release: v4.6.0

[123sarahj123]

What's Changed

🔒 Security

• Stop running Git hooks from shared mirrors when git-mirrors-path is set, so anyone who can write to a mirror can't run code in the next job that updates it. Hooks put in a mirror on purpose no longer run by @isaacsu in [A-2032] Stop running hooks from shared git mirrors when updating them #4501

✨ Added

Job errors are an experimental feature that's only enabled for Buildkite's own pipelines. It isn't available to other organizations, and it may change or be removed.

• Report failed local Git commands in the default checkout as job errors when a step sets BUILDKITE_CAPTURE_GIT_ERRORS: "true" by @pinzonjulian in Report failed local Git commands as job errors #4486
• Report failed Git fetches and clones as job errors, with codes for missing refs, rejected credentials and network failures by @pinzonjulian in Report failed Git fetches and clones as job errors #4487
• Report checkout failures outside Git commands as job errors, such as checkout and lock timeouts, invalid refs and a missing git-lfs by @pinzonjulian in Report checkout-phase failures as job errors #4488
• Add the experimental BUILDKITE_CAPTURE_AGENT_ERRORS opt-in for reporting failures the agent observes as job errors, and warn when the experimental buildkite-agent job capture-error is given a code starting with the reserved buildkite. prefix by @pinzonjulian in Add opt-in capture for agent-observed job failures #4464
• Report failed hooks as job errors, with the end of their output by @pinzonjulian in Report failed hooks with their output as job errors #4469
• Report failed commands as job errors, with the end of their output by @pinzonjulian in Report failed commands with their output as job errors #4470
• Report secret and plugin failures as job errors by @pinzonjulian in Report secret and plugin failures as job errors #4471
• Report failed pipeline uploads, secret and OIDC token requests, and Git credential lookups as job errors by @pinzonjulian in Report failed pipeline uploads, secret and OIDC requests, and Git credentials as job errors #4472
• Report failed artifact uploads and downloads, and cache saves and restores, as job errors by @pinzonjulian in Report failed artifact and cache transfers as job errors #4473
• Report why the agent refused a job as a job error, such as a signature that doesn't verify or a value an allowlist refuses, and report Kubernetes containers that never connect or are lost by @pinzonjulian in Report why the agent refused a job as job errors #4474

🐛 Fixed

• Correct the --cancel-cleanup-timeout help text: it gives a stopping agent time to upload the job log, not artifacts by @scadu in Fix cancel-cleanup-timeout help text #4514

🔧 Changed

• Stop sending experimental buildkite-agent job capture-error reports for a job once Buildkite refuses one because the job's error quota is full or error capture isn't available by @123sarahj123 in Stop forwarding captured job errors once the API refuses them #4497

🏠 Internal

• Treat breaking experimental surface as a minor release change by @moskyb in Treat breaking experimental surface as a minor release change #4517

Full Changelog: v4.5.0...v4.6.0

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-16T01:29:37.310948Z	5cd0715	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5cd071571a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[bk-docsbot]

🤖 Docs Draft Bot: I've created a draft documentation PR based on this change:

📝 Docs PR: https://github.com/buildkite/docs-private/pull/2471

Please review the draft and make any necessary adjustments.