hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-16 16:53:25 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'main' into redsun82/rust-doc

Browse Source
This commit is contained in:
Paolo Tranquilli
2025-06-06 14:25:37 +02:00
parent 00f4bfdd24 5bfed770ef
commit 779d06f47c
2754 changed files with 250096 additions and 21519 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
.github/workflows/build-ripunzip.yml vendored
View File

@@ -6,18 +6,18 @@ on:
ripunzip-version:
description: "what reference to checktout from google/runzip"
required: false
default: v1.2.1
default: v2.0.2
openssl-version:
description: "what reference to checkout from openssl/openssl for Linux"
required: false
default: openssl-3.3.0
default: openssl-3.5.0
jobs:
build:
strategy:
fail-fast: false
matrix:
os: [ubuntu-22.04, macos-13, windows-2019]
os: [ubuntu-22.04, macos-13, windows-2022]
runs-on: ${{ matrix.os }}
steps:
- uses: actions/checkout@v4

4
.github/workflows/csharp-qltest.yml vendored
View File

@@ -36,7 +36,7 @@ jobs:
unit-tests:
strategy:
matrix:
os: [ubuntu-latest, windows-2019]
os: [ubuntu-latest, windows-latest]
runs-on: ${{ matrix.os }}
steps:
- uses: actions/checkout@v4
@@ -66,6 +66,6 @@ jobs:
# Update existing stubs in the repo with the freshly generated ones
mv "$STUBS_PATH/output/stubs/_frameworks" ql/test/resources/stubs/
git status
codeql test run --threads=0 --search-path "${{ github.workspace }}" --check-databases --check-undefined-labels --check-repeated-labels --check-redefined-labels --consistency-queries ql/consistency-queries -- ql/test/library-tests/dataflow/flowsources/aspremote
codeql test run --threads=0 --search-path "${{ github.workspace }}" --check-databases --check-diff-informed --check-undefined-labels --check-repeated-labels --check-redefined-labels --consistency-queries ql/consistency-queries -- ql/test/library-tests/dataflow/flowsources/aspremote
env:
GITHUB_TOKEN: ${{ github.token }}

3
.github/workflows/go-tests-other-os.yml vendored
View File

@@ -26,9 +26,8 @@ jobs:
uses: ./go/actions/test
test-win:
if: github.repository_owner == 'github'
name: Test Windows
runs-on: windows-latest-xl
runs-on: windows-latest
steps:
- name: Check out code
uses: actions/checkout@v4

2
.github/workflows/mad_modelDiff.yml vendored
View File

@@ -68,7 +68,7 @@ jobs:
DATABASE=$2
cd codeql-$QL_VARIANT
SHORTNAME=`basename $DATABASE`
python java/ql/src/utils/modelgenerator/GenerateFlowModel.py --with-summaries --with-sinks $DATABASE $SHORTNAME/$QL_VARIANT
python misc/scripts/models-as-data/generate_mad.py --language java --with-summaries --with-sinks $DATABASE $SHORTNAME/$QL_VARIANT
mkdir -p $MODELS/$SHORTNAME
mv java/ql/lib/ext/generated/$SHORTNAME/$QL_VARIANT $MODELS/$SHORTNAME
cd ..

2
.github/workflows/ruby-qltest-rtjo.yml vendored
View File

@@ -35,6 +35,6 @@ jobs:
key: ruby-qltest
- name: Run QL tests
run: |
codeql test run --dynamic-join-order-mode=all --threads=0 --ram 50000 --search-path "${{ github.workspace }}" --check-databases --check-undefined-labels --check-unused-labels --check-repeated-labels --check-redefined-labels --check-use-before-definition --consistency-queries ql/consistency-queries ql/test --compilation-cache "${{ steps.query-cache.outputs.cache-dir }}"
codeql test run --dynamic-join-order-mode=all --threads=0 --ram 50000 --search-path "${{ github.workspace }}" --check-databases --check-diff-informed --check-undefined-labels --check-unused-labels --check-repeated-labels --check-redefined-labels --check-use-before-definition --consistency-queries ql/consistency-queries ql/test --compilation-cache "${{ steps.query-cache.outputs.cache-dir }}"
env:
GITHUB_TOKEN: ${{ github.token }}

2
.github/workflows/ruby-qltest.yml vendored
View File

@@ -68,6 +68,6 @@ jobs:
key: ruby-qltest
- name: Run QL tests
run: |
codeql test run --threads=0 --ram 50000 --search-path "${{ github.workspace }}" --check-databases --check-undefined-labels --check-unused-labels --check-repeated-labels --check-redefined-labels --check-use-before-definition --consistency-queries ql/consistency-queries ql/test --compilation-cache "${{ steps.query-cache.outputs.cache-dir }}"
codeql test run --threads=0 --ram 50000 --search-path "${{ github.workspace }}" --check-databases --check-diff-informed --check-undefined-labels --check-unused-labels --check-repeated-labels --check-redefined-labels --check-use-before-definition --consistency-queries ql/consistency-queries ql/test --compilation-cache "${{ steps.query-cache.outputs.cache-dir }}"
env:
GITHUB_TOKEN: ${{ github.token }}

2
.github/workflows/swift.yml vendored
View File

@@ -32,7 +32,7 @@ jobs:
if: github.repository_owner == 'github'
strategy:
matrix:
runner: [ubuntu-latest, macos-13-xlarge]
runner: [ubuntu-latest, macos-15-xlarge]
fail-fast: false
runs-on: ${{ matrix.runner }}
steps:

5
.gitignore vendored
View File

@@ -62,6 +62,7 @@ node_modules/
# Temporary folders for working with generated models
.model-temp
/mad-generation-build
# bazel-built in-tree extractor packs
/*/extractor-pack
@@ -71,3 +72,7 @@ node_modules/
# cargo build directory
/target
# some upgrade/downgrade checks create these files
**/upgrades/*/*.dbscheme.stats
**/downgrades/*/*.dbscheme.stats

5
CODEOWNERS
View File

@@ -8,6 +8,7 @@
/javascript/ @github/codeql-javascript
/python/ @github/codeql-python
/ruby/ @github/codeql-ruby
/rust/ @github/codeql-rust
/swift/ @github/codeql-swift
/misc/codegen/ @github/codeql-swift
/java/kotlin-extractor/ @github/codeql-kotlin
@@ -15,7 +16,8 @@
/java/ql/test-kotlin2/ @github/codeql-kotlin
# Experimental CodeQL cryptography
**/experimental/quantum/ @github/ps-codeql
**/experimental/**/quantum/ @github/ps-codeql
/shared/quantum/ @github/ps-codeql
# CodeQL tools and associated docs
/docs/codeql/codeql-cli/ @github/codeql-cli-reviewers
@@ -41,6 +43,7 @@ MODULE.bazel @github/codeql-ci-reviewers
/.github/workflows/go-* @github/codeql-go
/.github/workflows/ql-for-ql-* @github/codeql-ql-for-ql-reviewers
/.github/workflows/ruby-* @github/codeql-ruby
/.github/workflows/rust.yml @github/codeql-rust
/.github/workflows/swift.yml @github/codeql-swift
# Misc

323
Cargo.lock generated
View File

@@ -154,15 +154,15 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
[[package]]
name = "bitflags"
version = "2.8.0"
version = "2.9.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "8f68f53c83ab957f72c32642f3868eec03eb974d1fb82e453128456482613d36"
checksum = "5c8214115b7bf84099f1309324e63141d4c5d7cc26862f97a0a857dbefe165bd"
[[package]]
name = "borsh"
version = "1.5.3"
version = "1.5.5"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "2506947f73ad44e344215ccd6403ac2ae18cd8e046e581a441bf8d199f257f03"
checksum = "5430e3be710b68d984d1391c854eb431a9d548640711faa54eecb1df93db91cc"
dependencies = [
"cfg_aliases",
]
@@ -224,9 +224,9 @@ dependencies = [
[[package]]
name = "cargo_metadata"
version = "0.18.1"
version = "0.19.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "2d886547e41f740c616ae73108f6eb70afe6d940c7bc697cb30f13daec073037"
checksum = "dd5eb614ed4c27c5d706420e4320fbe3216ab31fa1c33cd8246ac36dae4479ba"
dependencies = [
"camino",
"cargo-platform",
@@ -242,6 +242,8 @@ version = "1.2.7"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "a012a0df96dd6d06ba9a1b29d6402d1a5d77c6befd2566afdc26e10603dc93d7"
dependencies = [
"jobserver",
"libc",
"shlex",
]
@@ -275,7 +277,7 @@ version = "0.100.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "4f114996bda14c0213f014a4ef31a7867dcf5f539a3900477fc6b20138e7a17b"
dependencies = [
"bitflags 2.8.0",
"bitflags 2.9.0",
"chalk-derive",
]
@@ -301,7 +303,7 @@ dependencies = [
"chalk-derive",
"chalk-ir",
"ena",
"indexmap 2.7.0",
"indexmap 2.9.0",
"itertools 0.12.1",
"petgraph",
"rustc-hash 1.1.0",
@@ -325,9 +327,9 @@ dependencies = [
[[package]]
name = "clap"
version = "4.5.32"
version = "4.5.35"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "6088f3ae8c3608d19260cd7445411865a485688711b78b5be70d78cd96136f83"
checksum = "d8aa86934b44c19c50f87cc2790e19f54f7a67aedb64101c2e1a2e5ecfb73944"
dependencies = [
"clap_builder",
"clap_derive",
@@ -335,9 +337,9 @@ dependencies = [
[[package]]
name = "clap_builder"
version = "4.5.32"
version = "4.5.35"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "22a7ef7f676155edfb82daa97f99441f3ebf4a58d5e32f295a56259f1b6facc8"
checksum = "2414dbb2dd0695280da6ea9261e327479e9d37b0630f6b53ba2a11c60c679fd9"
dependencies = [
"anstream",
"anstyle",
@@ -390,6 +392,7 @@ dependencies = [
"tree-sitter",
"tree-sitter-json",
"tree-sitter-ql",
"zstd",
]
[[package]]
@@ -622,7 +625,7 @@ version = "0.14.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "3d248bdd43ce613d87415282f69b9bb99d947d290b10962dd6c56233312c2ad5"
dependencies = [
"log 0.4.25",
"log 0.4.27",
]
[[package]]
@@ -691,9 +694,9 @@ checksum = "a246d82be1c9d791c5dfde9a2bd045fc3cbba3fa2b11ad558f27d01712f00569"
[[package]]
name = "equivalent"
version = "1.0.1"
version = "1.0.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "5443807d6dff69373d433ab9ef5378ad8df50ca6298caf15de6e52e24aaf54d5"
checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
[[package]]
name = "figment"
@@ -781,7 +784,7 @@ checksum = "cc6bd114ceda131d3b1d665eba35788690ad37f5916457286b32ab6fd3c438dd"
dependencies = [
"cfg-if",
"libc",
"log 0.4.25",
"log 0.4.27",
"rustversion",
"windows",
]
@@ -812,7 +815,7 @@ checksum = "15f1ce686646e7f1e19bf7d5533fe443a45dbfb990e00629110797578b42fb19"
dependencies = [
"aho-corasick",
"bstr",
"log 0.4.25",
"log 0.4.27",
"regex-automata 0.4.9",
"regex-syntax 0.8.5",
]
@@ -918,9 +921,9 @@ dependencies = [
[[package]]
name = "indexmap"
version = "2.7.0"
version = "2.9.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "62f822373a4fe84d4bb149bf54e584a7f4abec90e072ed49cda0edea5b95471f"
checksum = "cea70ddb795996207ad57735b50c5982d8844f38ba9ee5f1aedcfb708a2aa11e"
dependencies = [
"equivalent",
"hashbrown 0.15.2",
@@ -939,7 +942,7 @@ version = "0.11.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f37dccff2791ab604f9babef0ba14fbe0be30bd368dc541e2b08d07c8aa908f3"
dependencies = [
"bitflags 2.8.0",
"bitflags 2.9.0",
"inotify-sys",
"libc",
]
@@ -979,9 +982,18 @@ dependencies = [
[[package]]
name = "itoa"
version = "1.0.14"
version = "1.0.15"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "d75a2a4b1b190afb6f5425f10f6a8f959d2ea0b9c2b1d79553551850539e4674"
checksum = "4a5f13b858c8d314ee3e8f639011f7ccefe71f97f96e50151fb991f267928e2c"
[[package]]
name = "jobserver"
version = "0.1.32"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "48d1dbcbbeb6a7fec7e059840aa538bd62aaccf972c7346c4d9d2059312853d0"
dependencies = [
"libc",
]
[[package]]
name = "jod-thread"
@@ -1033,9 +1045,9 @@ checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
[[package]]
name = "libc"
version = "0.2.169"
version = "0.2.171"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "b5aba8db14291edd000dfcc4d620c7ebfb122c613afb886ca8803fa4e128a20a"
checksum = "c19937216e9d3aa9956d9bb8dfc0b0c8beb6058fc4f7a4dc4d850edf86a237d6"
[[package]]
name = "libredox"
@@ -1043,7 +1055,7 @@ version = "0.1.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c0ff37bd590ca25063e35af745c343cb7a0271906fb7b37e4813e8f79f00268d"
dependencies = [
"bitflags 2.8.0",
"bitflags 2.9.0",
"libc",
"redox_syscall",
]
@@ -1074,14 +1086,14 @@ version = "0.3.9"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "e19e8d5c34a3e0e2223db8e060f9e8264aeeb5c5fc64a4ee9965c062211c024b"
dependencies = [
"log 0.4.25",
"log 0.4.27",
]
[[package]]
name = "log"
version = "0.4.25"
version = "0.4.27"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "04cbf5b083de1c7e0222a7a51dbfdba1cbe1c6ab0b15e29fff3f6c077fd9cd9f"
checksum = "13dc2df351e3202783a1fe0d44375f7295ffb4049267b0f3018346dc122a1d94"
[[package]]
name = "loom"
@@ -1096,12 +1108,6 @@ dependencies = [
"tracing-subscriber",
]
[[package]]
name = "lz4_flex"
version = "0.11.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "75761162ae2b0e580d7e7c390558127e5f01b4194debd6221fd8c207fc80e3f5"
[[package]]
name = "matchers"
version = "0.1.0"
@@ -1142,7 +1148,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "2886843bf800fba2e3377cff24abf6379b4c4d5c6681eaf9ea5b0d15090450bd"
dependencies = [
"libc",
"log 0.4.25",
"log 0.4.27",
"wasi 0.11.0+wasi-snapshot-preview1",
"windows-sys 0.52.0",
]
@@ -1178,13 +1184,13 @@ version = "8.0.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "2fee8403b3d66ac7b26aee6e40a897d85dc5ce26f44da36b8b73e987cc52e943"
dependencies = [
"bitflags 2.8.0",
"bitflags 2.9.0",
"filetime",
"fsevent-sys",
"inotify",
"kqueue",
"libc",
"log 0.4.25",
"log 0.4.27",
"mio",
"notify-types",
"walkdir",
@@ -1240,9 +1246,9 @@ checksum = "945462a4b81e43c4e3ba96bd7b49d834c6f61198356aa858733bc4acf3cbe62e"
[[package]]
name = "oorandom"
version = "11.1.4"
version = "11.1.5"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "b410bbe7e14ab526a0e86877eb47c6996a2bd7746f027ba551028c925390e4e9"
checksum = "d6790f58c7ff633d8771f42965289203411a5e5c68388703c06e14f24770b41e"
[[package]]
name = "os_str_bytes"
@@ -1331,7 +1337,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "b4c5cc86750666a3ed20bdaf5ca2a0344f9c67674cae0515bec2da16fbaa47db"
dependencies = [
"fixedbitset",
"indexmap 2.7.0",
"indexmap 2.9.0",
]
[[package]]
@@ -1340,6 +1346,12 @@ version = "0.2.16"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "3b3cff922bd51709b605d9ead9aa71031d81447142d828eb4a6eba76fe619f9b"
[[package]]
name = "pkg-config"
version = "0.3.32"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "7edddbd0b52d732b21ad9a5fab5c704c14cd949e5e9a1ec5929a24fded1b904c"
[[package]]
name = "portable-atomic"
version = "1.11.0"
@@ -1398,7 +1410,7 @@ version = "0.100.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f1651b0f7e8c3eb7c27a88f39d277e69c32bfe58e3be174d286c1a24d6a7a4d8"
dependencies = [
"bitflags 2.8.0",
"bitflags 2.9.0",
"ra-ap-rustc_hashes",
"ra-ap-rustc_index",
"tracing",
@@ -1470,18 +1482,16 @@ dependencies = [
[[package]]
name = "ra_ap_base_db"
version = "0.0.270"
version = "0.0.273"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "4baa9734d254af14fd603528ad594650dea601b1764492bd39988da38598ae67"
checksum = "8fd761118bbafe29e2b187e694c6b8e800f2c7822bbc1d9d2db4ac21fb8b0365"
dependencies = [
"dashmap 5.5.3",
"la-arena",
"lz4_flex",
"ra_ap_cfg",
"ra_ap_intern",
"ra_ap_query-group-macro",
"ra_ap_span",
"ra_ap_stdx",
"ra_ap_syntax",
"ra_ap_vfs",
"rustc-hash 2.1.1",
@@ -1493,9 +1503,9 @@ dependencies = [
[[package]]
name = "ra_ap_cfg"
version = "0.0.270"
version = "0.0.273"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "0ef2ba45636c5e585040c0c4bee640737a6001b08309f1a25ca78cf04abfbf90"
checksum = "5ce74ce1af24afd86d3529dbbf5a849d026948b2d8ba51d199b6ea6db6e345b6"
dependencies = [
"ra_ap_intern",
"ra_ap_tt",
@@ -1505,20 +1515,20 @@ dependencies = [
[[package]]
name = "ra_ap_edition"
version = "0.0.270"
version = "0.0.273"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "8955c1484d5e7274f755187788ba0d51eb149f870c69cdf0d87c3b7edea20ea0"
checksum = "f423b9fb19e3920e4c7039120d09d9c79070a26efe8ff9f787c7234b07f518c5"
[[package]]
name = "ra_ap_hir"
version = "0.0.270"
version = "0.0.273"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "a51d7955beff2212701b149bea36d4cf2dc0f5cd129652c9bcf0cb5c0b021078"
checksum = "dd4aa8a568b80d288b90c4fa5dc8a3cc405914d261bfd33a3761c1ba41be358d"
dependencies = [
"arrayvec",
"either",
"indexmap 2.7.0",
"itertools 0.12.1",
"indexmap 2.9.0",
"itertools 0.14.0",
"ra_ap_base_db",
"ra_ap_cfg",
"ra_ap_hir_def",
@@ -1537,23 +1547,20 @@ dependencies = [
[[package]]
name = "ra_ap_hir_def"
version = "0.0.270"
version = "0.0.273"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "e5c97e617e4c585d24b3d4f668861452aedddfbe0262f4c53235dcea77e62f9b"
checksum = "acb18d9378a828a23ccf87b89199db005adb67ba2a05a37d7a3fcad4d1036e66"
dependencies = [
"arrayvec",
"bitflags 2.8.0",
"bitflags 2.9.0",
"cov-mark",
"dashmap 5.5.3",
"drop_bomb",
"either",
"fst",
"hashbrown 0.14.5",
"indexmap 2.7.0",
"itertools 0.12.1",
"indexmap 2.9.0",
"itertools 0.14.0",
"la-arena",
"ra-ap-rustc_abi",
"ra-ap-rustc_hashes",
"ra-ap-rustc_parse_format",
"ra_ap_base_db",
"ra_ap_cfg",
@@ -1570,21 +1577,20 @@ dependencies = [
"salsa",
"smallvec",
"text-size",
"thin-vec",
"tracing",
"triomphe",
]
[[package]]
name = "ra_ap_hir_expand"
version = "0.0.270"
version = "0.0.273"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "be57c0d7e3f2180dd8ea584b11447f34060eadc06f0f6d559e2a790f6e91b6c5"
checksum = "094fa79d8f661f52cf3b7fb8b3d91c4be2ad9e71a3967d3dacd25429fa44b37d"
dependencies = [
"cov-mark",
"either",
"hashbrown 0.14.5",
"itertools 0.12.1",
"la-arena",
"itertools 0.14.0",
"ra_ap_base_db",
"ra_ap_cfg",
"ra_ap_intern",
@@ -1605,24 +1611,22 @@ dependencies = [
[[package]]
name = "ra_ap_hir_ty"
version = "0.0.270"
version = "0.0.273"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f260f35748f3035b46a8afcdebda7cb75d95c24750105fad86101d09a9d387c8"
checksum = "093482d200d5db421db5692e7819bbb14fb717cc8cb0f91f93cce9fde85b3df2"
dependencies = [
"arrayvec",
"bitflags 2.8.0",
"bitflags 2.9.0",
"chalk-derive",
"chalk-ir",
"chalk-recursive",
"chalk-solve",
"cov-mark",
"dashmap 5.5.3",
"either",
"ena",
"indexmap 2.7.0",
"itertools 0.12.1",
"indexmap 2.9.0",
"itertools 0.14.0",
"la-arena",
"nohash-hasher",
"oorandom",
"ra-ap-rustc_abi",
"ra-ap-rustc_index",
@@ -1647,19 +1651,18 @@ dependencies = [
[[package]]
name = "ra_ap_ide_db"
version = "0.0.270"
version = "0.0.273"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "0426263be26e27cb55a3b9ef88b120511b66fe7d9b418a2473d6d5f3ac2fe0a6"
checksum = "b655b92dfa9444db8129321b9217d9e4a83a58ee707aa1004a93052acfb43d57"
dependencies = [
"arrayvec",
"bitflags 2.8.0",
"bitflags 2.9.0",
"cov-mark",
"crossbeam-channel",
"dashmap 5.5.3",
"either",
"fst",
"indexmap 2.7.0",
"itertools 0.12.1",
"indexmap 2.9.0",
"itertools 0.14.0",
"line-index",
"memchr",
"nohash-hasher",
@@ -1681,9 +1684,9 @@ dependencies = [
[[package]]
name = "ra_ap_intern"
version = "0.0.270"
version = "0.0.273"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f6ea8c9615b3b0688cf557e7310dbd9432f43860c8ea766d54f4416cbecf3571"
checksum = "b4e528496b4d4c351806bb073d3d7f6526535741b9e8801776603c924bbec624"
dependencies = [
"dashmap 5.5.3",
"hashbrown 0.14.5",
@@ -1693,17 +1696,16 @@ dependencies = [
[[package]]
name = "ra_ap_load-cargo"
version = "0.0.270"
version = "0.0.273"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "570907e16725c13a678bfd8050ce8839af2831da042a0878b75ee8c41b0f7b0c"
checksum = "1a97a5070b2f4b99f56683d91b2687aa0c530d8969cc5252ec2ae5644e428ffe"
dependencies = [
"anyhow",
"crossbeam-channel",
"itertools 0.12.1",
"itertools 0.14.0",
"ra_ap_hir_expand",
"ra_ap_ide_db",
"ra_ap_intern",
"ra_ap_paths",
"ra_ap_proc_macro_api",
"ra_ap_project_model",
"ra_ap_span",
@@ -1715,9 +1717,9 @@ dependencies = [
[[package]]
name = "ra_ap_mbe"
version = "0.0.270"
version = "0.0.273"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "e893fe03b04b30c9b5a339ac2bf39ce32ac9c05a8b50121b7d89ce658346e164"
checksum = "b187ee5ee3fa726eeea5142242a0397e2200d77084026986a68324b9599f9046"
dependencies = [
"arrayvec",
"cov-mark",
@@ -1726,19 +1728,17 @@ dependencies = [
"ra_ap_parser",
"ra_ap_span",
"ra_ap_stdx",
"ra_ap_syntax",
"ra_ap_syntax-bridge",
"ra_ap_tt",
"rustc-hash 2.1.1",
"smallvec",
"tracing",
]
[[package]]
name = "ra_ap_parser"
version = "0.0.270"
version = "0.0.273"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "6fd9a264120968b14a66b6ba756cd7f99435385b5dbc2f0a611cf3a12221c385"
checksum = "2306e6c051e60483f3b317fac9dec6c883b7792eeb8db24ec6f39dbfa5430159"
dependencies = [
"drop_bomb",
"ra-ap-rustc_lexer",
@@ -1748,20 +1748,20 @@ dependencies = [
[[package]]
name = "ra_ap_paths"
version = "0.0.270"
version = "0.0.273"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f47817351651e36b56ff3afc483b41600053c9cb7e67d945467c0abe93416032"
checksum = "dcedd00499621bdd0f1fe01955c04e4b388197aa826744003afaf6cc2944bc80"
dependencies = [
"camino",
]
[[package]]
name = "ra_ap_proc_macro_api"
version = "0.0.270"
version = "0.0.273"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "d96da3b8b9f6b813a98f5357eef303905450741f47ba90adaab8a5371b748416"
checksum = "7a2e49b550015cd4ad152bd78d92d73594497f2e44f61273f9fed3534ad4bbbe"
dependencies = [
"indexmap 2.7.0",
"indexmap 2.9.0",
"ra_ap_intern",
"ra_ap_paths",
"ra_ap_span",
@@ -1776,9 +1776,9 @@ dependencies = [
[[package]]
name = "ra_ap_profile"
version = "0.0.270"
version = "0.0.273"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "13637377287c84f88a628e40229d271ef0081c0d683956bd99a6c8278a4f8b14"
checksum = "87cdbd27ebe02ec21fdae3df303f194bda036a019ecef80d47e0082646f06c54"
dependencies = [
"cfg-if",
"libc",
@@ -1788,13 +1788,13 @@ dependencies = [
[[package]]
name = "ra_ap_project_model"
version = "0.0.270"
version = "0.0.273"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "053c5207a638fc7a752c7a454bc952b28b0d02f0bf9f6d7ec785ec809579d8fa"
checksum = "5eaa3406c891a7840d20ce615f8decca32cbc9d3654b82dcbcc3a31257ce90b9"
dependencies = [
"anyhow",
"cargo_metadata",
"itertools 0.12.1",
"itertools 0.14.0",
"la-arena",
"ra_ap_base_db",
"ra_ap_cfg",
@@ -1814,22 +1814,20 @@ dependencies = [
[[package]]
name = "ra_ap_query-group-macro"
version = "0.0.270"
version = "0.0.273"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "0f1a38f07b442e47a234cbe2e8fd1b8a41ff0cc5123cb1cf994c5ce20edb5bd6"
checksum = "1fbc1748e4876a9b0ccfacfc7e2fe254f30e92ef58d98925282b3803e8b004ed"
dependencies = [
"heck",
"proc-macro2",
"quote",
"salsa",
"syn",
]
[[package]]
name = "ra_ap_span"
version = "0.0.270"
version = "0.0.273"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "8818680c6f7da3b32cb2bb0992940b24264b1aa90203aa94812e09ab34d362d1"
checksum = "ed1d036e738bf32a057d90698df85bcb83ed6263b5fe9fba132c99e8ec3aecaf"
dependencies = [
"hashbrown 0.14.5",
"la-arena",
@@ -1843,12 +1841,12 @@ dependencies = [
[[package]]
name = "ra_ap_stdx"
version = "0.0.270"
version = "0.0.273"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f1c10bee1b03fc48083862c13cf06bd3ed17760463ecce2734103a2f511e5ed4"
checksum = "6e3775954ab24408f71e97079a97558078a166a4082052e83256ae4c22dae18d"
dependencies = [
"crossbeam-channel",
"itertools 0.12.1",
"itertools 0.14.0",
"jod-thread",
"libc",
"miow",
@@ -1858,14 +1856,12 @@ dependencies = [
[[package]]
name = "ra_ap_syntax"
version = "0.0.270"
version = "0.0.273"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "92bc32f3946fc5fcbdc79e61b7e26a8c2a3a56f3ef6ab27c7d298a9e21a462f2"
checksum = "b49b081f209a764700f688db91820a66c2ecfe5f138895d831361cf84f716691"
dependencies = [
"cov-mark",
"either",
"indexmap 2.7.0",
"itertools 0.12.1",
"itertools 0.14.0",
"ra-ap-rustc_lexer",
"ra_ap_parser",
"ra_ap_stdx",
@@ -1878,9 +1874,9 @@ dependencies = [
[[package]]
name = "ra_ap_syntax-bridge"
version = "0.0.270"
version = "0.0.273"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "a42052c44c98c122c37aac476260c8f19d8fec495edc9c05835307c9ae86194d"
checksum = "f2740bbe603d527f2cf0aaf51629de7d072694fbbaaeda8264f7591be1493d1b"
dependencies = [
"ra_ap_intern",
"ra_ap_parser",
@@ -1889,14 +1885,13 @@ dependencies = [
"ra_ap_syntax",
"ra_ap_tt",
"rustc-hash 2.1.1",
"tracing",
]
[[package]]
name = "ra_ap_toolchain"
version = "0.0.270"
version = "0.0.273"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "75996e70b3a0c68cd5157ba01f018964c7c6a5d7b209047d449b393139d0b57f"
checksum = "efbff9f26f307ef958586357d1653d000861dcd3acbaf33a009651e024720c7e"
dependencies = [
"camino",
"home",
@@ -1904,9 +1899,9 @@ dependencies = [
[[package]]
name = "ra_ap_tt"
version = "0.0.270"
version = "0.0.273"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "0e4ee31e93bfabe83e6720b7469db88d7ad7ec5c59a1f011efec4aa1327ffc5c"
checksum = "0b1ce3ac14765e414fa6031fda7dc35d3492c74de225aac689ba8b8bf037e1f8"
dependencies = [
"arrayvec",
"ra-ap-rustc_lexer",
@@ -1917,13 +1912,13 @@ dependencies = [
[[package]]
name = "ra_ap_vfs"
version = "0.0.270"
version = "0.0.273"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f6aac1e277ac70bb073f40f8a3fc44e4b1bb9e4d4b1d0e0bd2f8269543560f80"
checksum = "29427a7c27ce8ddfefb52d77c952a4588c74d0a7ab064dc627129088a90423ca"
dependencies = [
"crossbeam-channel",
"fst",
"indexmap 2.7.0",
"indexmap 2.9.0",
"nohash-hasher",
"ra_ap_paths",
"ra_ap_stdx",
@@ -1933,9 +1928,9 @@ dependencies = [
[[package]]
name = "ra_ap_vfs-notify"
version = "0.0.270"
version = "0.0.273"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "cd95285146049621ee8f7a512c982a008bf036321fcc9b01a95c1ad7e6aeae57"
checksum = "d5a0e3095b8216ecc131f38b4b0025cac324a646469a95d2670354aee7278078"
dependencies = [
"crossbeam-channel",
"notify",
@@ -2005,7 +2000,7 @@ version = "0.5.8"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "03a862b389f93e68874fbf580b9de08dd02facb9a788ebadaf4a3fd33cf58834"
dependencies = [
"bitflags 2.8.0",
"bitflags 2.9.0",
]
[[package]]
@@ -2093,10 +2088,10 @@ checksum = "2febf9acc5ee5e99d1ad0afcdbccc02d87aa3f857a1f01f825b80eacf8edfcd1"
[[package]]
name = "rustc_apfloat"
version = "0.2.1+llvm-462a31f5a5ab"
source = "git+https://github.com/redsun82/rustc_apfloat.git?rev=096d585100636bc2e9f09d7eefec38c5b334d47b#096d585100636bc2e9f09d7eefec38c5b334d47b"
version = "0.2.2+llvm-462a31f5a5ab"
source = "git+https://github.com/redsun82/rustc_apfloat.git?rev=32968f16ef1b082243f9bf43a3fbd65c381b3e27#32968f16ef1b082243f9bf43a3fbd65c381b3e27"
dependencies = [
"bitflags 1.3.2",
"bitflags 2.9.0",
"smallvec",
]
@@ -2123,7 +2118,7 @@ dependencies = [
"dashmap 6.1.0",
"hashbrown 0.15.2",
"hashlink",
"indexmap 2.7.0",
"indexmap 2.9.0",
"parking_lot",
"portable-atomic",
"rayon",
@@ -2176,9 +2171,9 @@ checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
[[package]]
name = "semver"
version = "1.0.24"
version = "1.0.26"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "3cb6eb87a131f756572d7fb904f6e7b68633f09cca868c5df1c4b8d1a694bbba"
checksum = "56e6fa9c48d24d85fb3de5ad847117517440f6beceb7798af16b4a87d616b8d0"
dependencies = [
"serde",
]
@@ -2234,7 +2229,7 @@ dependencies = [
"chrono",
"hex",
"indexmap 1.9.3",
"indexmap 2.7.0",
"indexmap 2.9.0",
"serde",
"serde_derive",
"serde_json",
@@ -2260,7 +2255,7 @@ version = "0.9.34+deprecated"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "6a8b1a1a2ebf674015cc02edccce75287f1a0130d394307b36743c2f5d504b47"
dependencies = [
"indexmap 2.7.0",
"indexmap 2.9.0",
"itoa",
"ryu",
"serde",
@@ -2345,19 +2340,25 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f18aa187839b2bdb1ad2fa35ead8c4c2976b64e4363c386d45ac0f7ee85c9233"
[[package]]
name = "thiserror"
version = "1.0.69"
name = "thin-vec"
version = "0.2.14"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
checksum = "144f754d318415ac792f9d69fc87abbbfc043ce2ef041c60f16ad828f638717d"
[[package]]
name = "thiserror"
version = "2.0.12"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "567b8a2dae586314f7be2a752ec7474332959c6460e02bde30d702a66d488708"
dependencies = [
"thiserror-impl",
]
[[package]]
name = "thiserror-impl"
version = "1.0.69"
version = "2.0.12"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
checksum = "7f7cf42b4507d8ea322120659672cf1b9dbb93f8f2d4ecfd6e51350ff5b17a1d"
dependencies = [
"proc-macro2",
"quote",
@@ -2432,7 +2433,7 @@ version = "0.22.24"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "17b4795ff5edd201c7cd6dca065ae59972ce77d1b80fa0a84d94950ece7d1474"
dependencies = [
"indexmap 2.7.0",
"indexmap 2.9.0",
"serde",
"serde_spanned",
"toml_datetime",
@@ -2488,7 +2489,7 @@ version = "0.2.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "ee855f1f400bd0e5c02d150ae5de3840039a3f54b025156404e34c23c03f47c3"
dependencies = [
"log 0.4.25",
"log 0.4.27",
"once_cell",
"tracing-core",
]
@@ -2603,9 +2604,9 @@ checksum = "a3e5df347f0bf3ec1d670aad6ca5c6a1859cd9ea61d2113125794654ccced68f"
[[package]]
name = "unicode-ident"
version = "1.0.16"
version = "1.0.17"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "a210d160f08b701c8721ba1c726c11662f877ea6b7094007e1ca9a1041945034"
checksum = "00e2473a93778eb0bad35909dff6a10d28e63f792f16ed15e404fca9d5eeedbe"
[[package]]
name = "unicode-properties"
@@ -2686,7 +2687,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "5f89bb38646b4f81674e8f5c3fb81b562be1fd936d84320f3264486418519c79"
dependencies = [
"bumpalo",
"log 0.4.25",
"log 0.4.27",
"proc-macro2",
"quote",
"syn",
@@ -2995,7 +2996,7 @@ version = "0.33.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "3268f3d866458b787f390cf61f4bbb563b922d091359f9608842999eaee3943c"
dependencies = [
"bitflags 2.8.0",
"bitflags 2.9.0",
]
[[package]]
@@ -3044,3 +3045,31 @@ dependencies = [
"quote",
"syn",
]
[[package]]
name = "zstd"
version = "0.13.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "e91ee311a569c327171651566e07972200e76fcfe2242a4fa446149a3881c08a"
dependencies = [
"zstd-safe",
]
[[package]]
name = "zstd-safe"
version = "7.2.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "8f49c4d5f0abb602a93fb8736af2a4f4dd9512e36f7f570d66e65ff867ed3b9d"
dependencies = [
"zstd-sys",
]
[[package]]
name = "zstd-sys"
version = "2.0.15+zstd.1.5.7"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "eb81183ddd97d0c74cedf1d50d85c8d08c1b8b68ee863bdee9e706eedba1a237"
dependencies = [
"cc",
"pkg-config",
]

3
Cargo.toml
View File

@@ -10,8 +10,9 @@ members = [
"rust/ast-generator",
"rust/autobuild",
]
exclude = ["mad-generation-build"]
[patch.crates-io]
# patch for build script bug preventing bazel build
# see https://github.com/rust-lang/rustc_apfloat/pull/17
rustc_apfloat = { git = "https://github.com/redsun82/rustc_apfloat.git", rev = "096d585100636bc2e9f09d7eefec38c5b334d47b" }
rustc_apfloat = { git = "https://github.com/redsun82/rustc_apfloat.git", rev = "32968f16ef1b082243f9bf43a3fbd65c381b3e27" }

72
MODULE.bazel
View File

@@ -24,7 +24,7 @@ bazel_dep(name = "bazel_skylib", version = "1.7.1")
bazel_dep(name = "abseil-cpp", version = "20240116.1", repo_name = "absl")
bazel_dep(name = "nlohmann_json", version = "3.11.3", repo_name = "json")
bazel_dep(name = "fmt", version = "10.0.0")
bazel_dep(name = "rules_kotlin", version = "2.0.0-codeql.1")
bazel_dep(name = "rules_kotlin", version = "2.1.3-codeql.1")
bazel_dep(name = "gazelle", version = "0.40.0")
bazel_dep(name = "rules_dotnet", version = "0.17.4")
bazel_dep(name = "googletest", version = "1.14.0.bcr.1")
@@ -75,7 +75,7 @@ use_repo(
"vendor_ts__argfile-0.2.1",
"vendor_ts__chalk-ir-0.100.0",
"vendor_ts__chrono-0.4.40",
"vendor_ts__clap-4.5.32",
"vendor_ts__clap-4.5.35",
"vendor_ts__dunce-1.0.5",
"vendor_ts__either-1.15.0",
"vendor_ts__encoding-0.2.33",
@@ -90,22 +90,22 @@ use_repo(
"vendor_ts__num_cpus-1.16.0",
"vendor_ts__proc-macro2-1.0.94",
"vendor_ts__quote-1.0.40",
"vendor_ts__ra_ap_base_db-0.0.270",
"vendor_ts__ra_ap_cfg-0.0.270",
"vendor_ts__ra_ap_hir-0.0.270",
"vendor_ts__ra_ap_hir_def-0.0.270",
"vendor_ts__ra_ap_hir_expand-0.0.270",
"vendor_ts__ra_ap_hir_ty-0.0.270",
"vendor_ts__ra_ap_ide_db-0.0.270",
"vendor_ts__ra_ap_intern-0.0.270",
"vendor_ts__ra_ap_load-cargo-0.0.270",
"vendor_ts__ra_ap_parser-0.0.270",
"vendor_ts__ra_ap_paths-0.0.270",
"vendor_ts__ra_ap_project_model-0.0.270",
"vendor_ts__ra_ap_span-0.0.270",
"vendor_ts__ra_ap_stdx-0.0.270",
"vendor_ts__ra_ap_syntax-0.0.270",
"vendor_ts__ra_ap_vfs-0.0.270",
"vendor_ts__ra_ap_base_db-0.0.273",
"vendor_ts__ra_ap_cfg-0.0.273",
"vendor_ts__ra_ap_hir-0.0.273",
"vendor_ts__ra_ap_hir_def-0.0.273",
"vendor_ts__ra_ap_hir_expand-0.0.273",
"vendor_ts__ra_ap_hir_ty-0.0.273",
"vendor_ts__ra_ap_ide_db-0.0.273",
"vendor_ts__ra_ap_intern-0.0.273",
"vendor_ts__ra_ap_load-cargo-0.0.273",
"vendor_ts__ra_ap_parser-0.0.273",
"vendor_ts__ra_ap_paths-0.0.273",
"vendor_ts__ra_ap_project_model-0.0.273",
"vendor_ts__ra_ap_span-0.0.273",
"vendor_ts__ra_ap_stdx-0.0.273",
"vendor_ts__ra_ap_syntax-0.0.273",
"vendor_ts__ra_ap_vfs-0.0.273",
"vendor_ts__rand-0.9.0",
"vendor_ts__rayon-1.10.0",
"vendor_ts__regex-1.11.1",
@@ -124,6 +124,7 @@ use_repo(
"vendor_ts__tree-sitter-ruby-0.23.1",
"vendor_ts__triomphe-0.1.14",
"vendor_ts__ungrammar-1.16.1",
"vendor_ts__zstd-0.13.3",
)
http_archive = use_repo_rule("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
@@ -193,10 +194,6 @@ use_repo(
kotlin_extractor_deps,
"codeql_kotlin_defaults",
"codeql_kotlin_embeddable",
"kotlin-compiler-1.5.0",
"kotlin-compiler-1.5.10",
"kotlin-compiler-1.5.20",
"kotlin-compiler-1.5.30",
"kotlin-compiler-1.6.0",
"kotlin-compiler-1.6.20",
"kotlin-compiler-1.7.0",
@@ -208,10 +205,7 @@ use_repo(
"kotlin-compiler-2.0.20-Beta2",
"kotlin-compiler-2.1.0-Beta1",
"kotlin-compiler-2.1.20-Beta1",
"kotlin-compiler-embeddable-1.5.0",
"kotlin-compiler-embeddable-1.5.10",
"kotlin-compiler-embeddable-1.5.20",
"kotlin-compiler-embeddable-1.5.30",
"kotlin-compiler-2.2.0-Beta1",
"kotlin-compiler-embeddable-1.6.0",
"kotlin-compiler-embeddable-1.6.20",
"kotlin-compiler-embeddable-1.7.0",
@@ -223,10 +217,7 @@ use_repo(
"kotlin-compiler-embeddable-2.0.20-Beta2",
"kotlin-compiler-embeddable-2.1.0-Beta1",
"kotlin-compiler-embeddable-2.1.20-Beta1",
"kotlin-stdlib-1.5.0",
"kotlin-stdlib-1.5.10",
"kotlin-stdlib-1.5.20",
"kotlin-stdlib-1.5.30",
"kotlin-compiler-embeddable-2.2.0-Beta1",
"kotlin-stdlib-1.6.0",
"kotlin-stdlib-1.6.20",
"kotlin-stdlib-1.7.0",
@@ -238,6 +229,7 @@ use_repo(
"kotlin-stdlib-2.0.20-Beta2",
"kotlin-stdlib-2.1.0-Beta1",
"kotlin-stdlib-2.1.20-Beta1",
"kotlin-stdlib-2.2.0-Beta1",
)
go_sdk = use_extension("@rules_go//go:extensions.bzl", "go_sdk")
@@ -247,24 +239,24 @@ go_deps = use_extension("@gazelle//:extensions.bzl", "go_deps")
go_deps.from_file(go_mod = "//go/extractor:go.mod")
use_repo(go_deps, "org_golang_x_mod", "org_golang_x_tools")
lfs_files = use_repo_rule("//misc/bazel:lfs.bzl", "lfs_files")
lfs_archive = use_repo_rule("//misc/bazel:lfs.bzl", "lfs_archive")
lfs_files(
lfs_archive(
name = "ripunzip-linux",
srcs = ["//misc/ripunzip:ripunzip-linux"],
executable = True,
src = "//misc/ripunzip:ripunzip-Linux.zip",
build_file = "//misc/ripunzip:BUILD.ripunzip.bazel",
)
lfs_files(
lfs_archive(
name = "ripunzip-windows",
srcs = ["//misc/ripunzip:ripunzip-windows.exe"],
executable = True,
src = "//misc/ripunzip:ripunzip-Windows.zip",
build_file = "//misc/ripunzip:BUILD.ripunzip.bazel",
)
lfs_files(
lfs_archive(
name = "ripunzip-macos",
srcs = ["//misc/ripunzip:ripunzip-macos"],
executable = True,
src = "//misc/ripunzip:ripunzip-macOS.zip",
build_file = "//misc/ripunzip:BUILD.ripunzip.bazel",
)
register_toolchains(

41
actions/extractor/tools/autobuild-impl.ps1
View File

@@ -1,21 +1,28 @@
if (($null -ne $env:LGTM_INDEX_INCLUDE) -or ($null -ne $env:LGTM_INDEX_EXCLUDE) -or ($null -ne $env:LGTM_INDEX_FILTERS)) {
Write-Output 'Path filters set. Passing them through to the JavaScript extractor.'
} else {
Write-Output 'No path filters set. Using the default filters.'
# Note: We're adding the `reusable_workflows` subdirectories to proactively
# record workflows that were called cross-repo, check them out locally,
# and enable an interprocedural analysis across the workflow files.
# These workflows follow the convention `.github/reusable_workflows/<nwo>/*.ya?ml`
$DefaultPathFilters = @(
'exclude:**/*',
'include:.github/workflows/*.yml',
'include:.github/workflows/*.yaml',
'include:.github/reusable_workflows/**/*.yml',
'include:.github/reusable_workflows/**/*.yaml',
'include:**/action.yml',
'include:**/action.yaml'
)
# Note: We're adding the `reusable_workflows` subdirectories to proactively
# record workflows that were called cross-repo, check them out locally,
# and enable an interprocedural analysis across the workflow files.
# These workflows follow the convention `.github/reusable_workflows/<nwo>/*.ya?ml`
$DefaultPathFilters = @(
'exclude:**/*',
'include:.github/workflows/*.yml',
'include:.github/workflows/*.yaml',
'include:.github/reusable_workflows/**/*.yml',
'include:.github/reusable_workflows/**/*.yaml',
'include:**/action.yml',
'include:**/action.yaml'
)
if ($null -ne $env:LGTM_INDEX_FILTERS) {
Write-Output 'LGTM_INDEX_FILTERS set. Using the default filters together with the user-provided filters, and passing through to the JavaScript extractor.'
# Begin with the default path inclusions only,
# followed by the user-provided filters.
# If the user provided `paths`, those patterns override the default inclusions
# (because `LGTM_INDEX_FILTERS` will begin with `exclude:**/*`).
# If the user provided `paths-ignore`, those patterns are excluded.
$PathFilters = ($DefaultPathFilters -join "`n") + "`n" + $env:LGTM_INDEX_FILTERS
$env:LGTM_INDEX_FILTERS = $PathFilters
} else {
Write-Output 'LGTM_INDEX_FILTERS not set. Using the default filters, and passing through to the JavaScript extractor.'
$env:LGTM_INDEX_FILTERS = $DefaultPathFilters -join "`n"
}

18
actions/extractor/tools/autobuild.sh
View File

@@ -17,10 +17,22 @@ include:**/action.yaml
END
)
if [ -n "${LGTM_INDEX_INCLUDE:-}" ] || [ -n "${LGTM_INDEX_EXCLUDE:-}" ] || [ -n "${LGTM_INDEX_FILTERS:-}" ] ; then
echo "Path filters set. Passing them through to the JavaScript extractor."
if [ -n "${LGTM_INDEX_FILTERS:-}" ]; then
echo "LGTM_INDEX_FILTERS set. Using the default filters together with the user-provided filters, and passing through to the JavaScript extractor."
# Begin with the default path inclusions only,
# followed by the user-provided filters.
# If the user provided `paths`, those patterns override the default inclusions
# (because `LGTM_INDEX_FILTERS` will begin with `exclude:**/*`).
# If the user provided `paths-ignore`, those patterns are excluded.
PATH_FILTERS="$(cat << END
${DEFAULT_PATH_FILTERS}
${LGTM_INDEX_FILTERS}
END
)"
LGTM_INDEX_FILTERS="${PATH_FILTERS}"
export LGTM_INDEX_FILTERS
else
echo "No path filters set. Using the default filters."
echo "LGTM_INDEX_FILTERS not set. Using the default filters, and passing through to the JavaScript extractor."
LGTM_INDEX_FILTERS="${DEFAULT_PATH_FILTERS}"
export LGTM_INDEX_FILTERS
fi

2
actions/ql/integration-tests/filters-default/test.py
View File

@@ -1,2 +0,0 @@
def test(codeql, actions):
codeql.database.create(source_root="src")

6
actions/ql/integration-tests/filters/actions.default-filters.expected Normal file
View File

@@ -0,0 +1,6 @@
| src/.github/action.yaml:1:1:11:32 | name: ' ... action' |
| src/.github/actions/action-name/action.yml:1:1:11:32 | name: ' ... action' |
| src/.github/workflows/workflow.yml:1:1:12:33 | name: A workflow |
| src/action.yml:1:1:11:32 | name: ' ... action' |
| src/excluded/action.yml:1:1:11:32 | name: ' ... action' |
| src/included/action.yml:1:1:11:32 | name: ' ... action' |

2
actions/ql/integration-tests/filters/actions.paths-and-paths-ignore.expected Normal file
View File

@@ -0,0 +1,2 @@
| src/included/action.yml:1:1:11:32 | name: ' ... action' |
| src/included/unreachable-workflow.yml:1:1:12:33 | name: A ... orkflow |

1
actions/ql/integration-tests/filters-default/actions.expected → actions/ql/integration-tests/filters/actions.paths-ignore-only.expected
View File

@@ -2,3 +2,4 @@
| src/.github/actions/action-name/action.yml:1:1:11:32 | name: ' ... action' |
| src/.github/workflows/workflow.yml:1:1:12:33 | name: A workflow |
| src/action.yml:1:1:11:32 | name: ' ... action' |
| src/included/action.yml:1:1:11:32 | name: ' ... action' |

2
actions/ql/integration-tests/filters/actions.paths-only.expected Normal file
View File

@@ -0,0 +1,2 @@
| src/included/action.yml:1:1:11:32 | name: ' ... action' |
| src/included/unreachable-workflow.yml:1:1:12:33 | name: A ... orkflow |

5
actions/ql/integration-tests/filters/actions.ql Normal file
View File

@@ -0,0 +1,5 @@
import actions
from AstNode n
where n instanceof Workflow or n instanceof CompositeAction
select n

4
actions/ql/integration-tests/filters/codeql-config.paths-and-paths-ignore.yml Normal file
View File

@@ -0,0 +1,4 @@
paths:
- 'included'
paths-ignore:
- 'excluded'

2
actions/ql/integration-tests/filters/codeql-config.paths-ignore-only.yml Normal file
View File

@@ -0,0 +1,2 @@
paths-ignore:
- 'excluded'

2
actions/ql/integration-tests/filters/codeql-config.paths-only.yml Normal file
View File

@@ -0,0 +1,2 @@
paths:
- 'included'

6
actions/ql/integration-tests/filters/source_archive.default-filters.expected Normal file
View File

@@ -0,0 +1,6 @@
src/.github/action.yaml
src/.github/actions/action-name/action.yml
src/.github/workflows/workflow.yml
src/action.yml
src/excluded/action.yml
src/included/action.yml

3
actions/ql/integration-tests/filters/source_archive.paths-and-paths-ignore.expected Normal file
View File

@@ -0,0 +1,3 @@
src/included/action.yml
src/included/not-an-action.yml
src/included/unreachable-workflow.yml

5
actions/ql/integration-tests/filters/source_archive.paths-ignore-only.expected Normal file
View File

@@ -0,0 +1,5 @@
src/.github/action.yaml
src/.github/actions/action-name/action.yml
src/.github/workflows/workflow.yml
src/action.yml
src/included/action.yml

3
actions/ql/integration-tests/filters/source_archive.paths-only.expected Normal file
View File

@@ -0,0 +1,3 @@
src/included/action.yml
src/included/not-an-action.yml
src/included/unreachable-workflow.yml

0
actions/ql/integration-tests/filters-default/src/.github/action.yaml → actions/ql/integration-tests/filters/src/.github/action.yaml vendored
View File

0
actions/ql/integration-tests/filters-default/src/.github/actions/action-name/action.yml → actions/ql/integration-tests/filters/src/.github/actions/action-name/action.yml vendored
View File

0
actions/ql/integration-tests/filters-default/src/.github/unreachable-workflow.yml → actions/ql/integration-tests/filters/src/.github/unreachable-workflow.yml vendored
View File

0
actions/ql/integration-tests/filters-default/src/.github/workflows/workflow.yml → actions/ql/integration-tests/filters/src/.github/workflows/workflow.yml vendored
View File

0
actions/ql/integration-tests/filters-default/src/action.yml → actions/ql/integration-tests/filters/src/action.yml
View File

11
actions/ql/integration-tests/filters/src/excluded/action.yml Normal file
View File

@@ -0,0 +1,11 @@
name: 'A composite action'
description: 'Do something'
runs:
using: "composite"
steps:
- name: Print
run: echo "Hello world"
shell: bash
- name: Checkout
uses: actions/checkout@v4

0
actions/ql/integration-tests/filters-default/src/unreachable-workflow.yml → actions/ql/integration-tests/filters/src/excluded/unreachable-workflow.yml
View File

11
actions/ql/integration-tests/filters/src/included/action.yml Normal file
View File

@@ -0,0 +1,11 @@
name: 'A composite action'
description: 'Do something'
runs:
using: "composite"
steps:
- name: Print
run: echo "Hello world"
shell: bash
- name: Checkout
uses: actions/checkout@v4

1
actions/ql/integration-tests/filters/src/included/not-an-action.yml Normal file
View File

@@ -0,0 +1 @@
name: 'Not an action, just a YAML file'

12
actions/ql/integration-tests/filters/src/included/unreachable-workflow.yml Normal file
View File

@@ -0,0 +1,12 @@
name: An unreachable workflow
on:
push:
branches:
- main
jobs:
job:
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v4

12
actions/ql/integration-tests/filters/src/unreachable-workflow.yml Normal file
View File

@@ -0,0 +1,12 @@
name: An unreachable workflow
on:
push:
branches:
- main
jobs:
job:
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v4

18
actions/ql/integration-tests/filters/test.py Executable file
View File

@@ -0,0 +1,18 @@
import pytest
@pytest.mark.ql_test(expected=".default-filters.expected")
def test_default_filters(codeql, actions, check_source_archive):
check_source_archive.expected_suffix = ".default-filters.expected"
codeql.database.create(source_root="src")
@pytest.mark.ql_test(expected=".paths-only.expected")
def test_config_paths_only(codeql, actions):
codeql.database.create(source_root="src", codescanning_config="codeql-config.paths-only.yml")
@pytest.mark.ql_test(expected=".paths-ignore-only.expected")
def test_config_paths_ignore_only(codeql, actions):
codeql.database.create(source_root="src", codescanning_config="codeql-config.paths-ignore-only.yml")
@pytest.mark.ql_test(expected=".paths-and-paths-ignore.expected")
def test_config_paths_and_paths_ignore(codeql, actions):
codeql.database.create(source_root="src", codescanning_config="codeql-config.paths-and-paths-ignore.yml")

1
actions/ql/integration-tests/query-suite/actions-code-quality.qls.expected Normal file
View File

@@ -0,0 +1 @@

17
actions/ql/integration-tests/query-suite/actions-code-scanning.qls.expected Normal file
View File

@@ -0,0 +1,17 @@
ql/actions/ql/src/Security/CWE-077/EnvPathInjectionCritical.ql
ql/actions/ql/src/Security/CWE-077/EnvVarInjectionCritical.ql
ql/actions/ql/src/Security/CWE-094/CodeInjectionCritical.ql
ql/actions/ql/src/Security/CWE-1395/UseOfKnownVulnerableAction.ql
ql/actions/ql/src/Security/CWE-275/MissingActionsPermissions.ql
ql/actions/ql/src/Security/CWE-285/ImproperAccessControl.ql
ql/actions/ql/src/Security/CWE-312/ExcessiveSecretsExposure.ql
ql/actions/ql/src/Security/CWE-312/SecretsInArtifacts.ql
ql/actions/ql/src/Security/CWE-312/UnmaskedSecretExposure.ql
ql/actions/ql/src/Security/CWE-349/CachePoisoningViaCodeInjection.ql
ql/actions/ql/src/Security/CWE-349/CachePoisoningViaDirectCache.ql
ql/actions/ql/src/Security/CWE-349/CachePoisoningViaPoisonableStep.ql
ql/actions/ql/src/Security/CWE-367/UntrustedCheckoutTOCTOUCritical.ql
ql/actions/ql/src/Security/CWE-367/UntrustedCheckoutTOCTOUHigh.ql
ql/actions/ql/src/Security/CWE-829/ArtifactPoisoningCritical.ql
ql/actions/ql/src/Security/CWE-829/UntrustedCheckoutCritical.ql
ql/actions/ql/src/Security/CWE-829/UntrustedCheckoutHigh.ql

27
actions/ql/integration-tests/query-suite/actions-security-and-quality.qls.expected Normal file
View File

@@ -0,0 +1,27 @@
ql/actions/ql/src/Debug/SyntaxError.ql
ql/actions/ql/src/Security/CWE-077/EnvPathInjectionCritical.ql
ql/actions/ql/src/Security/CWE-077/EnvPathInjectionMedium.ql
ql/actions/ql/src/Security/CWE-077/EnvVarInjectionCritical.ql
ql/actions/ql/src/Security/CWE-077/EnvVarInjectionMedium.ql
ql/actions/ql/src/Security/CWE-094/CodeInjectionCritical.ql
ql/actions/ql/src/Security/CWE-094/CodeInjectionMedium.ql
ql/actions/ql/src/Security/CWE-1395/UseOfKnownVulnerableAction.ql
ql/actions/ql/src/Security/CWE-275/MissingActionsPermissions.ql
ql/actions/ql/src/Security/CWE-285/ImproperAccessControl.ql
ql/actions/ql/src/Security/CWE-312/ExcessiveSecretsExposure.ql
ql/actions/ql/src/Security/CWE-312/SecretsInArtifacts.ql
ql/actions/ql/src/Security/CWE-312/UnmaskedSecretExposure.ql
ql/actions/ql/src/Security/CWE-349/CachePoisoningViaCodeInjection.ql
ql/actions/ql/src/Security/CWE-349/CachePoisoningViaDirectCache.ql
ql/actions/ql/src/Security/CWE-349/CachePoisoningViaPoisonableStep.ql
ql/actions/ql/src/Security/CWE-367/UntrustedCheckoutTOCTOUCritical.ql
ql/actions/ql/src/Security/CWE-367/UntrustedCheckoutTOCTOUHigh.ql
ql/actions/ql/src/Security/CWE-571/ExpressionIsAlwaysTrueCritical.ql
ql/actions/ql/src/Security/CWE-571/ExpressionIsAlwaysTrueHigh.ql
ql/actions/ql/src/Security/CWE-829/ArtifactPoisoningCritical.ql
ql/actions/ql/src/Security/CWE-829/ArtifactPoisoningMedium.ql
ql/actions/ql/src/Security/CWE-829/UnpinnedActionsTag.ql
ql/actions/ql/src/Security/CWE-829/UntrustedCheckoutCritical.ql
ql/actions/ql/src/Security/CWE-829/UntrustedCheckoutHigh.ql
ql/actions/ql/src/Security/CWE-829/UntrustedCheckoutMedium.ql
ql/actions/ql/src/Violations Of Best Practice/CodeQL/UnnecessaryUseOfAdvancedConfig.ql

23
actions/ql/integration-tests/query-suite/actions-security-extended.qls.expected Normal file
View File

@@ -0,0 +1,23 @@
ql/actions/ql/src/Security/CWE-077/EnvPathInjectionCritical.ql
ql/actions/ql/src/Security/CWE-077/EnvPathInjectionMedium.ql
ql/actions/ql/src/Security/CWE-077/EnvVarInjectionCritical.ql
ql/actions/ql/src/Security/CWE-077/EnvVarInjectionMedium.ql
ql/actions/ql/src/Security/CWE-094/CodeInjectionCritical.ql
ql/actions/ql/src/Security/CWE-094/CodeInjectionMedium.ql
ql/actions/ql/src/Security/CWE-1395/UseOfKnownVulnerableAction.ql
ql/actions/ql/src/Security/CWE-275/MissingActionsPermissions.ql
ql/actions/ql/src/Security/CWE-285/ImproperAccessControl.ql
ql/actions/ql/src/Security/CWE-312/ExcessiveSecretsExposure.ql
ql/actions/ql/src/Security/CWE-312/SecretsInArtifacts.ql
ql/actions/ql/src/Security/CWE-312/UnmaskedSecretExposure.ql
ql/actions/ql/src/Security/CWE-349/CachePoisoningViaCodeInjection.ql
ql/actions/ql/src/Security/CWE-349/CachePoisoningViaDirectCache.ql
ql/actions/ql/src/Security/CWE-349/CachePoisoningViaPoisonableStep.ql
ql/actions/ql/src/Security/CWE-367/UntrustedCheckoutTOCTOUCritical.ql
ql/actions/ql/src/Security/CWE-367/UntrustedCheckoutTOCTOUHigh.ql
ql/actions/ql/src/Security/CWE-829/ArtifactPoisoningCritical.ql
ql/actions/ql/src/Security/CWE-829/ArtifactPoisoningMedium.ql
ql/actions/ql/src/Security/CWE-829/UnpinnedActionsTag.ql
ql/actions/ql/src/Security/CWE-829/UntrustedCheckoutCritical.ql
ql/actions/ql/src/Security/CWE-829/UntrustedCheckoutHigh.ql
ql/actions/ql/src/Security/CWE-829/UntrustedCheckoutMedium.ql

17
actions/ql/integration-tests/query-suite/not_included_in_qls.expected Normal file
View File

@@ -0,0 +1,17 @@
ql/actions/ql/src/Debug/partial.ql
ql/actions/ql/src/Models/CompositeActionsSinks.ql
ql/actions/ql/src/Models/CompositeActionsSources.ql
ql/actions/ql/src/Models/CompositeActionsSummaries.ql
ql/actions/ql/src/Models/ReusableWorkflowsSinks.ql
ql/actions/ql/src/Models/ReusableWorkflowsSources.ql
ql/actions/ql/src/Models/ReusableWorkflowsSummaries.ql
ql/actions/ql/src/experimental/Security/CWE-074/OutputClobberingHigh.ql
ql/actions/ql/src/experimental/Security/CWE-078/CommandInjectionCritical.ql
ql/actions/ql/src/experimental/Security/CWE-078/CommandInjectionMedium.ql
ql/actions/ql/src/experimental/Security/CWE-088/ArgumentInjectionCritical.ql
ql/actions/ql/src/experimental/Security/CWE-088/ArgumentInjectionMedium.ql
ql/actions/ql/src/experimental/Security/CWE-200/SecretExfiltration.ql
ql/actions/ql/src/experimental/Security/CWE-284/CodeExecutionOnSelfHostedRunner.ql
ql/actions/ql/src/experimental/Security/CWE-829/ArtifactPoisoningPathTraversal.ql
ql/actions/ql/src/experimental/Security/CWE-829/UnversionedImmutableAction.ql
ql/actions/ql/src/experimental/Security/CWE-918/RequestForgery.ql

14
actions/ql/integration-tests/query-suite/test.py Normal file
View File

@@ -0,0 +1,14 @@
import runs_on
import pytest
from query_suites import *
well_known_query_suites = ['actions-code-quality.qls', 'actions-security-and-quality.qls', 'actions-security-extended.qls', 'actions-code-scanning.qls']
@runs_on.posix
@pytest.mark.parametrize("query_suite", well_known_query_suites)
def test(codeql, actions, check_query_suite, query_suite):
check_query_suite(query_suite)
@runs_on.posix
def test_not_included_queries(codeql, actions, check_queries_not_included):
check_queries_not_included('actions', well_known_query_suites)

14
actions/ql/lib/CHANGELOG.md
View File

@@ -1,3 +1,17 @@
## 0.4.9
No user-facing changes.
## 0.4.8
No user-facing changes.
## 0.4.7
### New Features
* CodeQL and Copilot Autofix support for GitHub Actions is now Generally Available.
## 0.4.6
### Bug Fixes

5
actions/ql/lib/change-notes/released/0.4.7.md Normal file
View File

@@ -0,0 +1,5 @@
## 0.4.7
### New Features
* CodeQL and Copilot Autofix support for GitHub Actions is now Generally Available.

3
actions/ql/lib/change-notes/released/0.4.8.md Normal file
View File

@@ -0,0 +1,3 @@
## 0.4.8
No user-facing changes.

3
actions/ql/lib/change-notes/released/0.4.9.md Normal file
View File

@@ -0,0 +1,3 @@
## 0.4.9
No user-facing changes.

2
actions/ql/lib/codeql-pack.release.yml
View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 0.4.6
lastReleaseVersion: 0.4.9

4
actions/ql/lib/codeql/actions/Ast.qll
View File

@@ -50,8 +50,8 @@ class Expression extends AstNode instanceof ExpressionImpl {
string getNormalizedExpression() { result = normalizeExpr(expression) }
}
/** A common class for `env` in workflow, job or step. */
abstract class Env extends AstNode instanceof EnvImpl {
/** An `env` in workflow, job or step. */
class Env extends AstNode instanceof EnvImpl {
/** Gets an environment variable value given its name. */
ScalarValueImpl getEnvVarValue(string name) { result = super.getEnvVarValue(name) }

13
actions/ql/lib/ext/config/actions_permissions.yml
View File

@@ -22,16 +22,21 @@ extensions:
- ["actions/stale", "pull-requests: write"]
- ["actions/attest-build-provenance", "id-token: write"]
- ["actions/attest-build-provenance", "attestations: write"]
- ["actions/deploy-pages", "pages: write"]
- ["actions/deploy-pages", "id-token: write"]
- ["actions/delete-package-versions", "packages: write"]
- ["actions/jekyll-build-pages", "contents: read"]
- ["actions/jekyll-build-pages", "pages: write"]
- ["actions/jekyll-build-pages", "id-token: write"]
- ["actions/publish-action", "contents: write"]
- ["actions/versions-package-tools", "contents: read"]
- ["actions/versions-package-tools", "contents: read"]
- ["actions/versions-package-tools", "actions: read"]
- ["actions/reusable-workflows", "contents: read"]
- ["actions/reusable-workflows", "contents: read"]
- ["actions/reusable-workflows", "actions: read"]
- ["actions/ai-inference", "contents: read"]
- ["actions/ai-inference", "models: read"]
# TODO: Add permissions for actions/download-artifact
# TODO: Add permissions for actions/upload-artifact
# No permissions needed for actions/upload-pages-artifact
# TODO: Add permissions for actions/cache
# No permissions needed for actions/configure-pages

2
actions/ql/lib/qlpack.yml
View File

@@ -1,5 +1,5 @@
name: codeql/actions-all
version: 0.4.7-dev
version: 0.4.10-dev
library: true
warnOnImplicitThis: true
dependencies:

34
actions/ql/src/CHANGELOG.md
View File

@@ -1,3 +1,37 @@
## 0.6.1
No user-facing changes.
## 0.6.0
### Breaking Changes
* The following queries have been removed from the `security-and-quality` suite.
They are not intended to produce user-facing
alerts describing vulnerabilities.
Any existing alerts for these queries will be closed automatically.
* `actions/composite-action-sinks`
* `actions/composite-action-sources`
* `actions/composite-action-summaries`
* `actions/reusable-workflow-sinks`
(renamed from `actions/reusable-wokflow-sinks`)
* `actions/reusable-workflow-sources`
* `actions/reusable-workflow-summaries`
### Bug Fixes
* Assigned a `security-severity` to the query `actions/excessive-secrets-exposure`.
## 0.5.4
### New Features
* CodeQL and Copilot Autofix support for GitHub Actions is now Generally Available.
### Bug Fixes
* Alerts produced by the query `actions/missing-workflow-permissions` now include a minimal set of recommended permissions in the alert message, based on well-known actions seen within the workflow file.
## 0.5.3
### Bug Fixes

2
actions/ql/src/Models/ReusableWorkflowsSinks.ql
View File

@@ -5,7 +5,7 @@
* @problem.severity warning
* @security-severity 9.3
* @precision high
* @id actions/reusable-wokflow-sinks
* @id actions/reusable-workflow-sinks
* @tags actions
* model-generator
* external/cwe/cwe-020

2
actions/ql/src/Security/CWE-077/EnvVarInjectionMedium.md
View File

@@ -109,7 +109,7 @@ An attacker could craft a malicious artifact that writes dangerous environment v
### Exploitation
An attacker is be able to run arbitrary code by injecting environment variables such as `LD_PRELOAD`, `BASH_ENV`, etc.
An attacker would be able to run arbitrary code by injecting environment variables such as `LD_PRELOAD`, `BASH_ENV`, etc.
## References

2
actions/ql/src/Security/CWE-275/MissingActionsPermissions.ql
View File

@@ -1,6 +1,6 @@
/**
* @name Workflow does not contain permissions
* @description Workflows should contain permissions to provide a clear understanding has permissions to run the workflow.
* @description Workflows should contain explicit permissions to restrict the scope of the default GITHUB_TOKEN.
* @kind problem
* @security-severity 5.0
* @problem.severity warning

1
actions/ql/src/Security/CWE-312/ExcessiveSecretsExposure.ql
View File

@@ -3,6 +3,7 @@
* @description All organization and repository secrets are passed to the workflow runner.
* @kind problem
* @precision high
* @security-severity 5.0
* @problem.severity warning
* @id actions/excessive-secrets-exposure
* @tags actions

4
actions/ql/src/Security/CWE-312/UnmaskedSecretExposure.md
View File

@@ -2,11 +2,11 @@
## Description
Secrets derived from other secrets are not know to the workflow runner and therefore not masked unless explicitly registered.
Secrets derived from other secrets are not known to the workflow runner, and therefore are not masked unless explicitly registered.
## Recommendations
Avoid defining non-plain secrets. For example, do not define a new secret containing a JSON object and then read properties out of it from the workflow since these read values will not be masked by the workflow runner.
Avoid defining non-plain secrets. For example, do not define a new secret containing a JSON object and then read properties out of it from the workflow, since these read values will not be masked by the workflow runner.
## Examples

4
actions/ql/src/change-notes/2025-05-14-minimal-permission-for-add-to-project.md Normal file
View File

@@ -0,0 +1,4 @@
---
category: minorAnalysis
---
* The query `actions/missing-workflow-permissions` is now aware of the minimal permissions needed for the actions `deploy-pages`, `delete-package-versions`, `ai-inference`. This should lead to better alert messages and better fix suggestions.

13
actions/ql/src/change-notes/2025-02-04-suggest-actions-permissions.md → actions/ql/src/change-notes/released/0.5.4.md
View File

@@ -1,4 +1,9 @@
---
category: fix
---
* Alerts produced by the query `actions/missing-workflow-permissions` now include a minimal set of recommended permissions in the alert message, based on well-known actions seen within the workflow file.
## 0.5.4
### New Features
* CodeQL and Copilot Autofix support for GitHub Actions is now Generally Available.
### Bug Fixes
* Alerts produced by the query `actions/missing-workflow-permissions` now include a minimal set of recommended permissions in the alert message, based on well-known actions seen within the workflow file.

19
actions/ql/src/change-notes/released/0.6.0.md Normal file
View File

@@ -0,0 +1,19 @@
## 0.6.0
### Breaking Changes
* The following queries have been removed from the `security-and-quality` suite.
They are not intended to produce user-facing
alerts describing vulnerabilities.
Any existing alerts for these queries will be closed automatically.
* `actions/composite-action-sinks`
* `actions/composite-action-sources`
* `actions/composite-action-summaries`
* `actions/reusable-workflow-sinks`
(renamed from `actions/reusable-wokflow-sinks`)
* `actions/reusable-workflow-sources`
* `actions/reusable-workflow-summaries`
### Bug Fixes
* Assigned a `security-severity` to the query `actions/excessive-secrets-exposure`.

3
actions/ql/src/change-notes/released/0.6.1.md Normal file
View File

@@ -0,0 +1,3 @@
## 0.6.1
No user-facing changes.

2
actions/ql/src/codeql-pack.release.yml
View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 0.5.3
lastReleaseVersion: 0.6.1

4
actions/ql/src/codeql-suites/actions-code-quality.qls
View File

@@ -1 +1,3 @@
[]
- queries: .
- apply: code-quality-selectors.yml
from: codeql/suite-helpers

2
actions/ql/src/qlpack.yml
View File

@@ -1,5 +1,5 @@
name: codeql/actions-queries
version: 0.5.4-dev
version: 0.6.2-dev
library: false
warnOnImplicitThis: true
groups: [actions, queries]

10
actions/ql/test/query-tests/Security/CWE-275/.github/workflows/perms10.yml vendored Normal file
View File

@@ -0,0 +1,10 @@
on:
workflow_call:
workflow_dispatch:
jobs:
build:
name: Build and test
runs-on: ubuntu-latest
steps:
- uses: actions/ai-inference

10
actions/ql/test/query-tests/Security/CWE-275/.github/workflows/perms8.yml vendored Normal file
View File

@@ -0,0 +1,10 @@
on:
workflow_call:
workflow_dispatch:
jobs:
build:
name: Build and test
runs-on: ubuntu-latest
steps:
- uses: actions/deploy-pages

10
actions/ql/test/query-tests/Security/CWE-275/.github/workflows/perms9.yml vendored Normal file
View File

@@ -0,0 +1,10 @@
on:
workflow_call:
workflow_dispatch:
jobs:
build:
name: Build and test
runs-on: ubuntu-latest
steps:
- uses: actions/delete-package-versions

3
actions/ql/test/query-tests/Security/CWE-275/MissingActionsPermissions.expected
View File

@@ -3,3 +3,6 @@
| .github/workflows/perms5.yml:7:5:10:32 | Job: build | Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read} |
| .github/workflows/perms6.yml:7:5:11:39 | Job: build | Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read, id-token: write, pages: write} |
| .github/workflows/perms7.yml:7:5:10:38 | Job: build | Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {} |
| .github/workflows/perms8.yml:7:5:10:33 | Job: build | Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {id-token: write, pages: write} |
| .github/workflows/perms9.yml:7:5:10:44 | Job: build | Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {packages: write} |
| .github/workflows/perms10.yml:7:5:10:33 | Job: build | Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read, models: read} |

2446
cpp/downgrades/0f0a390468a5eb43d1dc72937c028070b106bf53/old.dbscheme Normal file
View File

File diff suppressed because it is too large Load Diff

2444
cpp/downgrades/0f0a390468a5eb43d1dc72937c028070b106bf53/semmlecode.cpp.dbscheme Normal file
View File

File diff suppressed because it is too large Load Diff

3
cpp/downgrades/0f0a390468a5eb43d1dc72937c028070b106bf53/upgrade.properties Normal file
View File

@@ -0,0 +1,3 @@
description: Add a new predicate `isVla()` to the `ArrayType` class
compatibility: full
type_is_vla.rel: delete

11
cpp/downgrades/2e2d805ef93d060b813403cb9b51dc72455a4c68/aggregate_array_init.ql Normal file
View File

@@ -0,0 +1,11 @@
class Expr extends @expr {
string toString() { none() }
}
class AggregateLiteral extends Expr, @aggregateliteral {
override string toString() { none() }
}
from AggregateLiteral aggregate, Expr initializer, int element_index, int position
where aggregate_array_init(aggregate, initializer, element_index, position, _)
select aggregate, initializer, element_index, position

15
cpp/downgrades/2e2d805ef93d060b813403cb9b51dc72455a4c68/aggregate_field_init.ql Normal file
View File

@@ -0,0 +1,15 @@
class Expr extends @expr {
string toString() { none() }
}
class AggregateLiteral extends Expr, @aggregateliteral {
override string toString() { none() }
}
class MemberVariable extends @membervariable {
string toString() { none() }
}
from AggregateLiteral aggregate, Expr initializer, MemberVariable field, int position
where aggregate_field_init(aggregate, initializer, field, position, _)
select aggregate, initializer, field, position

2448
cpp/downgrades/2e2d805ef93d060b813403cb9b51dc72455a4c68/old.dbscheme Normal file
View File

File diff suppressed because it is too large Load Diff

2446
cpp/downgrades/2e2d805ef93d060b813403cb9b51dc72455a4c68/semmlecode.cpp.dbscheme Normal file
View File

File diff suppressed because it is too large Load Diff

4
cpp/downgrades/2e2d805ef93d060b813403cb9b51dc72455a4c68/upgrade.properties Normal file
View File

@@ -0,0 +1,4 @@
description: add `hasDesignator` predicate to `ArrayOrVectorAggregateLiteral` and `ClassAggregateLiteral`
compatibility: backwards
aggregate_array_init.rel: run aggregate_array_init.qlo
aggregate_field_init.rel: run aggregate_field_init.qlo

2
cpp/downgrades/59cb96ca699929b63941e81905f9b8de7eed59a6/preprocdirects.ql
View File

@@ -11,7 +11,7 @@ int getKind(int kind) {
if kind = 14
then result = 6 // Represent MSFT #import as #include
else
if kind = 15 or kind = 6
if kind = 15 or kind = 16
then result = 3 // Represent #elifdef and #elifndef as #elif
else result = kind
}

11
cpp/downgrades/9a7c3c14c1076f64b871719117a558733d987b48/decltypes.ql Normal file
View File

@@ -0,0 +1,11 @@
class Type extends @type {
string toString() { none() }
}
class Expr extends @expr {
string toString() { none() }
}
from Type decltype, Expr expr, Type basetype, boolean parentheses
where decltypes(decltype, expr, _, basetype, parentheses)
select decltype, expr, basetype, parentheses

19
cpp/downgrades/9a7c3c14c1076f64b871719117a558733d987b48/derivedtypes.ql Normal file
View File

@@ -0,0 +1,19 @@
class Type extends @type {
string toString() { none() }
}
predicate derivedType(Type type, string name, int kind, Type type_id) {
derivedtypes(type, name, kind, type_id)
}
predicate typeTransformation(Type type, string name, int kind, Type type_id) {
type_operators(type, _, _, type_id) and
name = "" and
kind = 3 // @type_with_specifiers
}
from Type type, string name, int kind, Type type_id
where
derivedType(type, name, kind, type_id) or
typeTransformation(type, name, kind, type_id)
select type, name, kind, type_id

2491
cpp/downgrades/9a7c3c14c1076f64b871719117a558733d987b48/old.dbscheme Normal file
View File

File diff suppressed because it is too large Load Diff

2448
cpp/downgrades/9a7c3c14c1076f64b871719117a558733d987b48/semmlecode.cpp.dbscheme Normal file
View File

File diff suppressed because it is too large Load Diff

5
cpp/downgrades/9a7c3c14c1076f64b871719117a558733d987b48/upgrade.properties Normal file
View File

@@ -0,0 +1,5 @@
description: Support C23 typeof and typeof_unqual
compatibility: backwards
decltypes.rel: run decltypes.qlo
derivedtypes.rel: run derivedtypes.qlo
type_operators.rel: delete

9
cpp/misc/bulk_generation_targets.json Normal file
View File

@@ -0,0 +1,9 @@
{
"strategy": "dca",
"language": "cpp",
"targets": [
{ "name": "openssl", "with-sources": false, "with-sinks": false },
{ "name": "sqlite", "with-sources": false, "with-sinks": false }
],
"destination": "cpp/ql/lib/ext/generated"
}

2
cpp/ql/integration-tests/header-variant-tests/clang-pch/a.c Normal file
View File

@@ -0,0 +1,2 @@
#include "a.h"
#define FOUR 4

0
cpp/ql/test/header-variant-tests/clang-pch/a.h → cpp/ql/integration-tests/header-variant-tests/clang-pch/a.h
View File

0
cpp/ql/test/header-variant-tests/clang-pch/b.c → cpp/ql/integration-tests/header-variant-tests/clang-pch/b.c
View File

0
cpp/ql/test/header-variant-tests/clang-pch/b.h → cpp/ql/integration-tests/header-variant-tests/clang-pch/b.h
View File

3
cpp/ql/integration-tests/header-variant-tests/clang-pch/c.c Normal file
View File

@@ -0,0 +1,3 @@
int main() {
return ONE + FOUR;
}

0
cpp/ql/test/header-variant-tests/clang-pch/clang-pch.expected → cpp/ql/integration-tests/header-variant-tests/clang-pch/clang-pch.expected
View File

0
cpp/ql/test/header-variant-tests/clang-pch/clang-pch.ql → cpp/ql/integration-tests/header-variant-tests/clang-pch/clang-pch.ql
View File

1
cpp/ql/integration-tests/header-variant-tests/clang-pch/d.c Normal file
View File

@@ -0,0 +1 @@
#import "d.h"

0
cpp/ql/test/header-variant-tests/clang-pch/d.h → cpp/ql/integration-tests/header-variant-tests/clang-pch/d.h
View File

3
cpp/ql/integration-tests/header-variant-tests/clang-pch/e.c Normal file
View File

@@ -0,0 +1,3 @@
int main() {
return SEVENTEEN;
}

5
cpp/ql/integration-tests/header-variant-tests/clang-pch/f.c Normal file
View File

@@ -0,0 +1,5 @@
#if 1
#pragma hdrstop
extern int x;
#define SEEN_F
#endif

5
cpp/ql/integration-tests/header-variant-tests/clang-pch/g.c Normal file
View File

@@ -0,0 +1,5 @@
#ifdef SEEN_F
static int g() {
return 20;
}
#endif

4
cpp/ql/integration-tests/header-variant-tests/clang-pch/h.c Normal file
View File

@@ -0,0 +1,4 @@
#include "h1.h"
#pragma hdrstop
#include "h2.h"
#define SEEN_H

0
cpp/ql/test/header-variant-tests/clang-pch/h1.h → cpp/ql/integration-tests/header-variant-tests/clang-pch/h1.h
View File

0
cpp/ql/test/header-variant-tests/clang-pch/h2.h → cpp/ql/integration-tests/header-variant-tests/clang-pch/h2.h
View File

Some files were not shown because too many files have changed in this diff Show More