Merge branch 'main' into dependabot/npm_and_yarn/npm-minor-21ac56865f

.github/workflows/__linux-arm64.yml

@@ -0,0 +1,90 @@
+# Warning: This file is generated automatically, and should not be modified.
+# Instead, please modify the template in the pr-checks directory and run:
+#     pr-checks/sync.sh
+# to regenerate this file.
+
+name: PR Check - Linux Arm64
+env:
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  GO111MODULE: auto
+on:
+  push:
+    branches:
+      - main
+      - releases/v*
+  pull_request: {}
+  merge_group:
+    types:
+      - checks_requested
+  schedule:
+    - cron: '0 5 * * *'
+  workflow_dispatch:
+    inputs:
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
+  workflow_call:
+    inputs:
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
+  group: linux-arm64-${{github.ref}}-${{inputs.go-version}}
+jobs:
+  linux-arm64:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-24.04-arm
+            version: nightly-latest
+    name: Linux Arm64
+    if: github.triggering_actor != 'dependabot[bot]'
+    permissions:
+      contents: read
+      security-events: read
+    timeout-minutes: 45
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version: ${{ inputs.go-version || '>=1.21.0' }}
+          cache: false
+      - name: Prepare test
+        id: prepare-test
+        uses: ./.github/actions/prepare-test
+        with:
+          version: ${{ matrix.version }}
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
+      - uses: ./../action/init
+        with:
+          languages: javascript,python,go
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
+      - name: Build Go code
+        run: go build main.go
+      - uses: ./../action/analyze
+        with:
+          upload-database: false
+      - name: Assert databases exist
+        run: |
+          cd "$RUNNER_TEMP/codeql_databases"
+          for lang in javascript python go; do
+            if [[ ! -d "$lang" ]]; then
+              echo "Did not find a database for $lang"
+              exit 1
+            fi
+          done
+    env:
+      CODEQL_ACTION_TEST_MODE: true

CHANGELOG.md

@@ -4,7 +4,7 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th
 
 ## [UNRELEASED]
 
-No user facing changes.
+- The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and download the native `linux-arm64` CodeQL bundle when available. [#4072](https://github.com/github/codeql-action/pull/4072)
 
 ## 4.37.9 - 26 Aug 2026
 

lib/entry-points.js

@@ -148627,6 +148627,7 @@ var toolrunner3 = __toESM(require_toolrunner());
 // src/cli-errors.ts
 var SUPPORTED_PLATFORMS = [
   ["linux", "x64"],
+  ["linux", "arm64"],
   ["win32", "x64"],
   ["darwin", "x64"],
   ["darwin", "arm64"]
@@ -151813,7 +151814,7 @@ function getCodeQLBundleName(compressionMethod) {
   if (process.platform === "win32") {
     platform2 = "win64";
   } else if (process.platform === "linux") {
-    platform2 = "linux64";
+    platform2 = process.arch === "arm64" ? "linux-arm64" : "linux64";
   } else if (process.platform === "darwin") {
     platform2 = "osx64";
   } else {

pr-checks/checks/linux-arm64.yml

@@ -0,0 +1,30 @@
+name: "Linux Arm64"
+description: "An end-to-end integration test running on a Linux Arm64 runner, checking that the native linux-arm64 CodeQL bundle is downloaded and can analyze interpreted and compiled code"
+operatingSystems:
+  - os: ubuntu
+    runner-image: ubuntu-24.04-arm
+# The native linux-arm64 CodeQL bundle is only available in recent CLI releases, so we restrict this
+# check to `nightly-latest`, which is guaranteed to ship it. Older stable versions do not have an
+# arm64 asset, and `prepare-test` would resolve an x64 bundle URL for them on this runner.
+versions:
+  - nightly-latest
+installGo: true
+steps:
+  - uses: ./../action/init
+    with:
+      languages: javascript,python,go
+      tools: ${{ steps.prepare-test.outputs.tools-url }}
+  - name: Build Go code
+    run: go build main.go
+  - uses: ./../action/analyze
+    with:
+      upload-database: false
+  - name: Assert databases exist
+    run: |
+      cd "$RUNNER_TEMP/codeql_databases"
+      for lang in javascript python go; do
+        if [[ ! -d "$lang" ]]; then
+          echo "Did not find a database for $lang"
+          exit 1
+        fi
+      done

src/cli-errors.test.ts

@@ -128,7 +128,6 @@ test("CliError constructor with empty stderr", (t) => {
 
 for (const [platform, arch] of [
   ["weird_plat", "x64"],
-  ["linux", "arm64"],
   ["win32", "arm64"],
 ]) {
   test.serial(
@@ -157,20 +156,34 @@ for (const [platform, arch] of [
   );
 }
 
-test("wrapCliConfigurationError - supported platform", (t) => {
+for (const [platform, arch] of [
-  const commandError = new CommandInvocationError(
+  ["linux", "x64"],
-    "codeql",
+  ["linux", "arm64"],
-    ["version"],
+  ["win32", "x64"],
-    1,
+  ["darwin", "x64"],
-    "Some error",
+  ["darwin", "arm64"],
+]) {
+  test.serial(
+    `wrapCliConfigurationError - ${platform}/${arch} supported`,
+    (t) => {
+      sinon.stub(process, "platform").value(platform);
+      sinon.stub(process, "arch").value(arch);
+      const commandError = new CommandInvocationError(
+        "codeql",
+        ["version"],
+        1,
+        "Some error",
+      );
+      const cliError = new CliError(commandError);
+
+      const wrappedError = wrapCliConfigurationError(cliError);
+
+      // Should return the original error since the platform is supported, rather
+      // than replacing it with the unsupported-platform ConfigurationError.
+      t.is(wrappedError, cliError);
+    },
   );
-  const cliError = new CliError(commandError);
+}
-
-  const wrappedError = wrapCliConfigurationError(cliError);
-
-  // Should return the original error since platform is supported
-  t.is(wrappedError, cliError);
-});
 
 test("wrapCliConfigurationError - autobuild error", (t) => {
   const commandError = new CommandInvocationError(

src/cli-errors.ts

@@ -8,6 +8,7 @@ import { ConfigurationError } from "./util";
 
 const SUPPORTED_PLATFORMS = [
   ["linux", "x64"],
+  ["linux", "arm64"],
   ["win32", "x64"],
   ["darwin", "x64"],
   ["darwin", "arm64"],

src/setup-codeql.test.ts

@@ -120,24 +120,42 @@ test.serial(
 const LINKED_BUNDLE_TEST_CASES = [
   {
     platform: "linux",
+    arch: "x64",
     tarSupportsZstd: true,
     expectedBundleName: "codeql-bundle-linux64.tar.zst",
     expectedCompressionMethod: "zstd",
   },
+  {
+    platform: "linux",
+    arch: "arm64",
+    tarSupportsZstd: true,
+    expectedBundleName: "codeql-bundle-linux-arm64.tar.zst",
+    expectedCompressionMethod: "zstd",
+  },
   {
     platform: "darwin",
+    arch: "arm64",
+    tarSupportsZstd: true,
+    expectedBundleName: "codeql-bundle-osx64.tar.zst",
+    expectedCompressionMethod: "zstd",
+  },
+  {
+    platform: "darwin",
+    arch: "x64",
     tarSupportsZstd: true,
     expectedBundleName: "codeql-bundle-osx64.tar.zst",
     expectedCompressionMethod: "zstd",
   },
   {
     platform: "win32",
+    arch: "x64",
     tarSupportsZstd: true,
     expectedBundleName: "codeql-bundle-win64.tar.gz",
     expectedCompressionMethod: "gzip",
   },
   {
     platform: "linux",
+    arch: "x64",
     tarSupportsZstd: false,
     expectedBundleName: "codeql-bundle-linux64.tar.gz",
     expectedCompressionMethod: "gzip",
@@ -146,15 +164,17 @@ const LINKED_BUNDLE_TEST_CASES = [
 
 for (const {
   platform,
+  arch,
   tarSupportsZstd,
   expectedBundleName,
   expectedCompressionMethod,
 } of LINKED_BUNDLE_TEST_CASES) {
   test.serial(
-    `getCodeQLSource selects ${expectedBundleName} for linked tools`,
+    `getCodeQLSource selects ${expectedBundleName} for linked tools on ${platform}/${arch}`,
     async (t) => {
       const features = createFeatures([]);
       sinon.stub(process, "platform").value(platform);
+      sinon.stub(process, "arch").value(arch);
 
       await withTmpDir(async (tmpDir) => {
         setupActionsVars(tmpDir, tmpDir);

src/setup-codeql.ts

@@ -75,7 +75,7 @@ export function getCodeQLBundleName(
   if (process.platform === "win32") {
     platform = "win64";
   } else if (process.platform === "linux") {
-    platform = "linux64";
+    platform = process.arch === "arm64" ? "linux-arm64" : "linux64";
   } else if (process.platform === "darwin") {
     platform = "osx64";
   } else {

src/testing-utils.ts

@@ -937,7 +937,9 @@ export function mockBundleDownloadApi({
     process.platform === "win32"
       ? "win64"
       : process.platform === "linux"
-        ? "linux64"
+        ? process.arch === "arm64"
+          ? "linux-arm64"
+          : "linux64"
         : "osx64";
 
   const baseUrl = apiDetails?.url ?? "https://example.com";