René's URL Explorer Experiment

Title: Use the combined bundle when queries may need other languages' library packs by henrymercer · Pull Request #4184 · github/codeql-action · GitHub

Open Graph Title: Use the combined bundle when queries may need other languages' library packs by henrymercer · Pull Request #4184 · github/codeql-action

X Title: Use the combined bundle when queries may need other languages' library packs by henrymercer · Pull Request #4184 · github/codeql-action

Description: We support custom configuration files that include packs for other languages, for example: name: Use custom queries disable-default-queries: true queries: ... - name: Go queries uses: codeql-testing/go-querypack@master - name: Cpp queries uses: codeql-testing/cpp-querypack@second-branch - name: JavaScript queries uses: codeql-testing/javascript-querypack/show_ifs2.ql@master - name: Python queries uses: codeql-testing/python-querypack/show_ifs2.ql@second-branch as taken from our PR checks. If these custom queries live in compiled packs, then the packs ship their own dependencies. However if the custom query is just a path to a QL file, then the dependencies are resolved from a bundle. This creates an issue with per-language bundles: CodeQL resolves every configured query before selecting the ones for the analyzed language, so a single-language analysis with a configuration like the above will fail. This is evidenced by failures in the "Go: Custom queries" and "Start proxy" PR checks when using per-language bundles. This PR only selects a per-language bundle when the query configuration known before CodeQL is set up can't reference such queries: there's no configuration file, the config input is unset or only sets threat models and model packs like default setup's does, and the queries input and github-codeql-extra-queries repository property only name built-in query suites. This avoids loading configuration files before setting up CodeQL, at the cost of using the combined bundle for configuration files that only use built-in queries. The config input is parsed once, before setting up CodeQL, and used both for this check and to configure the analysis. As a result, an invalid config input now fails before CodeQL is downloaded, with an error that names the config input rather than a temporary file. This PR also modifies setup-codeql to always use the combined bundle, since it can't tell whether the queries that a workflow runs with the CLI will need library packs for other languages. A separate commit corrects the docs for its languages and analysis-kinds inputs, which said to also pass them to init, even though init fails if setup-codeql has run in the same job. It also disables per-language bundles in the "Export file baseline information" PR check, since a per-language bundle only reports file baseline information for its own language. The second commit moves defaultSuites so that per-language-bundles.ts can use it without an import cycle. Finally, it moves per-language bundles to a new per_language_bundles_v2 feature flag, so that we can roll them out to Action versions that include this fix without also enabling them for earlier versions. Risk assessment Low risk: The change only affects bundle selection when the per_language_bundles or per_language_bundles_v2 feature flag is enabled. Which use cases does this change impact? Workflow types: Advanced setup - Single-language analyses with a configuration file, a config input, or queries that aren't built-in query suites, and workflows that pass a single language to setup-codeql. Managed - Default setup analyses that get a configuration file, or queries that aren't built-in query suites, from repository properties. Products: Code Scanning Code Quality Environments: Dotcom - Per-language bundles are only selected on GitHub.com. How did/will you validate this change? Unit tests - Each source of query configuration, and bundle selection for releases and nightlies. The setup-codeql Action's entry point has no unit tests, so its reason is only covered indirectly. End-to-end tests - "Go: Custom queries" and "Start proxy" use configuration files that reference other languages' queries, so they cover this change whenever they download a bundle with per-language bundles enabled. If something goes wrong after this change is released, what are the mitigation and rollback strategies? Feature flags - Disable per-language bundle selection with per_language_bundles_v2. How will you know if something goes wrong after this change is released? Telemetry - Monitor init failures in analyses that use a per-language bundle. Are there any special considerations for merging or releasing this change? No special considerations - This change can be merged at any time. Merge / deployment checklist Confirm this change is backwards compatible with existing workflows. Consider adding a changelog entry for this change. Confirm the readme and docs have been updated if necessary.

Open Graph Description: We support custom configuration files that include packs for other languages, for example: name: Use custom queries disable-default-queries: true queries: ... - name: Go queries uses: codeq...

X Description: We support custom configuration files that include packs for other languages, for example: name: Use custom queries disable-default-queries: true queries: ... - name: Go queries uses: codeq...

Opengraph URL: https://github.com/github/codeql-action/pull/4184

X: @github

direct link

Domain: github.com

Links:

Viewport: width=device-width