So, to be clear, whenever we run tests with a CLI >= 2.7.2, we will automatically be running with the --codescanning-config. Are there any other, new integration tests we should be writing here?

That's right, yes. And indeed this already highlighted the issue I fixed in the internal PR (e.g. this run). I think our coverage of different config files is already pretty good, but I'm open to adding more if you think we need to.

There is a slight annoyance that the packaging tests run with old CLIs (deliberately, since these are known to be compatible with the test packs), so those won't hit the new code path and we're relying on the integration tests in semmle-code to catch issues with specifying packages in the config files. The solution there would be to re-release the test packs with the next CLI version, then we can run those tests with that CLI so that we hit the new code path there too.