Commit Graph

87373 Commits

Author SHA1 Message Date
Jack Nørskov Jørgensen
0249be2277 Updated MaDs with certainty 4 2026-05-12 15:49:37 +02:00
Jack Nørskov Jørgensen
8d22ee5508 Add MaDs for Apache Avro 2026-05-12 15:35:15 +02:00
Jack Nørskov Jørgensen
1d19b2f41f Enable local threat-model by default 2026-05-12 15:35:15 +02:00
Taus
9c958a420a Merge pull request #21819 from github/tausbn/unified-vendor-in-tree-sitter-swift
unified: use a vendored-in copy of tree-sitter-swift
2026-05-12 14:55:35 +02:00
Taus
2e9de7878b unified: update build dependencies 2026-05-12 11:25:15 +00:00
Taus
c5ae315dbe unified: auto-generate parser files
Uses the `tree-sitter-generate` crate to generate these files on the
fly.
2026-05-12 11:24:35 +00:00
Owen Mansel-Chan
592c7c0437 Merge pull request #21826 from AriehSchneier/fix/go-extractor-root-test-files
Go: Fix extractor to extract root internal test files
2026-05-12 10:34:42 +01:00
Owen Mansel-Chan
c0798f7b1d Merge pull request #21829 from owen-mc/static/update-framework-report-sink-kinds
C#, Go, Java: Use all path injection sinks when generating docs
2026-05-12 10:16:31 +01:00
Jeroen Ketema
cac7262a45 Merge pull request #21831 from jketema/jketema/swift-declared-interface-type
Swift: Expose the declared interface type of a type decl
2026-05-12 09:47:39 +02:00
Owen Mansel-Chan
6b65866ff4 Merge branch 'main' into fix/go-extractor-root-test-files 2026-05-11 17:18:43 +01:00
Jeroen Ketema
73a210a442 Swift: Add change note 2026-05-11 17:24:09 +02:00
Owen Mansel-Chan
0aaa7d0631 Update expected test output 2026-05-11 16:15:50 +01:00
Jeroen Ketema
f212efbe5b Swift: Expose the declared interface type of a type decl 2026-05-11 17:05:45 +02:00
Arieh Schneier
aa1d322fe7 Address PR feedback
Changes based on code review:

1. Remove redundant strings.Contains check in isExactTestPackage
   The equality check on the next line handles both cases, making
   the early return unnecessary.

2. Extract package selection logic into selectBestPackages function
   This reduces code duplication and allows the test to call the
   actual implementation rather than copying the logic.

3. Add TestSelectBestPackages to test the new function
   Comprehensive test covering single packages, test vs production,
   exact vs nested tests, and multiple packages.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-05-11 21:07:39 +10:00
Arieh Schneier
151a332f0a Add Bazel build target for extractor_test.go
Generated by manually applying the output from CI's Gazelle check.
This adds the go_test target for the new extractor_test.go file.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-05-11 20:55:11 +10:00
Owen Mansel-Chan
974e7cc319 Merge pull request #21825 from github/dependabot/go_modules/go/extractor/extractor-dependencies-0e0a523006
Bump the extractor-dependencies group in /go/extractor with 2 updates
2026-05-11 11:35:14 +01:00
Asger F
f91482810d Merge pull request #21816 from github/tausbn/yeast-mutate-in-place
yeast: Two minor performance optimisations
2026-05-11 11:08:24 +02:00
Owen Mansel-Chan
ec8ff6ff68 Use all path injection sinks when generating docs 2026-05-11 09:56:02 +01:00
Arieh Schneier
b94ab8d186 Add integration test for root internal test extraction
This test verifies that root internal test files (package foo, not
foo_test) are correctly extracted when the repository has both:
1. Root-level internal tests (main_test.go with package main)
2. Nested packages with tests (nested/nested_test.go)

This scenario reproduces the bug that was fixed: the old extractor
would select the wrong package variant and miss root internal test
files.

The test ensures:
- main_test.go (root internal test) is extracted
- nested/nested_test.go (nested test) is extracted
- All test functions from both files are present in the database

This prevents regression of the bug fix.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-05-11 15:18:15 +10:00
Arieh Schneier
3ef4a5836c Fix Go extractor to extract root internal test files
When CODEQL_EXTRACTOR_GO_OPTION_EXTRACT_TESTS=true is set, the Go
extractor was incorrectly skipping internal test files (package foo)
at repository roots when the project contains nested test packages.

Root Cause:
The extractor selected package variants by longest ID string, but this
heuristic fails when nested packages have tests. For a package like
"github.com/go-git/go-git/v6", packages.Load returns multiple variants:

1. "github.com/go-git/go-git/v6" (19 files, production only)
2. "github.com/go-git/go-git/v6 [github.com/go-git/go-git/v6.test]"
   (39 files, production + 20 root tests) ← Should select this
3. "github.com/go-git/go-git/v6 [github.com/go-git/go-git/v6/plumbing/format/packfile.test]"
   (19 files, test dependency) ← Was incorrectly selected (longest string)

The old logic selected variant #3 (76 chars) over #2 (68 chars),
causing 20 root test files to be missing from the database.

Fix:
Replace string length comparison with a better heuristic that prefers:
1. Exact test packages (e.g., "pkg [pkg.test]") over nested dependencies
2. Packages with more Syntax nodes (more files to extract)
3. String length as a tiebreaker

This ensures the extractor selects the variant with the most complete
test coverage, particularly for root-level internal tests.

Testing:
- Added comprehensive unit tests covering the selection logic
- Tests simulate the real-world go-git scenario
- All tests pass

Impact:
Root-level external tests (package foo_test) were already extracted
correctly. This fix ensures internal tests (package foo) at the root
are now also extracted when they exist alongside nested test packages.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-05-11 13:42:17 +10:00
dependabot[bot]
8f9d5c5217 Bump the extractor-dependencies group in /go/extractor with 2 updates
Bumps the extractor-dependencies group in /go/extractor with 2 updates: [golang.org/x/mod](https://github.com/golang/mod) and [golang.org/x/tools](https://github.com/golang/tools).


Updates `golang.org/x/mod` from 0.35.0 to 0.36.0
- [Commits](https://github.com/golang/mod/compare/v0.35.0...v0.36.0)

Updates `golang.org/x/tools` from 0.44.0 to 0.45.0
- [Release notes](https://github.com/golang/tools/releases)
- [Commits](https://github.com/golang/tools/compare/v0.44.0...v0.45.0)

---
updated-dependencies:
- dependency-name: golang.org/x/mod
  dependency-version: 0.36.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: extractor-dependencies
- dependency-name: golang.org/x/tools
  dependency-version: 0.45.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: extractor-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-05-11 03:06:30 +00:00
Taus
60d6429b5d unified: update build dependencies 2026-05-08 13:41:45 +00:00
Taus
9f6bd88171 unified: vendor in tree-sitter-swift 2026-05-08 13:41:14 +00:00
Taus
15936a5f8d yeast: Take fields by ownership in apply_rules_inner
Previously, apply_rules_inner snapshotted a node's fields by cloning
the BTreeMap into a Vec<(FieldId, Vec<Id>)>, then built a fresh
BTreeMap of new_fields for the rewritten Ids. For a node with N
fields, this allocated 2N+1 things per visit (the snapshot Vec, N
cloned children Vecs, the new BTreeMap entries) — even when nothing
in the subtree was rewritten.

Use std::mem::take to swap the parent's fields out by ownership: the
recursion can mutate the AST (including pushing new nodes from rule
firings) without any conflict, since we hold the owned BTreeMap
locally. Iterate values_mut() and only allocate a fresh children Vec
on the first divergence (lazy alloc): unchanged children stay in the
existing slot. When done, swap the fields back.

For a subtree with no rewrites, this is now zero allocations per node
(modulo the recursion itself). For nodes with rewrites, it's one Vec
allocation per field that contains a rewritten child, instead of two
plus the BTreeMap rebuild.
2026-05-08 12:48:10 +00:00
Taus
7bd27b83e0 yeast: Mutate parent fields in place; remove redundant Node::id
apply_rules_inner used to handle the "child was rewritten, so the
parent needs new field IDs" case by cloning the parent node, swapping
in the new fields, pushing the clone onto the arena, and returning the
new Id. Every ancestor on the path from the rewrite up to the root was
duplicated this way, with the originals retained as garbage in the
arena.

Switch to in-place mutation: assign `ast.nodes[id].fields = new_fields`
and return the same Id. Rule firings still produce genuinely new nodes
via BuildCtx (their structure differs from the input), but the
ancestor-rebuild spine no longer copies anything.

This is safe because apply_rules_inner already works entirely by Id:
the field snapshot is cloned out before recursing, no &Node references
are held across mutations of the arena, and captures are scoped to a
single rule firing so the now-stable Ids do not break anything.

Memory effect: a desugaring pass that rewrites R leaves of a tree of
average depth d previously appended R*d ancestor clones to the arena.
Now appends 0.

With Ids stable for the lifetime of an Ast, the Node::id field becomes
truly redundant and is removed (along with the Node::id() accessor).
AstCursor switches from caching `node: &Node` to tracking `node_id:
Id` and looking the node up via the arena on each access; ChildrenIter
now yields Ids directly. A new AstCursor::node_id() method gives
callers access to the cursor position by Id.
2026-05-08 12:47:22 +00:00
Owen Mansel-Chan
36554d160c Merge pull request #21741 from MarkLee131/fix/path-injection-read-subkind
Fix/path injection read subkind
2026-05-08 12:38:16 +01:00
Taus
5a4dee50f7 Merge pull request #21810 from github/tausbn/yeast-forward-scan-queries
yeast: Align query semantics more closely with tree-sitter
2026-05-08 13:30:43 +02:00
Asger F
fdef477138 Merge pull request #21812 from asgerf/asgerf/swift-yeast-1
Add tree-sitter-swift extractor scaffolding and YEAST desugaring
2026-05-08 13:21:17 +02:00
Anders Schack-Mulligen
81e1ab7aab Merge pull request #21808 from aschackmull/cfg/switch-pattern-eval
Cfg: Rework CFG for switch case patterns.
2026-05-08 12:48:44 +02:00
Paolo Tranquilli
8cc6d788c5 Merge pull request #21814 from github/codeql-spark-run-25547718006
Update changelog documentation site for codeql-cli-2.25.4
2026-05-08 11:45:26 +02:00
github-actions[bot]
26e13055c8 update codeql documentation 2026-05-08 09:24:10 +00:00
Asger F
33e89ea123 Address review comments 2026-05-08 09:03:18 +02:00
Asger F
9a2b7bac8f Fix Bazel glob to include subdirectories
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
2026-05-08 08:56:40 +02:00
Anders Schack-Mulligen
048411e168 Apply suggestions from code review
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com>
2026-05-08 08:11:32 +02:00
Asger F
2802819170 Use new YEAST API after rebasing 2026-05-07 21:37:42 +02:00
Asger F
a1447075e8 Add AGENTS.md with build/test instructions 2026-05-07 21:35:51 +02:00
Asger F
cd457a7d6b Move Swift language into its own module 2026-05-07 21:35:50 +02:00
Asger F
4e12a8c8d2 Add basic YEAST dependency and rule 2026-05-07 21:35:48 +02:00
Asger F
0210c970f2 Add tree-sitter for Swift (called 'unified') 2026-05-07 21:35:46 +02:00
Taus
b027ac3658 Merge pull request #21809 from github/tausbn/yeast-add-support-for-desugaring-phases
Yeast: Two small improvements
2026-05-07 19:00:44 +02:00
MarkLee131
26af52897d Merge branch 'main' into fix/path-injection-read-subkind 2026-05-07 23:48:42 +08:00
Taus
af6e921da5 yeast: Forward-scan bare child patterns instead of strict positional
Previously, a bare child pattern in a query took whatever the next
child of the iterator was and either matched or failed: it would not
scan ahead to find a match. So `(foo ("baz"))` against a `foo` whose
implicit `child` field was `["bar", "baz"]` would fail (the pattern
took "bar" first).

Switch to forward-scan semantics: a SingleNode matcher advances through
the iterator until it finds a child that matches its sub-query. Patterns
that are named-only continue to skip past unnamed children for free.
Order is preserved across multiple bare patterns at the same level —
each pattern advances the shared iterator past whatever it consumed —
so a query cannot match children out of source order.

Captures from a failed match attempt are rolled back via a snapshot, so
partial captures from a complex sub-query do not leak across attempts.

Add two regression tests against the `do` body wrapper in a Ruby
for-loop, whose implicit `child` field contains [do, identifier, end]:
- a query for ("end") matches by skipping past `do` and the identifier
- a query for ("end") then ("do") fails, demonstrating order preservation
2026-05-07 15:08:22 +00:00
Taus
6f643a3604 yeast: Use canonical ID when registering unnamed kinds in Schema
Schema::from_language registered unnamed kinds via or_insert(id), where
`id` came from iterating 0..node_kind_count. For names with multiple
unnamed IDs (notably "end" in tree-sitter-ruby has IDs 0 and 13, where
ID 0 is the reserved error token), this picked the first encountered
ID — typically the wrong one.

The visitor sets node.kind via language.id_for_node_kind(name, false),
which returns the canonical ID. So a query for ("end") would compare
node.kind=13 against schema=0 and silently fail to match, with no
diagnostic.

Use language.id_for_node_kind(name, false) to obtain the canonical ID
when registering, mirroring the named-kind path that already does the
same with id_for_node_kind(name, true).
2026-05-07 15:08:21 +00:00
Taus
a4df96aad6 yeast: Support capturing unnamed nodes in queries
Three improvements to the query parser, all aimed at allowing query
patterns to refer to unnamed tokens:

1. Bare-literal capture: `"=" @op` now captures the unnamed `=` token,
   matching the parenthesized form `("=") @op`. Previously the literal
   branch in parse_query_list skipped the maybe_wrap_capture call, so
   the `@op` was a leftover token and would error.

2. Bare `_` matches any node, named or unnamed. Previously bare `_` and
   `(_)` both produced QueryNode::Any with the same matches_named_only
   behaviour, so bare `_` would skip unnamed children. Now Any carries a
   match_unnamed flag: false for `(_)` (named-only, tree-sitter default)
   and true for bare `_` (any node).

3. Named fields and bare child patterns may be intermixed in any order.
   Previously, once parse_query_fields saw a bare pattern it would stop
   accepting named fields. The fix accumulates bare patterns into the
   implicit `child` field and keeps parsing.

Each named field independently selects its target field for matching, so
the source-order of fields in the query is purely cosmetic and intermixing
is safe.

Add tests covering parenthesized capture, bare-literal capture, and the
named-vs-any distinction between `(_)` and bare `_`. Update query-syntax
docs to reflect all three.
2026-05-07 15:08:21 +00:00
Owen Mansel-Chan
f9240e7058 Fix QL formatting 2026-05-07 15:57:33 +01:00
Anders Schack-Mulligen
6b6df374fa C#/Java: Accept test changes. 2026-05-07 15:07:31 +02:00
Paolo Tranquilli
f9e42ac443 Merge pull request #21794 from github/post-release-prep/codeql-cli-2.25.4
Post-release preparation for codeql-cli-2.25.4
2026-05-07 14:43:24 +02:00
copilot-swe-agent[bot]
e0d663f79b yeast: address review wording in phase docs
Agent-Logs-Url: https://github.com/github/codeql/sessions/6d23db05-a6e9-4de4-8951-b465980fd0ef

Co-authored-by: tausbn <1104778+tausbn@users.noreply.github.com>
2026-05-07 12:35:46 +00:00
Taus
33fc767782 Merge pull request #21797 from github/tausbn/yeast-desugaring-tool
Shared: Add YEAST desugaring library
2026-05-07 13:48:12 +02:00
Anders Schack-Mulligen
072166ba88 C#/Java: Adjust Guards instantiations. 2026-05-07 13:46:52 +02:00