codeql-action/.github/workflows/update-bundle.yml

name: Update default CodeQL bundle

on:
  release:
    # From https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#release
    # Note: The prereleased type will not trigger for pre-releases published
    # from draft releases, but the published type will trigger. If you want a
    # workflow to run when stable and pre-releases publish, subscribe to
    # published instead of released and prereleased.
    #
    # From https://github.com/orgs/community/discussions/26281
    # As a work around, in published type workflow,  you could add if condition
    # to filter pre-release attribute.
    types: [published]

defaults:
  run:
    shell: bash

jobs:
  update-bundle:
    if: github.event.release.prerelease && startsWith(github.event.release.tag_name, 'codeql-bundle-')
    runs-on: ubuntu-latest
    permissions:
      contents: write # needed to push commits
      pull-requests: write # needed to create pull requests
    steps:
      - name: Dump environment
        run: env

      - name: Dump GitHub context
        env:
          GITHUB_CONTEXT: '${{ toJson(github) }}'
        run: echo "$GITHUB_CONTEXT"

      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Update git config
        run: |
          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git config --global user.name "github-actions[bot]"

      - name: Set up Python
        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
        with:
          python-version: '3.12'

      - name: Set up Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Update bundle
        uses: ./.github/actions/update-bundle

      - name: Set up CodeQL CLI from new bundle
        id: setup-codeql
        uses: ./setup-codeql
        with:
          tools: https://github.com/github/codeql-action/releases/download/${{ github.event.release.tag_name }}/codeql-bundle-linux64.tar.gz

      - name: Update built-in languages
        run: npx tsx pr-checks/update-builtin-languages.ts "$CODEQL_PATH"
        env:
          CODEQL_PATH: ${{ steps.setup-codeql.outputs.codeql-path }}

      - name: Bump Action minor version if new CodeQL minor version series
        id: bump-action-version
        run: |
          prior_cli_version=$(jq -r '.priorCliVersion' src/defaults.json)
          cli_version=$(jq -r '.cliVersion' src/defaults.json)

          prior_minor=$(echo "$prior_cli_version" | cut -d. -f2)
          current_minor=$(echo "$cli_version" | cut -d. -f2)

          if [[ "$current_minor" != "$prior_minor" ]]; then
            echo "New CodeQL minor version series ($prior_cli_version -> $cli_version), bumping Action minor version"
            npm version minor --no-git-tag-version
            echo "bumped=true" >> "$GITHUB_OUTPUT"
          else
            echo "Same minor version series ($prior_cli_version -> $cli_version), skipping Action version bump"
            echo "bumped=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Rebuild Action
        run: npm run build

      - name: Commit and push changes
        env:
          RELEASE_TAG: "${{ github.event.release.tag_name }}"
        run: |
          git checkout -b "update-bundle/$RELEASE_TAG"
          git commit -am "Update default bundle to $RELEASE_TAG"
          git push --set-upstream origin "update-bundle/$RELEASE_TAG"

      - name: Open pull request
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          ACTION_VERSION_BUMPED: ${{ steps.bump-action-version.outputs.bumped }}
        run: |
          cli_version=$(jq -r '.cliVersion' src/defaults.json)
          action_version=$(jq -r '.version' package.json)

          pr_body="This pull request updates the default CodeQL bundle, as used with \`tools: linked\` and on GHES, to $cli_version."
          if [[ "$ACTION_VERSION_BUMPED" == "true" ]]; then
            pr_body+=$'\n\n'"Since this is a new CodeQL minor version series, this PR also bumps the Action version to $action_version."
          fi

          pr_url=$(gh pr create \
            --title "Update default bundle to $cli_version" \
            --body "$pr_body" \
            --assignee "$GITHUB_ACTOR" \
          )
          echo "CLI_VERSION=$cli_version" | tee -a "$GITHUB_ENV"
          echo "PR_URL=$pr_url" | tee -a "$GITHUB_ENV"

      - name: Create changelog note
        run: |
          python .github/workflows/script/bundle_changelog.py

      - name: Push changelog note
        run: |
          git commit -am "Add changelog note"
          git push