Update Node.js version and enhance workflow configuration

.github/dependabot.yml

@@ -0,0 +1,27 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    target-branch: dev
+    schedule:
+      interval: weekly
+      day: monday
+    labels:
+      - dependencies
+      - npm
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+
+  - package-ecosystem: github-actions
+    directory: /
+    target-branch: dev
+    schedule:
+      interval: weekly
+      day: monday
+    labels:
+      - dependencies
+      - github-actions
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]

.github/workflows/ci_dependabot_automerge.yml

@@ -0,0 +1,32 @@
+---
+name: ci_dependabot_automerge
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  automerge:
+    runs-on: ubuntu-latest
+    if: github.actor == 'dependabot[bot]'
+    steps:
+      - name: Fetch Dependabot metadata
+        id: meta
+        uses: dependabot/fetch-metadata@v3
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Approve and enable auto-merge for minor and patch updates
+        if: >-
+          steps.meta.outputs.update-type == 'version-update:semver-minor' ||
+          steps.meta.outputs.update-type == 'version-update:semver-patch'
+        run: |
+          gh pr review --approve "$PR_URL"
+          gh pr merge --auto --squash "$PR_URL"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_URL: ${{ github.event.pull_request.html_url }}

.github/workflows/main.yml

@@ -5,25 +5,40 @@ on:
   push:
     branches:
       - master
+      - dev
+      - main
       - release/*
   schedule:
     - cron: '0 6 * * *'
 
 jobs:
   test:
-    name: default
-    runs-on: windows-latest
+    name: default (${{ matrix.runner }}, VS ${{ matrix.vsversion }})
+    runs-on: ${{ matrix.runner }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: windows-2022
+            vsversion: "2022"
+            supports_arm32: true
+          - runner: windows-2025
+            vsversion: "2026"
+            supports_arm32: false
     steps:
       - name: Check out source code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Download Internet
         run: npm install
       - name: Run eslint
         run: npm run lint
+      - name: Run unit tests
+        run: npm test
       - name: Enable Developer Command Prompt (amd64)
         uses: ./
         with:
           arch: amd64
+          vsversion: ${{ matrix.vsversion }}
       - name: Compile and run some C code (amd64)
         shell: cmd
         run: |
@@ -33,50 +48,64 @@ jobs:
         uses: ./
         with:
           arch: amd64_x86
+          vsversion: ${{ matrix.vsversion }}
       - name: Compile and run some C code (x86)
         shell: cmd
         run: |
           cl.exe hello.c
           hello.exe
       - name: Enable Developer Command Prompt (amd64_arm)
+        if: matrix.supports_arm32
         uses: ./
         with:
           arch: amd64_arm
+          vsversion: ${{ matrix.vsversion }}
       - name: Compile some C code (arm)
+        if: matrix.supports_arm32
         shell: cmd
         run: |
-          cl.exe hello.c
-          dumpbin /headers hello.exe
+          cl.exe /c hello.c
+          dumpbin /headers hello.obj
       - name: Enable Developer Command Prompt (amd64_arm64)
         uses: ./
         with:
           arch: amd64_arm64
+          vsversion: ${{ matrix.vsversion }}
       - name: Compile some C code (arm64)
         shell: cmd
         run: |
-          cl.exe hello.c
-          dumpbin /headers hello.exe
+          cl.exe /c hello.c
+          dumpbin /headers hello.obj
   audit:
     name: npm audit
     runs-on: ubuntu-latest
     steps:
       - name: Check out source code
-        uses: actions/checkout@v4
-      - run: npm install
-      - run: npm audit --audit-level=moderate --production
+        uses: actions/checkout@v6
+      - run: npm ci
+      - run: npm audit --audit-level=moderate --omit=dev
       - run: npm audit --audit-level=critical
   alias-arch:
-    name: arch aliases
-    runs-on: windows-latest
+    name: arch aliases (${{ matrix.runner }}, VS ${{ matrix.vsversion }})
+    runs-on: ${{ matrix.runner }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: windows-2022
+            vsversion: "2022"
+          - runner: windows-2025
+            vsversion: "2026"
     steps:
       - name: Check out source code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Download Internet
         run: npm install
       - name: Enable Developer Command Prompt
         uses: ./
         with:
           arch: Win32
+          vsversion: ${{ matrix.vsversion }}
       - name: Compile and run some C code
         shell: cmd
         run: |

.github/workflows/release-please.yml

@@ -0,0 +1,53 @@
+name: release-please
+
+on:
+  push:
+    branches:
+      - dev
+
+concurrency:
+  group: release-please-${{ github.ref }}
+  cancel-in-progress: false
+
+permissions:
+  contents: write
+  pull-requests: write
+  issues: write
+
+jobs:
+  release-please:
+    runs-on: ubuntu-latest
+    outputs:
+      release_created: ${{ steps.release.outputs.release_created }}
+      tag_name: ${{ steps.release.outputs.tag_name }}
+    steps:
+      - uses: googleapis/release-please-action@v4
+        id: release
+
+  move-major-tag:
+    name: Move floating major/minor tags
+    needs: release-please
+    if: ${{ needs.release-please.outputs.release_created == 'true' }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Move tags to point at the new release
+        env:
+          TAG: ${{ needs.release-please.outputs.tag_name }}
+        run: |
+          git config user.name github-actions[bot]
+          git config user.email 41898282+github-actions[bot]@users.noreply.github.com
+
+          MAJOR="${TAG%%.*}"
+          MINOR="${TAG%.*}"
+
+          git tag -fa "$MAJOR" -m "Release $TAG" "${TAG}^{}"
+          git tag -fa "$MINOR" -m "Release $TAG" "${TAG}^{}"
+
+          git push origin "refs/tags/$MAJOR" "refs/tags/$MINOR" --force

.github/workflows/release.yml

@@ -12,10 +12,10 @@ jobs:
     name: release
     runs-on: windows-latest
     steps:
-      - name: Setup Developer Command Prompt
-        uses: ilammy/msvc-dev-cmd@release/v1
       - name: Check out source code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
+      - name: Setup Developer Command Prompt
+        uses: ./
       - name: Compile and run some C code
         shell: cmd
         run: |
@@ -26,6 +26,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out source code
-        uses: actions/checkout@v4
-      - run: npm audit --audit-level=moderate --production
+        uses: actions/checkout@v6
+      - run: npm ci
+      - run: npm audit --audit-level=moderate --omit=dev
       - run: npm audit --audit-level=critical

.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "1.0.2"
+}

README.md

@@ -1,9 +1,11 @@
-<a href="https://github.com/ilammy/msvc-dev-cmd"><img alt="GitHub Actions status" src="https://github.com/ilammy/msvc-dev-cmd/workflows/msvc-dev-cmd/badge.svg"></a>
+<a href="https://github.com/vln-devsecops/actions-msvc"><img alt="GitHub Actions status" src="https://github.com/vln-devsecops/actions-msvc/workflows/msvc-dev-cmd/badge.svg"></a>
 
-# msvc-dev-cmd
+# actions-msvc
 
 [GitHub Action](https://github.com/features/actions) for configuring Developer Command Prompt for Microsoft Visual C++.
 
+This repository publishes the action as `vln-devsecops/actions-msvc`, while continuing the upstream `ilammy/msvc-dev-cmd` work.
+
 This sets up the environment for compiling C/C++ code from command line.
 
 Supports Windows. Does nothing on Linux and macOS.
@@ -16,8 +18,8 @@ Basic usage for default compilation settings is like this:
 jobs:
   test:
     steps:
-      - uses: actions/checkout@v4
-      - uses: ilammy/msvc-dev-cmd@v1
+      - uses: actions/checkout@v5
+      - uses: vln-devsecops/actions-msvc@v1
       - name: Build something requiring CL.EXE
         run: |
           cmake -G "NMake Makefiles" .
@@ -41,8 +43,8 @@ jobs:
           - amd64_x86
           - amd64_arm64
     steps:
-      - uses: actions/checkout@v4
-      - uses: ilammy/msvc-dev-cmd@v1
+      - uses: actions/checkout@v5
+      - uses: vln-devsecops/actions-msvc@v1
         with:
           arch: ${{ matrix.arch }}
       - name: Build something requiring CL.EXE
@@ -80,7 +82,7 @@ Using `shell: bash` in Actions may shadow some of the paths added by MSVC.
 In particular, `link.exe` (Microsoft C linker) is prone to be shadowed by `/usr/bin/link` (GNU filesystem link tool).
 
 Unfortunately, this happens because GitHub Actions unconditionally *prepend* GNU paths when `shell: bash` is used,
-on top of any paths set by `msvc-dev-cmd`, every time at the start of each new step.
+on top of any paths set by `vln-devsecops/actions-msvc`, every time at the start of each new step.
 Hence, there aren't many non-destructive options here.
 
 If you experience compilation errors where `link` complains about unreasonable command-line arguments,
@@ -90,7 +92,7 @@ If this is not acceptable, please file an issue, then we'll figure out something
 
 ### Reconfiguration
 
-You can invoke `ilammy/msvc-dev-cmd` multiple times during your jobs with different inputs
+You can invoke `vln-devsecops/actions-msvc` multiple times during your jobs with different inputs
 to reconfigure the environment for building with different settings
 (e.g., to target multiple architectures).
 
@@ -100,21 +102,21 @@ jobs:
     steps:
       # ...
       - name: Configure build for amd64
-        uses: ilammy/msvc-dev-cmd@v1
+        uses: vln-devsecops/actions-msvc@v1
         with:
           arch: amd64
 
       - run: build # (for amd64)
 
       - name: Configure build for x86
-        uses: ilammy/msvc-dev-cmd@v1
+        uses: vln-devsecops/actions-msvc@v1
         with:
           arch: amd64_x86
 
       - run: build # (for x86)
 
       - name: Configure build for ARM64
-        uses: ilammy/msvc-dev-cmd@v1
+        uses: vln-devsecops/actions-msvc@v1
         with:
           arch: amd64_arm64
 

action.yml

@@ -7,16 +7,16 @@ inputs:
   sdk:
     description: Windows SDK number to build for
   spectre:
-    description: Enable Specre mitigations
+    description: Enable Spectre mitigations
   toolset:
     description: VC++ compiler toolset version
   uwp:
     description: Build for Universal Windows Platform
   vsversion:
     description: The Visual Studio version to use. This can be the version number (e.g. 16.0 for 2019) or the year (e.g. "2019").
 runs:
-  using: node20
-  main: index.js
+  using: node24
+  main: dist/index.js
 branding:
   icon: terminal
   color: purple

lib.js

@@ -12,6 +12,7 @@ const EDITIONS = ['Enterprise', 'Professional', 'Community', 'BuildTools']
 const YEARS = ['2022', '2019', '2017']
 
 const VsYearVersion = {
+    '2026': '18.0',
     '2022': '17.0',
     '2019': '16.0',
     '2017': '15.0',
@@ -112,7 +113,7 @@ function isPathVariable(name) {
 
 function filterPathValue(path) {
     let paths = path.split(';')
-    // Remove duplicates by keeping the first occurance and preserving order.
+    // Remove duplicates by keeping the first occurrence and preserving order.
     // This keeps path shadowing working as intended.
     function unique(value, index, self) {
         return self.indexOf(value) === index