From ffd40b4a96bf519ca4f0c550b2802c7a59de5335 Mon Sep 17 00:00:00 2001
From: Angela P Wen <angelapwen@github.com>
Date: Fri, 4 Apr 2025 14:29:50 +0200
Subject: [PATCH] Always use the latest major version of CodeQL Action

---
 .../scripts/build/install-codeql-bundle.sh     | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/images/macos/scripts/build/install-codeql-bundle.sh b/images/macos/scripts/build/install-codeql-bundle.sh
index 7c179add8..5e8b5862a 100644
--- a/images/macos/scripts/build/install-codeql-bundle.sh
+++ b/images/macos/scripts/build/install-codeql-bundle.sh
@@ -6,9 +6,23 @@
 
 source ~/utils/utils.sh
 
+# Retrieve the latest major version of the CodeQL Action to use in the base URL for downloading the bundle.
+releases=$(curl -s "https://api.github.com/repos/github/codeql-action/releases")
+
+# Get the release tags starting with v[0-9] and sort them in descending order, then parse the first one to get the major version.
+codeql_action_latest_major_version=$(echo "$releases" |
+    jq -r '.[].tag_name' |
+    grep -E '^v[0-9]' |
+    sort -nr |
+    head -n 1 |
+    sed -E 's/^v([0-9]+).*/\1/')
+if [ -z "$codeql_action_latest_major_version" ]; then
+  echo "Error: Unable to find the latest major version of the CodeQL Action."
+  exit 1
+fi
+
 # Retrieve the CLI version of the latest CodeQL bundle.
-defaults_json_path=$(download_with_retry https://raw.githubusercontent.com/github/codeql-action/v3/src/defaults.json)
-bundle_version=$(jq -r '.cliVersion' $defaults_json_path)
+defaults_json_path=$(download_with_retry "https://raw.githubusercontent.com/github/codeql-action/$codeql_action_latest_major_version/src/defaults.json")
 bundle_tag_name="codeql-bundle-v$bundle_version"
 
 echo "Downloading CodeQL bundle $bundle_version..."