Tag

#codeql

Tagged “codeql”

6 articles

CodeQL 2.27.0 ships a native Linux ARM64 build

GitHub's static analysis engine now ships a native linux-arm64 CLI and bundle in 2.27.0, alongside a new Rust security query and expanded Java, Kotlin and C# framework coverage. Teams that already moved their runners to ARM stop paying an emulation tax on code scans.

Sep 10, 2026 · Maya Okonkwo Code quality & testing

GitHub splits Code Quality off the Actions billing meter

GitHub Code Quality CodeQL workflows now run on a dedicated Actions path, per an August 20 changelog. Their runs no longer count against a repo's regular Actions usage, and no longer sit in the same workflow-run history as the rest of its CI.

Aug 24, 2026 · Maya Okonkwo Security

CodeQL 2.26.3 retunes its Actions queries and drops the self-hosted module

CodeQL 2.26.3 reworks how the engine reasons about GitHub Actions workflows, tightening output-clobbering, cache-poisoning and env-var injection queries and removing the self-hosted runner module. Hosted code scanning is already on the new pack, so the next full run may move alert counts in both directions.

Aug 23, 2026 · Maya Okonkwo Security

CodeQL 2.26.2 trims what counts as safe: fresh alerts incoming

GitHub's static analysis engine adds Swift 6.3.3 and Kotlin 2.4.10 support in CodeQL 2.26.2, and quietly removes a batch of sanitizers that used to make path injection and URL redirection findings disappear.

Aug 10, 2026 · Tomás Vega Code quality & testing

GitHub Code Quality goes GA, and the billing meter turns on with it

GitHub Code Quality moved to general availability on GitHub Enterprise Cloud and GitHub Team on July 20, pairing CodeQL's analysis with AI-assisted detection and Copilot Autofix inside pull requests. The pricing landed the same day: $10 per active committer per month plus usage charges for AI work and CodeQL compute.

Jul 22, 2026 · Tomás Vega Code quality & testing

Code Quality findings now have a REST API a pipeline can actually call

GitHub put its Code Quality CodeQL findings behind two read-only REST endpoints in public preview, one for listing with filtering and pagination, one for a single finding. The change turns the Code Quality UI's data into something CI/CD jobs and remediation tooling can finally consume on their own schedule.

Jun 24, 2026 · Priya Nair