Upgrade CodeQL CLI to v2.27.3

.codeql-version

@@ -1 +1 @@
-v2.27.2
+v2.27.3

README.md

@@ -8,8 +8,10 @@ including findings about private code that cannot travel the public advisory rou
 
 ## GETTING STARTED
 
-**ABOM is unreleased. Building from source is the only supported installation.** GitHub Release
-downloads and Helm deployment are not available.
+**ABOM is published as [GitHub Releases](https://github.com/advanced-security/codeql-abom/releases)**:
+verifiable archives for Linux and macOS on amd64 and arm64, each built against the CodeQL CLI its
+version names. A release's notes say how to verify its archive and start it. You can also build
+from source, as the steps below do. Helm deployment is planned but not yet available.
 
 To try ABOM without an organization, run a [Demo](docs/demo.md) from an archive of this
 repository: `make demo-check`, then `make demo`. Or
@@ -62,7 +64,6 @@ claim traces back to the query or advisory that made it. If `actions/unpinned-ta
 a reference, this tool will not tell you it is safe — it will tell you the rule did not look.
 
 Coverage, unresolved dependencies and unplaceable findings are reported as first-class output.
-Silence about what was not analyzed reads as completeness, and would be a lie.
 
 ## Native Actions lockfiles
 

docs/demo.md

@@ -185,11 +185,11 @@ Install the CodeQL CLI with the [GitHub CLI](https://cli.github.com/)'s `gh code
 ```bash
 gh auth login                                   # once; the extension downloads CodeQL from GitHub
 gh extension install github/gh-codeql
-gh codeql set-version v2.27.2
+gh codeql set-version v2.27.3
 mkdir -p "$HOME/.local/bin"
 gh codeql install-stub "$HOME/.local/bin"       # puts `codeql` on PATH
 export PATH="$HOME/.local/bin:$PATH"            # add this line to your shell profile too
-codeql version --format=terse                   # prints 2.27.2
+codeql version --format=terse                   # prints 2.27.3
 ```
 
 Any patch release of the minor version in [`.codeql-version`](../.codeql-version) (`v2.27.x`, at

docs/deployment/index.md

@@ -1,15 +1,14 @@
 # Deploy ABOM
 
-Deployment means installing and configuring ABOM itself. **ABOM is unreleased; source installation
-is the only supported deployment.** There are no supported GitHub Release archives, container
-images or Helm installation instructions to use yet.
+Deployment means installing and configuring ABOM itself. **ABOM is published as
+[GitHub Release](https://github.com/advanced-security/codeql-abom/releases) archives, and can be
+built from source.** There are no container images or Helm installation instructions to use yet.
 
 ```mermaid
 flowchart LR
-    SOURCE["Build from source"] -->|"supported route"| LOCAL["Local ABOM<br/>API and browser UI"]
-    RELEASE["GitHub Release archives"] -. "not available" .-> LOCAL
+    SOURCE["Build from source"] -->|"source setup"| LOCAL["Local ABOM<br/>API and browser UI"]
+    RELEASE["GitHub Release archives"] -->|"release notes"| LOCAL
     HELM["Helm deployment"] -. "not available" .-> CLUSTER["Distributed Kubernetes execution"]
-    style RELEASE fill:#3d2d1d
     style HELM fill:#3d2d1d
     style CLUSTER fill:#3d2d1d
 ```
@@ -18,6 +17,7 @@ flowchart LR
 
 | Need | Guide |
 | --- | --- |
+| Verify, unpack and start a published release archive | That release's [notes](https://github.com/advanced-security/codeql-abom/releases) |
 | Install tools, query packs and the local application | [Build from source](source.md) |
 | Authenticate, declare ownership and choose paths or optional features | [Configuration](configuration.md) |
 | Start, stop, inspect, back up or troubleshoot an installation | [Operations](operations.md) |
@@ -36,7 +36,7 @@ state; copying only the main database file is not a backup.
 ABOM applies [best-effort remote-source checks](configuration.md#remote-source-eligibility).
 
 The [deployment plan](../../plans/tools/deployment.md) owns release archives and Kubernetes work,
-including the proposed Linux/macOS amd64/arm64 release matrix. Windows is outside that workstream.
-Until qualification is complete, the proposed matrix is not a certification of every operating
-system, architecture or external service. Future user guides will accompany usable release and
-Helm routes, not placeholders that suggest those routes already exist.
+including the Linux/macOS amd64/arm64 release matrix. Windows is outside that workstream. Until
+qualification is complete, that matrix is not a certification of every operating system,
+architecture or external service. Future user guides will accompany a usable Helm route, not
+placeholders that suggest that route already exists.

docs/deployment/operations.md

@@ -84,7 +84,7 @@ is not available merely because SQLite can produce a snapshot.
 
 ## Checkout updates and removal
 
-ABOM is unreleased and has no supported release-to-release upgrade or downgrade procedure. Before
+ABOM has no supported release-to-release upgrade or downgrade procedure. Before
 changing a working checkout, stop its server and preserve its state. Follow
 [source setup](source.md) again for changed toolchain pins or query dependencies, then rebuild.
 Startup migrations are not a promise that an older executable can read the resulting database.

internal/customql/customql.go

@@ -30,7 +30,7 @@ const SuitePath = "codeql-suites/abom-custom.qls"
 
 // ActionsAll is the codeql/actions-all both scaffolded packs pin: the version ABOM's own queries
 // and ql-mcp's tool queries resolve, so a query is written and run against one library.
-const ActionsAll = "0.6.3"
+const ActionsAll = "0.7.0"
 
 // Postprocess is the query, relative to the test pack, that reads a fixture's `# $ Alert` markers.
 const Postprocess = "utils/InlineExpectationsTestQuery.ql"

internal/harness/copilot.go

@@ -53,7 +53,7 @@ var builtins = []string{"view", "glob", "grep", "create", "edit"}
 const DefaultModel = "claude-opus-5"
 
 // DefaultQLMCP starts the ql-mcp release the loop was recorded against.
-const DefaultQLMCP = "npx -y codeql-development-mcp-server@2.27.2"
+const DefaultQLMCP = "npx -y codeql-development-mcp-server@2.27.3"
 
 // mcpTimeout bounds one ql-mcp call; extracting and testing run CodeQL.
 const mcpTimeout = int((20 * time.Minute) / time.Millisecond)

internal/runner/printast.go

@@ -19,7 +19,7 @@ const toolsPackName = "advanced-security/ql-mcp-actions-tools-src"
 
 // ToolsPack is that pack, pinned, so a tree ABOM prints and one a session printed come from the
 // same query.
-const ToolsPack = toolsPackName + "@2.27.2"
+const ToolsPack = toolsPackName + "@2.27.3"
 
 // printASTSources names the data extension that tells PrintAST which fixtures to print.
 const printASTSources = "abom/print-ast-sources"

ql/actions/findings/src/codeql-pack.lock.yml

@@ -2,35 +2,35 @@
 lockVersion: 1.0.0
 dependencies:
   codeql/actions-all:
-    version: 0.6.3
+    version: 0.7.0
   codeql/actions-queries:
-    version: 0.6.37
+    version: 0.6.38
   codeql/concepts:
-    version: 0.0.33
+    version: 0.0.34
   codeql/controlflow:
-    version: 2.0.43
+    version: 2.0.44
   codeql/dataflow:
-    version: 2.1.15
+    version: 2.1.16
   codeql/javascript-all:
-    version: 2.10.3
+    version: 2.10.4
   codeql/mad:
-    version: 1.0.59
+    version: 1.0.60
   codeql/regex:
-    version: 1.0.59
+    version: 1.0.60
   codeql/ssa:
-    version: 2.0.35
+    version: 2.0.36
   codeql/suite-helpers:
-    version: 1.0.59
+    version: 1.0.60
   codeql/threat-models:
-    version: 1.0.59
+    version: 1.1.0
   codeql/tutorial:
-    version: 1.0.59
+    version: 1.0.60
   codeql/typetracking:
-    version: 2.0.43
+    version: 2.0.44
   codeql/util:
-    version: 2.0.46
+    version: 2.0.47
   codeql/xml:
-    version: 1.0.59
+    version: 1.0.60
   codeql/yaml:
-    version: 1.0.59
+    version: 1.0.60
 compiled: false

ql/actions/findings/src/codeql-pack.yml

@@ -1,9 +1,9 @@
 name: advanced-security/abom-actions-findings-src
-version: 2.27.2
+version: 2.27.3
 description: 'Actions queries whose findings ABOM records and attributes, upstream and its own'
 library: false
 suites: codeql-suites
 dependencies:
-  codeql/actions-queries: 0.6.37
-  codeql/actions-all: 0.6.3
+  codeql/actions-queries: 0.6.38
+  codeql/actions-all: 0.7.0
   advanced-security/abom-actions-lib: ${workspace}

ql/actions/findings/src/codeql-suites/abom-experimental-findings.qls

@@ -20,4 +20,4 @@
 # so the set of rules ABOM attributes could change with no commit here.
 - queries: experimental
   from: codeql/actions-queries
-  version: 0.6.37
+  version: 0.6.38

ql/actions/findings/src/codeql-suites/abom-findings.qls

@@ -13,7 +13,7 @@
 # so the set of rules ABOM attributes could change with no commit here.
 - import: codeql-suites/actions-all.qls
   from: codeql/actions-queries
-  version: 0.6.37
+  version: 0.6.38
 
 # The nine `experimental/` queries stay in. Precision is a property of the rule, and a consumer
 # filtering on rule id can always drop them — whereas a finding never collected cannot be

ql/actions/findings/test/codeql-pack.lock.yml

@@ -2,35 +2,35 @@
 lockVersion: 1.0.0
 dependencies:
   codeql/actions-all:
-    version: 0.6.3
+    version: 0.7.0
   codeql/actions-queries:
-    version: 0.6.37
+    version: 0.6.38
   codeql/concepts:
-    version: 0.0.33
+    version: 0.0.34
   codeql/controlflow:
-    version: 2.0.43
+    version: 2.0.44
   codeql/dataflow:
-    version: 2.1.15
+    version: 2.1.16
   codeql/javascript-all:
-    version: 2.10.3
+    version: 2.10.4
   codeql/mad:
-    version: 1.0.59
+    version: 1.0.60
   codeql/regex:
-    version: 1.0.59
+    version: 1.0.60
   codeql/ssa:
-    version: 2.0.35
+    version: 2.0.36
   codeql/suite-helpers:
-    version: 1.0.59
+    version: 1.0.60
   codeql/threat-models:
-    version: 1.0.59
+    version: 1.1.0
   codeql/tutorial:
-    version: 1.0.59
+    version: 1.0.60
   codeql/typetracking:
-    version: 2.0.43
+    version: 2.0.44
   codeql/util:
-    version: 2.0.46
+    version: 2.0.47
   codeql/xml:
-    version: 1.0.59
+    version: 1.0.60
   codeql/yaml:
-    version: 1.0.59
+    version: 1.0.60
 compiled: false

ql/actions/findings/test/codeql-pack.yml

@@ -1,5 +1,5 @@
 name: advanced-security/abom-actions-findings-test
-version: 2.27.2
+version: 2.27.3
 dependencies:
   advanced-security/abom-actions-findings-src: ${workspace}
 extractor: actions

ql/actions/graph-extraction/src/codeql-pack.lock.yml

@@ -2,31 +2,31 @@
 lockVersion: 1.0.0
 dependencies:
   codeql/actions-all:
-    version: 0.6.3
+    version: 0.7.0
   codeql/concepts:
-    version: 0.0.33
+    version: 0.0.34
   codeql/controlflow:
-    version: 2.0.43
+    version: 2.0.44
   codeql/dataflow:
-    version: 2.1.15
+    version: 2.1.16
   codeql/javascript-all:
-    version: 2.10.3
+    version: 2.10.4
   codeql/mad:
-    version: 1.0.59
+    version: 1.0.60
   codeql/regex:
-    version: 1.0.59
+    version: 1.0.60
   codeql/ssa:
-    version: 2.0.35
+    version: 2.0.36
   codeql/threat-models:
-    version: 1.0.59
+    version: 1.1.0
   codeql/tutorial:
-    version: 1.0.59
+    version: 1.0.60
   codeql/typetracking:
-    version: 2.0.43
+    version: 2.0.44
   codeql/util:
-    version: 2.0.46
+    version: 2.0.47
   codeql/xml:
-    version: 1.0.59
+    version: 1.0.60
   codeql/yaml:
-    version: 1.0.59
+    version: 1.0.60
 compiled: false

ql/actions/graph-extraction/src/codeql-pack.yml

@@ -1,8 +1,8 @@
 name: advanced-security/abom-actions-graph-extraction-src
-version: 2.27.2
+version: 2.27.3
 description: 'Extraction queries for the Actions Bill of Materials (ABOM)'
 library: false
 suites: codeql-suites
 dependencies:
-  codeql/actions-all: 0.6.3
+  codeql/actions-all: 0.7.0
   advanced-security/abom-actions-lib: ${workspace}

ql/actions/graph-extraction/test/codeql-pack.lock.yml

@@ -2,31 +2,31 @@
 lockVersion: 1.0.0
 dependencies:
   codeql/actions-all:
-    version: 0.6.3
+    version: 0.7.0
   codeql/concepts:
-    version: 0.0.33
+    version: 0.0.34
   codeql/controlflow:
-    version: 2.0.43
+    version: 2.0.44
   codeql/dataflow:
-    version: 2.1.15
+    version: 2.1.16
   codeql/javascript-all:
-    version: 2.10.3
+    version: 2.10.4
   codeql/mad:
-    version: 1.0.59
+    version: 1.0.60
   codeql/regex:
-    version: 1.0.59
+    version: 1.0.60
   codeql/ssa:
-    version: 2.0.35
+    version: 2.0.36
   codeql/threat-models:
-    version: 1.0.59
+    version: 1.1.0
   codeql/tutorial:
-    version: 1.0.59
+    version: 1.0.60
   codeql/typetracking:
-    version: 2.0.43
+    version: 2.0.44
   codeql/util:
-    version: 2.0.46
+    version: 2.0.47
   codeql/xml:
-    version: 1.0.59
+    version: 1.0.60
   codeql/yaml:
-    version: 1.0.59
+    version: 1.0.60
 compiled: false

ql/actions/graph-extraction/test/codeql-pack.yml

@@ -1,5 +1,5 @@
 name: advanced-security/abom-actions-graph-extraction-test
-version: 2.27.2
+version: 2.27.3
 dependencies:
   advanced-security/abom-actions-graph-extraction-src: ${workspace}
 extractor: actions