[henrymercer]

The "Update default CodeQL bundle" workflow currently adds its "Update default CodeQL bundle version" entry directly to the [UNRELEASED] section of CHANGELOG.md. This PR changes pr-checks/bundle-changelog.ts to write the entry to a changenote file in unreleased-change-notes/ instead, so that it's added to the changelog with the other changenotes when we release.

The workflow now stages the unreleased-change-notes directory, since git commit -a doesn't pick up new files.

With this change, bundle update PRs no longer modify CHANGELOG.md, so they won't need to be excluded from the check added in #4217.

Risk assessment

For internal use only. Please select the risk level of this change:

• Low risk: Changes are fully under feature flags, or have been fully tested and validated in pre-production environments and are highly observable, or are documentation or test only.

Which use cases does this change impact?

Workflow types:

• N/A

Products:

• N/A

Environments:

• Testing/None - This change does not impact any CodeQL workflows in production.

How did/will you validate this change?

• Unit tests - I am depending on unit test coverage (i.e. tests in .test.ts files).
• Other - I ran pr-checks/bundle-changelog.ts locally and checked that npx tsx pr-checks/changenotes.ts validate accepts the generated note and that npx tsx pr-checks/changenotes.ts assemble adds it to the [UNRELEASED] section of CHANGELOG.md. The workflow only runs when a CodeQL bundle prerelease is published, so the next bundle update will be its first run.

If something goes wrong after this change is released, what are the mitigation and rollback strategies?

• Development/testing only - This change cannot cause any failures in production.

How will you know if something goes wrong after this change is released?

• Other - The "Update default CodeQL bundle" workflow run would fail, or the bundle update PR would be missing its changenote.

Are there any special considerations for merging or releasing this change?

• No special considerations - This change can be merged at any time.

Merge / deployment checklist

• Confirm this change is backwards compatible with existing workflows.
• Consider adding a changelog entry for this change.
• Confirm the readme and docs have been updated if necessary.

[Copilot]

🟢 Approval recommended

No active review issues block the migration of bundle-update release notes to the changenote pipeline.

No open issues 🎉

What changed in this PR

Moves bundle-update release notes into the existing changenote pipeline, so bundle update PRs no longer modify CHANGELOG.md directly or need an exception to the check proposed in #4217.

Changes:

• Creates version-specific changenote files with links to the bundle release and update PR.
• Replaces changelog-editing tests with checks for changenote content and validity.
• Explicitly stages new changenote files before committing and pushing.

File	Description
pr-checks/​bundle-changelog.ts	Writes a bundle-update changenote instead of editing the changelog.
pr-checks/​bundle-changelog.test.ts	Tests generated note contents and compatibility with changenote validation.
.github/​workflows/​update-bundle.yml	Stages and commits the new changenote files.

_{Review effort: Balanced (auto)}