Convert non-Go/Java qlrefs to query key format

Initial plan
Merge pull request #21941 from hvitved/python/content-approx
2026-06-10 15:31:12 +02:00 · 2026-06-10 12:37:39 +00:00 · 2026-06-10 12:31:19 +00:00 · 2026-06-09 15:46:04 +02:00 · 2026-06-09 05:30:45 +01:00 · 2026-06-09 03:03:37 +00:00
1072 changed files with 1825 additions and 1256 deletions
--- a/.github/workflows/go-version-update.yml
+++ b/.github/workflows/go-version-update.yml
@@ -0,0 +1,208 @@
+name: Update Go version
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "0 3 * * 1"  # Run weekly on Mondays at 3 AM UTC (1 = Monday)
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  update-go-version:
+    name: Check and update Go version
+    if: github.repository == 'github/codeql'
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - name: Set up Git
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+      - name: Fetch latest Go version
+        id: fetch-version
+        run: |
+          LATEST_GO_VERSION=$(curl -s https://go.dev/dl/?mode=json | jq -r '.[0].version')
+          
+          if [ -z "$LATEST_GO_VERSION" ] || [ "$LATEST_GO_VERSION" = "null" ]; then
+            echo "Error: Failed to fetch latest Go version from go.dev"
+            exit 1
+          fi
+          
+          echo "Latest Go version from go.dev: $LATEST_GO_VERSION"
+          echo "version=$LATEST_GO_VERSION" >> $GITHUB_OUTPUT
+          
+          # Extract version numbers (e.g., go1.26.0 -> 1.26.0)
+          LATEST_VERSION_NUM=$(echo $LATEST_GO_VERSION | sed 's/^go//')
+          echo "version_num=$LATEST_VERSION_NUM" >> $GITHUB_OUTPUT
+          
+          # Extract major.minor version (e.g., 1.26.0 -> 1.26)
+          LATEST_MAJOR_MINOR=$(echo $LATEST_VERSION_NUM | sed -E 's/^([0-9]+\.[0-9]+).*/\1/')
+          echo "major_minor=$LATEST_MAJOR_MINOR" >> $GITHUB_OUTPUT
+
+      - name: Check current Go version
+        id: current-version
+        run: |
+          CURRENT_VERSION=$(sed -n 's/.*go_sdk\.download(version = \"\([^\"]*\)\".*/\1/p' MODULE.bazel)
+          
+          if [ -z "$CURRENT_VERSION" ]; then
+            echo "Error: Could not extract Go version from MODULE.bazel"
+            exit 1
+          fi
+          
+          echo "Current Go version in MODULE.bazel: $CURRENT_VERSION"
+          echo "version=$CURRENT_VERSION" >> $GITHUB_OUTPUT
+          
+          # Extract major.minor version
+          CURRENT_MAJOR_MINOR=$(echo $CURRENT_VERSION | sed -E 's/^([0-9]+\.[0-9]+).*/\1/')
+          echo "major_minor=$CURRENT_MAJOR_MINOR" >> $GITHUB_OUTPUT
+
+      - name: Compare versions
+        id: compare
+        run: |
+          LATEST="${{ steps.fetch-version.outputs.version_num }}"
+          CURRENT="${{ steps.current-version.outputs.version }}"
+          
+          echo "Latest: $LATEST"
+          echo "Current: $CURRENT"
+          
+          if [ "$LATEST" = "$CURRENT" ]; then
+            echo "Go version is up to date"
+            echo "needs_update=false" >> $GITHUB_OUTPUT
+          else
+            echo "Go version needs update from $CURRENT to $LATEST"
+            echo "needs_update=true" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Update Go version in files
+        if: steps.compare.outputs.needs_update == 'true'
+        run: |
+          LATEST_VERSION_NUM="${{ steps.fetch-version.outputs.version_num }}"
+          LATEST_MAJOR_MINOR="${{ steps.fetch-version.outputs.major_minor }}"
+          CURRENT_VERSION="${{ steps.current-version.outputs.version }}"
+          CURRENT_MAJOR_MINOR="${{ steps.current-version.outputs.major_minor }}"
+          
+          echo "Updating from $CURRENT_VERSION to $LATEST_VERSION_NUM"
+          
+          # Escape dots in current version strings for use in sed patterns
+          CURRENT_VERSION_ESCAPED=$(echo "$CURRENT_VERSION" | sed 's/\./\\./g')
+          CURRENT_MAJOR_MINOR_ESCAPED=$(echo "$CURRENT_MAJOR_MINOR" | sed 's/\./\\./g')
+          
+          # Update MODULE.bazel
+          sed -i "s/go_sdk\.download(version = \"$CURRENT_VERSION_ESCAPED\")/go_sdk.download(version = \"$LATEST_VERSION_NUM\")/" MODULE.bazel
+          if ! grep -q "go_sdk.download(version = \"$LATEST_VERSION_NUM\")" MODULE.bazel; then
+            echo "Error: Failed to update MODULE.bazel"
+            exit 1
+          fi
+          
+          # Update go/extractor/go.mod
+          if ! sed -i "s/^go $CURRENT_MAJOR_MINOR_ESCAPED\$/go $LATEST_MAJOR_MINOR/" go/extractor/go.mod; then
+            echo "Warning: Failed to update go directive in go.mod"
+          fi
+          if ! sed -i "s/^toolchain go$CURRENT_VERSION_ESCAPED\$/toolchain go$LATEST_VERSION_NUM/" go/extractor/go.mod; then
+            echo "Warning: Failed to update toolchain in go.mod"
+          fi
+          
+          # Update go/extractor/autobuilder/build-environment.go
+          if ! sed -i "s/var maxGoVersion = util\.NewSemVer(\"$CURRENT_MAJOR_MINOR_ESCAPED\")/var maxGoVersion = util.NewSemVer(\"$LATEST_MAJOR_MINOR\")/" go/extractor/autobuilder/build-environment.go; then
+            echo "Warning: Failed to update build-environment.go"
+          fi
+          
+          # Update go/actions/test/action.yml
+          if ! sed -i "s/default: \"~$CURRENT_VERSION_ESCAPED\"/default: \"~$LATEST_VERSION_NUM\"/" go/actions/test/action.yml; then
+            echo "Warning: Failed to update action.yml"
+          fi
+          
+          # Show what changed
+          git diff
+
+      - name: Check for changes
+        id: check-changes
+        if: steps.compare.outputs.needs_update == 'true'
+        run: |
+          if git diff --quiet; then
+            echo "No changes detected"
+            echo "has_changes=false" >> $GITHUB_OUTPUT
+          else
+            echo "Changes detected"
+            echo "has_changes=true" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Check for existing PR
+        if: steps.check-changes.outputs.has_changes == 'true'
+        id: check-pr
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          BRANCH_NAME="workflow/go-version-update"
+          PR_NUMBER=$(gh pr list --head "$BRANCH_NAME" --state open --json number --jq '.[0].number')
+          
+          if [ -n "$PR_NUMBER" ]; then
+            echo "Existing PR found: #$PR_NUMBER"
+            echo "pr_exists=true" >> $GITHUB_OUTPUT
+            echo "pr_number=$PR_NUMBER" >> $GITHUB_OUTPUT
+          else
+            echo "No existing PR found"
+            echo "pr_exists=false" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Commit and push changes
+        if: steps.check-changes.outputs.has_changes == 'true'
+        run: |
+          BRANCH_NAME="workflow/go-version-update"
+          LATEST_VERSION_NUM="${{ steps.fetch-version.outputs.version_num }}"
+          LATEST_MAJOR_MINOR="${{ steps.fetch-version.outputs.major_minor }}"
+          
+          # Create or switch to branch
+          git checkout -B "$BRANCH_NAME"
+          
+          # Stage and commit changes
+          git add MODULE.bazel go/extractor/go.mod go/extractor/autobuilder/build-environment.go go/actions/test/action.yml
+          git commit -m "Go: Update to $LATEST_VERSION_NUM"
+          
+          # Push changes
+          git push --force-with-lease origin "$BRANCH_NAME"
+
+      - name: Create or update PR
+        if: steps.check-changes.outputs.has_changes == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          BRANCH_NAME="workflow/go-version-update"
+          LATEST_VERSION_NUM="${{ steps.fetch-version.outputs.version_num }}"
+          CURRENT_VERSION="${{ steps.current-version.outputs.version }}"
+          
+          PR_TITLE="Go: Update to $LATEST_VERSION_NUM"
+          
+          PR_BODY=$(cat <<EOF
+          This PR updates Go from $CURRENT_VERSION to $LATEST_VERSION_NUM.
+
+          Updated files:
+          - \`MODULE.bazel\` - go_sdk.download version
+          - \`go/extractor/go.mod\` - go directive and toolchain
+          - \`go/extractor/autobuilder/build-environment.go\` - maxGoVersion (only if MAJOR.MINOR changes)
+          - \`go/actions/test/action.yml\` - default go-test-version
+
+          This PR was automatically created by the [Go version update workflow](https://github.com/${{ github.repository }}/blob/main/.github/workflows/go-version-update.yml).
+          EOF
+          )
+          
+          if [ "${{ steps.check-pr.outputs.pr_exists }}" = "true" ]; then
+            echo "Updating existing PR #${{ steps.check-pr.outputs.pr_number }}"
+            gh pr edit "${{ steps.check-pr.outputs.pr_number }}" --title "$PR_TITLE" --body "$PR_BODY"
+          else
+            echo "Creating new PR"
+            gh pr create \
+              --title "$PR_TITLE" \
+              --body "$PR_BODY" \
+              --base main \
+              --head "$BRANCH_NAME" \
+              --label "Go"
+          fi
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -273,7 +273,7 @@ use_repo(
 )

 go_sdk = use_extension("@rules_go//go:extensions.bzl", "go_sdk")
-go_sdk.download(version = "1.26.0")
+go_sdk.download(version = "1.26.4")

 go_deps = use_extension("@gazelle//:extensions.bzl", "go_deps")
 go_deps.from_file(go_mod = "//go/extractor:go.mod")
--- a/actions/ql/test/query-tests/Models/CompositeActionsSinks.qlref
+++ b/actions/ql/test/query-tests/Models/CompositeActionsSinks.qlref
@@ -1 +1 @@
-Models/CompositeActionsSinks.ql
+query: Models/CompositeActionsSinks.ql
--- a/actions/ql/test/query-tests/Models/CompositeActionsSources.qlref
+++ b/actions/ql/test/query-tests/Models/CompositeActionsSources.qlref
@@ -1,2 +1 @@
-Models/CompositeActionsSources.ql
-
+query: Models/CompositeActionsSources.ql
--- a/actions/ql/test/query-tests/Models/CompositeActionsSummaries.qlref
+++ b/actions/ql/test/query-tests/Models/CompositeActionsSummaries.qlref
@@ -1,2 +1 @@
-Models/CompositeActionsSummaries.ql
-
+query: Models/CompositeActionsSummaries.ql
--- a/actions/ql/test/query-tests/Models/ReusableWorkflowsSinks.qlref
+++ b/actions/ql/test/query-tests/Models/ReusableWorkflowsSinks.qlref
@@ -1,2 +1 @@
-Models/ReusableWorkflowsSinks.ql
-
+query: Models/ReusableWorkflowsSinks.ql
--- a/actions/ql/test/query-tests/Models/ReusableWorkflowsSources.qlref
+++ b/actions/ql/test/query-tests/Models/ReusableWorkflowsSources.qlref
@@ -1,2 +1 @@
-Models/ReusableWorkflowsSources.ql
-
+query: Models/ReusableWorkflowsSources.ql
--- a/actions/ql/test/query-tests/Models/ReusableWorkflowsSummaries.qlref
+++ b/actions/ql/test/query-tests/Models/ReusableWorkflowsSummaries.qlref
@@ -1,2 +1 @@
-Models/ReusableWorkflowsSummaries.ql
-
+query: Models/ReusableWorkflowsSummaries.ql
--- a/actions/ql/test/query-tests/Security/CWE-074/OutputClobberingHigh.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-074/OutputClobberingHigh.qlref
@@ -1 +1 @@
-experimental/Security/CWE-074/OutputClobberingHigh.ql
+query: experimental/Security/CWE-074/OutputClobberingHigh.ql
--- a/actions/ql/test/query-tests/Security/CWE-077/EnvPathInjectionCritical.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-077/EnvPathInjectionCritical.qlref
@@ -1 +1 @@
-Security/CWE-077/EnvPathInjectionCritical.ql
+query: Security/CWE-077/EnvPathInjectionCritical.ql
--- a/actions/ql/test/query-tests/Security/CWE-077/EnvPathInjectionMedium.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-077/EnvPathInjectionMedium.qlref
@@ -1 +1 @@
-Security/CWE-077/EnvPathInjectionMedium.ql
+query: Security/CWE-077/EnvPathInjectionMedium.ql
--- a/actions/ql/test/query-tests/Security/CWE-077/EnvVarInjectionCritical.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-077/EnvVarInjectionCritical.qlref
@@ -1 +1 @@
-Security/CWE-077/EnvVarInjectionCritical.ql
+query: Security/CWE-077/EnvVarInjectionCritical.ql
--- a/actions/ql/test/query-tests/Security/CWE-077/EnvVarInjectionMedium.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-077/EnvVarInjectionMedium.qlref
@@ -1 +1 @@
-Security/CWE-077/EnvVarInjectionMedium.ql
+query: Security/CWE-077/EnvVarInjectionMedium.ql
--- a/actions/ql/test/query-tests/Security/CWE-078/CommandInjectionCritical.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-078/CommandInjectionCritical.qlref
@@ -1 +1 @@
-experimental/Security/CWE-078/CommandInjectionCritical.ql
+query: experimental/Security/CWE-078/CommandInjectionCritical.ql
--- a/actions/ql/test/query-tests/Security/CWE-078/CommandInjectionMedium.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-078/CommandInjectionMedium.qlref
@@ -1 +1 @@
-experimental/Security/CWE-078/CommandInjectionMedium.ql
+query: experimental/Security/CWE-078/CommandInjectionMedium.ql
--- a/actions/ql/test/query-tests/Security/CWE-088/ArgumentInjectionCritical.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-088/ArgumentInjectionCritical.qlref
@@ -1 +1 @@
-experimental/Security/CWE-088/ArgumentInjectionCritical.ql
+query: experimental/Security/CWE-088/ArgumentInjectionCritical.ql
--- a/actions/ql/test/query-tests/Security/CWE-088/ArgumentInjectionMedium.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-088/ArgumentInjectionMedium.qlref
@@ -1 +1 @@
-experimental/Security/CWE-088/ArgumentInjectionMedium.ql
+query: experimental/Security/CWE-088/ArgumentInjectionMedium.ql
--- a/actions/ql/test/query-tests/Security/CWE-094/CodeInjectionCritical.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-094/CodeInjectionCritical.qlref
@@ -1 +1 @@
-Security/CWE-094/CodeInjectionCritical.ql
+query: Security/CWE-094/CodeInjectionCritical.ql
--- a/actions/ql/test/query-tests/Security/CWE-094/CodeInjectionMedium.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-094/CodeInjectionMedium.qlref
@@ -1 +1 @@
-Security/CWE-094/CodeInjectionMedium.ql
+query: Security/CWE-094/CodeInjectionMedium.ql
--- a/actions/ql/test/query-tests/Security/CWE-1395/UseOfKnownVulnerableAction.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-1395/UseOfKnownVulnerableAction.qlref
@@ -1,2 +1 @@
-Security/CWE-1395/UseOfKnownVulnerableAction.ql
-
+query: Security/CWE-1395/UseOfKnownVulnerableAction.ql
--- a/actions/ql/test/query-tests/Security/CWE-200/SecretExfiltration.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-200/SecretExfiltration.qlref
@@ -1,2 +1 @@
-experimental/Security/CWE-200/SecretExfiltration.ql
-
+query: experimental/Security/CWE-200/SecretExfiltration.ql
--- a/actions/ql/test/query-tests/Security/CWE-275/MissingActionsPermissions.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-275/MissingActionsPermissions.qlref
@@ -1,2 +1 @@
-Security/CWE-275/MissingActionsPermissions.ql
-
+query: Security/CWE-275/MissingActionsPermissions.ql
--- a/actions/ql/test/query-tests/Security/CWE-284/CodeExecutionOnSelfHostedRunner.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-284/CodeExecutionOnSelfHostedRunner.qlref
@@ -1,2 +1 @@
-experimental/Security/CWE-284/CodeExecutionOnSelfHostedRunner.ql
-
+query: experimental/Security/CWE-284/CodeExecutionOnSelfHostedRunner.ql
--- a/actions/ql/test/query-tests/Security/CWE-285/ImproperAccessControl.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-285/ImproperAccessControl.qlref
@@ -1,2 +1 @@
-Security/CWE-285/ImproperAccessControl.ql
-
+query: Security/CWE-285/ImproperAccessControl.ql
--- a/actions/ql/test/query-tests/Security/CWE-312/ExcessiveSecretsExposure.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-312/ExcessiveSecretsExposure.qlref
@@ -1,2 +1 @@
-Security/CWE-312/ExcessiveSecretsExposure.ql
-
+query: Security/CWE-312/ExcessiveSecretsExposure.ql
--- a/actions/ql/test/query-tests/Security/CWE-312/SecretsInArtifacts.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-312/SecretsInArtifacts.qlref
@@ -1,2 +1 @@
-Security/CWE-312/SecretsInArtifacts.ql
-
+query: Security/CWE-312/SecretsInArtifacts.ql
--- a/actions/ql/test/query-tests/Security/CWE-312/UnmaskedSecretExposure.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-312/UnmaskedSecretExposure.qlref
@@ -1,2 +1 @@
-Security/CWE-312/UnmaskedSecretExposure.ql
-
+query: Security/CWE-312/UnmaskedSecretExposure.ql
--- a/actions/ql/test/query-tests/Security/CWE-349/CachePoisoningViaCodeInjection.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-349/CachePoisoningViaCodeInjection.qlref
@@ -1,2 +1 @@
-Security/CWE-349/CachePoisoningViaCodeInjection.ql
-
+query: Security/CWE-349/CachePoisoningViaCodeInjection.ql
--- a/actions/ql/test/query-tests/Security/CWE-349/CachePoisoningViaDirectCache.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-349/CachePoisoningViaDirectCache.qlref
@@ -1,2 +1 @@
-Security/CWE-349/CachePoisoningViaDirectCache.ql
-
+query: Security/CWE-349/CachePoisoningViaDirectCache.ql
--- a/actions/ql/test/query-tests/Security/CWE-349/CachePoisoningViaPoisonableStep.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-349/CachePoisoningViaPoisonableStep.qlref
@@ -1,2 +1 @@
-Security/CWE-349/CachePoisoningViaPoisonableStep.ql
-
+query: Security/CWE-349/CachePoisoningViaPoisonableStep.ql
--- a/actions/ql/test/query-tests/Security/CWE-367/UntrustedCheckoutTOCTOUCritical.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-367/UntrustedCheckoutTOCTOUCritical.qlref
@@ -1 +1 @@
-Security/CWE-367/UntrustedCheckoutTOCTOUCritical.ql
+query: Security/CWE-367/UntrustedCheckoutTOCTOUCritical.ql
--- a/actions/ql/test/query-tests/Security/CWE-367/UntrustedCheckoutTOCTOUHigh.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-367/UntrustedCheckoutTOCTOUHigh.qlref
@@ -1 +1 @@
-Security/CWE-367/UntrustedCheckoutTOCTOUHigh.ql
+query: Security/CWE-367/UntrustedCheckoutTOCTOUHigh.ql
--- a/actions/ql/test/query-tests/Security/CWE-571/ExpressionIsAlwaysTrueCritical.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-571/ExpressionIsAlwaysTrueCritical.qlref
@@ -1 +1 @@
-Security/CWE-571/ExpressionIsAlwaysTrueCritical.ql
+query: Security/CWE-571/ExpressionIsAlwaysTrueCritical.ql
--- a/actions/ql/test/query-tests/Security/CWE-571/ExpressionIsAlwaysTrueHigh.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-571/ExpressionIsAlwaysTrueHigh.qlref
@@ -1 +1 @@
-Security/CWE-571/ExpressionIsAlwaysTrueHigh.ql
+query: Security/CWE-571/ExpressionIsAlwaysTrueHigh.ql
--- a/actions/ql/test/query-tests/Security/CWE-829/ArtifactPoisoningCritical.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-829/ArtifactPoisoningCritical.qlref
@@ -1,2 +1 @@
-Security/CWE-829/ArtifactPoisoningCritical.ql
-
+query: Security/CWE-829/ArtifactPoisoningCritical.ql
--- a/actions/ql/test/query-tests/Security/CWE-829/ArtifactPoisoningMedium.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-829/ArtifactPoisoningMedium.qlref
@@ -1,2 +1 @@
-Security/CWE-829/ArtifactPoisoningMedium.ql
-
+query: Security/CWE-829/ArtifactPoisoningMedium.ql
--- a/actions/ql/test/query-tests/Security/CWE-829/ArtifactPoisoningPathTraversal.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-829/ArtifactPoisoningPathTraversal.qlref
@@ -1,2 +1 @@
-experimental/Security/CWE-829/ArtifactPoisoningPathTraversal.ql
-
+query: experimental/Security/CWE-829/ArtifactPoisoningPathTraversal.ql
--- a/actions/ql/test/query-tests/Security/CWE-829/UnpinnedActionsTag.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-829/UnpinnedActionsTag.qlref
@@ -1 +1 @@
-Security/CWE-829/UnpinnedActionsTag.ql
+query: Security/CWE-829/UnpinnedActionsTag.ql
--- a/actions/ql/test/query-tests/Security/CWE-829/UntrustedCheckoutCritical.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-829/UntrustedCheckoutCritical.qlref
@@ -1 +1 @@
-Security/CWE-829/UntrustedCheckoutCritical.ql
+query: Security/CWE-829/UntrustedCheckoutCritical.ql
--- a/actions/ql/test/query-tests/Security/CWE-829/UntrustedCheckoutHigh.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-829/UntrustedCheckoutHigh.qlref
@@ -1 +1 @@
-Security/CWE-829/UntrustedCheckoutHigh.ql
+query: Security/CWE-829/UntrustedCheckoutHigh.ql
--- a/actions/ql/test/query-tests/Security/CWE-829/UntrustedCheckoutMedium.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-829/UntrustedCheckoutMedium.qlref
@@ -1 +1 @@
-Security/CWE-829/UntrustedCheckoutMedium.ql
+query: Security/CWE-829/UntrustedCheckoutMedium.ql
--- a/actions/ql/test/query-tests/Security/CWE-829/UnversionedImmutableAction.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-829/UnversionedImmutableAction.qlref
@@ -1 +1 @@
-experimental/Security/CWE-829/UnversionedImmutableAction.ql
+query: experimental/Security/CWE-829/UnversionedImmutableAction.ql
--- a/actions/ql/test/query-tests/Security/CWE-918/RequestForgery.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-918/RequestForgery.qlref
@@ -1 +1 @@
-experimental/Security/CWE-918/RequestForgery.ql
+query: experimental/Security/CWE-918/RequestForgery.ql
--- a/actions/ql/test/query-tests/SyntaxError/SyntaxError.qlref
+++ b/actions/ql/test/query-tests/SyntaxError/SyntaxError.qlref
@@ -1 +1 @@
-Debug/SyntaxError.ql
+query: Debug/SyntaxError.ql
--- a/Practice/CodeQL/UnnecessaryUseOfAdvancedConfig.qlref
+++ b/Practice/CodeQL/UnnecessaryUseOfAdvancedConfig.qlref
@@ -1 +1 @@
-Violations Of Best Practice/CodeQL/UnnecessaryUseOfAdvancedConfig.ql
+query: Violations Of Best Practice/CodeQL/UnnecessaryUseOfAdvancedConfig.ql
--- a/cpp/ql/test/examples/BadLocking/AV
+++ b/cpp/ql/test/examples/BadLocking/AV
@@ -1 +1 @@
-jsf/4.13 Functions/AV Rule 107.ql
+query: jsf/4.13 Functions/AV Rule 107.ql
--- a/cpp/ql/test/examples/BadLocking/LocalVariableHidesGlobalVariable.qlref
+++ b/cpp/ql/test/examples/BadLocking/LocalVariableHidesGlobalVariable.qlref
@@ -1 +1 @@
-Best Practices/Hiding/LocalVariableHidesGlobalVariable.ql
+query: Best Practices/Hiding/LocalVariableHidesGlobalVariable.ql
--- a/cpp/ql/test/examples/expressions/PrintAST.qlref
+++ b/cpp/ql/test/examples/expressions/PrintAST.qlref
@@ -1 +1 @@
-semmle/code/cpp/PrintAST.ql
+query: semmle/code/cpp/PrintAST.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-020/NoCheckBeforeUnsafePutUser/NoCheckBeforeUnsafePutUser.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-020/NoCheckBeforeUnsafePutUser/NoCheckBeforeUnsafePutUser.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-020/NoCheckBeforeUnsafePutUser.ql
+query: experimental/Security/CWE/CWE-020/NoCheckBeforeUnsafePutUser.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-020/semmle/tests/LateCheckOfFunctionArgument.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-020/semmle/tests/LateCheckOfFunctionArgument.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-020/LateCheckOfFunctionArgument.ql
+query: experimental/Security/CWE/CWE-020/LateCheckOfFunctionArgument.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-078/WordexpTainted.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-078/WordexpTainted.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-078/WordexpTainted.ql
+query: experimental/Security/CWE/CWE-078/WordexpTainted.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-1041/semmle/tests/FindWrapperFunctions.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-1041/semmle/tests/FindWrapperFunctions.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-1041/FindWrapperFunctions.ql
+query: experimental/Security/CWE/CWE-1041/FindWrapperFunctions.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-1126/semmle/tests/DeclarationOfVariableWithUnnecessarilyWideScope.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-1126/semmle/tests/DeclarationOfVariableWithUnnecessarilyWideScope.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-1126/DeclarationOfVariableWithUnnecessarilyWideScope.ql
+query: experimental/Security/CWE/CWE-1126/DeclarationOfVariableWithUnnecessarilyWideScope.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-1240/CustomCryptographicPrimitive.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-1240/CustomCryptographicPrimitive.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-1240/CustomCryptographicPrimitive.ql
+query: experimental/Security/CWE/CWE-1240/CustomCryptographicPrimitive.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-125/semmle/tests/DangerousWorksWithMultibyteOrWideCharacters.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-125/semmle/tests/DangerousWorksWithMultibyteOrWideCharacters.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-125/DangerousWorksWithMultibyteOrWideCharacters.ql
+query: experimental/Security/CWE/CWE-125/DangerousWorksWithMultibyteOrWideCharacters.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/AllocMultiplicationOverflow/AllocMultiplicationOverflow.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/AllocMultiplicationOverflow/AllocMultiplicationOverflow.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-190/AllocMultiplicationOverflow.ql
+query: experimental/Security/CWE/CWE-190/AllocMultiplicationOverflow.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/DangerousUseOfTransformationAfterOperation/DangerousUseOfTransformationAfterOperation.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/DangerousUseOfTransformationAfterOperation/DangerousUseOfTransformationAfterOperation.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-190/DangerousUseOfTransformationAfterOperation.ql
+query: experimental/Security/CWE/CWE-190/DangerousUseOfTransformationAfterOperation.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/IfStatementAdditionOverflow/IfStatementAdditionOverflow.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/IfStatementAdditionOverflow/IfStatementAdditionOverflow.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-190/IfStatementAdditionOverflow.ql
+query: experimental/Security/CWE/CWE-190/IfStatementAdditionOverflow.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/array-access/ArrayAccessProductFlow.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/array-access/ArrayAccessProductFlow.qlref
@@ -1 +1 @@
-experimental/Likely Bugs/ArrayAccessProductFlow.ql
+query: experimental/Likely Bugs/ArrayAccessProductFlow.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/constant-size/ConstantSizeArrayOffByOne.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/constant-size/ConstantSizeArrayOffByOne.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-193/ConstantSizeArrayOffByOne.ql
+query: experimental/Security/CWE/CWE-193/ConstantSizeArrayOffByOne.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-200/test1/ExposureSensitiveInformationUnauthorizedActor.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-200/test1/ExposureSensitiveInformationUnauthorizedActor.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-200/ExposureSensitiveInformationUnauthorizedActor.ql
+query: experimental/Security/CWE/CWE-200/ExposureSensitiveInformationUnauthorizedActor.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-200/test2/ExposureSensitiveInformationUnauthorizedActor.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-200/test2/ExposureSensitiveInformationUnauthorizedActor.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-200/ExposureSensitiveInformationUnauthorizedActor.ql
+query: experimental/Security/CWE/CWE-200/ExposureSensitiveInformationUnauthorizedActor.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-200/test3/ExposureSensitiveInformationUnauthorizedActor.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-200/test3/ExposureSensitiveInformationUnauthorizedActor.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-200/ExposureSensitiveInformationUnauthorizedActor.ql
+query: experimental/Security/CWE/CWE-200/ExposureSensitiveInformationUnauthorizedActor.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-243/semmle/tests/IncorrectChangingWorkingDirectory.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-243/semmle/tests/IncorrectChangingWorkingDirectory.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-243/IncorrectChangingWorkingDirectory.ql
+query: experimental/Security/CWE/CWE-243/IncorrectChangingWorkingDirectory.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-266/semmle/tests/IncorrectPrivilegeAssignment.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-266/semmle/tests/IncorrectPrivilegeAssignment.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-266/IncorrectPrivilegeAssignment.ql
+query: experimental/Security/CWE/CWE-266/IncorrectPrivilegeAssignment.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-285/PamAuthorization.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-285/PamAuthorization.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-285/PamAuthorization.ql
+query: experimental/Security/CWE/CWE-285/PamAuthorization.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-295/CurlSSL.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-295/CurlSSL.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-295/CurlSSL.ql
+query: experimental/Security/CWE/CWE-295/CurlSSL.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-359/semmle/tests/PrivateCleartextWrite.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-359/semmle/tests/PrivateCleartextWrite.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-359/PrivateCleartextWrite.ql
+query: experimental/Security/CWE/CWE-359/PrivateCleartextWrite.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-369/semmle/tests/DivideByZeroUsingReturnValue.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-369/semmle/tests/DivideByZeroUsingReturnValue.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-369/DivideByZeroUsingReturnValue.ql
+query: experimental/Security/CWE/CWE-369/DivideByZeroUsingReturnValue.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-377/semmle/tests/InsecureTemporaryFile.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-377/semmle/tests/InsecureTemporaryFile.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-377/InsecureTemporaryFile.ql
+query: experimental/Security/CWE/CWE-377/InsecureTemporaryFile.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-401/semmle/tests/MemoryLeakOnFailedCallToRealloc.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-401/semmle/tests/MemoryLeakOnFailedCallToRealloc.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-401/MemoryLeakOnFailedCallToRealloc.ql
+query: experimental/Security/CWE/CWE-401/MemoryLeakOnFailedCallToRealloc.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs/DecompressionBombs.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs/DecompressionBombs.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-409/DecompressionBombs.ql
+query: experimental/Security/CWE/CWE-409/DecompressionBombs.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-415/semmle/tests/DoubleFree.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-415/semmle/tests/DoubleFree.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-415/DoubleFree.ql
+query: experimental/Security/CWE/CWE-415/DoubleFree.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-476/semmle/tests/DangerousUseOfExceptionBlocks.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-476/semmle/tests/DangerousUseOfExceptionBlocks.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-476/DangerousUseOfExceptionBlocks.ql
+query: experimental/Security/CWE/CWE-476/DangerousUseOfExceptionBlocks.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-561/semmle/tests/FindIncorrectlyUsedSwitch.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-561/semmle/tests/FindIncorrectlyUsedSwitch.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-561/FindIncorrectlyUsedSwitch.ql
+query: experimental/Security/CWE/CWE-561/FindIncorrectlyUsedSwitch.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-670/semmle/tests/DangerousUseSSL_shutdown.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-670/semmle/tests/DangerousUseSSL_shutdown.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-670/DangerousUseSSL_shutdown.ql
+query: experimental/Security/CWE/CWE-670/DangerousUseSSL_shutdown.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-675/semmle/tests/DoubleRelease.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-675/semmle/tests/DoubleRelease.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-675/DoubleRelease.ql
+query: experimental/Security/CWE/CWE-675/DoubleRelease.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/InsufficientControlFlowManagementAfterRefactoringTheCode.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/InsufficientControlFlowManagementAfterRefactoringTheCode.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementAfterRefactoringTheCode.ql
+query: experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementAfterRefactoringTheCode.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/InsufficientControlFlowManagementWhenUsingBitOperations.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/InsufficientControlFlowManagementWhenUsingBitOperations.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementWhenUsingBitOperations.ql
+query: experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementWhenUsingBitOperations.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-703/semmle/tests/FindIncorrectlyUsedExceptions.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-703/semmle/tests/FindIncorrectlyUsedExceptions.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-703/FindIncorrectlyUsedExceptions.ql
+query: experimental/Security/CWE/CWE-703/FindIncorrectlyUsedExceptions.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-754/semmle/tests/ImproperCheckReturnValueScanf.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-754/semmle/tests/ImproperCheckReturnValueScanf.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-754/ImproperCheckReturnValueScanf.ql
+query: experimental/Security/CWE/CWE-754/ImproperCheckReturnValueScanf.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-758/semmle/tests/UndefinedOrImplementationDefinedBehavior.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-758/semmle/tests/UndefinedOrImplementationDefinedBehavior.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-758/UndefinedOrImplementationDefinedBehavior.ql
+query: experimental/Security/CWE/CWE-758/UndefinedOrImplementationDefinedBehavior.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-783/semmle/tests/OperatorPrecedenceLogicErrorWhenUseBitwiseOrLogicalOperations.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-783/semmle/tests/OperatorPrecedenceLogicErrorWhenUseBitwiseOrLogicalOperations.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-783/OperatorPrecedenceLogicErrorWhenUseBitwiseOrLogicalOperations.ql
+query: experimental/Security/CWE/CWE-783/OperatorPrecedenceLogicErrorWhenUseBitwiseOrLogicalOperations.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/AccessOfMemoryLocationAfterEndOfBufferUsingStrlen.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/AccessOfMemoryLocationAfterEndOfBufferUsingStrlen.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrlen.ql
+query: experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrlen.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/OperatorPrecedenceLogicErrorWhenUseBoolType.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/OperatorPrecedenceLogicErrorWhenUseBoolType.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-783/OperatorPrecedenceLogicErrorWhenUseBoolType.ql
+query: experimental/Security/CWE/CWE-783/OperatorPrecedenceLogicErrorWhenUseBoolType.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-805/semmle/tests/BufferAccessWithIncorrectLengthValue.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-805/semmle/tests/BufferAccessWithIncorrectLengthValue.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-805/BufferAccessWithIncorrectLengthValue.ql
+query: experimental/Security/CWE/CWE-805/BufferAccessWithIncorrectLengthValue.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/semmle/tests/MemoryUnsafeFunctionScan.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/semmle/tests/MemoryUnsafeFunctionScan.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-120/MemoryUnsafeFunctionScan.ql
+query: experimental/Security/CWE/CWE-120/MemoryUnsafeFunctionScan.ql
--- a/cpp/ql/test/library-tests/c11_generic/PrintAST.qlref
+++ b/cpp/ql/test/library-tests/c11_generic/PrintAST.qlref
@@ -1 +1 @@
-semmle/code/cpp/PrintAST.ql
+query: semmle/code/cpp/PrintAST.ql
--- a/cpp/ql/test/library-tests/conversions/consistency.qlref
+++ b/cpp/ql/test/library-tests/conversions/consistency.qlref
@@ -1 +1 @@
-semmle/code/cpp/ASTConsistency.ql
+query: semmle/code/cpp/ASTConsistency.ql
--- a/cpp/ql/test/library-tests/extraction_errors/CompilerErrors.qlref
+++ b/cpp/ql/test/library-tests/extraction_errors/CompilerErrors.qlref
@@ -1 +1 @@
-Telemetry/CompilerErrors.ql
+query: Telemetry/CompilerErrors.ql
--- a/cpp/ql/test/library-tests/extraction_errors/DatabaseQuality.qlref
+++ b/cpp/ql/test/library-tests/extraction_errors/DatabaseQuality.qlref
@@ -1 +1 @@
-Telemetry/DatabaseQuality.ql
+query: Telemetry/DatabaseQuality.ql
--- a/cpp/ql/test/library-tests/extraction_errors/ExtractionMetrics.qlref
+++ b/cpp/ql/test/library-tests/extraction_errors/ExtractionMetrics.qlref
@@ -1 +1 @@
-Telemetry/ExtractionMetrics.ql
+query: Telemetry/ExtractionMetrics.ql
--- a/cpp/ql/test/library-tests/extraction_errors/SucceededIncludes.qlref
+++ b/cpp/ql/test/library-tests/extraction_errors/SucceededIncludes.qlref
@@ -1 +1 @@
-Telemetry/SucceededIncludes.ql
+query: Telemetry/SucceededIncludes.ql
--- a/cpp/ql/test/library-tests/ir/ir/aliased_ssa_consistency_unsound.qlref
+++ b/cpp/ql/test/library-tests/ir/ir/aliased_ssa_consistency_unsound.qlref
@@ -1 +1 @@
-semmle/code/cpp/ir/IRConsistency.ql
+query: semmle/code/cpp/ir/IRConsistency.ql
--- a/cpp/ql/test/library-tests/ir/ir/aliased_ssa_ssa_consistency_unsound.qlref
+++ b/cpp/ql/test/library-tests/ir/ir/aliased_ssa_ssa_consistency_unsound.qlref
@@ -1 +1 @@
-semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConsistency.ql
+query: semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConsistency.ql
--- a/cpp/ql/test/library-tests/ir/ir/raw_consistency.qlref
+++ b/cpp/ql/test/library-tests/ir/ir/raw_consistency.qlref
@@ -1 +1 @@
-semmle/code/cpp/ir/implementation/raw/IRConsistency.ql
+query: semmle/code/cpp/ir/implementation/raw/IRConsistency.ql
--- a/cpp/ql/test/library-tests/ir/ir/unaliased_ssa_consistency_unsound.qlref
+++ b/cpp/ql/test/library-tests/ir/ir/unaliased_ssa_consistency_unsound.qlref
@@ -1 +1 @@
-semmle/code/cpp/ir/implementation/unaliased_ssa/IRConsistency.ql
+query: semmle/code/cpp/ir/implementation/unaliased_ssa/IRConsistency.ql
--- a/cpp/ql/test/library-tests/ir/ir/unaliased_ssa_ssa_consistency_unsound.qlref
+++ b/cpp/ql/test/library-tests/ir/ir/unaliased_ssa_ssa_consistency_unsound.qlref
@@ -1 +1 @@
-semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConsistency.ql
+query: semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConsistency.ql
--- a/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_consistency_unsound.qlref
+++ b/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_consistency_unsound.qlref
@@ -1 +1 @@
-semmle/code/cpp/ir/IRConsistency.ql
+query: semmle/code/cpp/ir/IRConsistency.ql
--- a/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir_unsound.qlref
+++ b/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir_unsound.qlref
@@ -1 +1 @@
-semmle/code/cpp/ir/PrintIR.ql
+query: semmle/code/cpp/ir/PrintIR.ql
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
copilot-swe-agent[bot]	1999602836	Convert non-Go/Java qlrefs to query key format	2026-06-10 12:37:39 +00:00
copilot-swe-agent[bot]	c732bd6613	Initial plan	2026-06-10 12:31:19 +00:00
Tom Hvitved	f5919875b7	Merge pull request #21941 from hvitved/python/content-approx Python: Implement `ContentApprox`	2026-06-09 15:46:04 +02:00
Owen Mansel-Chan	8d456df26f	Merge pull request #21960 from github/dependabot/go_modules/go/extractor/extractor-dependencies-28a04969f3 Bump golang.org/x/mod from 0.36.0 to 0.37.0 in /go/extractor in the extractor-dependencies group	2026-06-09 05:30:45 +01:00
dependabot[bot]	72fcf27d1a	Bump golang.org/x/mod Bumps the extractor-dependencies group in /go/extractor with 1 update: [golang.org/x/mod](https://github.com/golang/mod). Updates `golang.org/x/mod` from 0.36.0 to 0.37.0 - [Commits](https://github.com/golang/mod/compare/v0.36.0...v0.37.0) --- updated-dependencies: - dependency-name: golang.org/x/mod dependency-version: 0.37.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: extractor-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>	2026-06-09 03:03:37 +00:00
yoff	0cea01c22f	Merge pull request #21926 from github/yoff/python-simplify-decorator-predicates Python: simplify decorator-detection predicates to pure AST match	2026-06-08 22:04:33 +02:00
Anders Schack-Mulligen	a473565256	Merge pull request #21954 from aschackmull/cfg/consistency-child-idx Cfg: Add consistency check for relevant child indices.	2026-06-08 14:44:20 +02:00
Anders Schack-Mulligen	c47135a40b	Cfg: Add consistency check for relevant child indices.	2026-06-08 13:40:33 +02:00
Owen Mansel-Chan	3cbc8f0262	Merge pull request #21951 from github/workflow/go-version-update Go: Update to 1.26.4	2026-06-08 11:47:47 +01:00
Tom Hvitved	cc1ea25856	Python: Implement `ContentApprox`	2026-06-08 08:41:28 +02:00
github-actions[bot]	5a38cbd5d5	Go: Update to 1.26.4	2026-06-08 04:30:10 +00:00
Owen Mansel-Chan	cf6d94cf8a	Merge pull request #21324 from github/copilot/automate-go-version-updates-again Automate Go version updates via scheduled workflow	2026-06-06 03:03:03 +01:00
Owen Mansel-Chan	292fc8b777	Fix detection of failed text replacement I checked and the comment seems to be correct. Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-06-06 02:52:21 +01:00
Owen Mansel-Chan	a1759d9834	Use --force-with-lease for slightly improved safety Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-06-06 02:51:36 +01:00
Owen Mansel-Chan	6b74874372	Minor improvement to PR text	2026-06-06 02:32:43 +01:00
copilot-swe-agent[bot]	ef29d22c75	Update Go version workflow to include patch numbers in messages	2026-06-06 01:03:44 +00:00
Owen Mansel-Chan	1f91f915c7	Merge pull request #21888 from owen-mc/py/remove-imprecise-container-steps Python: Remove imprecise container steps #2	2026-06-04 22:16:24 +01:00
Jon Janego	ba8eebe2b5	Merge pull request #21948 from github/codeql-spark-run-26974832191 Update changelog documentation site for codeql-cli-2.25.6	2026-06-04 14:55:17 -05:00
github-actions[bot]	dc1409e5f4	update codeql documentation	2026-06-04 19:36:45 +00:00
Mario Campos	284f42bb9e	Merge pull request #21945 from github/codeql-spark-run-26947645690 Update changelog documentation site for codeql-cli-2.25.6	2026-06-04 13:09:04 -05:00
Henry Mercer	2f3524de74	Merge branch 'rc/3.22' into codeql-spark-run-26947645690	2026-06-04 16:01:11 +01:00
github-actions[bot]	b32573b060	update codeql documentation	2026-06-04 14:57:38 +00:00
Owen Mansel-Chan	da999ee440	Address review comments	2026-06-03 21:24:16 +01:00
Henry Mercer	93a4b427e3	Merge pull request #21933 from github/post-release-prep/codeql-cli-2.25.6 Post-release preparation for codeql-cli-2.25.6	2026-06-03 16:57:48 +01:00
Owen Mansel-Chan	6f2cc43f32	Remove imprecise model for `tuple()`	2026-06-02 21:59:48 +01:00
Owen Mansel-Chan	5042fdee84	Remove imprecise model for `list()`	2026-06-02 21:59:46 +01:00
Owen Mansel-Chan	04341c47bd	Tweak model for str.join	2026-06-02 21:59:44 +01:00
Owen Mansel-Chan	b27d08ee32	Update edges in expected test output	2026-06-02 18:29:56 +01:00
Owen Mansel-Chan	20ce679d61	Accept changed edges in test output No changes to alerts	2026-06-02 16:15:08 +01:00
Owen Mansel-Chan	f62ebef9e0	Adjust expected test output	2026-06-02 16:15:06 +01:00
Owen Mansel-Chan	c3ef1ddd64	Add MaD models for lxml and xml etree.fromstringlist	2026-06-02 16:15:01 +01:00
Owen Mansel-Chan	dede5bc49b	Track flow through `tuple()` with list with tainted elements	2026-06-02 16:14:59 +01:00
Owen Mansel-Chan	ad97b6dd64	Use access path for `str.join` model	2026-06-02 16:14:56 +01:00
yoff	5fb75ac987	Python: simplify decorator-detection predicates to pure AST match The internal predicates that identify `@staticmethod`, `@classmethod` and `@property` decorators previously required the decorator's `NameNode` to satisfy `isGlobal()` (i.e. no SSA def reaches the decorator's name use). That filter was correct but unnecessarily indirect: these three names are builtins, and even when a class body redefines one, the class body has not started executing at the decorator position, so Python uses the builtin. Match the decorator's AST `Name` directly instead, dropping the CFG/SSA detour. The slight semantic change — `isGlobal()` would have rejected module-level shadowing of these builtins — is negligible in practice and explicitly documented in the change note. `hasContextmanagerDecorator` and `hasOverloadDecorator` keep the `NameNode.isGlobal()` check because their target names (`contextmanager`, `overload`) are imported, not builtin, and local shadowing is a real concern. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-06-01 14:04:43 +00:00
Owen Mansel-Chan	b38440490a	Address review comment	2026-05-31 21:47:44 +01:00
Owen Mansel-Chan	aee33a0cc9	Add missing code for `TAnyTupleOrDictionaryElement`	2026-05-29 10:26:24 +01:00
Owen Mansel-Chan	df15a719cb	Add a `ContentSet` for any tuple or dictionary element	2026-05-28 16:48:23 +01:00
Owen Mansel-Chan	812e8e6b34	Add change note	2026-05-28 11:37:54 +01:00
Owen Mansel-Chan	80c6f082d1	Fix TODO in `containerStep`	2026-05-28 11:34:02 +01:00
Owen Mansel-Chan	ec13e1bcd3	Add wildcard `ContentSet`s to avoid performance problems	2026-05-27 15:28:07 +01:00
Owen Mansel-Chan	e8779295ee	Update test results	2026-05-22 11:43:18 +01:00
Rasmus Lerchedahl Petersen	fa758d6bf5	python: fix test	2026-05-21 16:59:19 +01:00
Rasmus Lerchedahl Petersen	fa9426c749	Python: extra tests for comprehension	2026-05-21 16:59:18 +01:00
Rasmus Lerchedahl Petersen	0ecca91dea	Python: typo	2026-05-21 16:59:16 +01:00
Rasmus Lerchedahl Petersen	f669a4f3bf	Python: Make sure all imprecise taint bubbles up	2026-05-21 16:59:14 +01:00
Rasmus Lerchedahl Petersen	3275c814bd	Python: reset test expectations	2026-05-21 16:59:11 +01:00
Rasmus Lerchedahl Petersen	9a180036a5	Python: conversion step for `format_map` and adjust collection test	2026-05-21 16:59:08 +01:00
Rasmus Lerchedahl Petersen	93e7ab52b7	Python: adjust test expectations We now find an alert on this line as we hope to It is not an alert for _full_ SSRF, though, since that configuration cannot handle multiple substitutions.	2026-05-21 16:58:51 +01:00
Rasmus Lerchedahl Petersen	facb3b681d	Python: recover taint for % format strings	2026-05-21 16:57:50 +01:00
Rasmus Lerchedahl Petersen	b67694b2ab	Python: Remove imprecise container steps - remove `tupleStoreStep` and `dictStoreStep` from `containerStep` These are imprecise compared to the content being precise. - add implicit reads to recover taint at sinks - add implicit read steps for decoders to supplement the `AdditionalTaintStep` that now only covers when the full container is tainted.	2026-05-21 16:57:44 +01:00
Owen Mansel-Chan	a367294c23	Merge branch 'main' into copilot/automate-go-version-updates-again	2026-04-23 14:41:46 +01:00
copilot-swe-agent[bot]	b6004045bd	Clean up Go version workflow - remove unnecessary escaping and checks Co-authored-by: mbg <278086+mbg@users.noreply.github.com>	2026-02-13 11:23:44 +00:00
copilot-swe-agent[bot]	cc7e03b0f5	Add error handling and validation to Go version workflow Co-authored-by: mbg <278086+mbg@users.noreply.github.com>	2026-02-13 11:22:36 +00:00
copilot-swe-agent[bot]	1cbd423251	Improve portability and fix PR detection in Go version workflow Co-authored-by: mbg <278086+mbg@users.noreply.github.com>	2026-02-13 11:21:13 +00:00
copilot-swe-agent[bot]	437244fe90	Fix portability issues in Go version update workflow Co-authored-by: mbg <278086+mbg@users.noreply.github.com>	2026-02-13 11:19:56 +00:00
copilot-swe-agent[bot]	f7cf24d1f9	Add Go version update workflow Co-authored-by: mbg <278086+mbg@users.noreply.github.com>	2026-02-13 11:17:57 +00:00
copilot-swe-agent[bot]	c3bafacf81	Initial plan	2026-02-13 11:15:15 +00:00