Merge branch 'main' into mbg/set-restore-keys

Author: mbg

.github/workflows/__go-tracing-autobuilder.yml

@@ -30,7 +30,7 @@ jobs:
       fail-fast: false
       matrix:
         version:
-        - stable-v2.20.3
+        - stable-v2.20.7
         - default
         - linked
         - nightly-latest

.github/workflows/__go-tracing-custom-build-steps.yml

@@ -29,7 +29,7 @@ jobs:
       fail-fast: false
       matrix:
         version:
-        - stable-v2.20.3
+        - stable-v2.20.7
         - default
         - linked
         - nightly-latest
@@ -85,7 +85,7 @@ jobs:
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       - name: Check expected artifacts exist
         run: |
-          VERSIONS="stable-v2.20.3 default linked nightly-latest"
+          VERSIONS="stable-v2.20.7 default linked nightly-latest"
           LANGUAGES="cpp csharp go java javascript python"
           for version in $VERSIONS; do
             pushd "./my-debug-artifacts-${version//./}"

.github/workflows/__go-tracing-legacy-workflow.yml

@@ -4,8 +4,13 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th
 
 ## [UNRELEASED]
 
+- _Breaking change_: Bump the minimum required CodeQL bundle version to 2.20.7. [#4205](https://github.com/github/codeql-action/pull/4205)
+
+## 4.38.3 - 08 Oct 2026
+
 - _Upcoming breaking change_: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. [#4188](https://github.com/github/codeql-action/pull/4188)
 - Update default CodeQL bundle version to [2.27.2](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2). [#4203](https://github.com/github/codeql-action/pull/4203)
+- Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. [#4184](https://github.com/github/codeql-action/pull/4184)
 
 ## 4.38.2 - 24 Sept 2026
 

.github/workflows/__multi-language-autodetect.yml

@@ -53,6 +53,7 @@ Here are a few things you can do that will increase the likelihood of your pull
 - Write tests.
 - Keep your change as focused as possible. If there are multiple changes you would like to make that are not dependent upon each other, consider submitting them as separate pull requests.
 - Write a [good commit message](http://tbaggery.com/2008/04/19/a-note-about-git-commit-messages.html).
+- For user-facing changes, add a change-note file. See [unreleased-change-notes/README.md](unreleased-change-notes/README.md).
 
 ## Releasing (write access required)
 

.github/workflows/__rust.yml

@@ -1,3 +1,4 @@
 import pkg from "./package.json" with { type: "json" };
 
 globalThis.__CODEQL_ACTION_VERSION__ = pkg.version;
+globalThis.__CODEQL_ACTION_TEST_ENV__ = "unit-test";