Native binary, one less translation layer
CodeQL 2.27.0 now runs natively on Linux arm64, per the GitHub changelog dated September 9, 2026. Teams with ARM runners can pull the CLI and the CodeQL bundle from the linux-arm64 per-platform release assets and drop the x86-under-emulation setup they were carrying to get code scanning green.
The release also lands a new Rust security query, expanded framework coverage for Java, Kotlin and C#, and analysis accuracy improvements across multiple languages, per the same entry. GitHub does not itemise the accuracy deltas in the changelog.
The operational read is narrow. CodeQL is the analyser behind GitHub code scanning, and code scanning is usually one of the slower jobs in a repo's workflow set. A native arm64 build removes the qemu-style translation layer that self-hosted teams on Graviton, Ampere or Apple-silicon-adjacent hardware were quietly eating on every scan. It does not, by itself, change scan times on x86 runners.
What breaks if you cut over today
Two things to check before you flip a workflow. Anyone pinned to a specific CodeQL bundle version has to bump both the CLI and the bundle to 2.27.0 to pick up the arm64 asset; the download URL is per-platform, so a stale pin will silently keep pulling x86. And the new Rust query is genuinely new, so a repository that showed a clean CodeQL run on Rust code yesterday may see fresh alerts today. Those are findings from a query that did not exist in the prior bundle, not regressions in the analyser.
For teams that never left x86, the framework and accuracy work in this release is the actual change. For teams already on ARM, the CLI is the story: one less binary to translate, one less "why is code scanning so slow on the new runners" question at standup.
Top comments (0)