Add support for Linux Arm64 runners by redsun82 · Pull Request #4072 · github/codeql-action

redsun82 · 2026-08-04T13:31:55Z

The CodeQL CLI will ship native linux-arm64 artifacts, but the Action does not yet recognize that platform: it rejects the CLI as an unsupported platform/architecture combination and, even if it got past that, would resolve the wrong bundle asset. This change teaches the Action about linux/arm64 so it accepts the CLI and downloads the correct bundle.

Approach

Two small semantic edits, plus faithful test/mock coverage:

src/cli-errors.ts - add ["linux", "arm64"] to SUPPORTED_PLATFORMS so isUnsupportedPlatform() no longer rejects it.
src/setup-codeql.ts - make the linux branch of getCodeQLBundleName() architecture-aware, resolving codeql-bundle-linux-arm64.tar.zst on arm64 and codeql-bundle-linux64 elsewhere. This flows automatically to the download and nightlies URL builders.

Arm64 is shipped as a per-platform bundle only and is deliberately excluded from the combined all-platforms gzip (which is near the release-asset size limit), so it is important that resolution lands on the exact per-platform asset name rather than the combined-gzip fallback.

The bundle-download mock in src/testing-utils.ts was updated to mirror the same arch logic so it stays faithful on arm64 hosts (x64 behavior is unchanged). Tests were updated accordingly: the now-supported linux/arm64 case was removed from the unsupported-platform list in src/cli-errors.test.ts, and src/setup-codeql.test.ts gained an explicit arch per case plus a new linux/arm64 case.

x64, macOS, and Windows behavior is unchanged; the only new behavior is on Linux arm64 runners, which do not work at all today.

Risk assessment

For internal use only. Please select the risk level of this change:

Low risk: Changes are documentation or test only, or have been fully tested and validated. This change only adds behavior for Linux arm64 (a platform that fails today) and leaves all existing platforms untouched; it is covered by unit tests.

Which use cases does this change impact?

Workflow types:

Advanced setup - Impacts users who have custom CodeQL workflows.
Managed - Impacts users with dynamic workflows (Default Setup, Code Quality, ...).

Products:

Code Scanning - The changes impact analyses when analysis-kinds: code-scanning.
Code Quality - The changes impact analyses when analysis-kinds: code-quality.
Other first-party - The changes impact other first-party analyses.

Environments:

Dotcom - Impacts CodeQL workflows on github.com and/or GitHub Enterprise Cloud with Data Residency.
GHES - Impacts CodeQL workflows on GitHub Enterprise Server.

Only relevant when running on a Linux arm64 runner; other architectures are unaffected.

How did/will you validate this change?

Unit tests - I am depending on unit test coverage (i.e. tests in .test.ts files) for the new arch branch and platform-support change.
Test repository - This change will be tested on a Linux arm64 test repository before merging.

If something goes wrong after this change is released, what are the mitigation and rollback strategies?

Rollback - Change can only be disabled by rolling back the release or releasing a new version with a fix. There is no x64/macOS/Windows impact, so the blast radius is limited to arm64 runners.

How will you know if something goes wrong after this change is released?

Other - Failures would surface as CodeQL bundle download or platform errors in the Action logs on Linux arm64 runners.

Are there any special considerations for merging or releasing this change?

Special considerations - This relies on the CLI publishing the per-platform codeql-bundle-linux-arm64.tar.zst asset. It should only be merged once that asset is being produced.

Merge / deployment checklist

Confirm this change is backwards compatible with existing workflows.
Consider adding a changelog entry for this change.
Confirm the readme and docs have been updated if necessary.

Recognize the linux/arm64 platform so the CodeQL CLI is accepted on Arm64 Linux runners and the native per-platform bundle codeql-bundle-linux-arm64.tar.zst is resolved, rather than falling through to the combined all-platforms gzip fallback (which deliberately omits arm64). Add ["linux", "arm64"] to the supported platforms and make the linux bundle name arch-aware. Keep the download mock faithful and cover the new arch branch with tests. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

redsun82 · 2026-08-04T14:26:11Z

@mbg or @henrymercer do you mind giving a very early quick look whether this seems sensible? We can postpone merging until we decide to go with it in the releases. Tomorrow I plan on running some tests by hand on this branch with the nightly release, so I don't mind if the first review is shallow.

henrymercer

Looks good to start testing! Can we add a PR check based on ubuntu-24.04-arm?

mbg

Thanks for preparing these changes! They generally look reasonable. A few points that we'd probably want to tackle on top of them:

Add at least one end-to-end test that runs on arm64 Linux. (This might also require updating sync.ts) Possibly run other e2e tests on arm64 as well.
It would be nice if we could provide a useful error message if someone attempts to use an older CLI that doesn't support arm64 (e.g. by checking the release assets and provide an appropriate error message if on that platform)

- Add darwin/x64 case to linked bundle tests and disambiguate the parametrized test title by platform/arch - Reword CHANGELOG entry to clarify the CLI supports Linux Arm64 - Add a dedicated Linux Arm64 end-to-end PR check on ubuntu-24.04-arm Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 308c78bb-53a3-4877-a373-70fab87543f1

…support

…1399) * ci: drop redundant CodeQL scan, fix Scorecard ARM64 incompatibility codeql-action doesn't support Linux ARM64 (upstream: github/codeql-action#4072, #2700), and every codeql "actions" rule already maps to a zizmor audit running on ARM64 in ci.yml, so drop codeql.yml and raise zizmor's min-severity from high to medium to keep equivalent coverage. scorecard-action's amd64-only image has failed every scheduled run on ubuntu-24.04-arm since at least 2026-07-20 (ossf/scorecard-action#1697). Replace it with the checksum-verified linux_arm64 scorecard CLI binary, matching the existing cargo-semver-checks pattern, and upload SARIF via codeql-action/upload-sarif. Closes #1398 Signed-off-by: Hugues Clouâtre <hugues@linux.com> * ci: fix zizmor medium-severity findings surfaced by min-severity change Raising zizmor's min-severity to medium (this PR) surfaces two pre-existing findings unrelated to codeql/scorecard: - dtolnay/rust-toolchain is pinned to the "stable" branch tip but commented "# 1.97.1", which zizmor reads as a mismatched version comment since a branch literally named "1.97.1" points elsewhere. The actual desired version is already set via the "toolchain" input; correct the comment to "# stable" to match what's really pinned (matches the existing correct usage in update-deps.yml). - release.yml and release-repair.yml pass `secrets: inherit` into build-and-attest.yml, which only ever reads the auto-provided GITHUB_TOKEN. Drop the unneeded blanket secret grant. Signed-off-by: Hugues Clouâtre <hugues@linux.com> --------- Signed-off-by: Hugues Clouâtre <hugues@linux.com>

Copilot

Warning

Copilot's review of this pull request may be incomplete because some of the changed files are excluded by your Copilot content exclusion settings. See Excluding content from Copilot for details.

Pull request overview

Adds Linux Arm64 support by recognizing the platform and selecting native CodeQL bundles.

Changes:

Adds Linux Arm64 platform and bundle resolution.
Extends unit mocks/tests and adds an Arm64 integration check.
Documents the new support.

Show a summary per file

File	Description
`src/cli-errors.ts`	Recognizes Linux Arm64.
`src/cli-errors.test.ts`	Removes Arm64 from unsupported cases.
`src/setup-codeql.ts`	Resolves Arm64 bundle names.
`src/setup-codeql.test.ts`	Tests architecture-specific resolution.
`src/testing-utils.ts`	Updates bundle mocks for Arm64.
`pr-checks/checks/linux-arm64.yml`	Adds an Arm64 integration test.
`CHANGELOG.md`	Announces Arm64 support.
`lib/entry-points.js`	Generated artifact excluded from review.
`.github/workflows/__linux-arm64.yml`	Generated workflow excluded from review.

Review details

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Files excluded by content exclusion policy (2)

.github/workflows/__linux-arm64.yml
lib/entry-points.js

Files reviewed: 7/9 changed files
Comments generated: 1
Review effort level: Balanced

henrymercer · 2026-08-27T09:33:41Z


 const SUPPORTED_PLATFORMS = [
  ["linux", "x64"],
+  ["linux", "arm64"],


This is a good idea, we should stub the OS and architecture in "wrapCliConfigurationError - supported platform" rather than just testing on the OS / architecture on which we happen to be running.

henrymercer · 2026-08-27T09:31:45Z

+  - uses: ./../action/analyze
+    with:
+      skip-queries: true
+      upload-database: false


Perhaps we should run the queries, to check the database can be finalized and that it works to some extent. I'm not too concerned about the additional run time, as long as this doesn't become the longest check.

henrymercer · 2026-08-27T09:33:41Z


 const SUPPORTED_PLATFORMS = [
  ["linux", "x64"],
+  ["linux", "arm64"],


This is a good idea, we should stub the OS and architecture in "wrapCliConfigurationError - supported platform" rather than just testing on the OS / architecture on which we happen to be running.

github-actions Bot added the size/XS Should be very easy to review label Aug 4, 2026

redsun82 force-pushed the redsun82-linux-arm64-support branch from cb3455d to 4c96123 Compare August 4, 2026 13:32

henrymercer reviewed Aug 4, 2026

View reviewed changes

Comment thread src/setup-codeql.test.ts

mbg reviewed Aug 4, 2026

View reviewed changes

Comment thread CHANGELOG.md Outdated

github-actions Bot added size/S Should be easy to review and removed size/XS Should be very easy to review labels Aug 5, 2026

Merge remote-tracking branch 'origin/main' into redsun82-linux-arm64-…

b4c390c

…support

LMLiam mentioned this pull request Aug 12, 2026

perf(ci): run jobs on arm64 hosted runners LMLiam/Kotventure#555

Merged

clouatre mentioned this pull request Aug 20, 2026

ci: drop redundant CodeQL scan, fix Scorecard ARM64 incompatibility clouatre-labs/aptu-coder#1398

Closed

6 tasks

Merge branch 'main' into redsun82-linux-arm64-support

a952c07

redsun82 marked this pull request as ready for review August 27, 2026 08:08

redsun82 requested a review from a team as a code owner August 27, 2026 08:08

Copilot AI balanced review requested due to automatic review settings August 27, 2026 08:08

Copilot started reviewing on behalf of redsun82 August 27, 2026 08:08 View session

Copilot AI reviewed Aug 27, 2026

View reviewed changes

henrymercer reviewed Aug 27, 2026

View reviewed changes

Navigation Menu

Uh oh!

Add support for Linux Arm64 runners - #4072

Add support for Linux Arm64 runners#4072
redsun82 wants to merge 4 commits into
mainfrom
redsun82-linux-arm64-support

redsun82 commented Aug 4, 2026 •

edited

Loading

Uh oh!

redsun82 commented Aug 4, 2026

Uh oh!

henrymercer left a comment

Uh oh!

Uh oh!

mbg left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

henrymercer Aug 27, 2026

Uh oh!

henrymercer Aug 27, 2026

Uh oh!

henrymercer Aug 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

redsun82 commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Approach

Risk assessment

Which use cases does this change impact?

How did/will you validate this change?

If something goes wrong after this change is released, what are the mitigation and rollback strategies?

How will you know if something goes wrong after this change is released?

Are there any special considerations for merging or releasing this change?

Merge / deployment checklist

Uh oh!

redsun82 commented Aug 4, 2026

Uh oh!

henrymercer left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

mbg left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

henrymercer Aug 27, 2026

Choose a reason for hiding this comment

Uh oh!

henrymercer Aug 27, 2026

Choose a reason for hiding this comment

Uh oh!

henrymercer Aug 27, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

redsun82 commented Aug 4, 2026 •

edited

Loading