Would you mind if we hold this until next week when we've fixed the SHA of codeql-action that goes into GHES 3.5?

A thought I had just after approving: There was previously an issue with the API end-point that has now been fixed, right? But does that mean this could cause problems for users on old versions of GHES who pull in a new version of the Action? Should we gate this to only work on dot com or on new versions of GHES?

I appreciate the switch to a warning means we won't fail, but it would still be nice to avoid warnings in the log.

So you will still get a warning on old GHES versions, that is true. When I was implementing this it seemed somewhat reasonable to me, because it is indeed true that we cannot tell you if your analysis processing will fail.

I can add a check for the GHES version if you think this is not the best behavior though.

Hmm, I guess it's fine to have a warning in the logs in the fairly rare case of a pull request from a fork in a GHES instance. Or at least, it's probably not worth the extra complexity of having version checks in the code. Let's leave this as-is.