When AI writes code, review must get stricter. Output speed rose; human reading speed did not. GitHub's CodeQL 2.27.2 on October 9 targets exactly that — a C++ regex parser and Rust async flow tracking that cover corners humans skip. The CLI release is dated October 7.

This post reads the release notes as a PR gate: what gets caught now, what might break, and what to check in CI.

What gets caught: per-language cores

One-line direction: Default suite of 498 security queries over 170 CWEs, Extended adding 131 queries and 32 more CWEs. Same net, wider corners.

C/C++ — regex and third-party flows
 [o] parses ECMAScript-grammar regex in std::regex directly
     → inspection sees pattern structure, not just strings
 [o] SQL-injection sink models for Comdb2 C API (cdb2_run_statement, ...)
 [o] flow summaries for Bloomberg BDE codecs and bslx deserializers

Rust — async and attributes
 [o] extractor on rust-analyzer 0.0.352; AnyAttr and DocComment classes
 [o] better data flow for async blocks used with await
 [o] flow summaries for native-tls, async-native-tls, tokio-native-tls

Go — import paths and control flow
 [o] models github.com/coder/websocket alongside nhooyr.io/websocket
 [o] control-flow-graph library change (custom queries may need edits)

JavaScript/TypeScript — workflows and routes
 [o] recognizes Workflow SDK "use workflow" and "use step" directives
 [o] better Hapi handler and request-input tracking via helpers and HOFs

Before: code → read as strings → missed flows
After:  code → read as structure → tracked flows
  ├─ C++ regex: looks inside the pattern
  ├─ Rust async: follows data across await boundaries
  └─ JS workflows: understands directives and route registration

C# query refinements, an Actions trusted-owner exclusion, and CLI error-handling improvements ship alongside. PRs with AI-generated code feel these flow-tracking gains most — the machine covers diffs humans cannot fully read.

What might break: macOS 27 and Go queries

Two spots to check first.

Caution 1 — macOS 27 + Xcode 27 (compiled languages)
  multi-arch (x86-64/arm64) binary packaging changed
  → some CodeQL autobuild and manual build modes limited
  → check CI images and Xcode versions for C++ and Linux projects first

Caution 2 — Go control-flow-graph library (custom queries)
  additions like ControlFlow::EntryNode, ExitNode, SwitchStmt.getExpr
  → existing custom queries may break; diff against the changelog

Nothing sadder than a red CI after an upgrade. Run code scanning on a test branch first, and if you carry custom queries, start with the Go diff.

CodeBridge Mini Lab: wire it into the PR gate

Nothing grand needed. Scan automatically before merge; humans look when it trips.

# .github/workflows/codeql.yml — sketch, adapt paths to your repo
name: codeql-gate
on:
  pull_request:
    branches: [main]
jobs:
  analyze:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: github/codeql-action/init@v3
        with:
          languages: cpp, rust, go, javascript
          queries: security-and-quality
      - uses: github/codeql-action/analyze@v3

Four-piece PR gate:
 [ ] Default suite on — 498 queries and 170 CWEs as the start line
 [ ] per-language check — does your repo use C++ regex, Rust async, JS workflows
 [ ] flag AI-generated code — assign reviewers to Copilot and agent-touched files
 [ ] pair with secret scanning — code scan plus secret scan in one gate

Two post-release checks:
 [ ] on macOS 27 and Xcode 27, confirm compiled-language build modes
 [ ] for custom Go queries, diff the control-flow changes

Pair this inspection with the isolation in the Copilot sandbox post: cage execution in the sandbox, let CodeQL read the result, finish with a five-minute human diff read.

Conclusion: generate fast, merge slow

One line to close.

Let AI own generation speed; let the gate own merge speed.

Version 2.27.2 is not a grand new product but a finer net: inside regexes, beyond awaits, behind workflow directives. Today's job is small. Check CodeQL settings and CI compatibility on C++ and Linux projects, and gate the next PR on the default suite. That is the minimum fare in the AI-generated-code era.

Further reading

References

Go deeper with a course

To practice controlling AI-written code with validated, constrained workflows, this course organizes project rules, checks, and environments — a direct continuation of the PR gate here.