CodeQL Action v4.37.4 was released on July 30, 2026. The release contains two changes that affect how teams control analysis inputs: a repository custom property can now supply the tools value used by codeql-action/init, and the default CodeQL bundle moves to 2.26.2. GitHub says the custom-property rollout will be gradual, so this is a change-control event—not a reason to assume every repository has the capability immediately.
This checklist is for maintainers who need to review the release safely across GitHub-managed workflows and Advanced Setup. It separates what the release documents from what you should test in your own repository. No customer repository was scanned here, and the workflow below is not a security guarantee.
What changed in CodeQL Action v4.37.4
| Release fact | Review implication |
|---|---|
tools may be supplied through the github-codeql-tools repository property |
Check who can change the property and whether its value is approved for the repository’s risk tier. |
| The default bundle is CodeQL 2.26.2 | Record the effective CLI/bundle version rather than inferring it from the action tag. |
| Rollout is gradual | Expect repositories to differ temporarily; verify each workflow’s resolved behavior. |
First, classify the workflow path
Start by identifying whether the repository uses default setup, Advanced Setup, or a mixture. GitHub-managed workflows can consume a default bundle, while an Advanced Setup workflow can specify tools in its workflow definition. The release notes state that the workflow value takes precedence unless the repository property starts with !. Treat that precedence rule as documented behavior and verify it with a controlled pull request or an isolated test repository before changing production policy.
- List every workflow that invokes
github/codeql-action/init. - Record the trigger, ref, permissions, runner, languages, and whether the workflow is generated by default setup.
- Capture the current action ref and the effective CodeQL bundle reported in logs or artifacts.
- Mark any workflow that receives configuration from organization or repository custom properties.
Review the custom-property control boundary
A repository property is configuration with an ownership and change-history problem. Confirm who may create or edit github-codeql-tools, whether changes are reviewed, and how a value is removed. Do not treat a property name as proof that the feature has rolled out to the repository. A useful review record includes the property value, the actor or automation that changed it, the approval reference, and the first successful run that demonstrated the intended resolution.
- Define an allowlist of acceptable values such as a reviewed bundle or
toolcache. - Reject unexpected whitespace, shell syntax, URLs, or unreviewed version strings in your policy layer.
- Check organization policy and repository administration permissions separately.
- Keep a rollback value and document the expected run-log evidence before rollout.
Test precedence without changing production coverage
Create a disposable branch or test repository with a deliberately simple CodeQL workflow. Use one test where the workflow defines tools directly and a second where it relies on the repository property. Compare the initialization logs and the bundle version. If you test the documented ! prefix behavior, make that an explicit negative or override case and preserve the run URL in internal evidence. The purpose is to verify resolution and auditability, not to claim that a successful run proves the code is safe.
- Pin the action ref under review in the test workflow.
- Use least-privilege
permissionsand a non-production branch. - Change only one source of
toolsat a time. - Save the resolved-version log line and the property/workflow inputs together.
- Repeat after the rollout window if the repository initially behaves like the old path.
Check the CodeQL bundle transition
CodeQL Action v4.37.4 updates the default bundle to 2.26.2, while the separate bundle release contains the CLI and query-pack changes. Review any baseline, query-pack compatibility, or SARIF normalization that depends on the version. Compare alert counts and rule identifiers only as an investigation signal; a count difference can result from improved coverage, changed queries, generated-code treatment, or repository state.
For a controlled transition, run the old and new configurations against the same immutable commit when possible. Store the two SARIF outputs privately, compare category and rule identifiers, and have a reviewer classify material changes. Keep unmatched results open for triage rather than treating them as safe or unsafe based on presence alone.
Workflow and permissions checklist
| Item | Pass condition | Evidence |
|---|---|---|
| Action ref | Matches the approved release policy | Workflow diff and review record |
| Tools source | One declared, authorized source wins | Workflow/property snapshot and run log |
| Permissions | No broader token scope than required | Workflow YAML and security review |
| Bundle | Effective version is recorded | Initialization output or artifact metadata |
| Results | Changed findings are triaged, not dismissed automatically | Same-commit comparison notes |
Common failure modes
The most common mistake is reviewing only the action tag and missing a repository property that changes the effective tool selection. Another is assuming the new default is present everywhere during a gradual rollout. A third is comparing total alerts across different commits and calling the difference a regression. Finally, a workflow can be operationally reproducible while still having excessive permissions or an unreviewed administrator path. Keep resolution, authorization, and result interpretation as separate checks.
FAQ
Does v4.37.4 force every workflow to use CodeQL 2.26.2?
No. The release updates the default bundle, but Advanced Setup inputs and rollout behavior can affect the effective version. Verify the path used by each workflow.
Is toolcache automatically safer?
No. It may help teams control version changes or rate-limit pressure, but it is a policy choice that still needs an owner, approval, and rollback plan.
Should a changed alert count block deployment?
Not by itself. Preserve the results, identify changed rules and coverage, and apply your repository’s reviewed severity and deployment policy.
Use a local review record
For a repeatable local workflow, pair this release checklist with the free AI code review checklist. Teams evaluating how a change should be constrained before merge can also review the AI Change Firewall product page. For a broader positioning view, keep the single CodeRiskTools comparison page as the canonical comparison destination.
Official sources
- CodeQL Action v4.37.4 release — documented release notes.
- CodeQL Bundle 2.26.2 — referenced bundle release.
- GitHub code scanning documentation — configuration context.
- CodeQL workflow configuration documentation — workflow setup context.
- GitHub custom properties documentation — property administration context.
Editorial boundary: release-note statements above are documented/vendor claims. The verification steps are operational guidance. They do not establish that a repository is secure or unsafe.
