release: v4.6.0

[123sarahj123]

What's Changed

🔒 Security

• Stop running Git hooks from shared mirrors when git-mirrors-path is set, so anyone who can write to a mirror can't run code in the next job that updates it. Hooks put in a mirror on purpose no longer run by @isaacsu in [A-2032] Stop running hooks from shared git mirrors when updating them #4501

✨ Added

• Report failed local Git commands in the default checkout as job errors when a step sets BUILDKITE_CAPTURE_GIT_ERRORS: "true" by @pinzonjulian in Report failed local Git commands as job errors #4486
• Report failed Git fetches and clones as job errors, with codes for missing refs, rejected credentials and network failures by @pinzonjulian in Report failed Git fetches and clones as job errors #4487
• Report checkout failures outside Git commands as job errors, such as checkout and lock timeouts, invalid refs and a missing git-lfs by @pinzonjulian in Report checkout-phase failures as job errors #4488
• Add the BUILDKITE_CAPTURE_AGENT_ERRORS opt-in for reporting failures the agent observes as job errors, and warn when buildkite-agent job capture-error is given a code starting with the reserved buildkite. prefix by @pinzonjulian in Add opt-in capture for agent-observed job failures #4464
• Report failed hooks as job errors, with the end of their output by @pinzonjulian in Report failed hooks with their output as job errors #4469
• Report failed commands as job errors, with the end of their output by @pinzonjulian in Report failed commands with their output as job errors #4470
• Report secret and plugin failures as job errors by @pinzonjulian in Report secret and plugin failures as job errors #4471
• Report failed pipeline uploads, secret and OIDC token requests, and Git credential lookups as job errors by @pinzonjulian in Report failed pipeline uploads, secret and OIDC requests, and Git credentials as job errors #4472
• Report failed artifact uploads and downloads, and cache saves and restores, as job errors by @pinzonjulian in Report failed artifact and cache transfers as job errors #4473
• Report why the agent refused a job as a job error, such as a signature that doesn't verify or a value an allowlist refuses by @pinzonjulian in Report why the agent refused a job as job errors #4474

🐛 Fixed

• Correct the --cancel-cleanup-timeout help text: it gives a stopping agent time to upload the job log, not artifacts by @scadu in Fix cancel-cleanup-timeout help text #4514

🔧 Changed

• Stop sending buildkite-agent job capture-error reports for a job once Buildkite refuses one because the job's error quota is full or error capture isn't available by @123sarahj123 in Stop forwarding captured job errors once the API refuses them #4497

🏠 Internal

• Treat breaking experimental surface as a minor release change by @moskyb in Treat breaking experimental surface as a minor release change #4517

Full Changelog: v4.5.0...v4.6.0

[123sarahj123]

Opened by mistake from Isaac's stale release/v4.6.0 branch (from #4519, cut before the job errors stack merged). Replaced by a PR from release/v4.6.0-job-errors.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-16T01:27:57.919372Z	1924152	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.