From 9bc74b13fbdd76ff0b3f4c2c7d42aab9ed9b1c90 Mon Sep 17 00:00:00 2001
From: Henry Mercer <henrymercer@github.com>
Date: Mon, 2 Nov 2026 17:40:43 +0000
Subject: [PATCH] Create a changenote for bundle updates instead of editing the
 changelog

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 .github/workflows/update-bundle.yml |  7 +++--
 pr-checks/bundle-changelog.test.ts  | 15 ++++++++++
 pr-checks/bundle-changelog.ts       | 44 +++++++++++++++++++----------
 3 files changed, 48 insertions(+), 18 deletions(-)

diff --git a/.github/workflows/update-bundle.yml b/.github/workflows/update-bundle.yml
index d7d90b749..36503a64d 100644
--- a/.github/workflows/update-bundle.yml
+++ b/.github/workflows/update-bundle.yml
@@ -113,11 +113,12 @@ jobs:
           echo "CLI_VERSION=$cli_version" | tee -a "$GITHUB_ENV"
           echo "PR_URL=$pr_url" | tee -a "$GITHUB_ENV"
 
-      - name: Create changelog note
+      - name: Create changenote
         run: |
           npx tsx pr-checks/bundle-changelog.ts
 
-      - name: Push changelog note
+      - name: Push changenote
         run: |
-          git commit -am "Add changelog note"
+          git add unreleased-change-notes
+          git commit -m "Add changenote"
           git push
diff --git a/pr-checks/bundle-changelog.test.ts b/pr-checks/bundle-changelog.test.ts
index fad06826a..2aa90b35e 100644
--- a/pr-checks/bundle-changelog.test.ts
+++ b/pr-checks/bundle-changelog.test.ts
@@ -10,6 +10,7 @@ import { afterEach, beforeEach, describe, it } from "node:test";
 
 import {
   CLI_VERSION_ENV_VAR,
+  getChangenote,
   getCLIVersion,
   getPRNumber,
   getPRUrl,
@@ -21,6 +22,7 @@ import {
   NO_CHANGES_STR,
   UNRELEASED_PLACEHOLDER,
 } from "./changelog";
+import { isValidChangenoteContent } from "./changelog/validate";
 
 let testDir: string;
 
@@ -140,3 +142,16 @@ describe("updateChangelog", async () => {
     assert.deepEqual(result, expectedChangelog);
   });
 });
+
+describe("getChangenote", async () => {
+  await it("returns a note linking to the bundle release and the PR", async () => {
+    assert.equal(
+      getChangenote("1.2.3", testPrUrl),
+      "- Update default CodeQL bundle version to [1.2.3](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v1.2.3). [#42](https://github.com/github/codeql-action/pulls/42)\n",
+    );
+  });
+
+  await it("returns valid changenote content", async () => {
+    assert.ok(isValidChangenoteContent(getChangenote("1.2.3", testPrUrl)));
+  });
+});
diff --git a/pr-checks/bundle-changelog.ts b/pr-checks/bundle-changelog.ts
index 230b80fb8..d2f5aae69 100755
--- a/pr-checks/bundle-changelog.ts
+++ b/pr-checks/bundle-changelog.ts
@@ -1,17 +1,18 @@
 #!/usr/bin/env npx tsx
 
 /**
- * Updates the changelog with a change note for an updated CodeQL CLI bundle.
+ * Creates a changenote file for an update to the default CodeQL CLI bundle.
  */
 
 import * as fs from "node:fs";
+import * as path from "node:path";
 
 import {
   parseChangelog,
   renderChangelog,
   UNRELEASED_PLACEHOLDER,
 } from "./changelog";
-import { CHANGELOG_FILE, CLI_BUNDLE_RELEASE_URL_PREFIX } from "./config";
+import { CHANGENOTES_DIR, CLI_BUNDLE_RELEASE_URL_PREFIX } from "./config";
 import { getErrorMessage } from "./util";
 
 export const CLI_VERSION_ENV_VAR = "CLI_VERSION";
@@ -96,27 +97,40 @@ export function updateChangelog(contents: string, changelogNote: string) {
   return renderChangelog(changelog);
 }
 
+/**
+ * Returns the contents of the changenote file for an update to the default
+ * CodeQL CLI bundle.
+ *
+ * @param cliVersion The CodeQL CLI version of the new default bundle.
+ * @param prUrl The URL of the PR that updates the default bundle.
+ * @throws If the PR number can't be determined from `prUrl`.
+ */
+export function getChangenote(cliVersion: string, prUrl: string): string {
+  // The GitHub Release for the new bundle version.
+  const bundleReleaseUrl = `${CLI_BUNDLE_RELEASE_URL_PREFIX}${cliVersion}`;
+
+  const prNumber = getPRNumber(prUrl);
+  return `- Update default CodeQL bundle version to [${cliVersion}](${bundleReleaseUrl}). [#${prNumber}](${prUrl})\n`;
+}
+
 function main() {
   try {
     const cliVersion = getCLIVersion();
     const prUrl = getPRUrl();
 
-    // The GitHub Release for the new bundle version.
-    const bundleReleaseUrl = `${CLI_BUNDLE_RELEASE_URL_PREFIX}${cliVersion}`;
-
-    // Get the PR number from the PR URL.
-    const prNumber = getPRNumber(prUrl);
-    const changelogNote = `- Update default CodeQL bundle version to [${cliVersion}](${bundleReleaseUrl}). [#${prNumber}](${prUrl})`;
-
-    let changelog = fs.readFileSync(CHANGELOG_FILE, "utf-8");
-
-    changelog = updateChangelog(changelog, changelogNote);
-
-    fs.writeFileSync(CHANGELOG_FILE, changelog);
+    // Include the CLI version in the file name so that changenotes for
+    // different bundle updates don't conflict.
+    const changenotePath = path.join(
+      CHANGENOTES_DIR,
+      `update-bundle-${cliVersion}.md`,
+    );
+    fs.writeFileSync(changenotePath, getChangenote(cliVersion, prUrl));
 
     return 0;
   } catch (err) {
-    console.error(`Failed to bundle changelog: ${getErrorMessage(err)}`);
+    console.error(
+      `Failed to create changenote for bundle update: ${getErrorMessage(err)}`,
+    );
     return -1;
   }
 }