Bump the Action minor version number on new CodeQL minor version series

[henrymercer]

• Each CodeQL minor version series corresponds to a GHES version
• Each Action ships with a pinned version of the CodeQL bundle that is used on GHES
• Each GHES version has an associated Action version that pins the last CodeQL bundle for that minor version series

That handles the normal case, however what happens if we want to make a backport to GHES after we've already started the minor version series?

We need to release a new version of the Action based off that Action version pinning the CodeQL bundle associated with that GHES release.

This PR ensures we can assign a sensible version number to that version, by bumping the minor version number of the Action on each new CodeQL minor version series.

Suppose the version that shipped with CLI v2.23.9 was v4.31.11. Then this change makes sure the version that ships with CLI v2.24.0 will be v4.32.0 (or later). This means we can create a GHES backport that continues to pin CLI v2.23.9 and number this v4.31.12.

Risk assessment

For internal use only. Please select the risk level of this change:

• Low risk: Changes are fully under feature flags, or have been fully tested and validated in pre-production environments and are highly observable, or are documentation or test only.

Which use cases does this change impact?

Workflow types:

Products:

Environments:

• Testing/None - This change does not impact any CodeQL workflows in production.

How did/will you validate this change?

• None - I am not validating these changes.

If something goes wrong after this change is released, what are the mitigation and rollback strategies?

• Rollback - Change can only be disabled by rolling back the release or releasing a new version with a fix.

How will you know if something goes wrong after this change is released?

We'll find out because the bundle upgrade workflow will fail or the PR will be wrong.

Are there any special considerations for merging or releasing this change?

• No special considerations - This change can be merged at any time.

Merge / deployment checklist

• Confirm this change is backwards compatible with existing workflows.
• Consider adding a changelog entry for this change.
• Confirm the readme and docs have been updated if necessary.

[Copilot]

Pull request overview

Updates the CodeQL Action’s versioning scheme so each new CodeQL CLI minor series can start with a new Action minor version, enabling clean backport versioning for prior GHES-associated series.

Changes:

• Bump Action version from 4.31.12 to 4.32.0.
• Update the update-bundle workflow to automatically bump the Action minor version when the bundled CodeQL CLI version is x.y.0.
• Regenerate lib/ artifacts to reflect the new package version.

Reviewed changes

Copilot reviewed 14 out of 15 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
package.json	Updates the Action version to 4.32.0.
package-lock.json	Keeps lockfile version fields in sync with the new Action version.
lib/upload-sarif-action.js	Generated artifact updated with new package version.
lib/upload-sarif-action-post.js	Generated artifact updated with new package version.
lib/upload-lib.js	Generated artifact updated with new package version.
lib/start-proxy-action.js	Generated artifact updated with new package version.
lib/start-proxy-action-post.js	Generated artifact updated with new package version.
lib/setup-codeql-action.js	Generated artifact updated with new package version.
lib/resolve-environment-action.js	Generated artifact updated with new package version.
lib/init-action.js	Generated artifact updated with new package version.
lib/init-action-post.js	Generated artifact updated with new package version.
lib/autobuild-action.js	Generated artifact updated with new package version.
lib/analyze-action.js	Generated artifact updated with new package version.
lib/analyze-action-post.js	Generated artifact updated with new package version.
.github/workflows/update-bundle.yml	Adds automatic Action minor version bump + PR body note when starting a new CodeQL CLI minor series.

[Copilot]

The multi-line pr_body assignment includes leading indentation spaces on the second paragraph (from the YAML indentation), which will be preserved in the string and can render as a Markdown code block in the created PR body. Build the second paragraph without leading spaces (e.g., concatenate with explicit \n\n... or use a heredoc/printf that does not include YAML indentation) so the PR description renders as intended.

Suggested change

	pr_body="$pr_body
	Since this is a new CodeQL minor version series, this PR also bumps the Action version to $action_version."
	pr_body="$pr_body"$'\n\n'"Since this is a new CodeQL minor version series, this PR also bumps the Action version to $action_version."

[mbg]

Looks fine to merge. One or two things to follow-up on later.

[mbg]

This logic breaks if we ever need to skip a .0 CLI release and go straight to .1 or higher. I think ideally we'd extract the minor CLI version from src/defaults.json before the ./.github/actions/update-bundle step and then compare it to the one here. Not urgent, so feel free to do that in a follow-up PR.

[mbg]

Minor: This is a bit horrible. Perhaps in a follow-up, see if you can make this nicer

[mbg]

Thank you! I think the change addresses all of my feedback.