From 2a7a517ea51e333a8c3777cd9800140e937d0b15 Mon Sep 17 00:00:00 2001
From: Henry Mercer <henrymercer@github.com>
Date: Thu, 17 Mar 2022 17:42:54 +0000
Subject: [PATCH 01/20] Remove unused `repository_dispatch` trigger

---
 .github/workflows/update-release-branch.yml | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/.github/workflows/update-release-branch.yml b/.github/workflows/update-release-branch.yml
index b0cb714ca8..0a7a3a8750 100644
--- a/.github/workflows/update-release-branch.yml
+++ b/.github/workflows/update-release-branch.yml
@@ -1,11 +1,5 @@
 name: Update release branch
-on:
-  repository_dispatch:
-    # Example of how to trigger this:
-    # curl -H "Authorization: Bearer <token>" -X POST https://api.github.com/repos/github/codeql-action/dispatches -d '{"event_type":"update-release-branch"}'
-    # Replace <token> with a personal access token from this page: https://github.com/settings/tokens
-    types: [update-release-branch]
-  workflow_dispatch:
+on: workflow_dispatch
 
 jobs:
   update:

From b386fd4443664ef34e66683154e236262484b220 Mon Sep 17 00:00:00 2001
From: Henry Mercer <henrymercer@github.com>
Date: Thu, 17 Mar 2022 17:42:26 +0000
Subject: [PATCH 02/20] Parameterize release branch workflow over source and
 target branches

---
 .github/update-release-branch.py            | 86 +++++++++++++--------
 .github/workflows/update-release-branch.yml |  9 ++-
 2 files changed, 61 insertions(+), 34 deletions(-)

diff --git a/.github/update-release-branch.py b/.github/update-release-branch.py
index 71f1cd1c75..d202de4f16 100644
--- a/.github/update-release-branch.py
+++ b/.github/update-release-branch.py
@@ -1,12 +1,9 @@
+import argparse
 import datetime
 from github import Github
-import random
-import requests
-import subprocess
-import sys
 import json
-import datetime
 import os
+import subprocess
 
 EMPTY_CHANGELOG = """# CodeQL Action and CodeQL Runner Changelog
 
@@ -16,12 +13,6 @@
 
 """
 
-# The branch being merged from.
-# This is the one that contains day-to-day development work.
-MAIN_BRANCH = 'main'
-# The branch being merged into.
-# This is the release branch that users reference.
-LATEST_RELEASE_BRANCH = 'v1'
 # Name of the remote
 ORIGIN = 'origin'
 
@@ -39,7 +30,7 @@ def branch_exists_on_remote(branch_name):
   return run_git('ls-remote', '--heads', ORIGIN, branch_name).strip() != ''
 
 # Opens a PR from the given branch to the release branch
-def open_pr(repo, all_commits, short_main_sha, branch_name):
+def open_pr(repo, all_commits, short_main_sha, new_branch_name, source_branch, target_branch):
   # Sort the commits into the pull requests that introduced them,
   # and any commits that don't have a pull request
   pull_requests = []
@@ -61,7 +52,7 @@ def open_pr(repo, all_commits, short_main_sha, branch_name):
 
   # Start constructing the body text
   body = []
-  body.append('Merging ' + short_main_sha + ' into ' + LATEST_RELEASE_BRANCH)
+  body.append('Merging ' + short_main_sha + ' into ' + target_branch)
 
   conductor = get_conductor(repo, pull_requests, commits_without_pull_requests)
   body.append('')
@@ -86,16 +77,16 @@ def open_pr(repo, all_commits, short_main_sha, branch_name):
   body.append('Please review the following:')
   body.append(' - [ ] The CHANGELOG displays the correct version and date.')
   body.append(' - [ ] The CHANGELOG includes all relevant, user-facing changes since the last release.')
-  body.append(' - [ ] There are no unexpected commits being merged into the ' + LATEST_RELEASE_BRANCH + ' branch.')
+  body.append(' - [ ] There are no unexpected commits being merged into the ' + target_branch + ' branch.')
   body.append(' - [ ] The docs team is aware of any documentation changes that need to be released.')
-  body.append(' - [ ] The mergeback PR is merged back into ' + MAIN_BRANCH + ' after this PR is merged.')
+  body.append(' - [ ] The mergeback PR is merged back into ' + source_branch + ' after this PR is merged.')
 
-  title = 'Merge ' + MAIN_BRANCH + ' into ' + LATEST_RELEASE_BRANCH
+  title = 'Merge ' + source_branch + ' into ' + target_branch
 
   # Create the pull request
   # PR checks won't be triggered on PRs created by Actions. Therefore mark the PR as draft so that
   # a maintainer can take the PR out of draft, thereby triggering the PR checks.
-  pr = repo.create_pull(title=title, body='\n'.join(body), head=branch_name, base=LATEST_RELEASE_BRANCH, draft=True)
+  pr = repo.create_pull(title=title, body='\n'.join(body), head=new_branch_name, base=target_branch, draft=True)
   print('Created PR #' + str(pr.number))
 
   # Assign the conductor
@@ -115,8 +106,8 @@ def get_conductor(repo, pull_requests, other_commits):
 # since the release branched off.
 # This will not include any commits that exist on the release branch
 # that aren't on main.
-def get_commit_difference(repo):
-  commits = run_git('log', '--pretty=format:%H', ORIGIN + '/' + LATEST_RELEASE_BRANCH + '..' + ORIGIN + '/' + MAIN_BRANCH).strip().split('\n')
+def get_commit_difference(repo, source_branch, target_branch):
+  commits = run_git('log', '--pretty=format:%H', ORIGIN + '/' + target_branch + '..' + ORIGIN + '/' + source_branch).strip().split('\n')
 
   # Convert to full-fledged commit objects
   commits = [repo.get_commit(c) for c in commits]
@@ -179,23 +170,47 @@ def update_changelog(version):
 
 
 def main():
-  if len(sys.argv) != 3:
-    raise Exception('Usage: update-release.branch.py <github token> <repository nwo>')
-  github_token = sys.argv[1]
-  repository_nwo = sys.argv[2]
-
-  repo = Github(github_token).get_repo(repository_nwo)
+  parser = argparse.ArgumentParser('update-release-branch.py')
+
+  parser.add_argument(
+    '--github-token',
+    type=str,
+    required=True,
+    help='GitHub token, typically from GitHub Actions.'
+  )
+  parser.add_argument(
+    '--repository-nwo',
+    type=str,
+    required=True,
+    help='The nwo of the repository, for example github/codeql-action.'
+  )
+  parser.add_argument(
+    '--source-branch',
+    type=str,
+    required=True,
+    help='The branch being merged from, typically "main" for a v2 release or "v2" for a v1 release.'
+  )
+  parser.add_argument(
+    '--target-branch',
+    type=str,
+    required=True,
+    help='The branch being merged into, typically "v2" for a v2 release or "v1" for a v1 release.'
+  )
+
+  args = parser.parse_args()
+
+  repo = Github(args.github_token).get_repo(args.repository_nwo)
   version = get_current_version()
 
   # Print what we intend to go
-  print('Considering difference between ' + MAIN_BRANCH + ' and ' + LATEST_RELEASE_BRANCH)
-  short_main_sha = run_git('rev-parse', '--short', ORIGIN + '/' + MAIN_BRANCH).strip()
-  print('Current head of ' + MAIN_BRANCH + ' is ' + short_main_sha)
+  print('Considering difference between ' + args.source_branch + ' and ' + args.target_branch)
+  short_main_sha = run_git('rev-parse', '--short', ORIGIN + '/' + args.source_branch).strip()
+  print('Current head of ' + args.source_branch + ' is ' + short_main_sha)
 
   # See if there are any commits to merge in
-  commits = get_commit_difference(repo)
+  commits = get_commit_difference(repo=repo, source_branch=args.source_branch, target_branch=args.target_branch)
   if len(commits) == 0:
-    print('No commits to merge from ' + MAIN_BRANCH + ' to ' + LATEST_RELEASE_BRANCH)
+    print('No commits to merge from ' + args.source_branch + ' to ' + args.target_branch)
     return
 
   # The branch name is based off of the name of branch being merged into
@@ -212,7 +227,7 @@ def main():
 
   # Create the new branch and push it to the remote
   print('Creating branch ' + new_branch_name)
-  run_git('checkout', '-b', new_branch_name, ORIGIN + '/' + MAIN_BRANCH)
+  run_git('checkout', '-b', new_branch_name, ORIGIN + '/' + args.source_branch)
 
   print('Updating changelog')
   update_changelog(version)
@@ -224,7 +239,14 @@ def main():
   run_git('push', ORIGIN, new_branch_name)
 
   # Open a PR to update the branch
-  open_pr(repo, commits, short_main_sha, new_branch_name)
+  open_pr(
+    repo,
+    commits,
+    short_main_sha,
+    new_branch_name,
+    source_branch=args.source_branch,
+    target_branch=args.target_branch
+  )
 
 if __name__ == '__main__':
   main()
diff --git a/.github/workflows/update-release-branch.yml b/.github/workflows/update-release-branch.yml
index 0a7a3a8750..3d893c5870 100644
--- a/.github/workflows/update-release-branch.yml
+++ b/.github/workflows/update-release-branch.yml
@@ -5,7 +5,7 @@ jobs:
   update:
     timeout-minutes: 45
     runs-on: ubuntu-latest
-    if: ${{ github.repository == 'github/codeql-action' }}
+    if: github.repository == 'github/codeql-action'
     steps:
     - uses: actions/checkout@v2
       with:
@@ -28,4 +28,9 @@ jobs:
         git config --global user.name "github-actions[bot]"
 
     - name: Update release branch
-      run: python .github/update-release-branch.py ${{ secrets.GITHUB_TOKEN }} ${{ github.repository }}
+      run: |
+        python .github/update-release-branch.py \
+          --github-token ${{ secrets.GITHUB_TOKEN }} \
+          --repository-nwo ${{ github.repository }} \
+          --source-branch main \
+          --target-branch v1

From 81827d3fc670eafe1f7231c241ddca189bb4b486 Mon Sep 17 00:00:00 2001
From: Henry Mercer <henrymercer@github.com>
Date: Thu, 17 Mar 2022 18:13:28 +0000
Subject: [PATCH 03/20] Use the person triggering the release workflow as the
 conductor

---
 .github/update-release-branch.py            | 21 +++++++++------------
 .github/workflows/update-release-branch.yml |  3 ++-
 2 files changed, 11 insertions(+), 13 deletions(-)

diff --git a/.github/update-release-branch.py b/.github/update-release-branch.py
index d202de4f16..83a003de6d 100644
--- a/.github/update-release-branch.py
+++ b/.github/update-release-branch.py
@@ -30,7 +30,7 @@ def branch_exists_on_remote(branch_name):
   return run_git('ls-remote', '--heads', ORIGIN, branch_name).strip() != ''
 
 # Opens a PR from the given branch to the release branch
-def open_pr(repo, all_commits, short_main_sha, new_branch_name, source_branch, target_branch):
+def open_pr(repo, all_commits, short_main_sha, new_branch_name, source_branch, target_branch, conductor):
   # Sort the commits into the pull requests that introduced them,
   # and any commits that don't have a pull request
   pull_requests = []
@@ -54,7 +54,6 @@ def open_pr(repo, all_commits, short_main_sha, new_branch_name, source_branch, t
   body = []
   body.append('Merging ' + short_main_sha + ' into ' + target_branch)
 
-  conductor = get_conductor(repo, pull_requests, commits_without_pull_requests)
   body.append('')
   body.append('Conductor for this PR is @' + conductor)
 
@@ -93,15 +92,6 @@ def open_pr(repo, all_commits, short_main_sha, new_branch_name, source_branch, t
   pr.add_to_assignees(conductor)
   print('Assigned PR to ' + conductor)
 
-# Gets the person who should be in charge of the mergeback PR
-def get_conductor(repo, pull_requests, other_commits):
-  # If there are any PRs then use whoever merged the last one
-  if len(pull_requests) > 0:
-    return get_merger_of_pr(repo, pull_requests[-1])
-
-  # Otherwise take the author of the latest commit
-  return other_commits[-1].author.login
-
 # Gets a list of the SHAs of all commits that have happened on main
 # since the release branched off.
 # This will not include any commits that exist on the release branch
@@ -196,6 +186,12 @@ def main():
     required=True,
     help='The branch being merged into, typically "v2" for a v2 release or "v1" for a v1 release.'
   )
+  parser.add_argument(
+    '--conductor',
+    type=str,
+    required=True,
+    help='The GitHub handle of the person who is conducting the release process.'
+  )
 
   args = parser.parse_args()
 
@@ -245,7 +241,8 @@ def main():
     short_main_sha,
     new_branch_name,
     source_branch=args.source_branch,
-    target_branch=args.target_branch
+    target_branch=args.target_branch,
+    conductor=args.conductor
   )
 
 if __name__ == '__main__':
diff --git a/.github/workflows/update-release-branch.yml b/.github/workflows/update-release-branch.yml
index 3d893c5870..d77c2b41b7 100644
--- a/.github/workflows/update-release-branch.yml
+++ b/.github/workflows/update-release-branch.yml
@@ -33,4 +33,5 @@ jobs:
           --github-token ${{ secrets.GITHUB_TOKEN }} \
           --repository-nwo ${{ github.repository }} \
           --source-branch main \
-          --target-branch v1
+          --target-branch v1 \
+          --conductor ${GITHUB_ACTOR}

From ccda44cac500d43a7fcf61130d2fc609e15a5aac Mon Sep 17 00:00:00 2001
From: Henry Mercer <henrymercer@github.com>
Date: Thu, 17 Mar 2022 18:28:50 +0000
Subject: [PATCH 04/20] Handle missing author information when generating
 changelog

---
 .github/update-release-branch.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/update-release-branch.py b/.github/update-release-branch.py
index 83a003de6d..ec8bdf75b1 100644
--- a/.github/update-release-branch.py
+++ b/.github/update-release-branch.py
@@ -70,7 +70,8 @@ def open_pr(repo, all_commits, short_main_sha, new_branch_name, source_branch, t
     body.append('')
     body.append('Contains the following commits not from a pull request:')
     for commit in commits_without_pull_requests:
-      body.append('- ' + commit.sha + ' - ' + get_truncated_commit_message(commit) + ' (@' + commit.author.login + ')')
+      author_description = ' (@' + commit.author.login + ')' if commit.author is not None else ''
+      body.append('- ' + commit.sha + ' - ' + get_truncated_commit_message(commit) + author_description)
 
   body.append('')
   body.append('Please review the following:')

From 33f749f1c9d38dcc50e9167d92da04389d7ec61c Mon Sep 17 00:00:00 2001
From: Henry Mercer <henrymercer@github.com>
Date: Thu, 17 Mar 2022 19:11:37 +0000
Subject: [PATCH 05/20] Set up `main -> v2`, `v2 -> v1`, and `v2 -> main`
 merges

---
 .github/workflows/post-release-mergeback.yml |  3 ++-
 .github/workflows/update-release-branch.yml  | 23 ++++++++++++++++++--
 2 files changed, 23 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/post-release-mergeback.yml b/.github/workflows/post-release-mergeback.yml
index 636bd18d13..b6bc16d053 100644
--- a/.github/workflows/post-release-mergeback.yml
+++ b/.github/workflows/post-release-mergeback.yml
@@ -15,6 +15,7 @@ on:
   push:
     branches:
       - v1
+      - v2
 
 jobs:
   merge-back:
@@ -90,7 +91,7 @@ jobs:
           git push origin --follow-tags "$VERSION"
 
       - name: Create mergeback branch
-        if: steps.check.outputs.exists != 'true'
+        if: steps.check.outputs.exists != 'true' && contains(github.ref, 'v2')
         env:
           VERSION: "${{ steps.getVersion.outputs.version }}"
           NEW_BRANCH: "${{ steps.getVersion.outputs.newBranch }}"
diff --git a/.github/workflows/update-release-branch.yml b/.github/workflows/update-release-branch.yml
index d77c2b41b7..5271eda2ef 100644
--- a/.github/workflows/update-release-branch.yml
+++ b/.github/workflows/update-release-branch.yml
@@ -1,5 +1,13 @@
 name: Update release branch
-on: workflow_dispatch
+on:
+  # You can trigger this workflow via workflow dispatch to start a release.
+  # This will open a PR to update the v2 release branch.
+  workflow_dispatch:
+
+  # When the v2 release is complete, this workflow will open a PR to update the v1 release branch.
+  push:
+    branches:
+      - v2
 
 jobs:
   update:
@@ -27,11 +35,22 @@ jobs:
         git config --global user.email "github-actions@github.com"
         git config --global user.name "github-actions[bot]"
 
-    - name: Update release branch
+    - name: Update v2 release branch
+      if: github.event_name == 'workflow_dispatch'
       run: |
         python .github/update-release-branch.py \
           --github-token ${{ secrets.GITHUB_TOKEN }} \
           --repository-nwo ${{ github.repository }} \
           --source-branch main \
+          --target-branch v2 \
+          --conductor ${GITHUB_ACTOR}
+
+    - name: Update v1 release branch
+      if: github.event_name == 'push'
+      run: |
+        python .github/update-release-branch.py \
+          --github-token ${{ secrets.GITHUB_TOKEN }} \
+          --repository-nwo ${{ github.repository }} \
+          --source-branch v2 \
           --target-branch v1 \
           --conductor ${GITHUB_ACTOR}

From d76b18254a7f9e0d84958be7cf2faa59badfdf7f Mon Sep 17 00:00:00 2001
From: Henry Mercer <henrymercer@github.com>
Date: Thu, 17 Mar 2022 19:49:23 +0000
Subject: [PATCH 06/20] Add functionality for `v2 -> v1` backports

---
 .github/update-release-branch.py            | 23 +++++++++++++++++++--
 .github/workflows/update-release-branch.yml |  3 ++-
 2 files changed, 23 insertions(+), 3 deletions(-)

diff --git a/.github/update-release-branch.py b/.github/update-release-branch.py
index ec8bdf75b1..42479624a3 100644
--- a/.github/update-release-branch.py
+++ b/.github/update-release-branch.py
@@ -193,12 +193,22 @@ def main():
     required=True,
     help='The GitHub handle of the person who is conducting the release process.'
   )
+  parser.add_argument(
+    '--perform-v2-to-v1-backport',
+    action='store_true',
+    help='Pass this flag if this release is a backport from v2 to v1.'
+  )
 
   args = parser.parse_args()
 
   repo = Github(args.github_token).get_repo(args.repository_nwo)
   version = get_current_version()
 
+  if args.perform_v2_to_v1_backport:
+    # Change the version number to a v1 equivalent
+    version = get_current_version()
+    version = f'1{version[1:]}'
+
   # Print what we intend to go
   print('Considering difference between ' + args.source_branch + ' and ' + args.target_branch)
   short_main_sha = run_git('rev-parse', '--short', ORIGIN + '/' + args.source_branch).strip()
@@ -226,8 +236,17 @@ def main():
   print('Creating branch ' + new_branch_name)
   run_git('checkout', '-b', new_branch_name, ORIGIN + '/' + args.source_branch)
 
-  print('Updating changelog')
-  update_changelog(version)
+  if args.perform_v2_to_v1_backport:
+    print(f'Setting version number to {version}')
+    subprocess.run(['npm', 'version', version])
+    run_git('add', 'package.json', 'package-lock.json', 'runner/package.json', 'runner/package-lock.json')
+
+    print('Migrating changelog notes from v2 to v1')
+    subprocess.run(['sed', '-i', 's/## 2./## 1./g', 'CHANGELOG.md'])
+  else:
+    # We don't need to do this for a v1 release, since the changelog has already been updated in the v2 branch.
+    print('Updating changelog')
+    update_changelog(version)
 
   # Create a commit that updates the CHANGELOG
   run_git('add', 'CHANGELOG.md')
diff --git a/.github/workflows/update-release-branch.yml b/.github/workflows/update-release-branch.yml
index 5271eda2ef..ed8278e557 100644
--- a/.github/workflows/update-release-branch.yml
+++ b/.github/workflows/update-release-branch.yml
@@ -53,4 +53,5 @@ jobs:
           --repository-nwo ${{ github.repository }} \
           --source-branch v2 \
           --target-branch v1 \
-          --conductor ${GITHUB_ACTOR}
+          --conductor ${GITHUB_ACTOR} \
+          --perform-v2-to-v1-backport

From 4b465cb3ce6e1f57007b896e33b86d384c27cc57 Mon Sep 17 00:00:00 2001
From: Henry Mercer <henrymercer@github.com>
Date: Tue, 22 Mar 2022 15:10:40 +0000
Subject: [PATCH 07/20] Dump environment and GitHub context

---
 .github/workflows/post-release-mergeback.yml | 9 ++++++---
 .github/workflows/update-release-branch.yml  | 8 ++++++++
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/post-release-mergeback.yml b/.github/workflows/post-release-mergeback.yml
index b6bc16d053..ce4f6496db 100644
--- a/.github/workflows/post-release-mergeback.yml
+++ b/.github/workflows/post-release-mergeback.yml
@@ -26,10 +26,13 @@ jobs:
       HEAD_BRANCH: "${{ github.head_ref || github.ref }}"
 
     steps:
-      - name: Dump GitHub Event context
+      - name: Dump environment
+        run: env
+
+      - name: Dump GitHub context
         env:
-          GITHUB_EVENT_CONTEXT: "${{ toJson(github.event) }}"
-        run: echo "$GITHUB_EVENT_CONTEXT"
+          GITHUB_CONTEXT: '${{ toJson(github) }}'
+        run: echo "$GITHUB_CONTEXT"
 
       - uses: actions/checkout@v2
       - uses: actions/setup-node@v2
diff --git a/.github/workflows/update-release-branch.yml b/.github/workflows/update-release-branch.yml
index ed8278e557..93a3437608 100644
--- a/.github/workflows/update-release-branch.yml
+++ b/.github/workflows/update-release-branch.yml
@@ -15,6 +15,14 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository == 'github/codeql-action'
     steps:
+    - name: Dump environment
+      run: env
+
+    - name: Dump GitHub context
+      env:
+        GITHUB_CONTEXT: '${{ toJson(github) }}'
+      run: echo "$GITHUB_CONTEXT"
+
     - uses: actions/checkout@v2
       with:
         # Need full history so we calculate diffs

From b8f3a377bfeac2fc198940d26a1610d7abb64cb2 Mon Sep 17 00:00:00 2001
From: Henry Mercer <henrymercer@github.com>
Date: Tue, 22 Mar 2022 15:33:54 +0000
Subject: [PATCH 08/20] Fix exception when there are no commits to merge

---
 .github/update-release-branch.py | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/update-release-branch.py b/.github/update-release-branch.py
index 42479624a3..c41d3f8b36 100644
--- a/.github/update-release-branch.py
+++ b/.github/update-release-branch.py
@@ -98,7 +98,9 @@ def open_pr(repo, all_commits, short_main_sha, new_branch_name, source_branch, t
 # This will not include any commits that exist on the release branch
 # that aren't on main.
 def get_commit_difference(repo, source_branch, target_branch):
-  commits = run_git('log', '--pretty=format:%H', ORIGIN + '/' + target_branch + '..' + ORIGIN + '/' + source_branch).strip().split('\n')
+  # Passing split nothing means that the empty string splits to nothing: compare `''.split() == []`
+  # to `''.split('\n') == ['']`.
+  commits = run_git('log', '--pretty=format:%H', ORIGIN + '/' + target_branch + '..' + ORIGIN + '/' + source_branch).strip().split()
 
   # Convert to full-fledged commit objects
   commits = [repo.get_commit(c) for c in commits]

From 124e7d96a654a337cbd95cc8da81448306b32a60 Mon Sep 17 00:00:00 2001
From: Henry Mercer <henrymercer@github.com>
Date: Tue, 22 Mar 2022 19:35:19 +0000
Subject: [PATCH 09/20] Stop versioning the runner

We no longer release the runner.
---
 package.json | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/package.json b/package.json
index 5880e9a9b8..6c1050e636 100644
--- a/package.json
+++ b/package.json
@@ -9,8 +9,7 @@
     "test-debug": "ava src/**.test.ts --serial --verbose --timeout=20m",
     "lint": "eslint --report-unused-disable-directives --max-warnings=0 . --ext .js,.ts",
     "lint-fix": "eslint --report-unused-disable-directives --max-warnings=0 . --ext .js,.ts --fix",
-    "removeNPMAbsolutePaths": "removeNPMAbsolutePaths . --force",
-    "version": "cd runner && npm version patch && cd .. && npm run removeNPMAbsolutePaths && git add runner"
+    "removeNPMAbsolutePaths": "removeNPMAbsolutePaths . --force"
   },
   "ava": {
     "typescript": {

From 5fb01dd153bd087fca06ca074a4fb3812224c708 Mon Sep 17 00:00:00 2001
From: Henry Mercer <henrymercer@github.com>
Date: Tue, 22 Mar 2022 20:16:35 +0000
Subject: [PATCH 10/20] Avoid commits with duplicate names during v2 to v1
 backport

---
 .github/update-release-branch.py | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/.github/update-release-branch.py b/.github/update-release-branch.py
index c41d3f8b36..4af33e916d 100644
--- a/.github/update-release-branch.py
+++ b/.github/update-release-branch.py
@@ -239,20 +239,27 @@ def main():
   run_git('checkout', '-b', new_branch_name, ORIGIN + '/' + args.source_branch)
 
   if args.perform_v2_to_v1_backport:
+    # Migrate the package version number from a v2 version number to a v1 version number
     print(f'Setting version number to {version}')
-    subprocess.run(['npm', 'version', version])
-    run_git('add', 'package.json', 'package-lock.json', 'runner/package.json', 'runner/package-lock.json')
+    subprocess.run(['npm', 'version', version, '--no-git-tag-version'])
+    run_git('reset', 'HEAD~1')
+    run_git('add', 'package.json', 'package-lock.json')
 
+    # Migrate the changelog notes from v2 version numbers to v1 version numbers
     print('Migrating changelog notes from v2 to v1')
     subprocess.run(['sed', '-i', 's/## 2./## 1./g', 'CHANGELOG.md'])
+
+    # Amend the commit generated by `npm version` to update the CHANGELOG
+    run_git('add', 'CHANGELOG.md')
+    run_git('commit', '--amend', '-m', f'Update version and changelog for v{version}')
   else:
     # We don't need to do this for a v1 release, since the changelog has already been updated in the v2 branch.
     print('Updating changelog')
     update_changelog(version)
 
-  # Create a commit that updates the CHANGELOG
-  run_git('add', 'CHANGELOG.md')
-  run_git('commit', '-m', version)
+    # Create a commit that updates the CHANGELOG
+    run_git('add', 'CHANGELOG.md')
+    run_git('commit', '-m', f'Update changelog for v{version}')
 
   run_git('push', ORIGIN, new_branch_name)
 

From bd4757cd6b95a207c9cad4d147fc53eaf9d0998a Mon Sep 17 00:00:00 2001
From: Henry Mercer <henrymercer@github.com>
Date: Tue, 22 Mar 2022 20:18:57 +0000
Subject: [PATCH 11/20] Update the changelog and version number in a single
 commit

---
 .github/workflows/post-release-mergeback.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/post-release-mergeback.yml b/.github/workflows/post-release-mergeback.yml
index ce4f6496db..0ea1fa6def 100644
--- a/.github/workflows/post-release-mergeback.yml
+++ b/.github/workflows/post-release-mergeback.yml
@@ -104,11 +104,13 @@ jobs:
           PR_TITLE="Mergeback $VERSION $HEAD_BRANCH into $BASE_BRANCH"
           PR_BODY="Updates version and changelog."
 
+          # Update the version number ready for the next release
+          npm version patch --no-git-tag-version
+
           # Update the changelog
           perl -i -pe 's/^/## \[UNRELEASED\]\n\nNo user facing changes.\n\n/ if($.==3)' CHANGELOG.md
           git add .
           git commit -m "Update changelog and version after $VERSION"
-          npm version patch
 
           git push origin "$NEW_BRANCH"
 

From 1668e0a2bf933321e6f690c97ecdbc4fad986697 Mon Sep 17 00:00:00 2001
From: Henry Mercer <henrymercer@github.com>
Date: Tue, 22 Mar 2022 20:38:50 +0000
Subject: [PATCH 12/20] Only mention merging the mergeback PR in the checklist
 when relevant

---
 .github/update-release-branch.py | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/.github/update-release-branch.py b/.github/update-release-branch.py
index 4af33e916d..2454fad758 100644
--- a/.github/update-release-branch.py
+++ b/.github/update-release-branch.py
@@ -30,7 +30,7 @@ def branch_exists_on_remote(branch_name):
   return run_git('ls-remote', '--heads', ORIGIN, branch_name).strip() != ''
 
 # Opens a PR from the given branch to the release branch
-def open_pr(repo, all_commits, short_main_sha, new_branch_name, source_branch, target_branch, conductor):
+def open_pr(repo, all_commits, short_main_sha, new_branch_name, source_branch, target_branch, conductor, include_mergeback_in_changelog):
   # Sort the commits into the pull requests that introduced them,
   # and any commits that don't have a pull request
   pull_requests = []
@@ -79,7 +79,8 @@ def open_pr(repo, all_commits, short_main_sha, new_branch_name, source_branch, t
   body.append(' - [ ] The CHANGELOG includes all relevant, user-facing changes since the last release.')
   body.append(' - [ ] There are no unexpected commits being merged into the ' + target_branch + ' branch.')
   body.append(' - [ ] The docs team is aware of any documentation changes that need to be released.')
-  body.append(' - [ ] The mergeback PR is merged back into ' + source_branch + ' after this PR is merged.')
+  if include_mergeback_in_changelog:
+    body.append(' - [ ] The mergeback PR is merged back into ' + source_branch + ' after this PR is merged.')
 
   title = 'Merge ' + source_branch + ' into ' + target_branch
 
@@ -271,7 +272,8 @@ def main():
     new_branch_name,
     source_branch=args.source_branch,
     target_branch=args.target_branch,
-    conductor=args.conductor
+    conductor=args.conductor,
+    include_mergeback_in_changelog=not args.perform_v2_to_v1_backport
   )
 
 if __name__ == '__main__':

From 0b037b4fcbb60321c82fecc61d4046448a11c7cb Mon Sep 17 00:00:00 2001
From: Henry Mercer <henrymercer@github.com>
Date: Wed, 23 Mar 2022 15:14:15 +0000
Subject: [PATCH 13/20] Add merging the v1 release PR to the checklist

---
 .github/update-release-branch.py | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/.github/update-release-branch.py b/.github/update-release-branch.py
index 2454fad758..18aadb3772 100644
--- a/.github/update-release-branch.py
+++ b/.github/update-release-branch.py
@@ -30,7 +30,7 @@ def branch_exists_on_remote(branch_name):
   return run_git('ls-remote', '--heads', ORIGIN, branch_name).strip() != ''
 
 # Opens a PR from the given branch to the release branch
-def open_pr(repo, all_commits, short_main_sha, new_branch_name, source_branch, target_branch, conductor, include_mergeback_in_changelog):
+def open_pr(repo, all_commits, short_main_sha, new_branch_name, source_branch, target_branch, conductor, is_v2_to_v1_backport):
   # Sort the commits into the pull requests that introduced them,
   # and any commits that don't have a pull request
   pull_requests = []
@@ -79,8 +79,9 @@ def open_pr(repo, all_commits, short_main_sha, new_branch_name, source_branch, t
   body.append(' - [ ] The CHANGELOG includes all relevant, user-facing changes since the last release.')
   body.append(' - [ ] There are no unexpected commits being merged into the ' + target_branch + ' branch.')
   body.append(' - [ ] The docs team is aware of any documentation changes that need to be released.')
-  if include_mergeback_in_changelog:
+  if not is_v2_to_v1_backport:
     body.append(' - [ ] The mergeback PR is merged back into ' + source_branch + ' after this PR is merged.')
+    body.append(' - [ ] The v1 release PR is merged after this PR is merged.')
 
   title = 'Merge ' + source_branch + ' into ' + target_branch
 
@@ -273,7 +274,7 @@ def main():
     source_branch=args.source_branch,
     target_branch=args.target_branch,
     conductor=args.conductor,
-    include_mergeback_in_changelog=not args.perform_v2_to_v1_backport
+    is_v2_to_v1_backport=args.perform_v2_to_v1_backport
   )
 
 if __name__ == '__main__':

From f143182488a85b7d83897409743fe6721e9b9466 Mon Sep 17 00:00:00 2001
From: Henry Mercer <henrymercer@github.com>
Date: Wed, 23 Mar 2022 18:06:12 +0000
Subject: [PATCH 14/20] Add "Update dependencies" label to v1 release PR

---
 .github/update-release-branch.py | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/update-release-branch.py b/.github/update-release-branch.py
index 18aadb3772..351ce8bcf3 100644
--- a/.github/update-release-branch.py
+++ b/.github/update-release-branch.py
@@ -30,7 +30,7 @@ def branch_exists_on_remote(branch_name):
   return run_git('ls-remote', '--heads', ORIGIN, branch_name).strip() != ''
 
 # Opens a PR from the given branch to the release branch
-def open_pr(repo, all_commits, short_main_sha, new_branch_name, source_branch, target_branch, conductor, is_v2_to_v1_backport):
+def open_pr(repo, all_commits, short_main_sha, new_branch_name, source_branch, target_branch, conductor, is_v2_to_v1_backport, labels):
   # Sort the commits into the pull requests that introduced them,
   # and any commits that don't have a pull request
   pull_requests = []
@@ -89,6 +89,7 @@ def open_pr(repo, all_commits, short_main_sha, new_branch_name, source_branch, t
   # PR checks won't be triggered on PRs created by Actions. Therefore mark the PR as draft so that
   # a maintainer can take the PR out of draft, thereby triggering the PR checks.
   pr = repo.create_pull(title=title, body='\n'.join(body), head=new_branch_name, base=target_branch, draft=True)
+  pr.add_to_labels(*labels)
   print('Created PR #' + str(pr.number))
 
   # Assign the conductor
@@ -274,7 +275,8 @@ def main():
     source_branch=args.source_branch,
     target_branch=args.target_branch,
     conductor=args.conductor,
-    is_v2_to_v1_backport=args.perform_v2_to_v1_backport
+    is_v2_to_v1_backport=args.perform_v2_to_v1_backport,
+    labels=['Update dependencies'] if args.perform_v2_to_v1_backport else [],
   )
 
 if __name__ == '__main__':

From 33599909af7f1edb8b9a81d71debe89c4a9ad46a Mon Sep 17 00:00:00 2001
From: Henry Mercer <henrymercer@github.com>
Date: Wed, 23 Mar 2022 17:59:41 +0000
Subject: [PATCH 15/20] Avoid conflicts by reverting 1.x version num commit
 from last v1 release

---
 .github/update-release-branch.py | 41 ++++++++++++++++++++++++++++----
 1 file changed, 36 insertions(+), 5 deletions(-)

diff --git a/.github/update-release-branch.py b/.github/update-release-branch.py
index 351ce8bcf3..1de2bb18e0 100644
--- a/.github/update-release-branch.py
+++ b/.github/update-release-branch.py
@@ -239,24 +239,55 @@ def main():
 
   # Create the new branch and push it to the remote
   print('Creating branch ' + new_branch_name)
-  run_git('checkout', '-b', new_branch_name, ORIGIN + '/' + args.source_branch)
 
   if args.perform_v2_to_v1_backport:
+    # If we're performing a backport, start from the v1 branch
+    print(f'Creating {new_branch_name} from the {ORIGIN}/v1 branch')
+    run_git('checkout', '-b', new_branch_name, f'{ORIGIN}/v1')
+
+    # Revert the commit that we made as part of the last release that updated the version number and
+    # changelog to refer to 1.x.x variants. This avoids merge conflicts in the changelog and
+    # package.json files when we merge in the v2 branch.
+    # This commit will not exist the first time we release the v1 branch from the v2 branch, so we
+    # use `git log --grep` to conditionally revert the commit.
+    print('Reverting the 1.x.x version number and changelog updates from the last release to avoid conflicts')
+    v1_update_commits = run_git('log', '--grep', '^Update version and changelog for v', '--format=%H').split()
+
+    if len(v1_update_commits) > 0:
+      print(f'  Reverting {v1_update_commits[0]}')
+      # Only revert the newest commit as older ones will already have been reverted in previous
+      # releases.
+      run_git('revert', v1_update_commits[0], '--no-edit')
+
+      # Also revert the "Update checked-in dependencies" commit created by Actions.
+      update_dependencies_commit = run_git('log', '--grep', '^Update checked-in dependencies', '--format=%H').split()[0]
+      print(f'  Reverting {update_dependencies_commit}')
+      run_git('revert', update_dependencies_commit, '--no-edit')
+
+    else:
+      print('  Nothing to revert.')
+
+    print(f'Merging {ORIGIN}/{args.source_branch} into the release prep branch')
+    run_git('merge', f'{ORIGIN}/{args.source_branch}', '--no-edit')
+
     # Migrate the package version number from a v2 version number to a v1 version number
     print(f'Setting version number to {version}')
     subprocess.run(['npm', 'version', version, '--no-git-tag-version'])
-    run_git('reset', 'HEAD~1')
     run_git('add', 'package.json', 'package-lock.json')
 
     # Migrate the changelog notes from v2 version numbers to v1 version numbers
     print('Migrating changelog notes from v2 to v1')
-    subprocess.run(['sed', '-i', 's/## 2./## 1./g', 'CHANGELOG.md'])
+    subprocess.run(['sed', '-i', 's/## 2\./## 1\./g', 'CHANGELOG.md'])
 
     # Amend the commit generated by `npm version` to update the CHANGELOG
     run_git('add', 'CHANGELOG.md')
-    run_git('commit', '--amend', '-m', f'Update version and changelog for v{version}')
+    run_git('commit', '-m', f'Update version and changelog for v{version}')
   else:
-    # We don't need to do this for a v1 release, since the changelog has already been updated in the v2 branch.
+    # If we're performing a standard release, there won't be any new commits on the target branch,
+    # as these will have already been merged back into the source branch. Therefore we can just
+    # start from the source branch.
+    run_git('checkout', '-b', new_branch_name, f'{ORIGIN}/{args.source_branch}')
+
     print('Updating changelog')
     update_changelog(version)
 

From da7944b1654f45f347b4222e255c7955ccc80303 Mon Sep 17 00:00:00 2001
From: Henry Mercer <henrymercer@github.com>
Date: Thu, 24 Mar 2022 15:41:49 +0000
Subject: [PATCH 16/20] Update release process doc

---
 CONTRIBUTING.md | 20 +++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 54f597b9b2..5a1e6c1c0f 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -61,16 +61,22 @@ Here are a few things you can do that will increase the likelihood of your pull
 ## Releasing (write access required)
 
 1. The first step of releasing a new version of the `codeql-action` is running the "Update release branch" workflow.
-    This workflow goes through the pull requests that have been merged to `main` since the last release, creates a changelog, then opens a pull request to merge the changes since the last release into the `v1` release branch.
+    This workflow goes through the pull requests that have been merged to `main` since the last release, creates a changelog, then opens a pull request to merge the changes since the last release into the `v2` release branch.
 
-    A release is automatically started every Monday via a scheduled run of this workflow, however you can start a release manually by triggering a run via [workflow dispatch](https://github.com/github/codeql-action/actions/workflows/update-release-branch.yml).
-1. The workflow run will open a pull request titled "Merge main into v1". Mark the pull request as [ready for review](https://docs.github.com/en/github/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review) to trigger the PR checks.
+    You can start a release by triggering this workflow via [workflow dispatch](https://github.com/github/codeql-action/actions/workflows/update-release-branch.yml).
+1. The workflow run will open a pull request titled "Merge main into v2". Mark the pull request as [ready for review](https://docs.github.com/en/github/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review) to trigger the PR checks.
 1. Review the checklist items in the pull request description.
-    Once you've checked off all but the last of these, approve the PR and automerge it.
-1. When the "Merge main into v1" pull request is merged into the `v1` branch, the "Tag release and merge back" workflow will create a mergeback PR.
-    This mergeback incorporates the changelog updates into `main`, tags the release using the merge commit of the "Merge main into v1" pull request, and bumps the patch version of the CodeQL Action.
+    Once you've checked off all but the last two of these, approve the PR and automerge it.
+1. When the "Merge main into v2" pull request is merged into the `v2` branch, the "Tag release and merge back" workflow will create a mergeback PR.
+    This mergeback incorporates the changelog updates into `main`, tags the release using the merge commit of the "Merge main into v2" pull request, and bumps the patch version of the CodeQL Action.
 
-    Approve the mergeback PR and automerge it. Once the mergeback has been merged into main, the release is complete.
+    Approve the mergeback PR and automerge it.
+1. When the "Merge main into v2" pull request is merged into the `v2` branch, the "Update release branch" workflow will create a "Merge v2 into v1" pull request to merge the changes since the last release into the `v1` release branch.
+    This ensures we keep both the `v1` and `v2` release branches up to date and fully supported.
+
+    Review the checklist items in the pull request description.
+    Once you've checked off all the items, approve the PR and automerge it.
+1. Once the mergeback has been merged to `main` and the "Merge v2 into v1" PR has been merged to `v1`, the release is complete.
 
 ## Keeping the PR checks up to date (admin access required)
 

From 9d26fe0cb3eba6d5df21ff3b4f765e3e53c94dac Mon Sep 17 00:00:00 2001
From: Henry Mercer <henrymercer@github.com>
Date: Fri, 25 Mar 2022 12:55:00 +0000
Subject: [PATCH 17/20] Use source branch and target branch names consistently

---
 .github/update-release-branch.py | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/.github/update-release-branch.py b/.github/update-release-branch.py
index 1de2bb18e0..5e1b4f89d8 100644
--- a/.github/update-release-branch.py
+++ b/.github/update-release-branch.py
@@ -29,8 +29,8 @@ def run_git(*args):
 def branch_exists_on_remote(branch_name):
   return run_git('ls-remote', '--heads', ORIGIN, branch_name).strip() != ''
 
-# Opens a PR from the given branch to the release branch
-def open_pr(repo, all_commits, short_main_sha, new_branch_name, source_branch, target_branch, conductor, is_v2_to_v1_backport, labels):
+# Opens a PR from the given branch to the target branch
+def open_pr(repo, all_commits, source_branch_short_sha, new_branch_name, source_branch, target_branch, conductor, is_v2_to_v1_backport, labels):
   # Sort the commits into the pull requests that introduced them,
   # and any commits that don't have a pull request
   pull_requests = []
@@ -52,7 +52,7 @@ def open_pr(repo, all_commits, short_main_sha, new_branch_name, source_branch, t
 
   # Start constructing the body text
   body = []
-  body.append('Merging ' + short_main_sha + ' into ' + target_branch)
+  body.append('Merging ' + source_branch_short_sha + ' into ' + target_branch)
 
   body.append('')
   body.append('Conductor for this PR is @' + conductor)
@@ -96,10 +96,10 @@ def open_pr(repo, all_commits, short_main_sha, new_branch_name, source_branch, t
   pr.add_to_assignees(conductor)
   print('Assigned PR to ' + conductor)
 
-# Gets a list of the SHAs of all commits that have happened on main
-# since the release branched off.
-# This will not include any commits that exist on the release branch
-# that aren't on main.
+# Gets a list of the SHAs of all commits that have happened on the source branch
+# since the last release to the target branch.
+# This will not include any commits that exist on the target branch
+# that aren't on the source branch.
 def get_commit_difference(repo, source_branch, target_branch):
   # Passing split nothing means that the empty string splits to nothing: compare `''.split() == []`
   # to `''.split('\n') == ['']`.
@@ -123,7 +123,7 @@ def get_truncated_commit_message(commit):
   else:
     return message
 
-# Converts a commit into the PR that introduced it to the main branch.
+# Converts a commit into the PR that introduced it to the source branch.
 # Returns the PR object, or None if no PR could be found.
 def get_pr_for_commit(repo, commit):
   prs = commit.get_pulls()
@@ -216,8 +216,8 @@ def main():
 
   # Print what we intend to go
   print('Considering difference between ' + args.source_branch + ' and ' + args.target_branch)
-  short_main_sha = run_git('rev-parse', '--short', ORIGIN + '/' + args.source_branch).strip()
-  print('Current head of ' + args.source_branch + ' is ' + short_main_sha)
+  source_branch_short_sha = run_git('rev-parse', '--short', ORIGIN + '/' + args.source_branch).strip()
+  print('Current head of ' + args.source_branch + ' is ' + source_branch_short_sha)
 
   # See if there are any commits to merge in
   commits = get_commit_difference(repo=repo, source_branch=args.source_branch, target_branch=args.target_branch)
@@ -228,7 +228,7 @@ def main():
   # The branch name is based off of the name of branch being merged into
   # and the SHA of the branch being merged from. Thus if the branch already
   # exists we can assume we don't need to recreate it.
-  new_branch_name = 'update-v' + version + '-' + short_main_sha
+  new_branch_name = 'update-v' + version + '-' + source_branch_short_sha
   print('Branch name is ' + new_branch_name)
 
   # Check if the branch already exists. If so we can abort as this script
@@ -301,7 +301,7 @@ def main():
   open_pr(
     repo,
     commits,
-    short_main_sha,
+    source_branch_short_sha,
     new_branch_name,
     source_branch=args.source_branch,
     target_branch=args.target_branch,

From bed132dae4be4309f653e46b1523f45ef4045219 Mon Sep 17 00:00:00 2001
From: Henry Mercer <henrymercer@github.com>
Date: Fri, 25 Mar 2022 13:40:41 +0000
Subject: [PATCH 18/20] Use a more restrictive `sed` pattern

---
 .github/update-release-branch.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/update-release-branch.py b/.github/update-release-branch.py
index 5e1b4f89d8..22ac4d4d21 100644
--- a/.github/update-release-branch.py
+++ b/.github/update-release-branch.py
@@ -277,7 +277,7 @@ def main():
 
     # Migrate the changelog notes from v2 version numbers to v1 version numbers
     print('Migrating changelog notes from v2 to v1')
-    subprocess.run(['sed', '-i', 's/## 2\./## 1\./g', 'CHANGELOG.md'])
+    subprocess.run(['sed', '-i', 's/^## 2\./## 1./g', 'CHANGELOG.md'])
 
     # Amend the commit generated by `npm version` to update the CHANGELOG
     run_git('add', 'CHANGELOG.md')

From d0bd80897cc2d55a455a7d86d0c81f7056064b79 Mon Sep 17 00:00:00 2001
From: Henry Mercer <henrymercer@github.com>
Date: Fri, 25 Mar 2022 15:17:17 +0000
Subject: [PATCH 19/20] Expose a more restrictive interface to the release
 script

Give the release script modes rather
than source and target branches
---
 .github/update-release-branch.py            | 64 +++++++++++----------
 .github/workflows/update-release-branch.yml |  9 +--
 2 files changed, 38 insertions(+), 35 deletions(-)

diff --git a/.github/update-release-branch.py b/.github/update-release-branch.py
index 22ac4d4d21..9e9a6af27a 100644
--- a/.github/update-release-branch.py
+++ b/.github/update-release-branch.py
@@ -13,6 +13,12 @@
 
 """
 
+# Value of the mode flag for a v1 release
+V1_MODE = 'v1-release'
+
+# Value of the mode flag for a v2 release
+V2_MODE = 'v2-release'
+
 # Name of the remote
 ORIGIN = 'origin'
 
@@ -30,7 +36,7 @@ def branch_exists_on_remote(branch_name):
   return run_git('ls-remote', '--heads', ORIGIN, branch_name).strip() != ''
 
 # Opens a PR from the given branch to the target branch
-def open_pr(repo, all_commits, source_branch_short_sha, new_branch_name, source_branch, target_branch, conductor, is_v2_to_v1_backport, labels):
+def open_pr(repo, all_commits, source_branch_short_sha, new_branch_name, source_branch, target_branch, conductor, is_v2_release, labels):
   # Sort the commits into the pull requests that introduced them,
   # and any commits that don't have a pull request
   pull_requests = []
@@ -79,7 +85,7 @@ def open_pr(repo, all_commits, source_branch_short_sha, new_branch_name, source_
   body.append(' - [ ] The CHANGELOG includes all relevant, user-facing changes since the last release.')
   body.append(' - [ ] There are no unexpected commits being merged into the ' + target_branch + ' branch.')
   body.append(' - [ ] The docs team is aware of any documentation changes that need to be released.')
-  if not is_v2_to_v1_backport:
+  if is_v2_release:
     body.append(' - [ ] The mergeback PR is merged back into ' + source_branch + ' after this PR is merged.')
     body.append(' - [ ] The v1 release PR is merged after this PR is merged.')
 
@@ -181,16 +187,12 @@ def main():
     help='The nwo of the repository, for example github/codeql-action.'
   )
   parser.add_argument(
-    '--source-branch',
-    type=str,
-    required=True,
-    help='The branch being merged from, typically "main" for a v2 release or "v2" for a v1 release.'
-  )
-  parser.add_argument(
-    '--target-branch',
+    '--mode',
     type=str,
     required=True,
-    help='The branch being merged into, typically "v2" for a v2 release or "v1" for a v1 release.'
+    choices=[V2_MODE, V1_MODE],
+    help=f"Which release to perform. '{V2_MODE}' uses main as the source branch and v2 as the target branch. " +
+      f"'{V1_MODE}' uses v2 as the source branch and v1 as the target branch."
   )
   parser.add_argument(
     '--conductor',
@@ -198,31 +200,35 @@ def main():
     required=True,
     help='The GitHub handle of the person who is conducting the release process.'
   )
-  parser.add_argument(
-    '--perform-v2-to-v1-backport',
-    action='store_true',
-    help='Pass this flag if this release is a backport from v2 to v1.'
-  )
 
   args = parser.parse_args()
 
+  if args.mode == V2_MODE:
+    source_branch = 'main'
+    target_branch = 'v2'
+  elif args.mode == V1_MODE:
+    source_branch = 'v2'
+    target_branch = 'v1'
+  else:
+    raise ValueError(f"Unexpected value for release mode: '{args.mode}'")
+
   repo = Github(args.github_token).get_repo(args.repository_nwo)
   version = get_current_version()
 
-  if args.perform_v2_to_v1_backport:
+  if args.mode == V1_MODE:
     # Change the version number to a v1 equivalent
     version = get_current_version()
     version = f'1{version[1:]}'
 
   # Print what we intend to go
-  print('Considering difference between ' + args.source_branch + ' and ' + args.target_branch)
-  source_branch_short_sha = run_git('rev-parse', '--short', ORIGIN + '/' + args.source_branch).strip()
-  print('Current head of ' + args.source_branch + ' is ' + source_branch_short_sha)
+  print('Considering difference between ' + source_branch + ' and ' + target_branch)
+  source_branch_short_sha = run_git('rev-parse', '--short', ORIGIN + '/' + source_branch).strip()
+  print('Current head of ' + source_branch + ' is ' + source_branch_short_sha)
 
   # See if there are any commits to merge in
-  commits = get_commit_difference(repo=repo, source_branch=args.source_branch, target_branch=args.target_branch)
+  commits = get_commit_difference(repo=repo, source_branch=source_branch, target_branch=target_branch)
   if len(commits) == 0:
-    print('No commits to merge from ' + args.source_branch + ' to ' + args.target_branch)
+    print('No commits to merge from ' + source_branch + ' to ' + target_branch)
     return
 
   # The branch name is based off of the name of branch being merged into
@@ -240,7 +246,7 @@ def main():
   # Create the new branch and push it to the remote
   print('Creating branch ' + new_branch_name)
 
-  if args.perform_v2_to_v1_backport:
+  if args.mode == V1_MODE:
     # If we're performing a backport, start from the v1 branch
     print(f'Creating {new_branch_name} from the {ORIGIN}/v1 branch')
     run_git('checkout', '-b', new_branch_name, f'{ORIGIN}/v1')
@@ -267,8 +273,8 @@ def main():
     else:
       print('  Nothing to revert.')
 
-    print(f'Merging {ORIGIN}/{args.source_branch} into the release prep branch')
-    run_git('merge', f'{ORIGIN}/{args.source_branch}', '--no-edit')
+    print(f'Merging {ORIGIN}/{source_branch} into the release prep branch')
+    run_git('merge', f'{ORIGIN}/{source_branch}', '--no-edit')
 
     # Migrate the package version number from a v2 version number to a v1 version number
     print(f'Setting version number to {version}')
@@ -286,7 +292,7 @@ def main():
     # If we're performing a standard release, there won't be any new commits on the target branch,
     # as these will have already been merged back into the source branch. Therefore we can just
     # start from the source branch.
-    run_git('checkout', '-b', new_branch_name, f'{ORIGIN}/{args.source_branch}')
+    run_git('checkout', '-b', new_branch_name, f'{ORIGIN}/{source_branch}')
 
     print('Updating changelog')
     update_changelog(version)
@@ -303,11 +309,11 @@ def main():
     commits,
     source_branch_short_sha,
     new_branch_name,
-    source_branch=args.source_branch,
-    target_branch=args.target_branch,
+    source_branch=source_branch,
+    target_branch=target_branch,
     conductor=args.conductor,
-    is_v2_to_v1_backport=args.perform_v2_to_v1_backport,
-    labels=['Update dependencies'] if args.perform_v2_to_v1_backport else [],
+    is_v2_release=args.mode == V2_MODE,
+    labels=['Update dependencies'] if args.mode == V1_MODE else [],
   )
 
 if __name__ == '__main__':
diff --git a/.github/workflows/update-release-branch.yml b/.github/workflows/update-release-branch.yml
index 93a3437608..fbc35f4cb6 100644
--- a/.github/workflows/update-release-branch.yml
+++ b/.github/workflows/update-release-branch.yml
@@ -49,8 +49,7 @@ jobs:
         python .github/update-release-branch.py \
           --github-token ${{ secrets.GITHUB_TOKEN }} \
           --repository-nwo ${{ github.repository }} \
-          --source-branch main \
-          --target-branch v2 \
+          --mode release-v2 \
           --conductor ${GITHUB_ACTOR}
 
     - name: Update v1 release branch
@@ -59,7 +58,5 @@ jobs:
         python .github/update-release-branch.py \
           --github-token ${{ secrets.GITHUB_TOKEN }} \
           --repository-nwo ${{ github.repository }} \
-          --source-branch v2 \
-          --target-branch v1 \
-          --conductor ${GITHUB_ACTOR} \
-          --perform-v2-to-v1-backport
+          --mode release-v1 \
+          --conductor ${GITHUB_ACTOR}

From 044f112dc1429b4015a118022d12cd42cdf7b6b6 Mon Sep 17 00:00:00 2001
From: Henry Mercer <henrymercer@github.com>
Date: Fri, 25 Mar 2022 15:24:54 +0000
Subject: [PATCH 20/20] Update branch protection instructions

---
 CONTRIBUTING.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 5a1e6c1c0f..d9cb6ce2aa 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -91,12 +91,12 @@ To regenerate the PR jobs for the action:
     CHECKS="$(gh api repos/github/codeql-action/commits/${SHA}/check-runs --paginate | jq --slurp --compact-output --raw-output '[.[].check_runs | .[].name | select(contains("https://") or . == "CodeQL" or . == "LGTM.com" or . == "Update dependencies" or . == "Update Supported Enterprise Server Versions" | not)]')"
     echo "{\"contexts\": ${CHECKS}}" > checks.json
     gh api -X "PATCH" repos/github/codeql-action/branches/main/protection/required_status_checks --input checks.json
+    gh api -X "PATCH" repos/github/codeql-action/branches/v2/protection/required_status_checks --input checks.json
     gh api -X "PATCH" repos/github/codeql-action/branches/v1/protection/required_status_checks --input checks.json
     ````
 
 2. Go to the [branch protection rules settings page](https://github.com/github/codeql-action/settings/branches) and validate that the rules have been updated.
 
-
 ## Resources
 
 - [How to Contribute to Open Source](https://opensource.guide/how-to-contribute/)