Skip to content

Support CodeQL versions, ranges, release offsets, and nightly transitions #4079

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
felickz wants to merge 10 commits into
base: main
Choose a base branch
from
Draft

Support CodeQL versions, ranges, release offsets, and nightly transitions #4079

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
8c514cb
Support bare CodeQL CLI version numbers in the tools input
Copilot Aug 4, 2026
16c4f3e
Add latest-N offset and semver range support for tools input
Copilot Aug 5, 2026
eccc888
Clarify tools input resolution order and add URL disambiguation tests
Copilot Aug 5, 2026
18e73d3
Include available version range in latest-N/semver-range error messages
Copilot Aug 5, 2026
ada6eaf
Add latest-prerelease and nightly-until<version> tools input forms
Copilot Aug 5, 2026
06da642
Require a separator before the version in nightly-until forms; fix pr…
Copilot Aug 5, 2026
8f22549
Fix GHES multi-host resolution bug in getSortedCliVersions
Copilot Aug 5, 2026
71844e5
Replace nightly-until-stable-<version> with nightly-until-default-<ve…
Copilot Aug 5, 2026
9892b52
Add tests for nightly-until-default overlay-aware and GHES override s…
Copilot Aug 5, 2026
5ede042
Merge pull request #2 from forks-felickz/copilot/add-version-support-…
felickz Aug 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,10 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th

## [UNRELEASED]

No user facing changes.
- The `tools` input for the `init` and `setup-codeql` Actions now accepts a bare CodeQL CLI version number, for example `2.19.0` or `v2.19.0`. The Action will automatically download the CodeQL Bundle release asset that matches the runner's operating system and architecture, preferring the smaller `zstd`-compressed bundle where it is supported.
- The `tools` input also now accepts a CodeQL CLI version range, for example `2.24.x`, `2.x`, `~2.24.0`, or `^2.24.0`, as well as `latest-<N>` (for example `latest-1`), which resolves to the CodeQL Bundle release `N` stable releases before the most recent one.
- The `tools` input also now accepts `latest-prerelease`, which resolves to the most recent CodeQL Bundle release, whether it is a stable release or a GitHub prerelease, as well as `nightly-until-<version>` (for example `nightly-until-2.24.0`), which resolves to the most recent CodeQL Bundle release satisfying that version threshold, considering GitHub prereleases too, or falls back to the latest nightly version of the CodeQL tools if no such release exists.
- The `tools` input also now accepts `nightly-until-default-<version>` (for example `nightly-until-default-2.24.0`), which uses the default CodeQL CLI version for this environment if it satisfies that version threshold, or falls back to the latest nightly version of the CodeQL tools otherwise.
Comment on lines +7 to +10

@mbg mbg Aug 11, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is probably an excessive amount of release notes for this group of changes, especially given that we would not expect most people to use any of this. Consider condensing it to just something like

Suggested change
- The `tools` input for the `init` and `setup-codeql` Actions now accepts a bare CodeQL CLI version number, for example `2.19.0` or `v2.19.0`. The Action will automatically download the CodeQL Bundle release asset that matches the runner's operating system and architecture, preferring the smaller `zstd`-compressed bundle where it is supported.
- The `tools` input also now accepts a CodeQL CLI version range, for example `2.24.x`, `2.x`, `~2.24.0`, or `^2.24.0`, as well as `latest-<N>` (for example `latest-1`), which resolves to the CodeQL Bundle release `N` stable releases before the most recent one.
- The `tools` input also now accepts `latest-prerelease`, which resolves to the most recent CodeQL Bundle release, whether it is a stable release or a GitHub prerelease, as well as `nightly-until-<version>` (for example `nightly-until-2.24.0`), which resolves to the most recent CodeQL Bundle release satisfying that version threshold, considering GitHub prereleases too, or falls back to the latest nightly version of the CodeQL tools if no such release exists.
- The `tools` input also now accepts `nightly-until-default-<version>` (for example `nightly-until-default-2.24.0`), which uses the default CodeQL CLI version for this environment if it satisfies that version threshold, or falls back to the latest nightly version of the CodeQL tools otherwise.
- The `tools` input for the `init` and `setup-codeql` Actions now accepts additional input formats. See the respective Action specifications for more details. [#4079](https://github.com/github/codeql-action/pull/4079)


## 4.37.6 - 04 Aug 2026

Expand Down
18 changes: 18 additions & 0 deletions init/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,24 @@ inputs:

- A local path to a CodeQL Bundle tarball, or
- The URL of a CodeQL Bundle tarball GitHub release asset, or
- A CodeQL CLI version number, for example `2.19.0` or `v2.19.0`, in which case the CodeQL
Bundle containing that version will be downloaded, selecting the archive format and
release asset that matches the runner's operating system and architecture, or
- A CodeQL CLI version range, for example `2.24.x`, `2.x`, `~2.24.0`, or `^2.24.0`, in
which case the most recent stable CodeQL Bundle release satisfying that range will be
downloaded, or
- `latest-<N>`, for example `latest-1` or `LATEST-2` (matching is case insensitive), which
uses the CodeQL Bundle release `N` stable releases before the most recent one, or
- A special value `latest-prerelease` (matching is case insensitive) which uses the most
recent CodeQL Bundle release, whether it is a stable release or a GitHub prerelease, or
- `nightly-until-<version>`, for example `nightly-until-2.24.0` or
`NIGHTLY-UNTIL-2.24.0` (matching is case insensitive), which uses the most recent CodeQL
Bundle release satisfying that version threshold, considering GitHub prereleases too, or
falls back to the latest nightly version of the CodeQL tools if no such release exists, or
- `nightly-until-default-<version>`, for example `nightly-until-default-2.24.0` (matching
is case insensitive), which uses the default CodeQL CLI version if it satisfies that
version threshold, or falls back to the latest nightly version of the CodeQL tools
otherwise, or
Comment on lines +13 to +30

@mbg mbg Aug 11, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Currently, we (deliberately) don't document all existing inputs here because they generally cause more harm than good when used incorrectly. We should think carefully about which formats are worth documenting here once we have agreed on all the formats.

- A special value `linked` which uses the version of the CodeQL tools
that the Action has been bundled with.
- A special value `nightly` which uses the latest nightly version of the
Expand Down
Loading
Loading