GitHub has deprecated the all-platform CodeQL bundle beginning with CodeQL CLI 2.27.0. The bundle continues to be identified by the filenames codeql-bundle.tar.gz and codeql-bundle.tar.zst, but GitHub plans to remove or stop publishing it in mid-March 2027.
The replacement is a bundle selected for the host operating system and architecture. That change matters most for CI systems, release-asset download scripts, caches, and GitHub Actions configurations that currently assume one combined download works across multiple environments.
What changed in CodeQL CLI 2.27
When the CodeQL CLI runs from an all-platform distribution, CLI 2.27.0 emits a deprecation warning. The warning is an early signal for teams to locate installations that still download or cache the combined bundle.
GitHub’s announcement does not specify an exact calendar day in mid-March 2027 for the planned removal. It also does not document whether existing all-platform URLs will redirect, return an error, or remain available after the change. Automation should therefore not depend on any particular post-removal behavior.
The deprecation concerns the all-platform CodeQL bundle. It should not be confused with the separately mentioned generic multi-platform codeql.zip CLI distribution.
Use a bundle for the host platform
The documented replacement naming pattern is codeql-bundle-PLATFORM.tar.zst. The supported platform identifiers listed in the setup documentation are:
linux64for Linux x64linux-arm64for Linux ARM64osx64for macOSwin64for Windows
For example, the platform-specific assets include codeql-bundle-linux64.tar.zst, codeql-bundle-linux-arm64.tar.zst, codeql-bundle-osx64.tar.zst, and codeql-bundle-win64.tar.zst. Each also has a .tar.gz variant. The documentation describes the gzip-compressed archives as an option for older extraction tools that do not support Zstandard; the bundle contents are the same.
Linux ARM64 users should pay particular attention to this change. CodeQL CLI 2.27.0 provides a native codeql-linux-arm64.zip package and Linux ARM64 bundle assets named codeql-bundle-linux-arm64.tar.gz and codeql-bundle-linux-arm64.tar.zst. Linux ARM64 binaries are not included in the combined all-platform distributions.
The CodeQL CLI 2.27.0 release documentation provides the release-specific Linux ARM64 details, while the CodeQL CLI setup documentation describes the platform-specific bundle naming and extraction process.
Implications for CI and GitHub Actions
Organizations that provision CodeQL centrally or dynamically will need to account for the host platform when selecting an asset. A single hard-coded reference to codeql-bundle.tar.gz or codeql-bundle.tar.zst may need to become platform-specific handling for Linux x64, Linux ARM64, macOS, and Windows.
The setup documentation recommends downloading the bundle from the CodeQL Action releases page, extracting it, and then either invoking the codeql executable directly or adding its directory to PATH. For CI environments, the full bundle contents should be available to each analysis server. The documented approaches include copying the bundle from a central location or downloading it through GitHub’s release-asset REST API.
GitHub Actions provides a supported configuration path for custom provisioning. The init action reference accepts either a local path to a CodeQL Bundle tarball or a URL for a CodeQL Bundle GitHub release asset through its tools input. That allows workflows using a controlled local bundle or a release-asset URL to move to a platform-specific archive.
The CodeQL Action changelog also states that the Action supports CodeQL releases compatible with Linux ARM64 and downloads the native linux-arm64 bundle when available.
What developers and administrators should check
Start by searching infrastructure and automation for both deprecated filenames. The references may exist in bootstrap scripts, container or virtual-machine images, dependency caches, CI templates, release-asset download logic, or internal documentation.
- Identify the actual host platform. Select the bundle that matches both the operating system and architecture used by the analysis server.
- Replace all-platform asset references. Use the documented platform-specific
.tar.zstor.tar.gzbundle rather than relying on the combined distribution. - Extract and expose CodeQL. Extract the archive to the location used by the job, then invoke the executable directly or add its directory to
PATH. - Review GitHub Actions configuration. If the workflow supplies a local bundle or release-asset URL through the
toolsinput, update that value and test it on each runner platform in use. - Test cached and centrally copied bundles. Confirm that every analysis server receives the complete platform-appropriate bundle and that cache keys or artifact logic do not mix architectures.
- Run the analysis in the real build environment. For compiled languages, the system must independently be able to build and compile the analyzed code.
The CodeQL system requirements document supported operating systems and architectures, including Ubuntu 22.04 and 24.04 with x86-64 and ARM64, supported Windows versions with x86-64, and macOS 14, 15, and 26 with x86-64 and Apple Silicon ARM64. It also lists additional extraction requirements, such as glibc 2.17 or later for specified Linux scenarios, no compatibility with non-glibc distributions such as Alpine Linux, PowerShell on Windows for compiled-language extraction, and Node.js 14 or later for TypeScript extraction.
Do not treat the warning as a security finding
This announcement concerns CodeQL distribution and compatibility. The supplied documentation does not state that continuing to use the deprecated all-platform bundle creates a vulnerability or other security exposure.
The practical risk is operational: an installation or download process that still depends on an all-platform asset may require changes when GitHub stops publishing or removes that asset. The environment variable CODEQL_ALLOW_ALL_PLATFORMS_DIST=true can suppress the warning, but it does not change the deprecation or postpone the planned removal. Suppressing the message should not be treated as a migration strategy.
Availability and remaining uncertainty
Platform-specific bundles are already documented and available through the CodeQL Action releases process, including native Linux ARM64 assets. The announced removal of the all-platform bundle is a future change planned for mid-March 2027, but the exact date has not been published in the supplied documentation.
GitHub has also not documented a universal migration procedure for every third-party provisioning tool or custom download script. Teams should test their own asset selection, extraction, caching, and startup paths rather than assuming that an existing all-platform URL will be redirected automatically.
