Wait for the CodeQL standard-library tag before opening upgrade PRs

[data-douser]

Problem

The Update CodeQL CLI Dependencies workflow treats a release as ready when it appears in github/codeql-cli-binaries. Publication of the corresponding standard-library tag in github/codeql may lag behind the binary release.

This race occurred in #418. The CLI archive for v2.26.2 downloaded successfully, but QLT subsequently failed with:

Unknown standard library version: codeql-cli/v2.26.2

The required upstream tag was published later, allowing the previously failing check to recover. PR #418 can proceed independently; this issue tracks preventative workflow hardening in a follow-up PR.

Proposed change

Update .github/workflows/update-codeql.yml so an automated upgrade proceeds only when both are available:

• The latest release in github/codeql-cli-binaries.
• The corresponding codeql-cli/v<version> tag in github/codeql, matching CodeQLStandardLibrary in qlt.conf.json.

When the standard-library tag is not yet available, defer the upgrade without creating a pull request. Report the reason in the workflow summary and allow the next scheduled run to retry.

API or authentication failures should remain visible as workflow failures rather than being treated as publication delays.

Acceptance criteria

• No upgrade PR is created while the corresponding github/codeql tag is unavailable.
• A missing tag produces a successful, clearly worded deferred-update summary.
• Genuine API and authentication failures fail the workflow visibly.
• Once both repositories contain the required release artifacts, the existing update and PR creation pipeline runs normally.
• A follow-up PR is linked to and closes this issue.
• The workflow YAML is validated.

References

• Upgrade CodeQL CLI dependency to v2.26.2 #418
• Diagnosis comment
• Previously failing CI job