Bump minimum CodeQL CLI version to 2.20.7 by henrymercer · Pull Request #4205 · github/codeql-action · GitHub

Follows the deprecation in #3956.

Bump the minimum CodeQL version to 2.20.7 and add a changelog note.
Bump the minor version number.
Update the CodeQL versions tested by PR checks: drop 2.19.4, test 2.20.7 rather than 2.20.3 in the debug artifact checks, and add 2.25.6, which ships with GHES 3.22.
Remove code that is only needed for CodeQL versions older than 2.20.7:
- Unsetting empty CODEQL_PROXY_* environment variables in analyze.
- The Kotlin version limit override for CodeQL 2.20.3.
- The CodeQL version check before uploading debug artifacts.
- The Rust minimum version check (2.19.3) and the minimum version for C++ dependency installation (2.15.0). These were already redundant with the previous minimum version.

All the tools features are still needed, since CodeQL 2.20.7 doesn't report any of them as supported. The README compatibility table and the next deprecation are handled in #4188.

Risk assessment

For internal use only. Please select the risk level of this change:

Low risk: Changes are fully under feature flags, or have been fully tested and validated in pre-production environments and are highly observable, or are documentation or test only.

Which use cases does this change impact?

Workflow types:

Advanced setup - Impacts users who have custom CodeQL workflows.
Managed - Impacts users with dynamic workflows (Default Setup, Code Quality, ...).

Products:

Code Scanning - The changes impact analyses when analysis-kinds: code-scanning.
Code Quality - The changes impact analyses when analysis-kinds: code-quality.
Other first-party - The changes impact other first-party analyses.
Third-party analyses - The changes affect the upload-sarif action.

Environments:

Dotcom - Impacts CodeQL workflows on github.com and/or GitHub Enterprise Cloud with Data Residency.
GHES - Impacts CodeQL workflows on GitHub Enterprise Server.

How did/will you validate this change?

Unit tests - I am depending on unit test coverage (i.e. tests in .test.ts files).
End-to-end tests - I am depending on PR checks (i.e. tests in pr-checks).

If something goes wrong after this change is released, what are the mitigation and rollback strategies?

Rollback - Change can only be disabled by rolling back the release or releasing a new version with a fix.

How will you know if something goes wrong after this change is released?

Telemetry - I rely on existing telemetry or have made changes to the telemetry.
- Alerts - New or existing monitors will trip if something goes wrong with this change.

Are there any special considerations for merging or releasing this change?

Special considerations - The required checks need updating with pr-checks/sync-checks.ts before merging, since this changes the CodeQL versions in the PR check matrix.

Merge / deployment checklist

Confirm this change is backwards compatible with existing workflows.
Consider adding a changelog entry for this change.
Confirm the readme and docs have been updated if necessary.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

…ion` Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Warning

Copilot's review of this pull request may be incomplete because some of the changed files are excluded by your Copilot content exclusion settings. See Excluding content from Copilot for details.

Copilot review overview

🟢 Approval recommended

The compatibility removals consistently follow the new enforced minimum and the relevant test matrices were updated.

Review effort: Balanced
Findings: None

What changed in this PR

Raises the minimum supported CodeQL CLI to 2.20.7 and removes compatibility paths for older releases.

Changes:

Updates minimum and tested CodeQL versions.
Removes obsolete version checks and workarounds.
Bumps the Action to 4.39.0 and updates generated outputs.

File	Description
src/upload-sarif-action-post.ts	Simplifies debug artifact upload.
src/tools-features.ts	Removes obsolete safe-upload checks.
src/init-action.ts	Removes old Rust and Kotlin compatibility logic.
src/init-action-post-helper.ts	Removes the artifact-upload version parameter.
src/feature-flags.ts	Removes the obsolete C++ minimum version.
src/debug-artifacts.ts	Uploads artifacts without legacy version gating.
src/debug-artifacts.test.ts	Updates artifact-upload tests.
src/codeql.ts	Raises the minimum CLI version.
src/autobuild.ts	Removes unnecessary CLI dependency from C++ setup.
src/analyze.ts	Adapts C++ setup invocation.
src/analyze-action.ts	Removes the legacy proxy workaround.
src/analyze-action-post.ts	Avoids unnecessary CLI version lookup.
pr-checks/sync.ts	Updates the default tested versions.
pr-checks/checks/rust.yml	Tests Rust against the new minimum.
pr-checks/checks/multi-language-autodetect.yml	Drops the unsupported version.
package.json	Bumps the minor version.
package-lock.json	Synchronizes the package version.
CHANGELOG.md	Documents the breaking change.
.github/workflows/debug-artifacts-safe.yml	Updates debug-artifact coverage.
.github/workflows/debug-artifacts-failure-safe.yml	Updates failure-path coverage.
lib/entry-points.js	Generated output; contents excluded.
.github/workflows/__rust.yml	Generated workflow; contents excluded.
.github/workflows/__go-tracing-autobuilder.yml	Generated workflow; contents excluded.
.github/workflows/__multi-language-autodetect.yml	Generated workflow; contents excluded.
.github/workflows/__go-tracing-legacy-workflow.yml	Generated workflow; contents excluded.
.github/workflows/__go-tracing-custom-build-steps.yml	Generated workflow; contents excluded.

Files excluded by content exclusion policy (6)

.github/workflows/__go-tracing-autobuilder.yml
.github/workflows/__go-tracing-custom-build-steps.yml
.github/workflows/__go-tracing-legacy-workflow.yml
.github/workflows/__multi-language-autodetect.yml
.github/workflows/__rust.yml
lib/entry-points.js

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

LGTM, changes look reasonable for the minimum version bump. Thanks for doing the clean-up!

…odeql-2-20-7 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

henrymercer and others added 11 commits October 7, 2026 14:40

Bump minimum CodeQL CLI version to 2.20.7

772ffcd

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Bump version to 4.39.0

05d28f2

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Stop testing CodeQL versions older than 2.20.7 in PR checks

74aeac9

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Add CodeQL 2.25.6 to the PR check matrix

17e7897

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Remove CODEQL_PROXY_* workaround for CLIs older than 2.20.7

b97fbb3

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Remove Kotlin version limit workaround for CodeQL CLI 2.20.3

10e415a

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Remove CodeQL version check from debug artifact upload

3c1b1b6

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Remove unreachable minimum version check for Rust analysis

a8c7110

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Remove redundant CLI version requirement from `CppDependencyInstallat…

0b5c1fb

…ion` Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Clarify the oldest-version comment in the Rust PR check

8e7104f

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Add PR number to changelog entry and list it first

5d90bea

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

github-actions Bot added the size/M Should be of average difficulty to review label Oct 7, 2026

henrymercer requested a balanced review from Copilot October 7, 2026 13:44

Copilot started reviewing on behalf of henrymercer October 7, 2026 13:45

View session

Copilot AI reviewed Oct 7, 2026

View reviewed changes

henrymercer marked this pull request as ready for review October 7, 2026 18:01

henrymercer requested a review from a team as a code owner October 7, 2026 18:01

Merge branch 'main' into henrymercer/require-codeql-2-20-7

768784f

mbg previously approved these changes Oct 9, 2026

View reviewed changes

Merge remote-tracking branch 'origin/main' into henrymercer/require-c…

ae96eed

…odeql-2-20-7 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

henrymercer dismissed mbg’s stale review via ae96eed October 12, 2026 09:13

henrymercer requested a review from mbg October 12, 2026 09:14

mbg approved these changes Oct 12, 2026

View reviewed changes

henrymercer added this pull request to the merge queue Oct 12, 2026

Merged via the queue into main with commit 0db2f2b Oct 12, 2026
234 checks passed

henrymercer deleted the henrymercer/require-codeql-2-20-7 branch October 12, 2026 10:17

This was referenced Oct 14, 2026

Merge main into releases/v4 dsp-testing/mario-campos-post-comment-test#6

Merged

Merge main into releases/v4 #4239

Merged

Merge releases/v4 into releases/v3 #4241

Merged

cursor Bot mentioned this pull request Oct 19, 2026

ci: bump the actions group with 2 updates chhoumann/quickadd#2250

Merged

Bump minimum CodeQL CLI version to 2.20.7 by henrymercer · Pull Request #4205 · github/codeql-action · GitHub

Repository navigation

Bump minimum CodeQL CLI version to 2.20.7 - #4205

Bump minimum CodeQL CLI version to 2.20.7#4205
henrymercer merged 13 commits into
mainfrom
henrymercer/require-codeql-2-20-7

henrymercer commented Oct 7, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

mbg left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Bump minimum CodeQL CLI version to 2.20.7 by henrymercer · Pull Request #4205 · github/codeql-action · GitHub

Repository navigation

Bump minimum CodeQL CLI version to 2.20.7 - #4205

Bump minimum CodeQL CLI version to 2.20.7#4205henrymercer merged 13 commits intomaingithub/codeql-action:mainfrom henrymercer/require-codeql-2-20-7github/codeql-action:henrymercer/require-codeql-2-20-7Copy head branch name to clipboard

Conversation

henrymercer commented Oct 7, 2026

Risk assessment

Which use cases does this change impact?

How did/will you validate this change?

If something goes wrong after this change is released, what are the mitigation and rollback strategies?

How will you know if something goes wrong after this change is released?

Are there any special considerations for merging or releasing this change?

Merge / deployment checklist

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟢 Approval recommended

Uh oh!

mbg left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Bump minimum CodeQL CLI version to 2.20.7#4205
henrymercer merged 13 commits into
mainfrom
henrymercer/require-codeql-2-20-7