Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
CodeQL Action v2 retired on January 10, 2025. If an advanced GitHub code-scanning workflow still references github/codeql-action/*@v2, update it. On GitHub.com and supported GitHub Enterprise Server (GHES) versions, the forward-looking target is CodeQL Action v4, not v3, because v3 is scheduled for deprecation in December 2026.
What “retired” means
GitHub’s retirement notice means CodeQL Action v2 is no longer updated or supported. GitHub said it would not normally delete the old action, except in response to a security vulnerability, so every v2 workflow did not necessarily fail immediately on January 10, 2025. However, such workflows may eventually break and do not receive newer CodeQL capabilities. See GitHub’s retirement announcement.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Alice and Bob Learn Secure Coding | $32.76 | Buy on Amazon |
| 2 |
|
The Secure Vibe Coding Handbook: A Practical Guide to Safe and Secure AI Programming | $14.99 | Buy on Amazon |
| 3 |
|
Secure Coding in C And C++ | $29.99 | Buy on Amazon |
| 4 |
|
Secure Coding: Principles and Practices | $39.98 | Buy on Amazon |
| 5 |
|
Secure Coding in C and C++ (SEI Series in Software Engineering) | $40.69 | Buy on Amazon |
This is an action-version migration, not the same thing as a CodeQL query-engine migration. For example, CodeQL engine releases such as the dated CodeQL 2.26.1 release are separate from the major version of the GitHub Action.
Recommended Free Tools
Are you affected?
- Default code-scanning setup: GitHub generally manages the workflow and action-version transition, so you normally do not edit a workflow manually.
- Advanced setup: You are affected if a workflow explicitly uses
init,autobuild,analyze, orupload-sarifat v2. - Reusable workflows and templates: The reference may be in a workflow called with
workflow_call, an organization-provided template, or a composite action rather than the repository’s obvious CodeQL YAML file. - SHA-pinned actions: A full commit SHA can still point to an old v2 release even when the file contains no visible
@v2. Check the workflow run summary and deliberately advance the pin.
Find CodeQL v2 references
Search the tracked workflow files first:
git grep -n -E 'github/codeql-action/(init|autobuild|analyze|upload-sarif)@v2' -- .githubThen search for all CodeQL references, including unusual components:
#1 Best Overall
git grep -n 'github/codeql-action' -- .githubFor a case-insensitive search that also finds files not tracked by Git:
grep -Rni --exclude-dir=.git 'github/codeql-action' .githubInspect .github/workflows/, reusable workflows, composite actions, organization workflow templates, Dependabot pull requests, and generated workflow files. If your organization pins actions by SHA, identify the release represented by each SHA before changing it.
Update the workflow
The current recommendation: v4
Where the platform supports Node.js 24-based actions, replace v2 references directly with v4:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →- uses: github/codeql-action/init@v4
- uses: github/codeql-action/autobuild@v4
- uses: github/codeql-action/analyze@v4
- uses: github/codeql-action/upload-sarif@v4The original 2025 guidance was to move from v2 to v3. That was a valid historical migration, but v3 is scheduled for deprecation alongside GHES 3.19 in December 2026. Moving directly to v4 avoids a short-lived intermediate upgrade. GitHub documents the v3-to-v4 transition in its CodeQL Action v3 deprecation notice.
Minimal advanced-setup example
name: CodeQL
on:
push:
branches: [ "main" ]
pull_request:
branches: [ "main" ]
schedule:
- cron: '30 1 * * 0'
jobs:
analyze:
name: Analyze
runs-on: ubuntu-latest
permissions:
security-events: write
packages: read
actions: read
contents: read
strategy:
fail-fast: false
matrix:
language: [ 'javascript-typescript' ]
steps:
- name: Checkout repository
uses: actions/checkout@v4
- name: Initialize CodeQL
uses: github/codeql-action/init@v4
with:
languages: ${{ matrix.language }}
- name: Autobuild
uses: github/codeql-action/autobuild@v4
- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v4
with:
category: "/language:${{matrix.language}}"In most migrations, change only the CodeQL action major version. Do not unnecessarily rewrite the language matrix, build mode, query configuration, schedule, or permissions.
If the workflow uploads SARIF
upload-sarif is generally used to upload results produced by another security analyzer. If the workflow uses GitHub’s component, update it as follows:
Rank #3
- uses: github/codeql-action/upload-sarif@v4It is not required for ordinary CodeQL analysis, which normally uses init, an optional build step, and analyze. Changing the uploader does not repair malformed SARIF or errors produced by the third-party analyzer.
Tags versus commit SHAs
A reference such as @v4 is simple and follows the v4 major-release line. A full commit SHA improves reproducibility and can support stricter supply-chain policies, but it must be intentionally updated to a supported v4 release. Do not replace secure SHA pinning blindly; update the pin through your normal review process. Dependabot can help propose GitHub Actions dependency updates:
version-updates:
- package-ecosystem: github-actions
directory: "/"
schedule:
interval: weeklyDependabot reduces maintenance work, but it does not resolve incompatible GHES versions, build failures, permissions, runner limitations, or enterprise action policies.
Rank #4
- Used Book in Good Condition
GHES compatibility
CodeQL Action v4 uses Node.js 24. The practical guidance as of August 18, 2026 is:
| Platform | Guidance |
|---|---|
| GitHub.com | Update advanced workflows to v4. |
| GHES 3.20 and newer | v4 is included; update advanced workflows to v4. |
| GHES 3.19 | v4 can be downloaded through GitHub Connect if the administrator enables access. |
| GHES 3.18 and older | These versions cannot run the Node.js 24-based v4 action; upgrade GHES first. |
| GHES 3.11 and older | These are already retired in the context of the v2 migration and are not a supported migration target. |
On GHES, a syntactically correct YAML change can still fail if GitHub Connect is disabled, external action downloads are blocked, or enterprise policy disallows github/codeql-action. Review your server version and administrator policy before merging. GitHub’s runtime and compatibility details are covered in its v4 announcement.
Validate the migration
- Make the version changes on a branch.
- Push the branch or open a pull request that triggers code scanning.
- Inspect the Actions run for the runner operating system and architecture, language initialization, build or autobuild, database finalization, SARIF upload, and permission errors.
- Confirm that new findings appear in the repository’s Security area.
- Check the run log for retired-action or unsupported-Node.js warnings.
For compiled languages, autobuild may not infer the project’s build system. Use the project’s real build commands when necessary, for example:
- name: Build
run: |
./configure
make clean
makeThis is only an example; adapt it to the repository’s toolchain.
Troubleshoot common failures
| Symptom | Likely causes and next steps |
|---|---|
| Node.js version warning | A v2 or v3 reference remains, or another action still uses an old runtime. Search the complete workflow set and update supported dependencies. |
| “Action not found” | Check the action name, GHES version, GitHub Connect availability, network access, and enterprise allowlists. |
| “Resource not accessible by integration” | Check security-events: write and repository or enterprise pull-request policies. Do not expose secrets broadly to untrusted fork code just to bypass a permission error. |
| Build or autobuild failure | The runner may lack the required toolchain, the project may need an explicit build command, or the language matrix may include an unsuitable language. |
| SARIF upload failure | Confirm that the analyzer produced valid SARIF, the upload action matches the supported platform, and the workflow has the required security-events permission. |
| Unsupported runner | Check runner software, operating system, architecture, network access, and Node.js 24 constraints. Node.js 24 is incompatible with macOS 13.4 and lower and has no official ARM32 support. See GitHub’s Actions runtime migration guidance. |
Prevent the next action retirement
- Use Dependabot or an equivalent reviewed update process for GitHub Actions.
- Document whether your organization uses major tags, immutable SHAs, or another pinning policy.
- Test action upgrades in branches before changing shared workflows or templates.
- Search reusable workflows and organization templates during every migration.
- Track GitHub Changelog notices and the planned December 2026 CodeQL v3 deprecation.
What you probably do not need to buy
For most repositories, this notice does not require a new security product. The fix is to modernize the existing GitHub Actions workflow. GitHub Advanced Security may be relevant to organizations evaluating broader code, secret, and dependency security capabilities, but changing from CodeQL Action v2 to v4 alone does not justify moving to GitHub Enterprise or purchasing additional Actions capacity. Review current offerings through GitHub Advanced Security and GitHub Enterprise if your organization has separate licensing or compliance requirements.
The Bottom Line
Bottom line: CodeQL Action v2 is retired. Default-setup repositories generally need no manual edit; advanced workflows should move from v2 directly to v4 wherever GitHub.com or the GHES and runner environment supports it. Verify reusable workflows, SHA pins, permissions, builds, and platform compatibility before declaring the migration complete.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
