
         `the requested CodeQL version ${cliVersion2} is older than ${MIN_PER_LANGUAGE_BUNDLE_CLI_VERSION}, which is the first version for which per-language bundles are published`
       );
@@ -175868,12 +175928,12 @@ async function getCodeQLAssetDownloadURL(action, apiDetails, tagName, assetName,
     }
     const { owner: repositoryOwner, repo: repositoryName } = parseRepositoryNwo(repository);
     try {
-      const release2 = await getApiClient().rest.repos.getReleaseByTag({
+      const release3 = await getApiClient().rest.repos.getReleaseByTag({
         owner: repositoryOwner,
         repo: repositoryName,
         tag: tagName
       });
-      for (const asset of release2.data.assets) {
+      for (const asset of release3.data.assets) {
         if (asset.name === assetName) {
           action.logger.info(
             `Found ${assetKind} ${assetName} in ${repository} on ${instanceURL} with URL ${asset.url}.`
@@ -175892,12 +175952,12 @@ async function getCodeQLAssetDownloadURL(action, apiDetails, tagName, assetName,
 
 // src/tar.ts
 var import_child_process = require("child_process");
-var fs13 = __toESM(require("fs"));
+var fs14 = __toESM(require("fs"));
 var stream = __toESM(require("stream"));
 var import_toolrunner = __toESM(require_toolrunner());
 var io4 = __toESM(require_io());
 var toolcache = __toESM(require_tool_cache());
-var semver7 = __toESM(require_semver2());
+var semver8 = __toESM(require_semver2());
 var MIN_REQUIRED_BSD_TAR_VERSION = "3.4.3";
 var MIN_REQUIRED_GNU_TAR_VERSION = "1.31";
 async function getTarVersion() {
@@ -175939,9 +175999,9 @@ async function isZstdAvailable(logger2) {
       case "gnu":
         return {
           available: foundZstdBinary && // GNU tar only uses major and minor version numbers
-          semver7.gte(
-            semver7.coerce(version),
-            semver7.coerce(MIN_REQUIRED_GNU_TAR_VERSION)
+          semver8.gte(
+            semver8.coerce(version),
+            semver8.coerce(MIN_REQUIRED_GNU_TAR_VERSION)
           ),
           foundZstdBinary,
           version: tarVersion
@@ -175950,7 +176010,7 @@ async function isZstdAvailable(logger2) {
         return {
           available: foundZstdBinary && // Do a loose comparison since these version numbers don't contain
           // a patch version number.
-          semver7.gte(version, MIN_REQUIRED_BSD_TAR_VERSION),
+          semver8.gte(version, MIN_REQUIRED_BSD_TAR_VERSION),
           foundZstdBinary,
           version: tarVersion
         };
@@ -175965,7 +176025,7 @@ async function isZstdAvailable(logger2) {
   }
 }
 async function extract(tarPath, dest, compressionMethod, tarVersion, logger2) {
-  fs13.mkdirSync(dest, { recursive: true });
+  fs14.mkdirSync(dest, { recursive: true });
   switch (compressionMethod) {
     case "gzip":
       return await toolcache.extractTar(tarPath, dest);
@@ -176051,15 +176111,15 @@ function inferCompressionMethod(tarPath) {
 }
 
 // src/tools-download.ts
-var fs14 = __toESM(require("fs"));
-var os4 = __toESM(require("os"));
+var fs15 = __toESM(require("fs"));
+var os5 = __toESM(require("os"));
 var path12 = __toESM(require("path"));
 var import_perf_hooks3 = require("perf_hooks");
 var core11 = __toESM(require_core());
 var import_http_client = __toESM(require_lib());
 var toolcache2 = __toESM(require_tool_cache());
 var import_follow_redirects = __toESM(require_follow_redirects());
-var semver8 = __toESM(require_semver2());
+var semver9 = __toESM(require_semver2());
 var STREAMING_HIGH_WATERMARK_BYTES = 4 * 1024 * 1024;
 var STREAMING_STALL_TIMEOUT_MS = 5 * 60 * 1e3;
 var TOOLCACHE_TOOL_NAME = "CodeQL";
@@ -176137,7 +176197,7 @@ async function downloadAndExtract(codeqlURL, compressionMethod, dest, authorizat
   };
 }
 async function downloadAndExtractZstdWithStreaming(codeqlURL, dest, authorization, headers, tarVersion, logger2) {
-  fs14.mkdirSync(dest, { recursive: true });
+  fs15.mkdirSync(dest, { recursive: true });
   const agent = new import_http_client.HttpClient().getAgent(codeqlURL);
   headers = Object.assign(
     { "User-Agent": "CodeQL Action" },
@@ -176185,18 +176245,18 @@ function getToolcacheToolDirectory(env) {
   );
 }
 function getToolcacheVersionDirectoryName(version) {
-  return semver8.clean(version) || version;
+  return semver9.clean(version) || version;
 }
 function getToolcacheDirectory(version) {
   return path12.join(
     getToolcacheToolDirectory(getEnv()),
     getToolcacheVersionDirectoryName(version),
-    os4.arch() || ""
+    os5.arch() || ""
   );
 }
 function isToolcacheOnWorkspaceFilesystem(logger2) {
   try {
-    return fs14.statSync(getRequiredEnvParam("RUNNER_TOOL_CACHE")).dev === fs14.statSync(getRequiredEnvParam("GITHUB_WORKSPACE")).dev;
+    return fs15.statSync(getRequiredEnvParam("RUNNER_TOOL_CACHE")).dev === fs15.statSync(getRequiredEnvParam("GITHUB_WORKSPACE")).dev;
   } catch (e) {
     logger2.debug(
       `Could not determine whether the toolcache is on the same filesystem as the workspace: ${getErrorMessage(e)}`
@@ -176218,7 +176278,7 @@ async function deleteToolcacheBundles({
     return { deletedVersions: [], failed: true };
   }
   try {
-    if ((await fs14.promises.lstat(toolDirectory)).isSymbolicLink()) {
+    if ((await fs15.promises.lstat(toolDirectory)).isSymbolicLink()) {
       logger2.info(
         `Not deleting the CodeQL tools from the toolcache since '${toolDirectory}' is a symlink.`
       );
@@ -176237,7 +176297,7 @@ async function deleteToolcacheBundles({
     return { deletedVersions: [], failed: true };
   }
   try {
-    const entries = await fs14.promises.readdir(toolDirectory, {
+    const entries = await fs15.promises.readdir(toolDirectory, {
       withFileTypes: true
     });
     const deletedVersions = [];
@@ -176251,7 +176311,7 @@ async function deleteToolcacheBundles({
       }
       const versionDirectory = path12.join(toolDirectory, entry.name);
       try {
-        await fs14.promises.rm(versionDirectory, {
+        await fs15.promises.rm(versionDirectory, {
           force: true,
           recursive: true
         });
@@ -176276,7 +176336,7 @@ async function deleteToolcacheBundles({
 }
 function writeToolcacheMarkerFile(extractedPath, logger2) {
   const markerFilePath = `${extractedPath}.complete`;
-  fs14.writeFileSync(markerFilePath, "");
+  fs15.writeFileSync(markerFilePath, "");
   logger2.info(`Created toolcache marker file ${markerFilePath}`);
 }
 
@@ -176312,13 +176372,13 @@ function tryGetTagNameFromUrl(url2, logger2) {
   return match2[1];
 }
 function convertToSemVer(version, logger2) {
-  if (!semver9.valid(version)) {
+  if (!semver10.valid(version)) {
     logger2.debug(
       `Bundle version ${version} is not in SemVer format. Will treat it as pre-release 0.0.0-${version}.`
     );
     version = `0.0.0-${version}`;
   }
-  const s = semver9.clean(version);
+  const s = semver10.clean(version);
   if (!s) {
     throw new Error(`Bundle version ${version} is not in SemVer format.`);
   }
@@ -176328,7 +176388,7 @@ async function findOverridingToolsInCache(humanReadableVersion, logger2) {
   const candidates = toolcache3.findAllVersions("CodeQL").filter(isGoodVersion).map((version) => ({
     folder: toolcache3.find("CodeQL", version),
     version
-  })).filter(({ folder }) => fs15.existsSync(path13.join(folder, "pinned-version")));
+  })).filter(({ folder }) => fs16.existsSync(path13.join(folder, "pinned-version")));
   if (candidates.length === 1) {
     const candidate = candidates[0];
     logger2.debug(
@@ -176534,7 +176594,7 @@ async function getCodeQLSource(toolsInput, defaultCliVersion, rawLanguages, othe
     url2 = toolsInput;
     if (tagName) {
       const bundleVersion3 = tryGetBundleVersionFromTagName(tagName, logger2);
-      if (bundleVersion3 !== void 0 && semver9.valid(bundleVersion3)) {
+      if (bundleVersion3 !== void 0 && semver10.valid(bundleVersion3)) {
         cliVersion2 = convertToSemVer(bundleVersion3, logger2);
       }
     }
@@ -176916,7 +176976,7 @@ async function downloadCodeQLBundle(action, source, apiDetails, tarVersion, temp
 async function useZstdBundle(cliVersion2, tarSupportsZstd) {
   return (
     // In testing, gzip performs better than zstd on Windows.
-    process.platform !== "win32" && tarSupportsZstd && semver9.gte(cliVersion2, CODEQL_VERSION_ZSTD_BUNDLE)
+    process.platform !== "win32" && tarSupportsZstd && semver10.gte(cliVersion2, CODEQL_VERSION_ZSTD_BUNDLE)
   );
 }
 function getTempExtractionDir(tempDir) {
@@ -176940,14 +177000,14 @@ async function getLatestNightlyBundle(action, rawLanguages, otherLanguagePacksRe
     isLatestNightly: true
   });
   try {
-    const release2 = await getApiClient().rest.repos.listReleases({
+    const release3 = await getApiClient().rest.repos.listReleases({
       owner: CODEQL_NIGHTLIES_REPOSITORY_OWNER,
       repo: CODEQL_NIGHTLIES_REPOSITORY_NAME,
       per_page: 1,
       page: 1,
       prerelease: true
     });
-    const latestRelease = release2.data[0];
+    const latestRelease = release3.data[0];
     if (!latestRelease) {
       throw new Error("Could not find the latest nightly release.");
     }
@@ -176970,7 +177030,7 @@ async function getLatestNightlyBundle(action, rawLanguages, otherLanguagePacksRe
   }
 }
 function getLatestToolcacheVersion(logger2) {
-  const allVersions = toolcache3.findAllVersions("CodeQL").sort((a, b) => semver9.compare(b, a));
+  const allVersions = toolcache3.findAllVersions("CodeQL").sort((a, b) => semver10.compare(b, a));
   logger2.debug(
     `Found the following versions of the CodeQL tools in the toolcache: ${JSON.stringify(
       allVersions
@@ -176990,7 +177050,7 @@ function isReservedToolsValue(tools) {
 }
 
 // src/tracer-config.ts
-var fs16 = __toESM(require("fs"));
+var fs17 = __toESM(require("fs"));
 var path14 = __toESM(require("path"));
 async function shouldEnableIndirectTracing(codeql, config) {
   if (config.buildMode === "none" /* None */) {
@@ -177010,14 +177070,14 @@ async function endTracingForCluster(codeql, config, logger2) {
     config.dbLocation,
     "temp/tracingEnvironment/end-tracing.json"
   );
-  if (!fs16.existsSync(envVariablesFile)) {
+  if (!fs17.existsSync(envVariablesFile)) {
     throw new Error(
       `Environment file for ending tracing not found: ${envVariablesFile}`
     );
   }
   try {
     const endTracingEnvVariables = JSON.parse(
-      fs16.readFileSync(envVariablesFile, "utf8")
+      fs17.readFileSync(envVariablesFile, "utf8")
     );
     for (const [key, value] of Object.entries(endTracingEnvVariables)) {
       if (value !== null) {
@@ -177038,7 +177098,7 @@ async function getTracerConfigForCluster(logger2, config) {
     "temp/tracingEnvironment/start-tracing.json"
   );
   try {
-    const tracingEnvVariables = JSON.parse(fs16.readFileSync(filePath, "utf8"));
+    const tracingEnvVariables = JSON.parse(fs17.readFileSync(filePath, "utf8"));
     return {
       env: tracingEnvVariables
     };
@@ -177123,13 +177183,13 @@ async function getCodeQL(logger2, cmd) {
   }
   return cachedCodeQL;
 }
-async function getCodeQLForCmd(logger2, cmd, checkVersion) {
+async function getCodeQLForCmd(logger2, cmd, checkVersion, env = getEnv()) {
   const codeql = {
     getPath() {
       return cmd;
     },
     async getVersion() {
-      const cacheFilePath = getCommandCacheFilePath(getEnv());
+      const cacheFilePath = getCommandCacheFilePath(env);
       let result = getCachedCodeQlVersion(
         logger2,
         cacheFilePath,
@@ -177160,7 +177220,7 @@ async function getCodeQLForCmd(logger2, cmd, checkVersion) {
         "tools",
         "tracing-config.lua"
       );
-      return fs17.existsSync(tracingConfigPath);
+      return fs18.existsSync(tracingConfigPath);
     },
     async isScannedLanguage(language) {
       return !await this.isTracedLanguage(language);
@@ -177239,14 +177299,17 @@ async function getCodeQLForCmd(logger2, cmd, checkVersion) {
       }
     },
     async runAutobuild(config, language) {
-      applyAutobuildAzurePipelinesTimeoutFix();
+      applyAutobuildAzurePipelinesTimeoutFix(env);
       const autobuildCmd = path15.join(
         await this.resolveExtractor(language),
         "tools",
         process.platform === "win32" ? "autobuild.cmd" : "autobuild.sh"
       );
       if (config.debugMode) {
-        process.env["CODEQL_VERBOSITY" /* CLI_VERBOSITY */] = process.env["CODEQL_VERBOSITY" /* CLI_VERBOSITY */] || EXTRACTION_DEBUG_MODE_VERBOSITY;
+        env.set(
+          "CODEQL_VERBOSITY" /* CLI_VERBOSITY */,
+          env.getOptional("CODEQL_VERBOSITY" /* CLI_VERBOSITY */) ?? EXTRACTION_DEBUG_MODE_VERBOSITY
+        );
       }
       await runCli(autobuildCmd);
     },
@@ -177263,7 +177326,7 @@ async function getCodeQLForCmd(logger2, cmd, checkVersion) {
     },
     async extractUsingBuildMode(config, language) {
       if (config.buildMode === "autobuild" /* Autobuild */) {
-        applyAutobuildAzurePipelinesTimeoutFix();
+        applyAutobuildAzurePipelinesTimeoutFix(env);
       }
       try {
         await runCli(cmd, [
@@ -177365,7 +177428,7 @@ async function getCodeQLForCmd(logger2, cmd, checkVersion) {
         "--sarif-group-rules-by-pack",
         "--sarif-include-query-help=always",
         "--sublanguage-file-coverage",
-        ...await getJobRunUuidSarifOptions(),
+        ...await getJobRunUuidSarifOptions(env),
         ...getExtraOptionsFromEnv(["database", "interpret-results"])
       ];
       if (sarifRunPropertyFlag !== void 0) {
@@ -177444,7 +177507,7 @@ async function getCodeQLForCmd(logger2, cmd, checkVersion) {
     },
     async diagnosticsExport(sarifFile, automationDetailsId, config, diagnosticDir) {
       let configPath = getGeneratedCodeScanningConfigPath(config);
-      if (diagnosticDir !== void 0 && !fs17.existsSync(configPath)) {
+      if (diagnosticDir !== void 0 && !fs18.existsSync(configPath)) {
         configPath = void 0;
       }
       const args = [
@@ -177542,7 +177605,7 @@ Output was: ${extractorPath}`
     throw new ConfigurationError(
       `Expected a CodeQL CLI with version at least ${CODEQL_MINIMUM_VERSION} but got version ${(await codeql.getVersion()).version}`
     );
-  } else if (checkVersion && process.env["CODEQL_ACTION_SUPPRESS_DEPRECATED_SOON_WARNING" /* SUPPRESS_DEPRECATED_SOON_WARNING */] !== "true" && !await codeQlVersionAtLeast(codeql, CODEQL_NEXT_MINIMUM_VERSION)) {
+  } else if (checkVersion && env.getOptional("CODEQL_ACTION_SUPPRESS_DEPRECATED_SOON_WARNING" /* SUPPRESS_DEPRECATED_SOON_WARNING */) !== "true" && !await codeQlVersionAtLeast(codeql, CODEQL_NEXT_MINIMUM_VERSION)) {
     const result = await codeql.getVersion();
     core12.warning(
       `CodeQL CLI version ${result.version} was discontinued on ${GHES_MOST_RECENT_DEPRECATION_DATE} alongside GitHub Enterprise Server ${GHES_VERSION_MOST_RECENTLY_DEPRECATED} and will not be supported by the next minor release of the CodeQL Action. Please update to CodeQL CLI version ${CODEQL_NEXT_MINIMUM_VERSION} or later. For instance, if you have specified a custom version of the CLI using the 'tools' input to the 'init' Action, you can remove this input to use the default version.
@@ -177621,7 +177684,7 @@ async function writeCodeScanningConfigFile(config, logger2) {
   logger2.startGroup("Augmented user configuration file contents");
   logger2.info(dump(augmentedConfig));
   logger2.endGroup();
-  fs17.writeFileSync(codeScanningConfigFile, dump(augmentedConfig));
+  fs18.writeFileSync(codeScanningConfigFile, dump(augmentedConfig));
   return codeScanningConfigFile;
 }
 var TRAP_CACHE_SIZE_MB = 1024;
@@ -177649,16 +177712,19 @@ function getGeneratedCodeScanningConfigPath(config) {
 function getExtractionVerbosityArguments(enableDebugLogging) {
   return enableDebugLogging ? [`--verbosity=${EXTRACTION_DEBUG_MODE_VERBOSITY}`] : [];
 }
-function applyAutobuildAzurePipelinesTimeoutFix() {
-  const javaToolOptions = process.env["JAVA_TOOL_OPTIONS"] || "";
-  process.env["JAVA_TOOL_OPTIONS"] = [
-    ...javaToolOptions.split(/\s+/),
-    "-Dhttp.keepAlive=false",
-    "-Dmaven.wagon.http.pool=false"
-  ].join(" ");
+function applyAutobuildAzurePipelinesTimeoutFix(env) {
+  const javaToolOptions = env.getOptional("JAVA_TOOL_OPTIONS") ?? "";
+  env.set(
+    "JAVA_TOOL_OPTIONS",
+    [
+      ...javaToolOptions.split(/\s+/),
+      "-Dhttp.keepAlive=false",
+      "-Dmaven.wagon.http.pool=false"
+    ].join(" ")
+  );
 }
-async function getJobRunUuidSarifOptions() {
-  const jobRunUuid = process.env["CODEQL_ACTION_JOB_RUN_UUID" /* JOB_RUN_UUID */];
+async function getJobRunUuidSarifOptions(env) {
+  const jobRunUuid = env.getOptional("CODEQL_ACTION_JOB_RUN_UUID" /* JOB_RUN_UUID */);
   return jobRunUuid ? [`--sarif-run-property=jobRunUuid=${jobRunUuid}`] : [];
 }
 
@@ -177748,7 +177814,7 @@ async function runAutobuild(config, language, logger2) {
 }
 
 // src/dependency-caching.ts
-var os5 = __toESM(require("os"));
+var os6 = __toESM(require("os"));
 var import_path3 = require("path");
 var actionsCache4 = __toESM(require_cache4());
 var glob = __toESM(require_glob());
@@ -177760,9 +177826,9 @@ function getJavaTempDependencyDir() {
 async function getJavaDependencyDirs() {
   return [
     // Maven
-    (0, import_path3.join)(os5.homedir(), ".m2", "repository"),
+    (0, import_path3.join)(os6.homedir(), ".m2", "repository"),
     // Gradle
-    (0, import_path3.join)(os5.homedir(), ".gradle", "caches"),
+    (0, import_path3.join)(os6.homedir(), ".gradle", "caches"),
     // CodeQL Java build-mode: none
     getJavaTempDependencyDir()
   ];
@@ -177773,7 +177839,7 @@ function getCsharpTempDependencyDir() {
 async function getCsharpDependencyDirs(codeql, features) {
   const dirs = [
     // Nuget
-    (0, import_path3.join)(os5.homedir(), ".nuget", "packages")
+    (0, import_path3.join)(os6.homedir(), ".nuget", "packages")
   ];
   if (await features.getValue("csharp_cache_bmn" /* CsharpCacheBuildModeNone */, codeql)) {
     dirs.push(getCsharpTempDependencyDir());
@@ -177828,7 +177894,7 @@ var defaultCacheConfigs = {
     getHashPatterns: getCsharpHashPatterns
   },
   go: {
-    getDependencyPaths: async () => [(0, import_path3.join)(os5.homedir(), "go", "pkg", "mod")],
+    getDependencyPaths: async () => [(0, import_path3.join)(os6.homedir(), "go", "pkg", "mod")],
     getHashPatterns: async () => internal.makePatternCheck(["**/go.sum"])
   }
 };
@@ -178114,7 +178180,7 @@ function dbIsFinalized(config, language, logger2) {
   const dbPath = getCodeQLDatabasePath(config, language);
   try {
     const dbInfo = load(
-      fs18.readFileSync(path16.resolve(dbPath, "codeql-database.yml"), "utf8")
+      fs19.readFileSync(path16.resolve(dbPath, "codeql-database.yml"), "utf8")
     );
     return !("inProgress" in dbInfo);
   } catch {
@@ -178198,8 +178264,8 @@ function writeDiffRangeDataExtensionPack(logger2, ranges, checkoutPath) {
     ranges = [{ path: "", startLine: 0, endLine: 0 }];
   }
   const diffRangeDir = path16.join(getTemporaryDirectory(), "pr-diff-range");
-  fs18.mkdirSync(diffRangeDir, { recursive: true });
-  fs18.writeFileSync(
+  fs19.mkdirSync(diffRangeDir, { recursive: true });
+  fs19.writeFileSync(
     path16.join(diffRangeDir, "qlpack.yml"),
     `
 name: codeql-action/pr-diff-range
@@ -178216,7 +178282,7 @@ dataExtensions:
     checkoutPath
   );
   const extensionFilePath = path16.join(diffRangeDir, "pr-diff-range.yml");
-  fs18.writeFileSync(extensionFilePath, extensionContents);
+  fs19.writeFileSync(extensionFilePath, extensionContents);
   logger2.debug(
     `Wrote pr-diff-range extension pack to ${extensionFilePath}:
 ${extensionContents}`
@@ -178361,7 +178427,7 @@ async function runQueries(sarifFolder, memoryFlag, threadsFlag, diffRangePackDir
   }
   function getPerQueryAlertCounts(sarifPath) {
     const sarifObject = JSON.parse(
-      fs18.readFileSync(sarifPath, "utf8")
+      fs19.readFileSync(sarifPath, "utf8")
     );
     const perQueryAlertCounts = {};
     for (const sarifRun of sarifObject.runs) {
@@ -178379,13 +178445,13 @@ async function runQueries(sarifFolder, memoryFlag, threadsFlag, diffRangePackDir
 }
 async function runFinalize(features, outputDir, threadsFlag, memoryFlag, codeql, config, logger2) {
   try {
-    await fs18.promises.rm(outputDir, { force: true, recursive: true });
+    await fs19.promises.rm(outputDir, { force: true, recursive: true });
   } catch (error3) {
     if (error3?.code !== "ENOENT") {
       throw error3;
     }
   }
-  await fs18.promises.mkdir(outputDir, { recursive: true });
+  await fs19.promises.mkdir(outputDir, { recursive: true });
   const timings = await finalizeDatabaseCreation(
     codeql,
     features,
@@ -178429,7 +178495,7 @@ async function warnIfGoInstalledAfterInit(config, logger2) {
 }
 
 // src/database-upload.ts
-var fs19 = __toESM(require("fs"));
+var fs20 = __toESM(require("fs"));
 async function cleanupAndUploadDatabases(action, repositoryNwo, codeql, config, apiDetails, checkoutPath) {
   const logger2 = action.logger;
   if (getRequiredInput("upload-database") !== "true") {
@@ -178466,7 +178532,7 @@ async function cleanupAndUploadDatabases(action, repositoryNwo, codeql, config,
       const bundledDb = await bundleDb(config, language, codeql, language, {
         includeDiagnostics: false
       });
-      bundledDbSize = fs19.statSync(bundledDb).size;
+      bundledDbSize = fs20.statSync(bundledDb).size;
       const commitOid = await getCommitOid(action.env, checkoutPath);
       const maxAttempts = 4;
       let uploadDurationMs;
@@ -178544,7 +178610,7 @@ async function recordClearCleanupSizes(codeql, config, reports, logger2) {
       const bundledDb = await bundleDb(config, language, codeql, language, {
         includeDiagnostics: false
       });
-      report.clear_cleanup_zipped_size_bytes = fs19.statSync(bundledDb).size;
+      report.clear_cleanup_zipped_size_bytes = fs20.statSync(bundledDb).size;
       logger2.debug(
         `Database for ${language} is ${report.clear_cleanup_zipped_size_bytes} bytes zipped at the '${"clear" /* Clear */}' cleanup level (vs. ${report.zipped_upload_size_bytes ?? "unknown"} bytes at the '${"overlay" /* Overlay */}' level).`
       );
@@ -178567,7 +178633,7 @@ async function uploadBundledDatabase(repositoryNwo, language, commitOid, bundled
   if (uploadsBaseUrl.endsWith("/")) {
     uploadsBaseUrl = uploadsBaseUrl.slice(0, -1);
   }
-  const bundledDbReadStream = fs19.createReadStream(bundledDb);
+  const bundledDbReadStream = fs20.createReadStream(bundledDb);
   try {
     const startTime = performance.now();
     await client.request(
@@ -178619,7 +178685,7 @@ __export(upload_lib_exports, {
   waitForProcessing: () => waitForProcessing,
   writePostProcessedFiles: () => writePostProcessedFiles
 });
-var fs23 = __toESM(require("fs"));
+var fs24 = __toESM(require("fs"));
 var path19 = __toESM(require("path"));
 var url = __toESM(require("url"));
 var import_zlib = __toESM(require("zlib"));
@@ -178627,7 +178693,7 @@ var core13 = __toESM(require_core());
 var jsonschema2 = __toESM(require_lib2());
 
 // src/fingerprints.ts
-var fs20 = __toESM(require("fs"));
+var fs21 = __toESM(require("fs"));
 var import_path4 = __toESM(require("path"));
 
 // node_modules/long/index.js
@@ -179615,7 +179681,7 @@ async function hash(callback, filepath) {
     }
     updateHash(current);
   };
-  const readStream = fs20.createReadStream(filepath, "utf8");
+  const readStream = fs21.createReadStream(filepath, "utf8");
   for await (const data of readStream) {
     for (let i = 0; i < data.length; ++i) {
       processCharacter(data.charCodeAt(i));
@@ -179690,11 +179756,11 @@ function resolveUriToFile(location, artifacts, sourceRoot, logger2) {
   if (!import_path4.default.isAbsolute(uri)) {
     uri = srcRootPrefix + uri;
   }
-  if (!fs20.existsSync(uri)) {
+  if (!fs21.existsSync(uri)) {
     logger2.debug(`Unable to compute fingerprint for non-existent file: ${uri}`);
     return void 0;
   }
-  if (fs20.statSync(uri).isDirectory()) {
+  if (fs21.statSync(uri).isDirectory()) {
     logger2.debug(`Unable to compute fingerprint for directory: ${uri}`);
     return void 0;
   }
@@ -179749,7 +179815,7 @@ async function addFingerprints(sarifLog, sourceRoot, logger2) {
 }
 
 // src/init.ts
-var fs21 = __toESM(require("fs"));
+var fs22 = __toESM(require("fs"));
 var path18 = __toESM(require("path"));
 var toolrunner4 = __toESM(require_toolrunner());
 var github3 = __toESM(require_github());
@@ -179784,7 +179850,7 @@ async function initConfig2(actionState, inputs) {
   });
 }
 async function runDatabaseInitCluster(databaseInitEnvironment, codeql, config, sourceRoot, processName, qlconfigFile) {
-  fs21.mkdirSync(config.dbLocation, { recursive: true });
+  fs22.mkdirSync(config.dbLocation, { recursive: true });
   await wrapEnvironment(
     databaseInitEnvironment,
     async () => await codeql.databaseInitCluster(
@@ -179819,24 +179885,24 @@ async function checkPacksForOverlayCompatibility(codeql, config, logger2) {
 function checkPackForOverlayCompatibility(packDir, codeQlOverlayVersion, logger2) {
   try {
     let qlpackPath = path18.join(packDir, "qlpack.yml");
-    if (!fs21.existsSync(qlpackPath)) {
+    if (!fs22.existsSync(qlpackPath)) {
       qlpackPath = path18.join(packDir, "codeql-pack.yml");
     }
     const qlpackContents = load(
-      fs21.readFileSync(qlpackPath, "utf8")
+      fs22.readFileSync(qlpackPath, "utf8")
     );
     if (!qlpackContents.buildMetadata) {
       return true;
     }
     const packInfoPath = path18.join(packDir, ".packinfo");
-    if (!fs21.existsSync(packInfoPath)) {
+    if (!fs22.existsSync(packInfoPath)) {
       logger2.warning(
         `The query pack at ${packDir} does not have a .packinfo file, so it cannot support overlay analysis. Recompiling the query pack with the latest CodeQL CLI should solve this problem.`
       );
       return false;
     }
     const packInfoFileContents = JSON.parse(
-      fs21.readFileSync(packInfoPath, "utf8")
+      fs22.readFileSync(packInfoPath, "utf8")
     );
     const packOverlayVersion = packInfoFileContents.overlayVersion;
     if (typeof packOverlayVersion !== "number") {
@@ -179871,8 +179937,8 @@ async function checkInstallPython311(languages, codeql) {
     ]).exec();
   }
 }
-function cleanupDatabaseClusterDirectory(config, logger2, options = {}, rmSync5 = fs21.rmSync) {
-  if (fs21.existsSync(config.dbLocation) && (fs21.statSync(config.dbLocation).isFile() || fs21.readdirSync(config.dbLocation).length > 0)) {
+function cleanupDatabaseClusterDirectory(config, logger2, options = {}, rmSync5 = fs22.rmSync) {
+  if (fs22.existsSync(config.dbLocation) && (fs22.statSync(config.dbLocation).isFile() || fs22.readdirSync(config.dbLocation).length > 0)) {
     if (!options.disableExistingDirectoryWarning) {
       logger2.warning(
         `The database cluster directory ${config.dbLocation} must be empty. Attempting to clean it up.`
@@ -179977,7 +180043,7 @@ To opt out of this change, ${envVarOptOut}`;
 }
 
 // src/sarif/index.ts
-var fs22 = __toESM(require("fs"));
+var fs23 = __toESM(require("fs"));
 var InvalidSarifUploadError = class extends Error {
 };
 function getToolNames(sarifFile) {
@@ -179993,7 +180059,7 @@ function getToolNames(sarifFile) {
 }
 function readSarifFile(sarifFilePath) {
   try {
-    return JSON.parse(fs22.readFileSync(sarifFilePath, "utf8"));
+    return JSON.parse(fs23.readFileSync(sarifFilePath, "utf8"));
   } catch (err) {
     throw new Error(
       `Parsing SARIF file at '${sarifFilePath}' failed: ${getErrorMessage(err)}`
@@ -180134,8 +180200,8 @@ async function combineSarifFilesUsingCLI(sarifFiles, gitHubVersion, features, lo
     codeQL = initCodeQLResult.codeql;
   }
   const baseTempDir = path19.resolve(tempDir, "combined-sarif");
-  fs23.mkdirSync(baseTempDir, { recursive: true });
-  const outputDirectory = fs23.mkdtempSync(path19.resolve(baseTempDir, "output-"));
+  fs24.mkdirSync(baseTempDir, { recursive: true });
+  const outputDirectory = fs24.mkdtempSync(path19.resolve(baseTempDir, "output-"));
   const outputFile = path19.resolve(outputDirectory, "combined-sarif.sarif");
   await codeQL.mergeResults(sarifFiles, outputFile, {
     mergeRunsFromEqualCategory: true
@@ -180180,7 +180246,7 @@ async function uploadPayload(payload, repositoryNwo, logger2, analysis) {
       `SARIF upload disabled by an environment variable. Saving to ${payloadSaveFile}`
     );
     logger2.info(`Payload: ${JSON.stringify(payload, null, 2)}`);
-    fs23.writeFileSync(payloadSaveFile, JSON.stringify(payload, null, 2));
+    fs24.writeFileSync(payloadSaveFile, JSON.stringify(payload, null, 2));
     return "dummy-sarif-id";
   }
   const client = getApiClient();
@@ -180214,7 +180280,7 @@ async function uploadPayload(payload, repositoryNwo, logger2, analysis) {
 function findSarifFilesInDir(sarifPath, isSarif) {
   const sarifFiles = [];
   const walkSarifFiles = (dir) => {
-    const entries = fs23.readdirSync(dir, { withFileTypes: true });
+    const entries = fs24.readdirSync(dir, { withFileTypes: true });
     for (const entry of entries) {
       if (entry.isFile() && isSarif(entry.name)) {
         sarifFiles.push(path19.resolve(dir, entry.name));
@@ -180227,11 +180293,11 @@ function findSarifFilesInDir(sarifPath, isSarif) {
   return sarifFiles;
 }
 function getSarifFilePaths(sarifPath, isSarif) {
-  if (!fs23.existsSync(sarifPath)) {
+  if (!fs24.existsSync(sarifPath)) {
     throw new ConfigurationError(`Path does not exist: ${sarifPath}`);
   }
   let sarifFiles;
-  if (fs23.lstatSync(sarifPath).isDirectory()) {
+  if (fs24.lstatSync(sarifPath).isDirectory()) {
     sarifFiles = findSarifFilesInDir(sarifPath, isSarif);
     if (sarifFiles.length === 0) {
       throw new ConfigurationError(
@@ -180244,7 +180310,7 @@ function getSarifFilePaths(sarifPath, isSarif) {
   return sarifFiles;
 }
 async function getGroupedSarifFilePaths(logger2, sarifPath) {
-  const stats = fs23.statSync(sarifPath, { throwIfNoEntry: false });
+  const stats = fs24.statSync(sarifPath, { throwIfNoEntry: false });
   if (stats === void 0) {
     throw new ConfigurationError(`Path does not exist: ${sarifPath}`);
   }
@@ -180379,7 +180445,7 @@ function buildPayload(commitOid, ref, analysisKey, analysisName, zippedSarif, wo
       payloadObj.base_sha = mergeBaseCommitOid;
     } else if (process.env.GITHUB_EVENT_PATH) {
       const githubEvent = JSON.parse(
-        fs23.readFileSync(process.env.GITHUB_EVENT_PATH, "utf8")
+        fs24.readFileSync(process.env.GITHUB_EVENT_PATH, "utf8")
       );
       payloadObj.base_ref = `refs/heads/${githubEvent.pull_request.base.ref}`;
       payloadObj.base_sha = githubEvent.pull_request.base.sha;
@@ -180517,9 +180583,9 @@ async function uploadPostProcessedFiles(logger2, checkoutPath, uploadTarget, pos
   };
 }
 function dumpSarifFile(sarifPayload, outputDir, logger2, uploadTarget) {
-  if (!fs23.existsSync(outputDir)) {
-    fs23.mkdirSync(outputDir, { recursive: true });
-  } else if (!fs23.lstatSync(outputDir).isDirectory()) {
+  if (!fs24.existsSync(outputDir)) {
+    fs24.mkdirSync(outputDir, { recursive: true });
+  } else if (!fs24.lstatSync(outputDir).isDirectory()) {
     throw new ConfigurationError(
       `The path that processed SARIF files should be written to exists, but is not a directory: ${outputDir}`
     );
@@ -180529,7 +180595,7 @@ function dumpSarifFile(sarifPayload, outputDir, logger2, uploadTarget) {
     `upload${uploadTarget.sarifExtension}`
   );
   logger2.info(`Writing processed SARIF file to ${outputFile}`);
-  fs23.writeFileSync(outputFile, sarifPayload);
+  fs24.writeFileSync(outputFile, sarifPayload);
 }
 var STATUS_CHECK_INITIAL_BACKOFF_MILLISECONDS = 5 * 1e3;
 var STATUS_CHECK_BACKOFF_MULTIPLIER = 2;
@@ -180776,7 +180842,7 @@ function doesGoExtractionOutputExist(config) {
     "trap",
     "go" /* go */
   );
-  return fs24.existsSync(trapDirectory) && fs24.readdirSync(trapDirectory).some(
+  return fs25.existsSync(trapDirectory) && fs25.readdirSync(trapDirectory).some(
     (fileName) => [
       ".trap",
       ".trap.gz",
@@ -181079,18 +181145,18 @@ async function runWrapper() {
 }
 
 // src/analyze-action-post.ts
-var fs28 = __toESM(require("fs"));
+var fs29 = __toESM(require("fs"));
 var core16 = __toESM(require_core());
 
 // src/debug-artifacts.ts
-var fs27 = __toESM(require("fs"));
+var fs28 = __toESM(require("fs"));
 var path23 = __toESM(require("path"));
 var artifact = __toESM(require_artifact2());
 var artifactLegacy = __toESM(require_artifact_client2());
 var core15 = __toESM(require_core());
 
 // node_modules/archiver/lib/core.js
-var import_fs = require("fs");
+var import_fs2 = require("fs");
 
 // node_modules/is-stream/index.js
 function isStream(stream2, { checkOpen = true } = {}) {
@@ -181098,7 +181164,7 @@ function isStream(stream2, { checkOpen = true } = {}) {
 }
 
 // node_modules/readdir-glob/dist/index.mjs
-var fs25 = __toESM(require("fs"), 1);
+var fs26 = __toESM(require("fs"), 1);
 var import_events = require("events");
 
 // node_modules/readdir-glob/node_modules/balanced-match/dist/esm/index.js
@@ -182975,7 +183041,7 @@ minimatch.unescape = unescape2;
 var import_path6 = require("path");
 function readdir2(dir, strict) {
   return new Promise((resolve$1, reject) => {
-    fs25.readdir(dir, { withFileTypes: true }, (err, files) => {
+    fs26.readdir(dir, { withFileTypes: true }, (err, files) => {
       if (err) switch (err.code) {
         case "ENOTDIR":
           if (strict) reject(err);
@@ -182998,7 +183064,7 @@ function readdir2(dir, strict) {
 }
 function getStat(file, followSymlinks) {
   return new Promise((resolve$1) => {
-    const statFunc = followSymlinks ? fs25.stat : fs25.lstat;
+    const statFunc = followSymlinks ? fs26.stat : fs26.lstat;
     statFunc(file, (err, stats) => {
       if (err) switch (err.code) {
         case "ENOENT":
@@ -183168,7 +183234,7 @@ var import_async = __toESM(require_async(), 1);
 var import_path7 = require("path");
 
 // node_modules/archiver/lib/error.js
-var import_util37 = __toESM(require("util"), 1);
+var import_util38 = __toESM(require("util"), 1);
 var ERROR_CODES = {
   ABORTED: "archive was aborted",
   DIRECTORYDIRPATHREQUIRED: "diretory dirpath argument must be a non-empty string value",
@@ -183193,7 +183259,7 @@ function ArchiverError(code, data) {
   this.code = code;
   this.data = data;
 }
-import_util37.default.inherits(ArchiverError, Error);
+import_util38.default.inherits(ArchiverError, Error);
 
 // node_modules/archiver/lib/core.js
 var import_readable_stream2 = __toESM(require_ours(), 1);
@@ -183306,7 +183372,7 @@ var Archiver = class extends import_readable_stream2.Transform {
     data.sourcePath = filepath;
     task.data = data;
     this._entriesCount++;
-    if (data.stats && data.stats instanceof import_fs.Stats) {
+    if (data.stats && data.stats instanceof import_fs2.Stats) {
       task = this._updateQueueTaskWithStats(task, data.stats);
       if (task) {
         if (data.stats.size) {
@@ -183554,7 +183620,7 @@ var Archiver = class extends import_readable_stream2.Transform {
       callback();
       return;
     }
-    (0, import_fs.lstat)(
+    (0, import_fs2.lstat)(
       task.filepath,
       function(err, stats) {
         if (this._state.aborted) {
@@ -183616,7 +183682,7 @@ var Archiver = class extends import_readable_stream2.Transform {
       task.data.type = "file";
       task.data.sourceType = "stream";
       task.source = new import_lazystream.Readable(function() {
-        return (0, import_fs.createReadStream)(task.filepath);
+        return (0, import_fs2.createReadStream)(task.filepath);
       });
     } else if (stats.isDirectory() && this._supportsDirectory) {
       task.data.name = trailingSlashIt(task.data.name);
@@ -183625,7 +183691,7 @@ var Archiver = class extends import_readable_stream2.Transform {
       task.data.sourceType = "buffer";
       task.source = Buffer.concat([]);
     } else if (stats.isSymbolicLink() && this._supportsSymlink) {
-      const linkPath = (0, import_fs.readlinkSync)(task.filepath);
+      const linkPath = (0, import_fs2.readlinkSync)(task.filepath);
       const dirName = (0, import_path7.dirname)(task.filepath);
       task.data.type = "symlink";
       task.data.linkname = (0, import_path7.relative)(
@@ -185468,8 +185534,8 @@ var ZipArchive = class extends Archiver {
 };
 
 // src/artifact-scanner.ts
-var fs26 = __toESM(require("fs"));
-var os6 = __toESM(require("os"));
+var fs27 = __toESM(require("fs"));
+var os7 = __toESM(require("os"));
 var path22 = __toESM(require("path"));
 var exec = __toESM(require_exec());
 var GITHUB_PAT_CLASSIC_PATTERN = {
@@ -185515,7 +185581,7 @@ function isAuthToken(value, patterns = GITHUB_TOKEN_PATTERNS) {
 function scanFileForTokens(filePath, relativePath2, logger2) {
   const findings = [];
   try {
-    const content = fs26.readFileSync(filePath, "utf8");
+    const content = fs27.readFileSync(filePath, "utf8");
     for (const { type, pattern } of GITHUB_TOKEN_PATTERNS) {
       const matches = content.match(pattern);
       if (matches) {
@@ -185548,7 +185614,7 @@ async function scanArchiveFile(archivePath, relativeArchivePath, extractDir, log
     findings: []
   };
   try {
-    const tempExtractDir = fs26.mkdtempSync(
+    const tempExtractDir = fs27.mkdtempSync(
       path22.join(extractDir, `extract-${depth}-`)
     );
     const fileName = path22.basename(archivePath).toLowerCase();
@@ -185582,7 +185648,7 @@ async function scanArchiveFile(archivePath, relativeArchivePath, extractDir, log
         path22.basename(archivePath, ".gz")
       );
       await exec.exec("gunzip", ["-c", archivePath], {
-        outStream: fs26.createWriteStream(outputFile),
+        outStream: fs27.createWriteStream(outputFile),
         silent: true
       });
     } else if (fileName.endsWith(".zip")) {
@@ -185603,7 +185669,7 @@ async function scanArchiveFile(archivePath, relativeArchivePath, extractDir, log
     );
     result.scannedFiles += scanResult.scannedFiles;
     result.findings.push(...scanResult.findings);
-    fs26.rmSync(tempExtractDir, { recursive: true, force: true });
+    fs27.rmSync(tempExtractDir, { recursive: true, force: true });
   } catch (e) {
     logger2.debug(
       `Could not extract or scan archive file ${archivePath}: ${getErrorMessage(e)}`
@@ -185638,7 +185704,7 @@ async function scanDirectory(dirPath, baseRelativePath, logger2, depth = 0) {
     scannedFiles: 0,
     findings: []
   };
-  const entries = fs26.readdirSync(dirPath, { withFileTypes: true });
+  const entries = fs27.readdirSync(dirPath, { withFileTypes: true });
   for (const entry of entries) {
     const fullPath = path22.join(dirPath, entry.name);
     const relativePath2 = path22.join(baseRelativePath, entry.name);
@@ -185673,10 +185739,10 @@ async function scanArtifactsForTokens(filesToScan, logger2) {
     scannedFiles: 0,
     findings: []
   };
-  const tempScanDir = fs26.mkdtempSync(path22.join(os6.tmpdir(), "artifact-scan-"));
+  const tempScanDir = fs27.mkdtempSync(path22.join(os7.tmpdir(), "artifact-scan-"));
   try {
     for (const filePath of filesToScan) {
-      const stats = fs26.statSync(filePath);
+      const stats = fs27.statSync(filePath);
       const fileName = path22.basename(filePath);
       if (stats.isDirectory()) {
         const dirResult = await scanDirectory(filePath, fileName, logger2);
@@ -185714,7 +185780,7 @@ async function scanArtifactsForTokens(filesToScan, logger2) {
     }
   } finally {
     try {
-      fs26.rmSync(tempScanDir, { recursive: true, force: true });
+      fs27.rmSync(tempScanDir, { recursive: true, force: true });
     } catch (e) {
       logger2.debug(
         `Could not clean up temporary scan directory: ${getErrorMessage(e)}`
@@ -185736,10 +185802,10 @@ async function uploadCombinedSarifArtifacts(logger2, gitHubVariant) {
       );
       const baseTempDir = path23.resolve(tempDir, "combined-sarif");
       const toUpload = [];
-      if (fs27.existsSync(baseTempDir)) {
-        const outputDirs = fs27.readdirSync(baseTempDir);
+      if (fs28.existsSync(baseTempDir)) {
+        const outputDirs = fs28.readdirSync(baseTempDir);
         for (const outputDir of outputDirs) {
-          const sarifFiles = fs27.readdirSync(path23.resolve(baseTempDir, outputDir)).filter((f) => path23.extname(f) === ".sarif");
+          const sarifFiles = fs28.readdirSync(path23.resolve(baseTempDir, outputDir)).filter((f) => path23.extname(f) === ".sarif");
           for (const sarifFile of sarifFiles) {
             toUpload.push(path23.resolve(baseTempDir, outputDir, sarifFile));
           }
@@ -185766,17 +185832,17 @@ async function uploadCombinedSarifArtifacts(logger2, gitHubVariant) {
 function tryPrepareSarifDebugArtifact(config, language, logger2) {
   try {
     const analyzeActionOutputDir = process.env["CODEQL_ACTION_SARIF_RESULTS_OUTPUT_DIR" /* SARIF_RESULTS_OUTPUT_DIR */];
-    if (analyzeActionOutputDir !== void 0 && fs27.existsSync(analyzeActionOutputDir) && fs27.lstatSync(analyzeActionOutputDir).isDirectory()) {
+    if (analyzeActionOutputDir !== void 0 && fs28.existsSync(analyzeActionOutputDir) && fs28.lstatSync(analyzeActionOutputDir).isDirectory()) {
       const sarifFile = path23.resolve(
         analyzeActionOutputDir,
         `${language}.sarif`
       );
-      if (fs27.existsSync(sarifFile)) {
+      if (fs28.existsSync(sarifFile)) {
         const sarifInDbLocation = path23.resolve(
           config.dbLocation,
           `${language}.sarif`
         );
-        fs27.copyFileSync(sarifFile, sarifInDbLocation);
+        fs28.copyFileSync(sarifFile, sarifInDbLocation);
         return sarifInDbLocation;
       }
     }
@@ -185944,10 +186010,10 @@ async function createPartialDatabaseBundle(config, language) {
   core15.info(
     `${config.debugDatabaseName}-${language} is not finalized. Uploading partial database bundle at ${databaseBundlePath}...`
   );
-  if (fs27.existsSync(databaseBundlePath)) {
-    await fs27.promises.rm(databaseBundlePath, { force: true });
+  if (fs28.existsSync(databaseBundlePath)) {
+    await fs28.promises.rm(databaseBundlePath, { force: true });
   }
-  const output = fs27.createWriteStream(databaseBundlePath);
+  const output = fs28.createWriteStream(databaseBundlePath);
   const zip = new ZipArchive();
   zip.on("error", (err) => {
     throw err;
@@ -185997,9 +186063,9 @@ async function runWrapper2() {
       getCsharpTempDependencyDir()
     ];
     for (const tempDependencyDir of tempDependencyDirs) {
-      if (fs28.existsSync(tempDependencyDir)) {
+      if (fs29.existsSync(tempDependencyDir)) {
         try {
-          fs28.rmSync(tempDependencyDir, { recursive: true });
+          fs29.rmSync(tempDependencyDir, { recursive: true });
         } catch (error3) {
           logger2.info(
             `Failed to remove temporary dependencies directory: ${getErrorMessage(error3)}`
@@ -186110,11 +186176,11 @@ async function runWrapper3() {
 }
 
 // src/init-action.ts
-var fs30 = __toESM(require("fs"));
+var fs31 = __toESM(require("fs"));
 var path25 = __toESM(require("path"));
 var core19 = __toESM(require_core());
 var io7 = __toESM(require_io());
-var semver10 = __toESM(require_semver2());
+var semver11 = __toESM(require_semver2());
 
 // src/config/inputs.ts
 async function getToolsInput(action, repositoryProperties) {
@@ -186150,6 +186216,105 @@ async function getToolsInput(action, repositoryProperties) {
   return void 0;
 }
 
+// src/languages/swift.ts
+async function isSwiftCompatible(config, codeql, macosVersion) {
+  if (!config.languages.includes("swift" /* swift */)) {
+    return;
+  }
+  if (await codeql.supportsFeature("swiftSupportsAllPlatforms" /* SwiftSupportsAllPlatforms */)) {
+    return;
+  }
+  if (macosVersion === void 0) {
+    throw new ConfigurationError(
+      `Swift analysis is only supported on macOS runner images. Please migrate to a macOS runner.`
+    );
+  }
+}
+
+// src/languages/traced.ts
+var UNSUPPORTED_MACOS_FOR_TRACED = 27;
+var UNSUPPORTED_XCODE_FOR_TRACED = 27;
+function handleUnsupportedVersion(logger2, config, skipUnsupportedTracedAnalysis, product, version) {
+  const baseMessage = [
+    `Traced analysis is not supported on ${product} ${UNSUPPORTED_MACOS_FOR_TRACED} or above.`,
+    `Configure your analysis to run on macOS ${UNSUPPORTED_MACOS_FOR_TRACED - 1} or below`,
+    `and XCode ${UNSUPPORTED_XCODE_FOR_TRACED - 1} or below.`
+  ].join(" ");
+  const attributeName = product === "macOS" ? "macOSVersion" : "xcodeVersion";
+  for (const language of config.languages) {
+    addDiagnostic(
+      config,
+      language,
+      makeDiagnostic(
+        `codeql-action/unsupported-traced-analysis-${product.toLowerCase()}`,
+        `Traced analysis is not supported on this version of ${product}`,
+        {
+          attributes: {
+            languages: config.languages,
+            [attributeName]: version.toString()
+          },
+          markdownMessage: baseMessage,
+          severity: skipUnsupportedTracedAnalysis ? "error" : "warning",
+          visibility: {
+            cliSummaryTable: true,
+            statusPage: true,
+            telemetry: true
+          }
+        }
+      )
+    );
+  }
+  if (skipUnsupportedTracedAnalysis) {
+    throw new ConfigurationError(baseMessage);
+  } else {
+    logger2.warning(baseMessage);
+  }
+}
+async function hasTracedLanguages(config, codeql) {
+  for (const language of config.languages) {
+    if (await codeql.isTracedLanguage(language)) {
+      return true;
+    }
+  }
+  return false;
+}
+async function checkRunnerSupportsTracedAnalysis(action, config, codeql) {
+  const version = macOSVersion(action);
+  await isSwiftCompatible(config, codeql, version);
+  if (config.buildMode !== void 0 && config.buildMode === "none") {
+    return;
+  }
+  if (!await hasTracedLanguages(config, codeql)) {
+    return;
+  }
+  const skipUnsupportedTracedAnalysis = await action.features.getValue(
+    "skip_unsupported_traced_analysis" /* SkipUnsupportedTracedAnalysis */
+  );
+  if (typeof version === "string") {
+    action.logger.warning(
+      `Unable to determine version of macOS, got: ${version}`
+    );
+  } else if (version !== void 0 && version.major >= UNSUPPORTED_MACOS_FOR_TRACED) {
+    handleUnsupportedVersion(
+      action.logger,
+      config,
+      skipUnsupportedTracedAnalysis,
+      "macOS",
+      version
+    );
+  }
+  const xcodeVer = xcodeVersion(action.logger);
+  if (xcodeVer !== void 0 && xcodeVer.major >= UNSUPPORTED_XCODE_FOR_TRACED) {
+    handleUnsupportedVersion(
+      action.logger,
+      config,
+      skipUnsupportedTracedAnalysis,
+      "Xcode",
+      xcodeVer
+    );
+  }
+}
+
 // src/status-report/tools-download.ts
 function createInitToolsDownloadFields(report, toolsFeatureFlagsValid) {
   const fields = { ...report?.perLanguage };
@@ -186169,7 +186334,7 @@ function createInitToolsDownloadFields(report, toolsFeatureFlagsValid) {
 }
 
 // src/workflow.ts
-var fs29 = __toESM(require("fs"));
+var fs30 = __toESM(require("fs"));
 var path24 = __toESM(require("path"));
 var import_zlib3 = __toESM(require("zlib"));
 var core18 = __toESM(require_core());
@@ -186321,7 +186486,7 @@ async function getWorkflow(logger2) {
     );
   }
   const workflowPath = await getWorkflowAbsolutePath(logger2);
-  return load(fs29.readFileSync(workflowPath, "utf-8"));
+  return load(fs30.readFileSync(workflowPath, "utf-8"));
 }
 async function getWorkflowAbsolutePath(logger2) {
   const relativePath2 = await getWorkflowRelativePath();
@@ -186329,7 +186494,7 @@ async function getWorkflowAbsolutePath(logger2) {
     getRequiredEnvParam("GITHUB_WORKSPACE"),
     relativePath2
   );
-  if (fs29.existsSync(absolutePath)) {
+  if (fs30.existsSync(absolutePath)) {
     logger2.debug(
       `Derived the following absolute path for the currently executing workflow: ${absolutePath}.`
     );
@@ -186624,7 +186789,7 @@ async function run3(actionState) {
     ) {
       const publicPreview = "2.22.1";
       const actualVer = (await codeql.getVersion()).version;
-      if (semver10.lt(actualVer, publicPreview)) {
+      if (semver11.lt(actualVer, publicPreview)) {
         actionState.env.export("CODEQL_ENABLE_EXPERIMENTAL_FEATURES" /* EXPERIMENTAL_FEATURES */, "true");
         logger2.info("Experimental Rust analysis enabled");
       }
@@ -186669,11 +186834,11 @@ async function run3(actionState) {
       enableFileCoverageInformation: fileCoverageResult.enabled,
       logger: logger2
     });
-    if (config.languages.includes("swift" /* swift */) && process.platform !== "darwin") {
-      throw new ConfigurationError(
-        `Swift analysis is only supported on macOS runner images. Please migrate to a macOS runner.`
-      );
-    }
+    await checkRunnerSupportsTracedAnalysis(
+      actionStateWithFeatures,
+      config,
+      codeql
+    );
     if (repositoryPropertiesResult.isFailure()) {
       addNoLanguageDiagnostic(
         config,
@@ -186773,16 +186938,16 @@ async function run3(actionState) {
               "codeql-action-go-tracing",
               "bin"
             );
-            fs30.mkdirSync(tempBinPath, { recursive: true });
+            fs31.mkdirSync(tempBinPath, { recursive: true });
             core19.addPath(tempBinPath);
             const goWrapperPath = path25.resolve(tempBinPath, "go");
-            fs30.writeFileSync(
+            fs31.writeFileSync(
               goWrapperPath,
               `#!/bin/bash
 
 exec ${goBinaryPath} "$@"`
             );
-            fs30.chmodSync(goWrapperPath, "755");
+            fs31.chmodSync(goWrapperPath, "755");
             actionState.env.export("CODEQL_ACTION_GO_BINARY" /* GO_BINARY_LOCATION */, goWrapperPath);
           } catch (e) {
             logger2.warning(
@@ -186964,7 +187129,7 @@ async function runWrapper4() {
 var core20 = __toESM(require_core());
 
 // src/init-action-post-helper.ts
-var fs31 = __toESM(require("fs"));
+var fs32 = __toESM(require("fs"));
 var import_path8 = __toESM(require("path"));
 var github4 = __toESM(require_github());
 function createFailedUploadFailedSarifResult(error3) {
@@ -187042,7 +187207,7 @@ async function generateFailedSarif(logger2, features, config, category, checkout
     let diagnosticDir = getTempDiagnosticPath(
       config.tempDir
     );
-    if (!fs31.existsSync(diagnosticDir)) {
+    if (!fs32.existsSync(diagnosticDir)) {
       diagnosticDir = void 0;
     }
     await codeql.diagnosticsExport(sarifFile, category, config, diagnosticDir);
@@ -187169,7 +187334,7 @@ async function uploadFailureInfo(uploadAllAvailableDebugArtifacts, printDebugLog
   }
   if (isSelfHostedRunner() && config.dbLocation) {
     try {
-      fs31.rmSync(config.dbLocation, {
+      fs32.rmSync(config.dbLocation, {
         recursive: true,
         force: true,
         maxRetries: 3
@@ -188109,7 +188274,7 @@ function generateCertificateAuthority() {
 }
 
 // src/start-proxy/environment.ts
-var fs32 = __toESM(require("fs"));
+var fs33 = __toESM(require("fs"));
 var path28 = __toESM(require("path"));
 var toolrunner5 = __toESM(require_toolrunner());
 var io8 = __toESM(require_io());
@@ -188182,9 +188347,9 @@ function checkJdkSettings(logger2, jdkHome) {
   for (const fileToCheck of filesToCheck) {
     const file = path28.join(jdkHome, fileToCheck);
     try {
-      if (fs32.existsSync(file)) {
+      if (fs33.existsSync(file)) {
         logger2.debug(`Found '${file}'.`);
-        const lines = String(fs32.readFileSync(file)).split("\n");
+        const lines = String(fs33.readFileSync(file)).split("\n");
         for (const line of lines) {
           for (const property of javaProperties) {
             if (line.startsWith(`${property}=`)) {
diff --git a/pr-checks/checks/unsupported-macos.yml b/pr-checks/checks/unsupported-macos.yml
new file mode 100644
index 0000000000..dec7933e53
--- /dev/null
+++ b/pr-checks/checks/unsupported-macos.yml
@@ -0,0 +1,54 @@
+name: "Unsupported macOS"
+description: "Tests that unsupported macOS versions are detected and result in appropriate diagnostics."
+versions:
+  - linked
+  - nightly-latest
+installNode: true
+
+operatingSystems:
+  - os: macos
+    runner-image: xcode-27
+
+env:
+  # Allow the failed SARIF file to be generated.
+  CODEQL_ACTION_SKIP_GENERATE_FAILED_SARIF: false
+  # But don't actually upload it.
+  CODEQL_ACTION_SKIP_SARIF_UPLOAD: true
+  # Mark telemetry for this workflow so it can be treated separately.
+  CODEQL_ACTION_TESTING_ENVIRONMENT: codeql-action-pr-checks
+
+steps:
+  - uses: ./../action/init
+    id: init
+    with:
+      languages: swift
+      tools: ${{ steps.prepare-test.outputs.tools-url }}
+
+  - name: Analyze
+    uses: ./../action/analyze
+    with:
+      category: "/test-codeql-version:${{ matrix.version }}"
+
+validationJobs:
+  unsupported-macos-sarif-checks:
+    checkout: true
+    installNode: true
+    steps:
+      - name: Download workflow artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          pattern: test-mode-sarif-*
+          path: sarif
+
+      - name: List artifact contents
+        run: ls -laR ./sarif
+
+      - name: Check diagnostics appear in SARIF
+        env:
+          SARIF_PATH: "./sarif/codeql-failed-run.sarif"
+          DIAGNOSTIC_ID: "codeql-action/unsupported-traced-analysis-macos"
+          DIAGNOSTIC_NAME: "Traced analysis is not supported on this version of macOS"
+          EXPECTED_LOCATIONS: "0"
+          EXPECTED_MESSAGE: |
+            Traced analysis is not supported on macOS 27 or above.
+        run: npx tsx ./pr-checks/check-diagnostics.ts
diff --git a/src/action-common.ts b/src/action-common.ts
index 79f1901f22..efb0bd97a0 100644
--- a/src/action-common.ts
+++ b/src/action-common.ts
@@ -1,3 +1,5 @@
+import * as os from "os";
+
 import * as core from "@actions/core";
 
 import { ActionsEnv, getActionsEnv } from "./actions-util";
@@ -13,6 +15,8 @@ import {
 } from "./status-report";
 import { getEnv, getErrorMessage, wrapError } from "./util";
 
+export type { Logger } from "./logging";
+
 /** Base state that is available to an Action on startup. */
 export interface BaseState {
   /** The name of the Action. */
@@ -23,6 +27,8 @@ export interface BaseState {
   platform: NodeJS.Platform;
   /** The architecture of the host. */
   arch: NodeJS.Architecture;
+  /** The version of the operating system. */
+  osRelease: string;
 }
 
 /** Describes different state features that an Action may have. */
@@ -173,6 +179,7 @@ export async function runInActions(action: Action) {
       startedAt,
       platform: process.platform,
       arch: process.arch,
+      osRelease: os.release(),
       logger,
       env,
       actions: actionsEnv,
diff --git a/src/actions-util.ts b/src/actions-util.ts
index 13e33a8e9d..997b8ee90a 100644
--- a/src/actions-util.ts
+++ b/src/actions-util.ts
@@ -72,7 +72,7 @@ export const getOptionalInput = function (name: string): string | undefined {
  * directory that has been set in `CODEQL_ACTION_TEMP` by e.g. a previous step, or the
  * value of `RUNNER_TEMP` otherwise.
  */
-export function getTemporaryDirectory(env: Env = getEnv()): string {
+export function getTemporaryDirectory(env: ReadOnlyEnv = getEnv()): string {
   return (
     env.getOptional(EnvVar.TEMP) ?? env.getRequired(ActionsEnvVars.RUNNER_TEMP)
   );
diff --git a/src/cli/output-cache.ts b/src/cli/output-cache.ts
index fb5deb1ad6..209df575db 100644
--- a/src/cli/output-cache.ts
+++ b/src/cli/output-cache.ts
@@ -2,7 +2,7 @@ import * as fs from "fs";
 import path from "path";
 
 import { getTemporaryDirectory } from "../actions-util";
-import { Env } from "../environment";
+import { ReadOnlyEnv } from "../environment";
 import * as json from "../json";
 import { Logger } from "../logging";
 
@@ -51,7 +51,7 @@ export function resetCachedCodeQlVersion(): void {
  * Returns the path to the temporary file that backs the
  * on-disk cache of CLI responses between workflow steps.
  */
-export function getCommandCacheFilePath(env: Env): string {
+export function getCommandCacheFilePath(env: ReadOnlyEnv): string {
   return path.join(getTemporaryDirectory(env), COMMAND_CACHE_FILENAME);
 }
 
diff --git a/src/codeql.ts b/src/codeql.ts
index 7595e604a6..6329073cb5 100644
--- a/src/codeql.ts
+++ b/src/codeql.ts
@@ -18,7 +18,7 @@ import { CliError, wrapCliConfigurationError } from "./cli-errors";
 import type { ActionConfig } from "./config/action-config";
 import { appendExtraQueryExclusions, type Config } from "./config-utils";
 import { DocUrl } from "./doc-url";
-import { EnvVar, getEnv, exportEnvVar } from "./environment";
+import { EnvVar, getEnv, exportEnvVar, Env, ReadOnlyEnv } from "./environment";
 import {
   CodeQLDefaultVersionInfo,
   Feature,
@@ -495,8 +495,9 @@ export function createStubCodeQL(partialCodeql: Partial<CodeQL>): CodeQL {
 export async function getCodeQLForTesting(
   cmd = "codeql-for-testing",
   logger: Logger = getRunnerLogger(true),
+  env: Env = getEnv(),
 ): Promise<CodeQL> {
-  return getCodeQLForCmd(logger, cmd, false);
+  return getCodeQLForCmd(logger, cmd, false, env);
 }
 
 /**
@@ -511,13 +512,14 @@ async function getCodeQLForCmd(
   logger: Logger,
   cmd: string,
   checkVersion: boolean,
+  env: Env = getEnv(),
 ): Promise<CodeQL> {
   const codeql: CodeQL = {
     getPath() {
       return cmd;
     },
     async getVersion() {
-      const cacheFilePath = outputCache.getCommandCacheFilePath(getEnv());
+      const cacheFilePath = outputCache.getCommandCacheFilePath(env);
       let result = outputCache.getCachedCodeQlVersion(
         logger,
         cacheFilePath,
@@ -643,7 +645,7 @@ async function getCodeQLForCmd(
       }
     },
     async runAutobuild(config: Config, language: Language) {
-      applyAutobuildAzurePipelinesTimeoutFix();
+      applyAutobuildAzurePipelinesTimeoutFix(env);
 
       const autobuildCmd = path.join(
         await this.resolveExtractor(language),
@@ -653,8 +655,11 @@ async function getCodeQLForCmd(
 
       // Bump the verbosity of the autobuild command if we're in debug mode
       if (config.debugMode) {
-        process.env[EnvVar.CLI_VERBOSITY] =
-          process.env[EnvVar.CLI_VERBOSITY] || EXTRACTION_DEBUG_MODE_VERBOSITY;
+        env.set(
+          EnvVar.CLI_VERBOSITY,
+          env.getOptional(EnvVar.CLI_VERBOSITY) ??
+            EXTRACTION_DEBUG_MODE_VERBOSITY,
+        );
       }
 
       // On macOS, System Integrity Protection (SIP) typically interferes with
@@ -686,7 +691,7 @@ async function getCodeQLForCmd(
     },
     async extractUsingBuildMode(config: Config, language: Language) {
       if (config.buildMode === BuildMode.Autobuild) {
-        applyAutobuildAzurePipelinesTimeoutFix();
+        applyAutobuildAzurePipelinesTimeoutFix(env);
       }
       try {
         await runCli(cmd, [
@@ -818,7 +823,7 @@ async function getCodeQLForCmd(
         "--sarif-group-rules-by-pack",
         "--sarif-include-query-help=always",
         "--sublanguage-file-coverage",
-        ...(await getJobRunUuidSarifOptions()),
+        ...(await getJobRunUuidSarifOptions(env)),
         ...getExtraOptionsFromEnv(["database", "interpret-results"]),
       ];
       if (sarifRunPropertyFlag !== undefined) {
@@ -1055,7 +1060,7 @@ async function getCodeQLForCmd(
     );
   } else if (
     checkVersion &&
-    process.env[EnvVar.SUPPRESS_DEPRECATED_SOON_WARNING] !== "true" &&
+    env.getOptional(EnvVar.SUPPRESS_DEPRECATED_SOON_WARNING) !== "true" &&
     !(await util.codeQlVersionAtLeast(codeql, CODEQL_NEXT_MINIMUM_VERSION))
   ) {
     const result = await codeql.getVersion();
@@ -1277,17 +1282,20 @@ function getExtractionVerbosityArguments(
  * Without the fix, long build processes will timeout when pulling down Java packages
  * https://developercommunity.visualstudio.com/content/problem/292284/maven-hosted-agent-connection-timeout.html
  */
-function applyAutobuildAzurePipelinesTimeoutFix() {
-  const javaToolOptions = process.env["JAVA_TOOL_OPTIONS"] || "";
-  process.env["JAVA_TOOL_OPTIONS"] = [
-    ...javaToolOptions.split(/\s+/),
-    "-Dhttp.keepAlive=false",
-    "-Dmaven.wagon.http.pool=false",
-  ].join(" ");
+function applyAutobuildAzurePipelinesTimeoutFix(env: Env) {
+  const javaToolOptions = env.getOptional("JAVA_TOOL_OPTIONS") ?? "";
+  env.set(
+    "JAVA_TOOL_OPTIONS",
+    [
+      ...javaToolOptions.split(/\s+/),
+      "-Dhttp.keepAlive=false",
+      "-Dmaven.wagon.http.pool=false",
+    ].join(" "),
+  );
 }
 
-async function getJobRunUuidSarifOptions() {
-  const jobRunUuid = process.env[EnvVar.JOB_RUN_UUID];
+async function getJobRunUuidSarifOptions(env: ReadOnlyEnv) {
+  const jobRunUuid = env.getOptional(EnvVar.JOB_RUN_UUID);
 
   return jobRunUuid ? [`--sarif-run-property=jobRunUuid=${jobRunUuid}`] : [];
 }
diff --git a/src/diagnostics.ts b/src/diagnostics.ts
index a3b44fd760..30c6ab5135 100644
--- a/src/diagnostics.ts
+++ b/src/diagnostics.ts
@@ -3,7 +3,7 @@ import path from "path";
 
 import type { ActionState } from "./action-common";
 import { getTemporaryDirectory } from "./actions-util";
-import type { Config } from "./config-utils";
+import type { ActionConfig } from "./config/action-config";
 import { Language } from "./languages";
 import { getActionsLogger, type Logger } from "./logging";
 import {
@@ -160,7 +160,7 @@ export function getDiagnosticsPath(basePath: string, language?: Language) {
  * @param diagnostic The diagnostic message to add to the database.
  */
 export function addDiagnostic(
-  config: Config,
+  config: ActionConfig<"dbLocation" | "tempDir">,
   language: Language,
   diagnostic: DiagnosticMessage,
   logger: Logger = getActionsLogger(),
@@ -185,7 +185,7 @@ export function addDiagnostic(
 
 /** Adds a diagnostic that is not specific to any language. */
 export function addNoLanguageDiagnostic(
-  config: Config | undefined,
+  config: ActionConfig<"languages" | "dbLocation" | "tempDir"> | undefined,
   diagnostic: DiagnosticMessage,
   logger: Logger = getActionsLogger(),
 ) {
@@ -268,7 +268,7 @@ function writeDiagnosticFile(
 
 /** Gets the path where diagnostics for {@link language} should be stored in the database. */
 export function getDatabaseDiagnosticsPath(
-  config: Config,
+  config: ActionConfig<"dbLocation">,
   language: Language | undefined,
 ) {
   return getDiagnosticsPath(config.dbLocation, language);
@@ -283,7 +283,7 @@ export function getDatabaseDiagnosticsPath(
  */
 function writeDiagnostic(
   action: ActionState<["Logger"]>,
-  config: Config,
+  config: ActionConfig<"dbLocation">,
   language: Language | undefined,
   diagnostic: DiagnosticMessage,
 ) {
@@ -317,7 +317,7 @@ export function logTemporaryDiagnostics(action: ActionState<["Logger"]>) {
 /** Relocates all temporary diagnostics to the respective databases. */
 export function flushDiagnostics(
   action: ActionState<["Logger"]>,
-  config: Config,
+  config: ActionConfig<"dbLocation" | "languages">,
 ) {
   const diagnosticsCount = temporaryDiagnostics.length;
   action.logger.debug(
diff --git a/src/feature-flags.ts b/src/feature-flags.ts
index 5cf7c7414c..6c6afd9e57 100644
--- a/src/feature-flags.ts
+++ b/src/feature-flags.ts
@@ -165,6 +165,8 @@ export enum Feature {
    */
   PerLanguageBundles = "per_language_bundles_v2",
   QaTelemetryEnabled = "qa_telemetry_enabled",
+  /** Whether we should fail early if we detect that traced analysis is unsupported. */
+  SkipUnsupportedTracedAnalysis = "skip_unsupported_traced_analysis",
   /** Routes (some) API requests through the registry proxy. */
   ProxyApiRequests = "proxy_api_requests",
   /** Note that this currently only disables baseline file coverage information. */
@@ -456,6 +458,11 @@ export const featureConfig = {
     envVar: "CODEQL_ACTION_START_PROXY_USE_FEATURES_RELEASE",
     minimumVersion: undefined,
   },
+  [Feature.SkipUnsupportedTracedAnalysis]: {
+    defaultValue: false,
+    envVar: "CODEQL_ACTION_SKIP_UNSUPPORTED_TRACED_ANALYSIS",
+    minimumVersion: undefined,
+  },
   [Feature.ToolsRepositoryProperty]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_TOOLS_REPOSITORY_PROPERTY",
diff --git a/src/init-action.ts b/src/init-action.ts
index bd5ed3395a..f0f377c4f7 100644
--- a/src/init-action.ts
+++ b/src/init-action.ts
@@ -62,6 +62,7 @@ import {
   runDatabaseInitCluster,
 } from "./init";
 import { JavaEnvVars, BuiltInLanguage } from "./languages";
+import { checkRunnerSupportsTracedAnalysis } from "./languages/traced";
 import { Logger, withGroupAsync } from "./logging";
 import {
   downloadOverlayBaseDatabaseFromCache,
@@ -418,14 +419,11 @@ async function run(
       logger,
     });
 
-    if (
-      config.languages.includes(BuiltInLanguage.swift) &&
-      process.platform !== "darwin"
-    ) {
-      throw new ConfigurationError(
-        `Swift analysis is only supported on macOS runner images. Please migrate to a macOS runner.`,
-      );
-    }
+    await checkRunnerSupportsTracedAnalysis(
+      actionStateWithFeatures,
+      config,
+      codeql,
+    );
 
     if (repositoryPropertiesResult.isFailure()) {
       addNoLanguageDiagnostic(
diff --git a/src/languages/swift.test.ts b/src/languages/swift.test.ts
new file mode 100644
index 0000000000..3bdcf1fa29
--- /dev/null
+++ b/src/languages/swift.test.ts
@@ -0,0 +1,89 @@
+import test from "ava";
+import * as sinon from "sinon";
+
+import { getCodeQLForTesting } from "../codeql";
+import { ActionsEnvVars } from "../environment";
+import {
+  createTestConfig,
+  getTestEnv,
+  makeVersionInfo,
+  RecordingLogger,
+  setupTests,
+} from "../testing-utils";
+import { ToolsFeature } from "../tools-features";
+import { withTmpDir } from "../util";
+
+import { isSwiftCompatible } from "./swift";
+
+import { BuiltInLanguage } from ".";
+
+setupTests(test);
+
+test("isSwiftCompatible doesn't throw for non-Swift languages", async (t) => {
+  for (const language of Object.values(BuiltInLanguage)) {
+    if (language === BuiltInLanguage.swift) {
+      continue;
+    }
+
+    const codeql = await getCodeQLForTesting();
+    await t.notThrowsAsync(
+      isSwiftCompatible(
+        createTestConfig({ languages: [language] }),
+        codeql,
+        // A value of `undefined` should make `isSwiftCompatible` throw for Swift by default
+        // since it means we are on a platform other than macOS
+        undefined,
+      ),
+    );
+  }
+});
+
+test("isSwiftCompatible doesn't throw for Swift if CLI supports swiftSupportsAllPlatforms", async (t) =>
+  withTmpDir(async (tmpDir) => {
+    const logger = new RecordingLogger();
+    const env = getTestEnv();
+    env.set(ActionsEnvVars.RUNNER_TEMP, tmpDir);
+
+    const codeql = await getCodeQLForTesting("codeql-for-testing", logger, env);
+    const supportsFeature = sinon
+      .stub(codeql, "supportsFeature")
+      .withArgs(ToolsFeature.SwiftSupportsAllPlatforms)
+      .resolves(true);
+
+    await t.notThrowsAsync(
+      isSwiftCompatible(
+        createTestConfig({ languages: [BuiltInLanguage.swift] }),
+        codeql,
+        // A value of `undefined` should make `isSwiftCompatible` throw for Swift by default
+        // since it means we are on a platform other than macOS
+        undefined,
+      ),
+    );
+
+    t.is(supportsFeature.callCount, 1);
+    t.deepEqual(supportsFeature.args[0], [
+      ToolsFeature.SwiftSupportsAllPlatforms,
+    ]);
+  }));
+
+test("isSwiftCompatible doesn't throw for Swift on darwin", async (t) =>
+  withTmpDir(async (tmpDir) => {
+    const logger = new RecordingLogger();
+    const env = getTestEnv();
+    env.set(ActionsEnvVars.RUNNER_TEMP, tmpDir);
+
+    const codeql = await getCodeQLForTesting("codeql-for-testing", logger, env);
+    sinon.stub(codeql, "getVersion").resolves(makeVersionInfo("2.27.0"));
+
+    await t.notThrowsAsync(
+      isSwiftCompatible(
+        createTestConfig({
+          tempDir: tmpDir,
+          languages: [BuiltInLanguage.swift],
+        }),
+        codeql,
+        // A value other than `undefined` means we are on macOS.
+        "some-macos-version",
+      ),
+    );
+  }));
diff --git a/src/languages/swift.ts b/src/languages/swift.ts
new file mode 100644
index 0000000000..34932fe78d
--- /dev/null
+++ b/src/languages/swift.ts
@@ -0,0 +1,42 @@
+import type { SemVer } from "semver";
+
+import { CodeQL } from "../codeql";
+import type { ActionConfig } from "../config/action-config";
+import { ToolsFeature } from "../tools-features";
+import { ConfigurationError } from "../util";
+
+import { BuiltInLanguage } from ".";
+
+/**
+ * Determines whether we can run a Swift analysis on the current runner.
+ *
+ * @param config The Action configuration.
+ * @param codeql The {@link CodeQL} CLI instance.
+ * @param macosVersion The version of macOS, if any.
+ *
+ * @throws {ConfigurationError} If Swift analysis is not possible on the current runner.
+ */
+export async function isSwiftCompatible(
+  config: ActionConfig<"languages">,
+  codeql: CodeQL,
+  macosVersion: SemVer | string | undefined,
+) {
+  // The checks are not relevant if we are not trying to analyse Swift.
+  if (!config.languages.includes(BuiltInLanguage.swift)) {
+    return;
+  }
+
+  // Skip the checks if the `swiftSupportsAllPlatforms` feature is supported by the CLI.
+  // This is a forward-looking measure that allows a future CLI update to disable these
+  // platform checks in the Action when they shouldn't be enforced anymore.
+  if (await codeql.supportsFeature(ToolsFeature.SwiftSupportsAllPlatforms)) {
+    return;
+  }
+
+  // If `macosVersion` is undefined, then we are not on macOS and Swift analysis is unsupported.
+  if (macosVersion === undefined) {
+    throw new ConfigurationError(
+      `Swift analysis is only supported on macOS runner images. Please migrate to a macOS runner.`,
+    );
+  }
+}
diff --git a/src/languages/traced.test.ts b/src/languages/traced.test.ts
new file mode 100644
index 0000000000..459db37895
--- /dev/null
+++ b/src/languages/traced.test.ts
@@ -0,0 +1,472 @@
+import fs from "fs";
+
+import test from "ava";
+import * as sinon from "sinon";
+
+import { getCodeQLForTesting, type CodeQL } from "../codeql";
+import * as diagnostics from "../diagnostics";
+import { ActionsEnvVars, type Env } from "../environment";
+import { Feature } from "../feature-flags";
+import type { Logger } from "../logging";
+import { XCODE_SELECT_LINK_PATH } from "../platform";
+import {
+  checkExpectedLogMessages,
+  checkUnexpectedLogMessages,
+  createFeatures,
+  createTestConfig,
+  getTestEnv,
+  initAllState,
+  makeVersionInfo,
+  RecordingLogger,
+  setupTests,
+} from "../testing-utils";
+import { BuildMode, withTmpDir } from "../util";
+
+import { checkRunnerSupportsTracedAnalysis } from "./traced";
+
+import { BuiltInLanguage } from ".";
+
+setupTests(test);
+
+const TEST_DEFAULT_TRACED_LANGUAGES = {
+  [BuiltInLanguage.swift]: true,
+  [BuiltInLanguage.go]: true,
+};
+
+async function getCodeQLWithTracedStub(
+  cmd: string,
+  logger: Logger,
+  env: Env,
+  tracedLanguages: Partial<
+    Record<BuiltInLanguage, boolean>
+  > = TEST_DEFAULT_TRACED_LANGUAGES,
+): Promise<CodeQL> {
+  const codeql = await getCodeQLForTesting(cmd, logger, env);
+  sinon.stub(codeql, "isTracedLanguage").callsFake(async (language) => {
+    return tracedLanguages[language] === true;
+  });
+  return codeql;
+}
+
+const nonDarwinPlatforms: NodeJS.Platform[] = ["linux", "win32"];
+for (const nonDarwinPlatform of nonDarwinPlatforms) {
+  test(`checkRunnerSupportsTracedAnalysis throws for Swift on ${nonDarwinPlatform}`, async (t) =>
+    withTmpDir(async (tmpDir) => {
+      const logger = new RecordingLogger();
+      const env = getTestEnv();
+      env.set(ActionsEnvVars.RUNNER_TEMP, tmpDir);
+
+      const codeql = await getCodeQLWithTracedStub(
+        "codeql-for-testing",
+        logger,
+        env,
+      );
+      sinon.stub(codeql, "getVersion").resolves(makeVersionInfo("2.27.0"));
+
+      await t.throwsAsync(
+        checkRunnerSupportsTracedAnalysis(
+          initAllState({ platform: nonDarwinPlatform, env, logger }),
+          createTestConfig({ languages: [BuiltInLanguage.swift] }),
+          codeql,
+        ),
+      );
+    }));
+}
+
+test(`checkRunnerSupportsTracedAnalysis doesn't throw for BMN`, async (t) =>
+  withTmpDir(async (tmpDir) => {
+    const logger = new RecordingLogger();
+    const env = getTestEnv();
+    env.set(ActionsEnvVars.RUNNER_TEMP, tmpDir);
+
+    const codeql = await getCodeQLWithTracedStub(
+      "codeql-for-testing",
+      logger,
+      env,
+    );
+    sinon.stub(codeql, "getVersion").resolves(makeVersionInfo("2.27.0"));
+
+    await t.notThrowsAsync(
+      checkRunnerSupportsTracedAnalysis(
+        initAllState({
+          platform: "darwin",
+          osRelease: "27.0.0",
+          env,
+          logger,
+        }),
+        createTestConfig({ buildMode: BuildMode.None }),
+        codeql,
+      ),
+    );
+  }));
+
+// Some languages not in `TEST_DEFAULT_TRACED_LANGUAGES`.
+const nonTracedLanguages: BuiltInLanguage[] = [
+  BuiltInLanguage.javascript,
+  BuiltInLanguage.actions,
+];
+for (const nonTracedLanguage of nonTracedLanguages) {
+  test(`checkRunnerSupportsTracedAnalysis doesn't throw for ${nonTracedLanguage} on unsupported macOS`, async (t) =>
+    withTmpDir(async (tmpDir) => {
+      const logger = new RecordingLogger();
+      const env = getTestEnv();
+      env.set(ActionsEnvVars.RUNNER_TEMP, tmpDir);
+
+      const codeql = await getCodeQLWithTracedStub(
+        "codeql-for-testing",
+        logger,
+        env,
+      );
+      sinon.stub(codeql, "getVersion").resolves(makeVersionInfo("2.27.0"));
+
+      await t.notThrowsAsync(
+        checkRunnerSupportsTracedAnalysis(
+          initAllState({
+            platform: "darwin",
+            osRelease: "27.0.0",
+            env,
+            logger,
+          }),
+          createTestConfig({ languages: [nonTracedLanguage] }),
+          codeql,
+        ),
+      );
+    }));
+}
+
+test("checkRunnerSupportsTracedAnalysis warns if version string is not a semver", async (t) =>
+  withTmpDir(async (tmpDir) => {
+    const logger = new RecordingLogger();
+    const env = getTestEnv();
+    env.set(ActionsEnvVars.RUNNER_TEMP, tmpDir);
+
+    const codeql = await getCodeQLWithTracedStub(
+      "codeql-for-testing",
+      logger,
+      env,
+    );
+    sinon.stub(codeql, "getVersion").resolves(makeVersionInfo("2.27.0"));
+
+    await checkRunnerSupportsTracedAnalysis(
+      initAllState({
+        logger,
+        platform: "darwin",
+        osRelease: "unexpected",
+        env,
+      }),
+      createTestConfig({ languages: [BuiltInLanguage.go] }),
+      codeql,
+    );
+
+    checkExpectedLogMessages(t, logger.messages, [
+      "Unable to determine version of macOS, got: unexpected",
+    ]);
+  }));
+
+// `addDiagnostic` changes global state and we must stub it, so this test must be serial.
+test.serial(
+  "checkRunnerSupportsTracedAnalysis logs and adds diagnostic if macOS version is unsupported",
+  async (t) =>
+    withTmpDir(async (tmpDir) => {
+      const logger = new RecordingLogger();
+      const env = getTestEnv();
+      env.set(ActionsEnvVars.RUNNER_TEMP, tmpDir);
+
+      const codeql = await getCodeQLWithTracedStub(
+        "codeql-for-testing",
+        logger,
+        env,
+      );
+      sinon.stub(codeql, "getVersion").resolves(makeVersionInfo("2.27.0"));
+
+      const addDiagnostic = sinon.stub(diagnostics, "addDiagnostic");
+
+      const config = createTestConfig({ languages: [BuiltInLanguage.swift] });
+      await checkRunnerSupportsTracedAnalysis(
+        initAllState({
+          logger,
+          platform: "darwin",
+          osRelease: "27.0.0",
+          env,
+        }),
+        config,
+        codeql,
+      );
+
+      checkExpectedLogMessages(t, logger.messages, [
+        "Traced analysis is not supported on macOS 27",
+      ]);
+
+      t.is(addDiagnostic.callCount, 1);
+      t.like(addDiagnostic.args[0], [
+        config,
+        BuiltInLanguage.swift,
+        {
+          attributes: {
+            languages: [BuiltInLanguage.swift],
+            macOSVersion: "27.0.0",
+          },
+          severity: "warning",
+          source: {
+            id: "codeql-action/unsupported-traced-analysis-macos",
+            name: "Traced analysis is not supported on this version of macOS",
+          },
+          visibility: {
+            cliSummaryTable: true,
+            statusPage: true,
+            telemetry: true,
+          },
+        } satisfies Partial<diagnostics.DiagnosticMessage>,
+      ]);
+    }),
+);
+
+// `addDiagnostic` changes global state and we must stub it, so this test must be serial.
+test.serial(
+  "checkRunnerSupportsTracedAnalysis throws if macOS version is unsupported and FF is enabled",
+  async (t) =>
+    withTmpDir(async (tmpDir) => {
+      const logger = new RecordingLogger();
+      const env = getTestEnv();
+      env.set(ActionsEnvVars.RUNNER_TEMP, tmpDir);
+
+      const features = createFeatures([Feature.SkipUnsupportedTracedAnalysis]);
+
+      const codeql = await getCodeQLWithTracedStub(
+        "codeql-for-testing",
+        logger,
+        env,
+      );
+      sinon.stub(codeql, "getVersion").resolves(makeVersionInfo("2.27.0"));
+
+      const addDiagnostic = sinon.stub(diagnostics, "addDiagnostic");
+
+      const config = createTestConfig({ languages: [BuiltInLanguage.swift] });
+      await t.throwsAsync(
+        checkRunnerSupportsTracedAnalysis(
+          initAllState({
+            logger,
+            platform: "darwin",
+            osRelease: "27.0.0",
+            env,
+            features,
+          }),
+          config,
+          codeql,
+        ),
+      );
+
+      t.is(addDiagnostic.callCount, 1);
+      t.like(addDiagnostic.args[0], [
+        config,
+        BuiltInLanguage.swift,
+        {
+          attributes: {
+            languages: [BuiltInLanguage.swift],
+            macOSVersion: "27.0.0",
+          },
+          severity: "error",
+          source: {
+            id: "codeql-action/unsupported-traced-analysis-macos",
+            name: "Traced analysis is not supported on this version of macOS",
+          },
+          visibility: {
+            cliSummaryTable: true,
+            statusPage: true,
+            telemetry: true,
+          },
+        } satisfies Partial<diagnostics.DiagnosticMessage>,
+      ]);
+    }),
+);
+
+// `addDiagnostic` changes global state and we must stub it, so this test must be serial.
+test.serial(
+  "checkRunnerSupportsTracedAnalysis doesn't add a diagnostic if Xcode version is supported",
+  async (t) =>
+    withTmpDir(async (tmpDir) => {
+      const logger = new RecordingLogger();
+      const env = getTestEnv();
+      env.set(ActionsEnvVars.RUNNER_TEMP, tmpDir);
+
+      const statSync = sinon
+        .stub(fs, "statSync")
+        .returns({ isSymbolicLink: () => true } as fs.Stats);
+      const readlinkSync = sinon
+        .stub(fs, "readlinkSync")
+        .returns("/Applications/Xcode_26.0.app/Contents/Developer");
+
+      const codeql = await getCodeQLWithTracedStub(
+        "codeql-for-testing",
+        logger,
+        env,
+      );
+      sinon.stub(codeql, "getVersion").resolves(makeVersionInfo("2.27.0"));
+
+      const addDiagnostic = sinon.stub(diagnostics, "addDiagnostic");
+
+      const config = createTestConfig({ languages: [BuiltInLanguage.swift] });
+      await checkRunnerSupportsTracedAnalysis(
+        initAllState({
+          logger,
+          platform: "darwin",
+          osRelease: "26.0.0",
+          env,
+        }),
+        config,
+        codeql,
+      );
+
+      t.is(statSync.callCount, 1);
+      t.deepEqual(statSync.args[0], [XCODE_SELECT_LINK_PATH]);
+      t.is(readlinkSync.callCount, 1);
+      t.deepEqual(readlinkSync.args[0], [XCODE_SELECT_LINK_PATH]);
+
+      checkUnexpectedLogMessages(t, logger.messages, [
+        "Traced analysis is not supported on Xcode 27",
+      ]);
+
+      t.is(addDiagnostic.callCount, 0);
+    }),
+);
+
+// `addDiagnostic` changes global state and we must stub it, so this test must be serial.
+test.serial(
+  "checkRunnerSupportsTracedAnalysis logs and adds diagnostic if Xcode version is unsupported",
+  async (t) =>
+    withTmpDir(async (tmpDir) => {
+      const logger = new RecordingLogger();
+      const env = getTestEnv();
+      env.set(ActionsEnvVars.RUNNER_TEMP, tmpDir);
+
+      const statSync = sinon
+        .stub(fs, "statSync")
+        .returns({ isSymbolicLink: () => true } as fs.Stats);
+      const readlinkSync = sinon
+        .stub(fs, "readlinkSync")
+        .returns("/Applications/Xcode_27.0.app/Contents/Developer");
+
+      const codeql = await getCodeQLWithTracedStub(
+        "codeql-for-testing",
+        logger,
+        env,
+      );
+      sinon.stub(codeql, "getVersion").resolves(makeVersionInfo("2.27.0"));
+
+      const addDiagnostic = sinon.stub(diagnostics, "addDiagnostic");
+
+      const config = createTestConfig({ languages: [BuiltInLanguage.swift] });
+      await checkRunnerSupportsTracedAnalysis(
+        initAllState({
+          logger,
+          platform: "darwin",
+          osRelease: "26.0.0",
+          env,
+        }),
+        config,
+        codeql,
+      );
+
+      t.is(statSync.callCount, 1);
+      t.deepEqual(statSync.args[0], [XCODE_SELECT_LINK_PATH]);
+      t.is(readlinkSync.callCount, 1);
+      t.deepEqual(readlinkSync.args[0], [XCODE_SELECT_LINK_PATH]);
+
+      checkExpectedLogMessages(t, logger.messages, [
+        "Traced analysis is not supported on Xcode 27",
+      ]);
+
+      t.is(addDiagnostic.callCount, 1);
+      t.like(addDiagnostic.args[0], [
+        config,
+        BuiltInLanguage.swift,
+        {
+          attributes: {
+            languages: [BuiltInLanguage.swift],
+            xcodeVersion: "27.0.0",
+          },
+          severity: "warning",
+          source: {
+            id: "codeql-action/unsupported-traced-analysis-xcode",
+            name: "Traced analysis is not supported on this version of Xcode",
+          },
+          visibility: {
+            cliSummaryTable: true,
+            statusPage: true,
+            telemetry: true,
+          },
+        } satisfies Partial<diagnostics.DiagnosticMessage>,
+      ]);
+    }),
+);
+
+// `addDiagnostic` changes global state and we must stub it, so this test must be serial.
+test.serial(
+  "checkRunnerSupportsTracedAnalysis throws if Xcode version is unsupported and FF is enabled",
+  async (t) =>
+    withTmpDir(async (tmpDir) => {
+      const logger = new RecordingLogger();
+      const env = getTestEnv();
+      env.set(ActionsEnvVars.RUNNER_TEMP, tmpDir);
+
+      const statSync = sinon
+        .stub(fs, "statSync")
+        .returns({ isSymbolicLink: () => true } as fs.Stats);
+      const readlinkSync = sinon
+        .stub(fs, "readlinkSync")
+        .returns("/Applications/Xcode_27.0.app/Contents/Developer");
+
+      const features = createFeatures([Feature.SkipUnsupportedTracedAnalysis]);
+
+      const codeql = await getCodeQLWithTracedStub(
+        "codeql-for-testing",
+        logger,
+        env,
+      );
+      sinon.stub(codeql, "getVersion").resolves(makeVersionInfo("2.27.0"));
+
+      const addDiagnostic = sinon.stub(diagnostics, "addDiagnostic");
+
+      const config = createTestConfig({ languages: [BuiltInLanguage.swift] });
+      await t.throwsAsync(
+        checkRunnerSupportsTracedAnalysis(
+          initAllState({
+            logger,
+            platform: "darwin",
+            osRelease: "26.0.0",
+            env,
+            features,
+          }),
+          config,
+          codeql,
+        ),
+      );
+
+      t.is(statSync.callCount, 1);
+      t.deepEqual(statSync.args[0], [XCODE_SELECT_LINK_PATH]);
+      t.is(readlinkSync.callCount, 1);
+      t.deepEqual(readlinkSync.args[0], [XCODE_SELECT_LINK_PATH]);
+
+      t.is(addDiagnostic.callCount, 1);
+      t.like(addDiagnostic.args[0], [
+        config,
+        BuiltInLanguage.swift,
+        {
+          attributes: {
+            languages: [BuiltInLanguage.swift],
+            xcodeVersion: "27.0.0",
+          },
+          severity: "error",
+          source: {
+            id: "codeql-action/unsupported-traced-analysis-xcode",
+            name: "Traced analysis is not supported on this version of Xcode",
+          },
+          visibility: {
+            cliSummaryTable: true,
+            statusPage: true,
+            telemetry: true,
+          },
+        } satisfies Partial<diagnostics.DiagnosticMessage>,
+      ]);
+    }),
+);
diff --git a/src/languages/traced.ts b/src/languages/traced.ts
new file mode 100644
index 0000000000..07f4cdc960
--- /dev/null
+++ b/src/languages/traced.ts
@@ -0,0 +1,161 @@
+import * as semver from "semver";
+
+import type { ActionState, Logger } from "../action-common";
+import type { CodeQL } from "../codeql";
+import type { ActionConfig } from "../config/action-config";
+import { addDiagnostic, makeDiagnostic } from "../diagnostics";
+import { Feature } from "../feature-flags";
+import { macOSVersion, xcodeVersion } from "../platform";
+import { ConfigurationError } from "../util";
+
+import { isSwiftCompatible } from "./swift";
+
+/** macOS 27 and above do not support traced extraction. */
+export const UNSUPPORTED_MACOS_FOR_TRACED = 27;
+
+/** Xcode 27 and above do not support traced extraction. */
+export const UNSUPPORTED_XCODE_FOR_TRACED = 27;
+
+/**
+ * Creates a diagnostic indicating that `version` of `product` is unsupported for traced  analysis.
+ * Depending on `skipUnsupportedTracedAnalysis`, this function then either throws a {@link ConfigurationError}
+ * or logs the problem as a warning.
+ *
+ * @param logger The logger to use.
+ * @param config The CodeQL Action configuration.
+ * @param skipUnsupportedTracedAnalysis Whether this is a fatal error.
+ * @param product The product that the version is unsupported of.
+ * @param version The unsupported version.
+ */
+function handleUnsupportedVersion(
+  logger: Logger,
+  config: ActionConfig<"languages" | "dbLocation" | "tempDir">,
+  skipUnsupportedTracedAnalysis: boolean,
+  product: "macOS" | "Xcode",
+  version: semver.SemVer,
+) {
+  const baseMessage = [
+    `Traced analysis is not supported on ${product} ${UNSUPPORTED_MACOS_FOR_TRACED} or above.`,
+    `Configure your analysis to run on macOS ${UNSUPPORTED_MACOS_FOR_TRACED - 1} or below`,
+    `and XCode ${UNSUPPORTED_XCODE_FOR_TRACED - 1} or below.`,
+  ].join(" ");
+
+  const attributeName = product === "macOS" ? "macOSVersion" : "xcodeVersion";
+
+  // Create a diagnostic that will show up on the TSP.
+  for (const language of config.languages) {
+    addDiagnostic(
+      config,
+      language,
+      makeDiagnostic(
+        `codeql-action/unsupported-traced-analysis-${product.toLowerCase()}`,
+        `Traced analysis is not supported on this version of ${product}`,
+        {
+          attributes: {
+            languages: config.languages,
+            [attributeName]: version.toString(),
+          },
+          markdownMessage: baseMessage,
+          severity: skipUnsupportedTracedAnalysis ? "error" : "warning",
+          visibility: {
+            cliSummaryTable: true,
+            statusPage: true,
+            telemetry: true,
+          },
+        },
+      ),
+    );
+  }
+
+  // Throw an error to abort the analysis if the FF is enabled or log the message.
+  if (skipUnsupportedTracedAnalysis) {
+    // ConfigurationErrors are converted to the "aborted" status by the exception handler
+    // in `init-action.ts` that guards the call to `checkRunnerSupportsTracedAnalysis`.
+    throw new ConfigurationError(baseMessage);
+  } else {
+    // This will also show up as a workflow annotation.
+    logger.warning(baseMessage);
+  }
+}
+
+/**
+ * Decides whether {@link config} has any traced languages by looking for tracer
+ * configurations in the {@link codeql} CLI installation.
+ */
+export async function hasTracedLanguages(
+  config: ActionConfig<"languages">,
+  codeql: CodeQL,
+): Promise<boolean> {
+  for (const language of config.languages) {
+    if (await codeql.isTracedLanguage(language)) {
+      return true;
+    }
+  }
+
+  return false;
+}
+
+/**
+ * Determines whether we can run a traced analysis on the current runner.
+ *
+ * @throws {ConfigurationError} If traced analysis is not possible on the current runner.
+ */
+export async function checkRunnerSupportsTracedAnalysis(
+  action: ActionState<["Base", "Logger", "FeatureFlags"]>,
+  config: ActionConfig<"languages" | "dbLocation" | "tempDir">,
+  codeql: CodeQL,
+) {
+  // Try to get the macOS version.
+  const version = macOSVersion(action);
+
+  // Perform some initial, Swift-specific checks.
+  await isSwiftCompatible(config, codeql, version);
+
+  // `build-mode: none` doesn't use the tracer, so it is always supported.
+  if (config.buildMode !== undefined && config.buildMode === "none") {
+    return;
+  }
+
+  // If none of the languages are traced, then we can skip the compatibility checks below as well.
+  if (!(await hasTracedLanguages(config, codeql))) {
+    return;
+  }
+
+  const skipUnsupportedTracedAnalysis = await action.features.getValue(
+    Feature.SkipUnsupportedTracedAnalysis,
+  );
+  if (typeof version === "string") {
+    // If we got a string, we are on macOS but couldn't parse the version string.
+    action.logger.warning(
+      `Unable to determine version of macOS, got: ${version}`,
+    );
+  } else if (
+    version !== undefined &&
+    version.major >= UNSUPPORTED_MACOS_FOR_TRACED
+  ) {
+    handleUnsupportedVersion(
+      action.logger,
+      config,
+      skipUnsupportedTracedAnalysis,
+      "macOS",
+      version,
+    );
+  }
+
+  // Determining whether the Xcode version is supported only makes sense on macOS, so we only do it
+  // after determining that we are running on macOS.
+  const xcodeVer = xcodeVersion(action.logger);
+
+  if (
+    xcodeVer !== undefined &&
+    xcodeVer.major >= UNSUPPORTED_XCODE_FOR_TRACED
+  ) {
+    handleUnsupportedVersion(
+      action.logger,
+      config,
+      skipUnsupportedTracedAnalysis,
+      "Xcode",
+      xcodeVer,
+    );
+  }
+}
diff --git a/src/platform.test.ts b/src/platform.test.ts
index c8a6a7955d..5de468d823 100644
--- a/src/platform.test.ts
+++ b/src/platform.test.ts
@@ -1,6 +1,23 @@
+import fs from "fs";
+
 import test from "ava";
+import * as sinon from "sinon";
+
+import {
+  BundlePlatform,
+  getBundlePlatform,
+  macOSVersion,
+  XCODE_SELECT_LINK_PATH,
+  xcodeVersion,
+} from "./platform";
+import {
+  checkExpectedLogMessages,
+  initAllState,
+  RecordingLogger,
+  setupTests,
+} from "./testing-utils";
 
-import { BundlePlatform, getBundlePlatform } from "./platform";
+setupTests(test);
 
 for (const [platform, arch, expected] of [
   ["linux", "x64", BundlePlatform.Linux64],
@@ -16,3 +33,160 @@ for (const [platform, arch, expected] of [
     t.is(getBundlePlatform(platform, arch), expected);
   });
 }
+
+const platforms: NodeJS.Platform[] = ["linux", "win32", "freebsd"];
+for (const platform of platforms) {
+  test(`macOSVersion returns undefined on ${platform}`, (t) => {
+    t.is(macOSVersion(initAllState({ platform })), undefined);
+  });
+}
+
+test("macOSVersion returns raw string if semver parsing fails", (t) => {
+  const invalidSemVer = "sealOS-2026";
+  t.is(
+    macOSVersion(
+      initAllState({ platform: "darwin", osRelease: invalidSemVer }),
+    ),
+    invalidSemVer,
+  );
+});
+
+test("macOSVersion returns semver if parsing succeeds", (t) => {
+  const validSemVer = "27.0.1";
+
+  const version = macOSVersion(
+    initAllState({ platform: "darwin", osRelease: validSemVer }),
+  );
+
+  // Check that `version` is not undefined and narrow the type; throws if undefined.
+  if (t.truthy(version)) {
+    // Check that it's also not just a string.
+    t.not(typeof version, "string");
+
+    // Should be an object with the expected properties.
+    t.is(typeof version, "object");
+    t.is(version["major"], 27);
+    t.is(version["minor"], 0);
+    t.is(version["patch"], 1);
+  }
+});
+
+test.serial("xcodeVersion returns undefined if symlink doesn't exist", (t) => {
+  const logger = new RecordingLogger();
+
+  const statSync = sinon.stub(fs, "statSync").throws(new Error("ENOENT"));
+
+  t.is(xcodeVersion(logger), undefined);
+  t.is(statSync.callCount, 1);
+  t.deepEqual(statSync.args[0], [XCODE_SELECT_LINK_PATH]);
+
+  checkExpectedLogMessages(t, logger.messages, [
+    "Unable to determine Xcode version: ENOENT",
+  ]);
+});
+
+test.serial("xcodeVersion returns undefined if file is not a symlink", (t) => {
+  const logger = new RecordingLogger();
+
+  const statSync = sinon
+    .stub(fs, "statSync")
+    .returns({ isSymbolicLink: () => false } as fs.Stats);
+
+  t.is(xcodeVersion(logger), undefined);
+  t.is(statSync.callCount, 1);
+  t.deepEqual(statSync.args[0], [XCODE_SELECT_LINK_PATH]);
+
+  checkExpectedLogMessages(t, logger.messages, [
+    "exists, but is not a symbolic link",
+  ]);
+});
+
+test.serial(
+  "xcodeVersion returns undefined if resolving the symlink returns nothing",
+  (t) => {
+    const logger = new RecordingLogger();
+
+    const statSync = sinon
+      .stub(fs, "statSync")
+      .returns({ isSymbolicLink: () => true } as fs.Stats);
+    const readlinkSync = sinon.stub(fs, "readlinkSync").returns("");
+
+    t.is(xcodeVersion(logger), undefined);
+    t.is(statSync.callCount, 1);
+    t.deepEqual(statSync.args[0], [XCODE_SELECT_LINK_PATH]);
+    t.is(readlinkSync.callCount, 1);
+    t.deepEqual(readlinkSync.args[0], [XCODE_SELECT_LINK_PATH]);
+
+    checkExpectedLogMessages(t, logger.messages, [
+      "unexpectedly returned nothing",
+    ]);
+  },
+);
+
+test.serial(
+  "xcodeVersion returns undefined if resolved path doesn't include pattern",
+  (t) => {
+    const logger = new RecordingLogger();
+
+    const statSync = sinon
+      .stub(fs, "statSync")
+      .returns({ isSymbolicLink: () => true } as fs.Stats);
+    const readlinkSync = sinon
+      .stub(fs, "readlinkSync")
+      .returns("/Applications/Xcode.app/Contents/Developer");
+
+    t.is(xcodeVersion(logger), undefined);
+    t.is(statSync.callCount, 1);
+    t.deepEqual(statSync.args[0], [XCODE_SELECT_LINK_PATH]);
+    t.is(readlinkSync.callCount, 1);
+    t.deepEqual(readlinkSync.args[0], [XCODE_SELECT_LINK_PATH]);
+
+    checkExpectedLogMessages(t, logger.messages, [
+      "does not contain expected pattern",
+    ]);
+  },
+);
+
+test.serial("xcodeVersion returns undefined if match can't be parsed", (t) => {
+  const logger = new RecordingLogger();
+
+  const statSync = sinon
+    .stub(fs, "statSync")
+    .returns({ isSymbolicLink: () => true } as fs.Stats);
+  const readlinkSync = sinon
+    .stub(fs, "readlinkSync")
+    .returns("/Applications/Xcode_00.0.app/Contents/Developer");
+
+  t.is(xcodeVersion(logger), undefined);
+  t.is(statSync.callCount, 1);
+  t.deepEqual(statSync.args[0], [XCODE_SELECT_LINK_PATH]);
+  t.is(readlinkSync.callCount, 1);
+  t.deepEqual(readlinkSync.args[0], [XCODE_SELECT_LINK_PATH]);
+
+  checkExpectedLogMessages(t, logger.messages, [
+    "Couldn't parse '00.0' as a semantic version.",
+  ]);
+});
+
+test.serial("xcodeVersion returns version from resolved path", (t) => {
+  const logger = new RecordingLogger();
+
+  const statSync = sinon
+    .stub(fs, "statSync")
+    .returns({ isSymbolicLink: () => true } as fs.Stats);
+  const readlinkSync = sinon
+    .stub(fs, "readlinkSync")
+    .returns("/Applications/Xcode_16.4.app/Contents/Developer");
+
+  const result = xcodeVersion(logger);
+
+  if (t.truthy(result)) {
+    t.is(result.major, 16);
+    t.is(result.minor, 4);
+  }
+
+  t.is(statSync.callCount, 1);
+  t.deepEqual(statSync.args[0], [XCODE_SELECT_LINK_PATH]);
+  t.is(readlinkSync.callCount, 1);
+  t.deepEqual(readlinkSync.args[0], [XCODE_SELECT_LINK_PATH]);
+});
diff --git a/src/platform.ts b/src/platform.ts
index 1cc085d6ab..d5c77c9f73 100644
--- a/src/platform.ts
+++ b/src/platform.ts
@@ -1,3 +1,10 @@
+import fs from "fs";
+
+import * as semver from "semver";
+
+import type { ActionState, Logger } from "./action-common";
+import { getErrorMessage } from "./util";
+
 /** Platform identifiers used in CodeQL bundle asset names. */
 export enum BundlePlatform {
   Linux64 = "linux64",
@@ -24,3 +31,92 @@ export function getBundlePlatform(
       return undefined;
   }
 }
+
+/**
+ * Tries to determine the version of macOS.
+ *
+ * @returns
+ *  The version as either a semantic version object, the raw version string
+ *  if it is not a semantic version, or `undefined` if we are not on macOS.
+ */
+export function macOSVersion(
+  action: ActionState<["Base"]>,
+): semver.SemVer | string | undefined {
+  // Skip if we are not running on macOS.
+  if (action.platform !== "darwin") {
+    return undefined;
+  }
+
+  // Try to parse the OS version string.
+  const version = semver.parse(action.osRelease);
+
+  if (version === null) {
+    return action.osRelease;
+  }
+
+  return version;
+}
+
+/** The static path we check for a symbolic link to the (dynamic) Xcode location. */
+export const XCODE_SELECT_LINK_PATH = "/private/var/db/xcode_select_link";
+
+/** The pattern we expect to find in the Xcode path. */
+export const XCODE_APP_FILENAME_PATTERN = new RegExp(
+  /(?<filename>Xcode_(?<majorMinor>\d+.\d+).app)/,
+);
+
+/**
+ * Tries to determine the version of Xcode that is installed.
+ *
+ * @param logger The logger to use.
+ * @returns The Xcode version or `undefined` if it couldn't be determined.
+ */
+export function xcodeVersion(logger: Logger): semver.SemVer | undefined {
+  try {
+    // Stat the expected symbolic link to check that it exists and is a symbolic link.
+    // The `readlinkSync` call below returns an empty string in either case and so
+    // this check allows us to distinguish between the two cases.
+    const stats = fs.statSync(XCODE_SELECT_LINK_PATH);
+
+    if (!stats.isSymbolicLink()) {
+      logger.warning(
+        `${XCODE_SELECT_LINK_PATH} exists, but is not a symbolic link.`,
+      );
+      return undefined;
+    }
+
+    // Read what the symbolic link points to.
+    const xcodePath = fs.readlinkSync(XCODE_SELECT_LINK_PATH);
+
+    if (xcodePath === "") {
+      logger.warning(
+        `Resolving ${XCODE_SELECT_LINK_PATH} unexpectedly returned nothing.`,
+      );
+      return undefined;
+    }
+
+    // Try to extract the version from the path.
+    const matchResult = xcodePath.match(XCODE_APP_FILENAME_PATTERN);
+
+    if (matchResult?.groups === undefined) {
+      logger.warning(
+        `Xcode path '${xcodePath}' does not contain expected pattern.`,
+      );
+      return undefined;
+    }
+
+    const majorMinor = matchResult.groups["majorMinor"];
+    const version = semver.coerce(majorMinor);
+
+    if (version === null) {
+      logger.warning(`Couldn't parse '${majorMinor}' as a semantic version.`);
+      return undefined;
+    }
+    return version;
+  } catch (err) {
+    logger.warning(
+      `Unable to determine Xcode version: ${getErrorMessage(err)}`,
+    );
+    return undefined;
+  }
+}
diff --git a/src/testing-utils.ts b/src/testing-utils.ts
index 8c38187c4e..55683af45b 100644
--- a/src/testing-utils.ts
+++ b/src/testing-utils.ts
@@ -1,4 +1,5 @@
 import { TextDecoder } from "node:util";
+import * as os from "os";
 import path from "path";
 
 import * as github from "@actions/github";
@@ -34,6 +35,7 @@ import { Logger } from "./logging";
 import { OverlayDatabaseMode } from "./overlay/overlay-database-mode";
 import { getBundlePlatform } from "./platform";
 import { ActionName } from "./status-report";
+import { ToolsFeature } from "./tools-features";
 import {
   DEFAULT_DEBUG_ARTIFACT_NAME,
   DEFAULT_DEBUG_DATABASE_NAME,
@@ -272,6 +274,7 @@ export function initAllState(
     startedAt: new Date(),
     platform: process.platform,
     arch: process.arch,
+    osRelease: os.release(),
     logger: new RecordingLogger(),
     env,
     actions: getTestActionsEnv(env),
@@ -910,7 +913,7 @@ export function mockLanguagesInRepo(languages: string[]) {
  */
 export const makeVersionInfo = (
   version: string,
-  features?: { [name: string]: boolean },
+  features?: { [key in ToolsFeature]?: boolean },
   overlayVersion?: number,
 ): VersionInfo => ({
   version,
diff --git a/src/tools-features.ts b/src/tools-features.ts
index 35e626c887..84dc1d0f44 100644
--- a/src/tools-features.ts
+++ b/src/tools-features.ts
@@ -6,6 +6,7 @@ export enum ToolsFeature {
   BundleSupportsOverlay = "bundleSupportsOverlay",
   IndirectTracingSupportsStaticBinaries = "indirectTracingSupportsStaticBinaries",
   SuppressesMissingFileBaselineWarning = "suppressesMissingFileBaselineWarning",
+  SwiftSupportsAllPlatforms = "swiftSupportsAllPlatforms",
 }
 
 /**