Support CodeQL versions, ranges, release offsets, and nightly transitions

CHANGELOG.md

@@ -4,7 +4,10 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th
 
 ## [UNRELEASED]
 
-No user facing changes.
+- The `tools` input for the `init` and `setup-codeql` Actions now accepts a bare CodeQL CLI version number, for example `2.19.0` or `v2.19.0`. The Action will automatically download the CodeQL Bundle release asset that matches the runner's operating system and architecture, preferring the smaller `zstd`-compressed bundle where it is supported.
+- The `tools` input also now accepts a CodeQL CLI version range, for example `2.24.x`, `2.x`, `~2.24.0`, or `^2.24.0`, as well as `latest-<N>` (for example `latest-1`), which resolves to the CodeQL Bundle release `N` stable releases before the most recent one.
+- The `tools` input also now accepts `latest-prerelease`, which resolves to the most recent CodeQL Bundle release, whether it is a stable release or a GitHub prerelease, as well as `nightly-until-<version>` (for example `nightly-until-2.24.0`), which resolves to the most recent CodeQL Bundle release satisfying that version threshold, considering GitHub prereleases too, or falls back to the latest nightly version of the CodeQL tools if no such release exists.
+- The `tools` input also now accepts `nightly-until-default-<version>` (for example `nightly-until-default-2.24.0`), which uses the default CodeQL CLI version for this environment if it satisfies that version threshold, or falls back to the latest nightly version of the CodeQL tools otherwise.
 
 ## 4.37.6 - 04 Aug 2026
 

init/action.yml

@@ -10,6 +10,24 @@ inputs:
 
       - A local path to a CodeQL Bundle tarball, or
       - The URL of a CodeQL Bundle tarball GitHub release asset, or
+      - A CodeQL CLI version number, for example `2.19.0` or `v2.19.0`, in which case the CodeQL
+        Bundle containing that version will be downloaded, selecting the archive format and
+        release asset that matches the runner's operating system and architecture, or
+      - A CodeQL CLI version range, for example `2.24.x`, `2.x`, `~2.24.0`, or `^2.24.0`, in
+        which case the most recent stable CodeQL Bundle release satisfying that range will be
+        downloaded, or
+      - `latest-<N>`, for example `latest-1` or `LATEST-2` (matching is case insensitive), which
+        uses the CodeQL Bundle release `N` stable releases before the most recent one, or
+      - A special value `latest-prerelease` (matching is case insensitive) which uses the most
+        recent CodeQL Bundle release, whether it is a stable release or a GitHub prerelease, or
+      - `nightly-until-<version>`, for example `nightly-until-2.24.0` or
+        `NIGHTLY-UNTIL-2.24.0` (matching is case insensitive), which uses the most recent CodeQL
+        Bundle release satisfying that version threshold, considering GitHub prereleases too, or
+        falls back to the latest nightly version of the CodeQL tools if no such release exists, or
+      - `nightly-until-default-<version>`, for example `nightly-until-default-2.24.0` (matching
+        is case insensitive), which uses the default CodeQL CLI version if it satisfies that
+        version threshold, or falls back to the latest nightly version of the CodeQL tools
+        otherwise, or
       - A special value `linked` which uses the version of the CodeQL tools
         that the Action has been bundled with.
       - A special value `nightly` which uses the latest nightly version of the