Add support for Linux Arm64 runners

CHANGELOG.md

@@ -4,7 +4,7 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th
 
 ## [UNRELEASED]
 
-No user facing changes.
+- The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and download the native `linux-arm64` CodeQL bundle when available. [#4072](https://github.com/github/codeql-action/pull/4072)
 
 ## 4.37.9 - 26 Aug 2026
 

pr-checks/checks/linux-arm64.yml

@@ -0,0 +1,30 @@
+name: "Linux Arm64"
+description: "An end-to-end integration test running on a Linux Arm64 runner, checking that the native linux-arm64 CodeQL bundle is downloaded and can analyze interpreted and compiled code"
+operatingSystems:
+  - os: ubuntu
+    runner-image: ubuntu-24.04-arm
+# The native linux-arm64 CodeQL bundle is only available in recent CLI releases, so we restrict this
+# check to `nightly-latest`, which is guaranteed to ship it. Older stable versions do not have an
+# arm64 asset, and `prepare-test` would resolve an x64 bundle URL for them on this runner.
+versions:
+  - nightly-latest
+installGo: true
+steps:
+  - uses: ./../action/init
+    with:
+      languages: javascript,python,go
+      tools: ${{ steps.prepare-test.outputs.tools-url }}
+  - name: Build Go code
+    run: go build main.go
+  - uses: ./../action/analyze
+    with:
+      upload-database: false
+  - name: Assert databases exist
+    run: |
+      cd "$RUNNER_TEMP/codeql_databases"
+      for lang in javascript python go; do
+        if [[ ! -d "$lang" ]]; then
+          echo "Did not find a database for $lang"
+          exit 1
+        fi
+      done

src/cli-errors.test.ts

@@ -128,7 +128,6 @@ test("CliError constructor with empty stderr", (t) => {
 
 for (const [platform, arch] of [
   ["weird_plat", "x64"],
-  ["linux", "arm64"],
   ["win32", "arm64"],
 ]) {
   test.serial(
@@ -157,20 +156,34 @@ for (const [platform, arch] of [
   );
 }
 
-test("wrapCliConfigurationError - supported platform", (t) => {
-  const commandError = new CommandInvocationError(
-    "codeql",
-    ["version"],
-    1,
-    "Some error",
-  );
-  const cliError = new CliError(commandError);
+for (const [platform, arch] of [
+  ["linux", "x64"],
+  ["linux", "arm64"],
+  ["win32", "x64"],
+  ["darwin", "x64"],
+  ["darwin", "arm64"],
+]) {
+  test.serial(
+    `wrapCliConfigurationError - ${platform}/${arch} supported`,
+    (t) => {
+      sinon.stub(process, "platform").value(platform);
+      sinon.stub(process, "arch").value(arch);
+      const commandError = new CommandInvocationError(
+        "codeql",
+        ["version"],
+        1,
+        "Some error",
+      );
+      const cliError = new CliError(commandError);
 
-  const wrappedError = wrapCliConfigurationError(cliError);
+      const wrappedError = wrapCliConfigurationError(cliError);
 
-  // Should return the original error since platform is supported
-  t.is(wrappedError, cliError);
-});
+      // Should return the original error since the platform is supported, rather
+      // than replacing it with the unsupported-platform ConfigurationError.
+      t.is(wrappedError, cliError);
+    },
+  );
+}
 
 test("wrapCliConfigurationError - autobuild error", (t) => {
   const commandError = new CommandInvocationError(

src/cli-errors.ts

@@ -8,6 +8,7 @@ import { ConfigurationError } from "./util";
 
 const SUPPORTED_PLATFORMS = [
   ["linux", "x64"],
+  ["linux", "arm64"],
   ["win32", "x64"],
   ["darwin", "x64"],
   ["darwin", "arm64"],

src/setup-codeql.test.ts

@@ -120,24 +120,42 @@ test.serial(
 const LINKED_BUNDLE_TEST_CASES = [
   {
     platform: "linux",
+    arch: "x64",
     tarSupportsZstd: true,
     expectedBundleName: "codeql-bundle-linux64.tar.zst",
     expectedCompressionMethod: "zstd",
   },
+  {
+    platform: "linux",
+    arch: "arm64",
+    tarSupportsZstd: true,
+    expectedBundleName: "codeql-bundle-linux-arm64.tar.zst",
+    expectedCompressionMethod: "zstd",
+  },
+  {
+    platform: "darwin",
+    arch: "arm64",
+    tarSupportsZstd: true,
+    expectedBundleName: "codeql-bundle-osx64.tar.zst",
+    expectedCompressionMethod: "zstd",
+  },
   {
     platform: "darwin",
+    arch: "x64",
     tarSupportsZstd: true,
     expectedBundleName: "codeql-bundle-osx64.tar.zst",
     expectedCompressionMethod: "zstd",
   },
   {
     platform: "win32",
+    arch: "x64",
     tarSupportsZstd: true,
     expectedBundleName: "codeql-bundle-win64.tar.gz",
     expectedCompressionMethod: "gzip",
   },
   {
     platform: "linux",
+    arch: "x64",
     tarSupportsZstd: false,
     expectedBundleName: "codeql-bundle-linux64.tar.gz",
     expectedCompressionMethod: "gzip",
@@ -146,15 +164,17 @@ const LINKED_BUNDLE_TEST_CASES = [
 
 for (const {
   platform,
+  arch,
   tarSupportsZstd,
   expectedBundleName,
   expectedCompressionMethod,
 } of LINKED_BUNDLE_TEST_CASES) {
   test.serial(
-    `getCodeQLSource selects ${expectedBundleName} for linked tools`,
+    `getCodeQLSource selects ${expectedBundleName} for linked tools on ${platform}/${arch}`,
     async (t) => {
       const features = createFeatures([]);
       sinon.stub(process, "platform").value(platform);
+      sinon.stub(process, "arch").value(arch);
 
       await withTmpDir(async (tmpDir) => {
         setupActionsVars(tmpDir, tmpDir);

src/setup-codeql.ts

@@ -75,7 +75,7 @@ export function getCodeQLBundleName(
   if (process.platform === "win32") {
     platform = "win64";
   } else if (process.platform === "linux") {
-    platform = "linux64";
+    platform = process.arch === "arm64" ? "linux-arm64" : "linux64";
   } else if (process.platform === "darwin") {
     platform = "osx64";
   } else {

src/testing-utils.ts

@@ -937,7 +937,9 @@ export function mockBundleDownloadApi({
     process.platform === "win32"
       ? "win64"
       : process.platform === "linux"
-        ? "linux64"
+        ? process.arch === "arm64"
+          ? "linux-arm64"
+          : "linux64"
         : "osx64";
 
   const baseUrl = apiDetails?.url ?? "https://example.com";