Merge main into releases/v4 - #3426
Conversation
Sorry, something went wrong.
Mergeback v4.31.11 refs/heads/releases/v4 into main
Add `installYq` option to `sync.py` and install `yq` directly from GitHub release
Update default bundle to 2.24.0
henrymercer
left a comment
There was a problem hiding this comment.
We haven't yet updated the automation to do this, but I'd like to bump the minor version number of the Action as part of the new CLI minor version series. This means that if we want to make a GHES backport, we can branch off this previous minor version series of the Action.
Sorry, something went wrong.
|
Sorry for the interruption @nickrolfe. I'll close this, bump the minor version in a separate PR, and hand this back to you. |
Sorry, something went wrong.
There was a problem hiding this comment.
Pull request overview
This release PR merges main into releases/v4, bumps the action version to 4.31.12, updates the default CodeQL bundle/CLI to 2.24.0, and incorporates the yq installation change for Windows test workflows. The only files that require fresh review per the release process are CHANGELOG.md and package.json, and both are consistent with the described changes and versioning.
Changes:
- Bump the action version from 4.31.11 to 4.31.12 in package.json (and propagated to the lockfile and generated artifacts).
- Update the default CodeQL bundle and CLI versions in src/defaults.json (and generated artifacts) from 2.23.9 to 2.24.0, recording this in CHANGELOG.md as release 4.31.12 dated 26 Jan 2026.
- Integrate the yq installation workflow change for Windows into the PR checks by adding an installYq option and switching from choco to downloading yq directly from a GitHub release (already reviewed in source PRs, now present in this release branch).
The checklist items from the PR description are satisfied as follows:
- CHANGELOG version/date: New entry is ## 4.31.12 - 26 Jan 2026, matching package.json’s 4.31.12 and fitting chronologically after 4.31.11 - 23 Jan 2026.
- User-facing changes since last release: The only user-facing change here is the default bundle/CLI version bump to 2.24.0, which is explicitly called out; the yq change affects internal PR-check workflows only and reasonably does not appear in the changelog.
- Unexpected commits: All touched files align with the linked PRs (#3423 and #3425) and the standard version/changelog bump; there are no unrelated feature or docs changes.
- Docs coordination: No documentation files are changed in this PR, so there is nothing new to hand off to the docs team.
Reviewed changes
Copilot reviewed 19 out of 20 changed files in this pull request and generated no comments.
Show a summary per file| File | Description |
|---|---|
| src/defaults.json | Updates the default CodeQL bundle and CLI versions to 2.24.0 and advances the recorded prior versions accordingly, in line with PR #3425. |
| pr-checks/sync.py | Adds an installYq flag that, when set, injects a Windows-only step to install yq by downloading a specific GitHub release binary using gh. (Already reviewed in the source feature PR; not re-reviewed here per release-PR guidelines.) |
| pr-checks/checks/build-mode-autobuild.yml | Sets installYq: "true" for the build-mode autobuild check and removes the inline Chocolatey-based yq installation, delegating to the new generator logic. (Already reviewed in the source feature PR.) |
| package.json | Bumps the package version from 4.31.11 to 4.31.12, matching the new changelog entry and generated artifacts. |
| package-lock.json | Updates the root and package entry versions to 4.31.12 to stay in sync with package.json. |
| lib/upload-sarif-action.js | Regenerated compiled artifact reflecting the new package version and updated default bundle/CLI versions. (Generated code; no review needed.) |
| lib/upload-sarif-action-post.js | Regenerated compiled artifact with updated embedded package version. (Generated code; no review needed.) |
| lib/upload-lib.js | Regenerated compiled artifact with updated package version and default bundle/CLI settings. (Generated code; no review needed.) |
| lib/start-proxy-action.js | Regenerated compiled artifact incorporating new package version and default bundle/CLI versions. (Generated code; no review needed.) |
| lib/start-proxy-action-post.js | Regenerated compiled artifact with updated embedded package version. (Generated code; no review needed.) |
| lib/setup-codeql-action.js | Regenerated compiled artifact with updated package version and default bundle/CLI versions. (Generated code; no review needed.) |
| lib/resolve-environment-action.js | Regenerated compiled artifact with updated embedded package version. (Generated code; no review needed.) |
| lib/init-action.js | Regenerated compiled artifact with updated default bundle/CLI versions. (Generated code; no review needed.) |
| lib/init-action-post.js | Regenerated compiled artifact with updated embedded package version and default bundle/CLI versions. (Generated code; no review needed.) |
| lib/defaults.json | Regenerated JSON defaults mirroring the source src/defaults.json bundle/CLI and prior-version updates. (Generated code; no review needed.) |
| lib/autobuild-action.js | Regenerated compiled artifact with updated default bundle/CLI versions. (Generated code; no review needed.) |
| lib/analyze-action.js | Regenerated compiled artifact with updated default bundle/CLI versions. (Generated code; no review needed.) |
| lib/analyze-action-post.js | Regenerated compiled artifact with updated embedded package version. (Generated code; no review needed.) |
| CHANGELOG.md | Adds a 4.31.12 - 26 Jan 2026 entry documenting the default bundle upgrade to 2.24.0 and linking to PR #3425; formatting and ordering are consistent with prior entries. |
| .github/workflows/__build-mode-autobuild.yml | Regenerated GitHub Actions workflow reflecting the new yq installation approach for Windows runners in the build-mode-autobuild job. (Auto-generated workflow; not subject to detailed review.) |
Sorry, something went wrong.
@henrymercer when you do that, please also advise me on how exactly I should continue, e.g. should I just re-follow the steps in the release process (starting with running the "Update release branch" workflow)? |
Sorry, something went wrong.
Merging 5e767ef into releases/v4.
Conductor for this PR is @nickrolfe.
Contains the following pull requests:
Please do the following: