gitdash

CodeQL on Linux ARM64: What CodeQL 2.27.0 Changes

CodeQL 2.27.0 runs natively on Linux ARM64. Learn what changes for self-hosted runners, Rust analysis, platform downloads, and CodeQL upgrades.

A shielded dependency vault sends a security alert through a focused analysis pipeline

CodeQL 2.27.0 adds native Linux ARM64 support to the CodeQL CLI and bundle. That is useful if your CI fleet includes Graviton, Ampere, Raspberry Pi-class build machines, or other ARM64 Linux hosts and you want security analysis to run on the same architecture as your build.

The release also adds a Rust command-line injection query, expands framework modeling for Java, Kotlin, and C#, and changes how some GitHub Actions author-association checks are analyzed. This guide focuses on the ARM64 migration, then covers the changes worth checking before you upgrade. See the CodeQL 2.27.0 announcement for the full release list.

What native ARM64 support means

Before this release, Linux ARM64 teams commonly had to use an x64 runner, emulation, or a separate analysis machine. The Linux ARM64 CodeQL distribution lets the analysis process run natively on an ARM64 Linux host. That can simplify runner pools and remove one architecture difference from a build-and-scan pipeline.

Native does not mean automatic. Your runner still needs enough memory, disk, compilers, package managers, and project dependencies for the languages you scan. GitHub's CodeQL hardware guidance suggests at least 8 GB RAM and 2 CPU cores for a small codebase, 16 GB and 4 or 8 cores for a medium codebase, and 64 GB or more with 8 cores for a large codebase.

Use an ARM64 runner deliberately

Give the runner a clear label and select it only for jobs that are ready for ARM64. Labels are case-sensitive, so use the labels actually registered on your runner. A typical job looks like this:

jobs:
  analyze:
    name: CodeQL on ARM64
    runs-on: [self-hosted, Linux, ARM64]
    permissions:
      security-events: write
      packages: read
      actions: read
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: javascript-typescript
      - name: Autobuild
        uses: github/codeql-action/autobuild@v4
      - name: Analyze
        uses: github/codeql-action/analyze@v4

The exact permissions depend on your workflow. Keep only the permissions that the job needs. The ARM64 change affects where CodeQL runs, not the token model or the permission required to upload code scanning results.

Upgrade the platform asset, not just the version string

CodeQL now provides per-platform release assets, including Linux ARM64. Download the asset for the machine that executes the CLI. Do not keep using the generic all-platform codeql.zip as a long-term default: GitHub says that distribution will be removed in a future release and the CLI now warns when it is used.

# Example shape: choose the exact 2.27.0 asset name from the release page
gh release download v2.27.0 \
  --repo github/codeql-cli-binaries \
  --pattern '*linux-arm64*.zip' \
  --dir codeql

unzip -q codeql/*linux-arm64*.zip -d codeql/2.27.0
codeql/2.27.0/codeql/codeql version

Treat the command as a release pattern, not a blind copy-paste. Confirm the current asset name and checksum from the CodeQL release page, then pin the version in your runner image or installation script. A moving latest download makes it harder to reproduce a scan after a finding.

Watch the build boundary

For compiled languages, CodeQL needs to observe the build that produces the code database. Moving the analysis to ARM64 is safest when the build also runs on ARM64. Otherwise you may introduce architecture-specific dependency failures or analyze a build that does not match the production path.

Self-hosted runners are responsible for their own toolchain. Install Git, the language runtime, package managers, compilers, and system libraries before moving a job. Containers add another constraint: GitHub documents that the CodeQL CLI is not compatible with non-glibc distributions such as Alpine Linux.

New findings worth checking

The ARM64 binary is the headline, but the release changes analysis too. Rust gains a rust/command-line-injection query. Java and Kotlin analysis adds Micronaut modeling. C# analysis improves ASP.NET Core MVC discovery and adds OData taint tracking.

Upgrade review
  ✓ Linux ARM64 asset selected
  ✓ Runner has enough RAM, CPU, and disk
  ✓ Build dependencies installed for the target architecture
  ✓ CodeQL CLI version pinned
  ✓ New alerts reviewed after the first scan
  ✓ Generic codeql.zip removed from installation scripts

The release also changes a GitHub Actions security analysis detail: checks involving author-association fields are only treated as protection when the event payload provides the relevant field. If your workflow security depends on that kind of check, review any new alerts instead of assuming the result is a false positive.

A small migration plan

  1. Create or select a disposable ARM64 runner with the same operating-system family as the target fleet.
  2. Install the pinned Linux ARM64 CodeQL asset and verify its version.
  3. Run one representative repository and compare scan duration, database size, build output, and findings with the existing runner.
  4. Review new or moved alerts, especially for Rust command-line injection and workflow author-association checks.
  5. Move the label into the normal runner pool only after the representative scan is stable.

CodeQL 2.27.0 makes Linux ARM64 a supported native analysis target. The lowest-risk upgrade is an explicit one: pin the right platform asset, match the build architecture, provision the runner like a build machine, and compare the first results. Once that passes, ARM64 can be a normal part of your code scanning fleet instead of a special workaround.