GitHub CodeQL All-Platform Bundle Deprecation: Migrate Before March 2027
GitHub announced September 22, 2026 that the all-platform CodeQL bundle files codeql-bundle.tar.gz and codeql-bundle.tar.zst are deprecated starting with CodeQL CLI 2.27.0 and are planned for removal in mid-March 2027. GitHub's current CodeQL documentation recommends platform-specific bundles instead: linux64 for Linux x64, linux-arm64 for Linux ARM64, osx64 for macOS and win64 for Windows. GitHub also notes that Linux ARM64 binaries are available only through platform-specific downloads and are not included in the all-platform bundle. This is a packaging and distribution migration for CodeQL CLI automation; it does not mean CodeQL itself is being retired. Teams that download, cache, mirror or checksum the generic bundle should update those workflows now, verify the runner architecture explicitly, and test database creation and analysis before the all-platform artifacts disappear.
A CI or security pipeline downloads codeql-bundle.tar.gz or codeql-bundle.tar.zst without selecting an operating system or architecture
An internal artifact mirror, cache key or checksum job assumes the generic CodeQL bundle will continue to be published
A Linux ARM64 runner needs CodeQL but automation still points at the all-platform bundle
A team sees a CodeQL CLI 2.27.0 deprecation warning and is unsure whether CodeQL scanning itself is being discontinued
Possible causes
GitHub is retiring the all-platform distribution format while keeping platform-specific CodeQL bundles
Older installation scripts often hardcode the generic bundle filename rather than detecting runner OS and architecture
Caches, mirrors and checksum manifests can depend on artifact names even when the CodeQL command line itself is unchanged
Linux ARM64 requires the dedicated platform-specific bundle and is not covered by the deprecated all-platform package
HOW TO FIX IT
Work from the safest step to the harder repair.
Step 1. Inventory every place that downloads or mirrors CodeQL: workflow YAML, bootstrap scripts, container images, internal package mirrors, checksum manifests and offline security-tool bundles. Search specifically for codeql-bundle.tar.gz and codeql-bundle.tar.zst.
Step 2. Detect the actual runner operating system and architecture before selecting a replacement artifact. GitHub documents linux64 for Linux x64, linux-arm64 for Linux ARM64, osx64 for macOS and win64 for Windows.
Step 3. Replace the generic filename with the appropriate codeql-bundle-PLATFORM.tar.zst artifact. Prefer the Zstandard package unless the environment genuinely requires the less efficient gzip variant because of older decompression tooling.
Step 4. Handle Linux ARM64 explicitly. GitHub says Linux ARM64 binaries are available only through platform-specific downloads and are not included in the deprecated all-platform bundle.
Step 5. Update cache keys, artifact-mirror paths, integrity manifests and allowlists at the same time as the download URL. A pipeline can appear migrated while still failing later because a cache or mirror expects the old generic filename.
Step 6. Pin or record the CodeQL bundle release according to the organization's update policy. Do not silently switch a production security scanner from a reviewed version to an unbounded latest download merely to solve the filename deprecation.
Step 7. Run an end-to-end validation on each supported runner class: initialize CodeQL, create a representative database, run analysis, upload or consume results as applicable, and confirm existing query packs and custom configuration still resolve.
Step 8. Verify proxy, firewall and artifact-registry rules for every new platform-specific path. Platform selection can introduce new download filenames or cache objects even when network destinations stay the same.
Step 9. Keep a temporary rollback path during migration by retaining the last known-good reviewed bundle reference while the all-platform artifact still exists. Do not treat that rollback as a reason to postpone the migration until March 2027.
Step 10. Recheck GitHub's changelog and CodeQL setup documentation before the mid-March 2027 removal window in case the final removal date or supported platform labels change.
Need the actual code? Go to GenesisCodeDoctor.com to search the Code Store or request code for the exact platform, error, and repair you are working on.
Test the migration with representative repositories and the same runner architectures used in production security scanning.
Preserve integrity verification and approved version-pinning rules while changing artifact names.
Keep credentials for private mirrors or upload steps out of logs and diagnostic output during migration testing.
STOP AND GET HELP WHEN
Do not turn a repair into a larger outage.
Do not interpret retirement of the all-platform archive as retirement of CodeQL or code scanning.
Do not map a Linux ARM64 runner to linux64; select the architecture-specific bundle GitHub documents.
Do not loosen checksum verification, artifact provenance or network policy merely to make a new bundle filename download successfully.
Do not wait until the old artifact disappears before testing mirrors, caches and offline installation paths that depend on it.
HOW GENESIS HANDLES IT
Diagnose the exact failure before choosing a repair.
Genesis separates the visible symptom from the underlying technical cause. Run the supported diagnostic first, review the evidence, and then use a matching repair only when the failure is actually verified.
Platform scope
GitHub CodeQL CLI · code scanning · CI/CD · Linux x64 · Linux ARM64 · macOS · Windows
Category
Application security · CodeQL · CI/CD migration
Last updated
2026-09-22
REPAIR PROFILE
Know the complexity before you edit.
Difficulty
Intermediate
Change risk
Medium
These labels describe implementation complexity and blast radius, not a guaranteed repair time.
AUTHORITATIVE SOURCES
Verify time-sensitive platform details at the source.
No. GitHub is deprecating and then removing the all-platform bundle distribution. Its current documentation directs users to platform-specific CodeQL bundles instead.
When does the all-platform CodeQL bundle go away?
GitHub's September 22, 2026 announcement says the all-platform bundle is deprecated starting with CodeQL CLI 2.27.0 and is planned for removal in mid-March 2027.
Which CodeQL bundle should I download?
GitHub documents linux64 for Linux x64, linux-arm64 for Linux ARM64, osx64 for macOS and win64 for Windows. Match the artifact to the runner that will execute CodeQL.
Can Linux ARM64 keep using the all-platform bundle?
No. GitHub says Linux ARM64 binaries are available only through platform-specific downloads and are not included in the all-platform bundle.
Once you know the platform and the verified problem, search the Genesis Code Doctor Code Store for a matching package. If the exact integration or repair is not there, use Request a Code and describe the platform, official documentation, desired behavior, and sanitized error—never send your secret key.
Start with a free diagnostic. If Genesis verifies a problem and a compatible treatment exists, continue to the matching Code Store product or repair path. If you cannot find the exact code you need, request it at GenesisCodeDoctor.com rather than forcing a generic snippet into the wrong platform.
GENESISCODE DOCTOR AI