Update Node.js version and enhance workflow configuration by blytkerchan · Pull Request #101 · ilammy/msvc-dev-cmd

blytkerchan · 2026-03-16T01:53:52Z

Update Node.js version to 24 in action.yml
Add Visual Studio 2025 version mapping to VsYearVersion
Add 'dev' and 'main' branches to push trigger in workflow
Fix typos in action.yml and lib.js comments
Add dependabot configuration for npm and GitHub Actions updates
Update actions/checkout version to v6 in main workflow
Update GitHub Actions workflow to support Visual Studio 2025 and 2026
Add configurable support for ARM32 architecture (to disable it where not supported)
Fix compilation commands for ARM architecture in main workflow (don't always expect exe)
Remove Windows 2019 runner from workflow matrix -- no longer supported

* Update Node.js version to 24 in action.yml * Add Visual Studio 2025 version mapping to VsYearVersion * Add 'dev' and 'main' branches to push trigger in workflow * Fix typos in action.yml and lib.js comments * Add dependabot configuration for npm and GitHub Actions updates * Update actions/checkout version to v6 in main workflow * Update GitHub Actions workflow to support Visual Studio 2025 and 2026 * Add configurable support for ARM32 architecture (to disable it where not supported) * Fix compilation commands for ARM architecture in main workflow (don't always expect exe) * Remove Windows 2019 runner from workflow matrix -- no longer supported

- Added @vercel/ncc as a devDependency in package.json - Updated the build script in package.json to use ncc for building the project - Updated package-lock.json to reflect the addition of @vercel/ncc

sergio-nsk · 2026-03-17T07:02:01Z

Update Node.js version to 24 in action.yml

This is done here #94

mk-pmb · 2026-03-31T17:52:38Z

Thank you for this PR, which made this fix very easy:

     steps:
       - name: 'Install Visual Studio Build Tools'
-        uses: ilammy/msvc-dev-cmd@v1
+        uses: ilammy/msvc-dev-cmd@138b1c783b65ec697d8342918306b7b2db4e88f1

madmajestro · 2026-04-02T12:43:08Z

@ilammy

Many projects use your GitHub action. If you no longer have the time or interest to maintain this project (which is perfectly fine), you could make another developer a collaborator who could continue the maintenance or help out for a certain period. The project would continue, and several people wouldn't have to create a fork. Imho that would be better for everyone (including you) than letting the project die. What do you think?

I regularly contribute code to https://github.com/krakjoe/apcu, and this action is used there. Therefore, I would be happy if this project continues to work and I didn't have to worry about finding another solution...

pzhlkj6612 · 2026-04-02T17:44:23Z

FWIW, I just found that someone has made their own forked MSVC action for some years and they are keeping maintaining it: https://github.com/TheMrMilchmann/setup-msvc-dev.

I feel a little bit unhappy when I read the git-blame of that interesting "cls" hack: TheMrMilchmann/setup-msvc-dev::src/setup-msvc-dev.ts#L63-L64, which could be from ilammy/msvc-dev-cmd::index.js#L119. IIRC, MIT doesn't force anything about Git history, so I should calm down.

However, we know that something is better than nothing. That's it.

pzhlkj6612 · 2026-04-02T20:50:58Z

@mk-pmb:

Is this project even still needed?

Someday you may want or need to build something with specific components, for example, an older Windows SDK. You need to call "vcvarsall.bat" and try to figure out how to persist those environment variables, then you see the core of this project.

Package Version

Microsoft.VisualStudio.Component.Windows10SDK 17.14.36510.44

Microsoft.VisualStudio.Component.Windows10SDK.19041 17.14.36809.9

Microsoft.VisualStudio.Component.Windows11SDK.22621 17.14.36510.44

Microsoft.VisualStudio.Component.Windows11SDK.26100 17.14.37011.9

from: https://github.com/actions/runner-images/blob/7dd3415d1d3ad55ae79239951900b4d1268f6f69/images/windows/Windows2022-Readme.md

.

madmajestro · 2026-04-08T15:44:44Z

@@ -12,6 +12,7 @@ const EDITIONS = ['Enterprise', 'Professional', 'Community', 'BuildTools']
 const YEARS = ['2022', '2019', '2017']


Suggested change

const YEARS = ['2022', '2019', '2017']

const YEARS = ['2026', '2022', '2019', '2017']

+1: https://github.com/actions/runner-images/blob/e031541032bbd7f133be1053fbc4fb1bfe090842/images/windows/Windows2025-VS2026-Readme.md#visual-studio-enterprise-2026

Hi, @blytkerchan, this one?

TBH, to me it looks like this change probably isn't necessary at the moment, because the year seems not to be part of the path in this VS version. But if this changes someday, it could be useful and it shouldn't harm.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

This PR modernizes the JavaScript Action packaging and CI setup to support newer Visual Studio versions (including VS 2026), adds automated release/dependency tooling, and introduces unit tests to validate the action’s behavior.

Changes:

Updates the action runtime/packaging to use a bundled dist/index.js entrypoint and newer Node.js runtime.
Expands CI matrices and logic to support newer Windows/Visual Studio runners and ARM behavior, and adds unit tests.
Adds release automation (release-please) and dependency automation (Dependabot + optional automerge workflow).

Reviewed changes

Copilot reviewed 14 out of 16 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
`test/lib.test.js`	Adds unit tests for VS version mapping, vswhere lookup, fallback search, and env var export logic.
`test/index.test.js`	Adds unit tests for the `index.js` entrypoint input wiring and error handling.
`test/helpers.js`	Adds a VM-based CommonJS loader helper to isolate modules and mock dependencies in tests.
`lib.js`	Adds VS 2026 mapping and fixes a comment typo; core logic remains the same.
`dist/index.js`	Adds bundled action output for `action.yml` to execute directly.
`action.yml`	Moves runtime to Node.js 24 and points action entry to `dist/index.js`; fixes “Spectre” typo.
`README.md`	Renames/repoints documentation to the forked action location and updates usage examples.
`package.json`	Adds build/test scripts and updates dependencies (e.g., `@actions/core`), introduces `ncc`.
`package-lock.json`	Updates lockfile to reflect dependency and devDependency changes.
`release-please-config.json`	Adds release-please configuration for node-style releases.
`.release-please-manifest.json`	Adds release-please manifest to track package versions.
`.github/workflows/main.yml`	Expands CI to multiple Windows runners/VS versions, adds ARM32 gating, and runs unit tests.
`.github/workflows/release.yml`	Updates checkout action version and aligns audit steps with `npm ci` usage.
`.github/workflows/release-please.yml`	Adds automated release PR + release creation workflow and tag-moving job.
`.github/workflows/ci_dependabot_automerge.yml`	Adds optional Dependabot automerge workflow for minor/patch updates.
`.github/dependabot.yml`	Configures Dependabot updates for npm and GitHub Actions on the `dev` branch.

Comments suppressed due to low confidence (1)

package.json:14

package.json metadata still points at the upstream repository, but this fork’s README states it publishes as vln-devsecops/actions-msvc. Updating the repository.url avoids tooling (release-please, npm, GitHub UI links) sending users to the wrong repo.

  "repository": {
    "type": "git",
    "url": "git+https://github.com/ilammy/msvc-dev-cmd.git"
  },

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.



 const EDITIONS = ['Enterprise', 'Professional', 'Community', 'BuildTools']
 const YEARS = ['2022', '2019', '2017']


+      - uses: actions/checkout@v5
+      - uses: vln-devsecops/actions-msvc@v1


+      - uses: actions/checkout@v5
+      - uses: vln-devsecops/actions-msvc@v1


      - name: Download Internet
        run: npm install


      - name: Download Internet
        run: npm install


  "bugs": {
    "url": "https://github.com/ilammy/msvc-dev-cmd/issues"
  },
  "homepage": "https://github.com/ilammy/msvc-dev-cmd#readme",


Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 3.13.1 to 3.15.0. - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@3.13.1...3.15.0) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 3.15.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [flatted](https://github.com/WebReflection/flatted) from 3.2.2 to 3.4.2. - [Commits](WebReflection/flatted@v3.2.2...v3.4.2) --- updated-dependencies: - dependency-name: flatted dependency-version: 3.4.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

GITHUB_TOKEN cannot approve pull requests, so the approve/merge step needs a fine-grained PAT instead.

* Bump minimatch from 3.1.2 to 3.1.5 Bumps [minimatch](https://github.com/isaacs/minimatch) from 3.1.2 to 3.1.5. - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v3.1.2...v3.1.5) --- updated-dependencies: - dependency-name: minimatch dependency-version: 3.1.5 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> * Re-trigger automerge workflow after fixing allow_auto_merge + DEPENDABOT_AUTOMERGE_TOKEN --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Ronald Landheer-Cieslak <rlc@vlinder.ca>

GitHub treats pull_request-triggered runs whose actor is dependabot[bot] exactly like fork PRs: read-only GITHUB_TOKEN, no access to repo secrets at all. DEPENDABOT_AUTOMERGE_TOKEN was silently resolving to empty every time Dependabot itself triggered the workflow. pull_request_target runs in the base-repo context instead, so secrets are available; this workflow doesn't check out PR code, so there's no added risk.

…ks (#11)

Replaces the hand-written backport in #11 with a verbatim copy of the now-canonical template in vln-devsecops/guidance (PR #10), which fixes two failure modes the node-dashboard version #11 was based on still had: - self-exclusion now keys on the workflow run id rather than the job name. This job's own check run lands on the same head SHA, so the name filter stops excluding it the moment the job is renamed, and the gate waits on itself until it times out - blocking the PR permanently. - a 180s settle window replaces the 25s sleep. An empty check-run list is indistinguishable from a sibling runner that is still queueing, so concluding "nothing to wait for" early merges before a failing check ever registers - the original node-dashboard#37 bug, reachable again. Verified with guidance's tests/automerge_gate_test.sh against this repo's copy: 10/10 pass. The `ready_for_review` trigger type is dropped to stay byte-identical to the template; Dependabot does not open draft PRs, so it never fired. Refs #10 Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

#14 landed just before guidance#11, which corrected the token comment and added the GITHUB_TOKEN fallback. No behavioural change for this repo - DEPENDABOT_AUTOMERGE_TOKEN is provisioned here, so the PAT branch of the fallback is taken either way - but the runbook requires this file to stay byte-identical to guidance@main. Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

…18)

blytkerchan added 2 commits March 16, 2026 02:47

Add @vercel/ncc for build process and update package scripts

c544b75

- Added @vercel/ncc as a devDependency in package.json - Updated the build script in package.json to use ncc for building the project - Updated package-lock.json to reflect the addition of @vercel/ncc

fix: check out code before use

138b1c7

This comment was marked as outdated.

Sign in to view

madmajestro reviewed Apr 8, 2026

View reviewed changes

pzhlkj6612 mentioned this pull request Apr 9, 2026

update deps and workflows #102

Closed

Add Dependabot auto-merge workflow

43aac1e

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

shinra-electric mentioned this pull request Apr 26, 2026

CI: Resolve actions build warnings Vita3K/Vita3K#3904

Merged

Copilot AI and others added 8 commits April 26, 2026 14:55

Fix npm audit workflow failures

4e77739

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Update Node24-compatible workflow actions

b1ce912

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Update migrated action README references

bce4ea0

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Add unit tests for action logic

38ff9a8

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Fix PowerShell unit test glob

b42d2ea

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Run unit tests with bash on Windows

3acebef

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

List unit test files explicitly

adcf358

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

docs: align README action name

9903b5d

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

This was referenced May 7, 2026

[ci] update all actions to versions that support node 24 wpilibsuite/allwpilib#8871

Merged

[ci] update github actions to support node 24 azahar-emu/azahar#2110

Merged

ASillyNeko mentioned this pull request Jun 3, 2026

Update actions MRVN-Radiant/MRVN-Radiant#95

Closed

Masterkatze mentioned this pull request Jun 11, 2026

Bump actions versions NeotokyoRebuild/neo#1987

Merged

Copilot AI and others added 2 commits June 18, 2026 16:53

ci: fix windows-2025 runner jobs failing on VS 2022 lookup

5b37bbd

chore: install release-please (#4)

f6566b7

Copilot AI review requested due to automatic review settings July 9, 2026 04:17

Copilot started reviewing on behalf of blytkerchan July 9, 2026 04:18 View session

Copilot AI reviewed Jul 9, 2026

View reviewed changes

dependabot Bot and others added 12 commits July 9, 2026 22:35

Use DEPENDABOT_AUTOMERGE_TOKEN in dependabot automerge workflow

6eb3836

GITHUB_TOKEN cannot approve pull requests, so the approve/merge step needs a fine-grained PAT instead.

Migrate ESLint config to flat config and bump to v10 (#9)

22bcab4

fix: stop dependabot automerge from merging past failing sibling chec…

da94470

…ks (#11)

docs: note branch-protection/matrix coupling in main.yml (#12)

49e26c7

chore: resync automerge workflow with canonical template (#16)

6adb8f7

fix: resync automerge workflow with canonical template (guidance#15) (#…

b40c1fb

…18)

Navigation Menu

Update Node.js version and enhance workflow configuration - #101

Update Node.js version and enhance workflow configuration #101
blytkerchan wants to merge 26 commits into
ilammy:masterfrom
vln-devsecops:dev

blytkerchan commented Mar 16, 2026

Uh oh!

sergio-nsk commented Mar 17, 2026

Uh oh!

mk-pmb commented Mar 31, 2026 •

edited

Loading

Uh oh!

madmajestro commented Apr 2, 2026

Uh oh!

pzhlkj6612 commented Apr 2, 2026

Uh oh!

This comment was marked as outdated.

pzhlkj6612 commented Apr 2, 2026

Uh oh!

madmajestro Apr 8, 2026

Uh oh!

pzhlkj6612 Apr 8, 2026

Uh oh!

pzhlkj6612 Apr 28, 2026

Uh oh!

madmajestro Apr 28, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

		@@ -12,6 +12,7 @@ const EDITIONS = ['Enterprise', 'Professional', 'Community', 'BuildTools']
		const YEARS = ['2022', '2019', '2017']

	const YEARS = ['2022', '2019', '2017']
	const YEARS = ['2026', '2022', '2019', '2017']



		const EDITIONS = ['Enterprise', 'Professional', 'Community', 'BuildTools']
		const YEARS = ['2022', '2019', '2017']

		- uses: actions/checkout@v5
		- uses: vln-devsecops/actions-msvc@v1

Conversation

blytkerchan commented Mar 16, 2026

Uh oh!

sergio-nsk commented Mar 17, 2026

Uh oh!

mk-pmb commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

madmajestro commented Apr 2, 2026

Uh oh!

pzhlkj6612 commented Apr 2, 2026

Uh oh!

This comment was marked as outdated.

pzhlkj6612 commented Apr 2, 2026

Uh oh!

madmajestro Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

pzhlkj6612 Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

pzhlkj6612 Apr 28, 2026

Choose a reason for hiding this comment

Uh oh!

madmajestro Apr 28, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

mk-pmb commented Mar 31, 2026 •

edited

Loading