Convert non-Go/Java qlrefs to query key format

Initial plan
Merge pull request #21941 from hvitved/python/content-approx
2026-06-10 15:31:12 +02:00 · 2026-06-10 12:37:39 +00:00 · 2026-06-10 12:31:19 +00:00 · 2026-06-09 15:46:04 +02:00 · 2026-06-09 05:30:45 +01:00 · 2026-06-09 03:03:37 +00:00
1535 changed files with 24276 additions and 13587 deletions
--- a/.github/workflows/go-version-update.yml
+++ b/.github/workflows/go-version-update.yml
@@ -0,0 +1,208 @@
 name: Update Go version
 on:
  workflow_dispatch:
  schedule:
    - cron: "0 3 * * 1"  # Run weekly on Mondays at 3 AM UTC (1 = Monday)
 permissions:
  contents: write
  pull-requests: write
 jobs:
  update-go-version:
    name: Check and update Go version
    if: github.repository == 'github/codeql'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v5
        with:
          fetch-depth: 0
      - name: Set up Git
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
      - name: Fetch latest Go version
        id: fetch-version
        run: |
          LATEST_GO_VERSION=$(curl -s https://go.dev/dl/?mode=json | jq -r '.[0].version')
          if [ -z "$LATEST_GO_VERSION" ] || [ "$LATEST_GO_VERSION" = "null" ]; then
            echo "Error: Failed to fetch latest Go version from go.dev"
            exit 1
          fi
          echo "Latest Go version from go.dev: $LATEST_GO_VERSION"
          echo "version=$LATEST_GO_VERSION" >> $GITHUB_OUTPUT
          # Extract version numbers (e.g., go1.26.0 -> 1.26.0)
          LATEST_VERSION_NUM=$(echo $LATEST_GO_VERSION | sed 's/^go//')
          echo "version_num=$LATEST_VERSION_NUM" >> $GITHUB_OUTPUT
          # Extract major.minor version (e.g., 1.26.0 -> 1.26)
          LATEST_MAJOR_MINOR=$(echo $LATEST_VERSION_NUM | sed -E 's/^([0-9]+\.[0-9]+).*/\1/')
          echo "major_minor=$LATEST_MAJOR_MINOR" >> $GITHUB_OUTPUT
      - name: Check current Go version
        id: current-version
        run: |
          CURRENT_VERSION=$(sed -n 's/.*go_sdk\.download(version = \"\([^\"]*\)\".*/\1/p' MODULE.bazel)
          if [ -z "$CURRENT_VERSION" ]; then
            echo "Error: Could not extract Go version from MODULE.bazel"
            exit 1
          fi
          echo "Current Go version in MODULE.bazel: $CURRENT_VERSION"
          echo "version=$CURRENT_VERSION" >> $GITHUB_OUTPUT
          # Extract major.minor version
          CURRENT_MAJOR_MINOR=$(echo $CURRENT_VERSION | sed -E 's/^([0-9]+\.[0-9]+).*/\1/')
          echo "major_minor=$CURRENT_MAJOR_MINOR" >> $GITHUB_OUTPUT
      - name: Compare versions
        id: compare
        run: |
          LATEST="${{ steps.fetch-version.outputs.version_num }}"
          CURRENT="${{ steps.current-version.outputs.version }}"
          echo "Latest: $LATEST"
          echo "Current: $CURRENT"
          if [ "$LATEST" = "$CURRENT" ]; then
            echo "Go version is up to date"
            echo "needs_update=false" >> $GITHUB_OUTPUT
          else
            echo "Go version needs update from $CURRENT to $LATEST"
            echo "needs_update=true" >> $GITHUB_OUTPUT
          fi
      - name: Update Go version in files
        if: steps.compare.outputs.needs_update == 'true'
        run: |
          LATEST_VERSION_NUM="${{ steps.fetch-version.outputs.version_num }}"
          LATEST_MAJOR_MINOR="${{ steps.fetch-version.outputs.major_minor }}"
          CURRENT_VERSION="${{ steps.current-version.outputs.version }}"
          CURRENT_MAJOR_MINOR="${{ steps.current-version.outputs.major_minor }}"
          echo "Updating from $CURRENT_VERSION to $LATEST_VERSION_NUM"
          # Escape dots in current version strings for use in sed patterns
          CURRENT_VERSION_ESCAPED=$(echo "$CURRENT_VERSION" | sed 's/\./\\./g')
          CURRENT_MAJOR_MINOR_ESCAPED=$(echo "$CURRENT_MAJOR_MINOR" | sed 's/\./\\./g')
          # Update MODULE.bazel
          sed -i "s/go_sdk\.download(version = \"$CURRENT_VERSION_ESCAPED\")/go_sdk.download(version = \"$LATEST_VERSION_NUM\")/" MODULE.bazel
          if ! grep -q "go_sdk.download(version = \"$LATEST_VERSION_NUM\")" MODULE.bazel; then
            echo "Error: Failed to update MODULE.bazel"
            exit 1
          fi
          # Update go/extractor/go.mod
          if ! sed -i "s/^go $CURRENT_MAJOR_MINOR_ESCAPED\$/go $LATEST_MAJOR_MINOR/" go/extractor/go.mod; then
            echo "Warning: Failed to update go directive in go.mod"
          fi
          if ! sed -i "s/^toolchain go$CURRENT_VERSION_ESCAPED\$/toolchain go$LATEST_VERSION_NUM/" go/extractor/go.mod; then
            echo "Warning: Failed to update toolchain in go.mod"
          fi
          # Update go/extractor/autobuilder/build-environment.go
          if ! sed -i "s/var maxGoVersion = util\.NewSemVer(\"$CURRENT_MAJOR_MINOR_ESCAPED\")/var maxGoVersion = util.NewSemVer(\"$LATEST_MAJOR_MINOR\")/" go/extractor/autobuilder/build-environment.go; then
            echo "Warning: Failed to update build-environment.go"
          fi
          # Update go/actions/test/action.yml
          if ! sed -i "s/default: \"~$CURRENT_VERSION_ESCAPED\"/default: \"~$LATEST_VERSION_NUM\"/" go/actions/test/action.yml; then
            echo "Warning: Failed to update action.yml"
          fi
          # Show what changed
          git diff
      - name: Check for changes
        id: check-changes
        if: steps.compare.outputs.needs_update == 'true'
        run: |
          if git diff --quiet; then
            echo "No changes detected"
            echo "has_changes=false" >> $GITHUB_OUTPUT
          else
            echo "Changes detected"
            echo "has_changes=true" >> $GITHUB_OUTPUT
          fi
      - name: Check for existing PR
        if: steps.check-changes.outputs.has_changes == 'true'
        id: check-pr
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          BRANCH_NAME="workflow/go-version-update"
          PR_NUMBER=$(gh pr list --head "$BRANCH_NAME" --state open --json number --jq '.[0].number')
          if [ -n "$PR_NUMBER" ]; then
            echo "Existing PR found: #$PR_NUMBER"
            echo "pr_exists=true" >> $GITHUB_OUTPUT
            echo "pr_number=$PR_NUMBER" >> $GITHUB_OUTPUT
          else
            echo "No existing PR found"
            echo "pr_exists=false" >> $GITHUB_OUTPUT
          fi
      - name: Commit and push changes
        if: steps.check-changes.outputs.has_changes == 'true'
        run: |
          BRANCH_NAME="workflow/go-version-update"
          LATEST_VERSION_NUM="${{ steps.fetch-version.outputs.version_num }}"
          LATEST_MAJOR_MINOR="${{ steps.fetch-version.outputs.major_minor }}"
          # Create or switch to branch
          git checkout -B "$BRANCH_NAME"
          # Stage and commit changes
          git add MODULE.bazel go/extractor/go.mod go/extractor/autobuilder/build-environment.go go/actions/test/action.yml
          git commit -m "Go: Update to $LATEST_VERSION_NUM"
          # Push changes
          git push --force-with-lease origin "$BRANCH_NAME"
      - name: Create or update PR
        if: steps.check-changes.outputs.has_changes == 'true'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          BRANCH_NAME="workflow/go-version-update"
          LATEST_VERSION_NUM="${{ steps.fetch-version.outputs.version_num }}"
          CURRENT_VERSION="${{ steps.current-version.outputs.version }}"
          PR_TITLE="Go: Update to $LATEST_VERSION_NUM"
          PR_BODY=$(cat <<EOF
          This PR updates Go from $CURRENT_VERSION to $LATEST_VERSION_NUM.
          Updated files:
          - \`MODULE.bazel\` - go_sdk.download version
          - \`go/extractor/go.mod\` - go directive and toolchain
          - \`go/extractor/autobuilder/build-environment.go\` - maxGoVersion (only if MAJOR.MINOR changes)
          - \`go/actions/test/action.yml\` - default go-test-version
          This PR was automatically created by the [Go version update workflow](https://github.com/${{ github.repository }}/blob/main/.github/workflows/go-version-update.yml).
          EOF
          )
          if [ "${{ steps.check-pr.outputs.pr_exists }}" = "true" ]; then
            echo "Updating existing PR #${{ steps.check-pr.outputs.pr_number }}"
            gh pr edit "${{ steps.check-pr.outputs.pr_number }}" --title "$PR_TITLE" --body "$PR_BODY"
          else
            echo "Creating new PR"
            gh pr create \
              --title "$PR_TITLE" \
              --body "$PR_BODY" \
              --base main \
              --head "$BRANCH_NAME" \
              --label "Go"
          fi
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -273,7 +273,7 @@ use_repo(
 )
 go_sdk = use_extension("@rules_go//go:extensions.bzl", "go_sdk")
-go_sdk.download(version = "1.26.0")
+go_sdk.download(version = "1.26.4")
 go_deps = use_extension("@gazelle//:extensions.bzl", "go_deps")
 go_deps.from_file(go_mod = "//go/extractor:go.mod")
--- a/actions/ql/test/query-tests/Models/CompositeActionsSinks.qlref
+++ b/actions/ql/test/query-tests/Models/CompositeActionsSinks.qlref
@@ -1 +1 @@
-Models/CompositeActionsSinks.ql
+query: Models/CompositeActionsSinks.ql
--- a/actions/ql/test/query-tests/Models/CompositeActionsSources.qlref
+++ b/actions/ql/test/query-tests/Models/CompositeActionsSources.qlref
@@ -1,2 +1 @@
-Models/CompositeActionsSources.ql
+query: Models/CompositeActionsSources.ql
--- a/actions/ql/test/query-tests/Models/CompositeActionsSummaries.qlref
+++ b/actions/ql/test/query-tests/Models/CompositeActionsSummaries.qlref
@@ -1,2 +1 @@
-Models/CompositeActionsSummaries.ql
+query: Models/CompositeActionsSummaries.ql
--- a/actions/ql/test/query-tests/Models/ReusableWorkflowsSinks.qlref
+++ b/actions/ql/test/query-tests/Models/ReusableWorkflowsSinks.qlref
@@ -1,2 +1 @@
-Models/ReusableWorkflowsSinks.ql
+query: Models/ReusableWorkflowsSinks.ql
--- a/actions/ql/test/query-tests/Models/ReusableWorkflowsSources.qlref
+++ b/actions/ql/test/query-tests/Models/ReusableWorkflowsSources.qlref
@@ -1,2 +1 @@
-Models/ReusableWorkflowsSources.ql
+query: Models/ReusableWorkflowsSources.ql
--- a/actions/ql/test/query-tests/Models/ReusableWorkflowsSummaries.qlref
+++ b/actions/ql/test/query-tests/Models/ReusableWorkflowsSummaries.qlref
@@ -1,2 +1 @@
-Models/ReusableWorkflowsSummaries.ql
+query: Models/ReusableWorkflowsSummaries.ql
--- a/actions/ql/test/query-tests/Security/CWE-074/OutputClobberingHigh.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-074/OutputClobberingHigh.qlref
@@ -1 +1 @@
-experimental/Security/CWE-074/OutputClobberingHigh.ql
+query: experimental/Security/CWE-074/OutputClobberingHigh.ql
--- a/actions/ql/test/query-tests/Security/CWE-077/EnvPathInjectionCritical.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-077/EnvPathInjectionCritical.qlref
@@ -1 +1 @@
-Security/CWE-077/EnvPathInjectionCritical.ql
+query: Security/CWE-077/EnvPathInjectionCritical.ql
--- a/actions/ql/test/query-tests/Security/CWE-077/EnvPathInjectionMedium.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-077/EnvPathInjectionMedium.qlref
@@ -1 +1 @@
-Security/CWE-077/EnvPathInjectionMedium.ql
+query: Security/CWE-077/EnvPathInjectionMedium.ql
--- a/actions/ql/test/query-tests/Security/CWE-077/EnvVarInjectionCritical.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-077/EnvVarInjectionCritical.qlref
@@ -1 +1 @@
-Security/CWE-077/EnvVarInjectionCritical.ql
+query: Security/CWE-077/EnvVarInjectionCritical.ql
--- a/actions/ql/test/query-tests/Security/CWE-077/EnvVarInjectionMedium.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-077/EnvVarInjectionMedium.qlref
@@ -1 +1 @@
-Security/CWE-077/EnvVarInjectionMedium.ql
+query: Security/CWE-077/EnvVarInjectionMedium.ql
--- a/actions/ql/test/query-tests/Security/CWE-078/CommandInjectionCritical.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-078/CommandInjectionCritical.qlref
@@ -1 +1 @@
-experimental/Security/CWE-078/CommandInjectionCritical.ql
+query: experimental/Security/CWE-078/CommandInjectionCritical.ql
--- a/actions/ql/test/query-tests/Security/CWE-078/CommandInjectionMedium.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-078/CommandInjectionMedium.qlref
@@ -1 +1 @@
-experimental/Security/CWE-078/CommandInjectionMedium.ql
+query: experimental/Security/CWE-078/CommandInjectionMedium.ql
--- a/actions/ql/test/query-tests/Security/CWE-088/ArgumentInjectionCritical.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-088/ArgumentInjectionCritical.qlref
@@ -1 +1 @@
-experimental/Security/CWE-088/ArgumentInjectionCritical.ql
+query: experimental/Security/CWE-088/ArgumentInjectionCritical.ql
--- a/actions/ql/test/query-tests/Security/CWE-088/ArgumentInjectionMedium.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-088/ArgumentInjectionMedium.qlref
@@ -1 +1 @@
-experimental/Security/CWE-088/ArgumentInjectionMedium.ql
+query: experimental/Security/CWE-088/ArgumentInjectionMedium.ql
--- a/actions/ql/test/query-tests/Security/CWE-094/CodeInjectionCritical.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-094/CodeInjectionCritical.qlref
@@ -1 +1 @@
-Security/CWE-094/CodeInjectionCritical.ql
+query: Security/CWE-094/CodeInjectionCritical.ql
--- a/actions/ql/test/query-tests/Security/CWE-094/CodeInjectionMedium.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-094/CodeInjectionMedium.qlref
@@ -1 +1 @@
-Security/CWE-094/CodeInjectionMedium.ql
+query: Security/CWE-094/CodeInjectionMedium.ql
--- a/actions/ql/test/query-tests/Security/CWE-1395/UseOfKnownVulnerableAction.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-1395/UseOfKnownVulnerableAction.qlref
@@ -1,2 +1 @@
-Security/CWE-1395/UseOfKnownVulnerableAction.ql
+query: Security/CWE-1395/UseOfKnownVulnerableAction.ql
--- a/actions/ql/test/query-tests/Security/CWE-200/SecretExfiltration.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-200/SecretExfiltration.qlref
@@ -1,2 +1 @@
-experimental/Security/CWE-200/SecretExfiltration.ql
+query: experimental/Security/CWE-200/SecretExfiltration.ql
--- a/actions/ql/test/query-tests/Security/CWE-275/MissingActionsPermissions.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-275/MissingActionsPermissions.qlref
@@ -1,2 +1 @@
-Security/CWE-275/MissingActionsPermissions.ql
+query: Security/CWE-275/MissingActionsPermissions.ql
--- a/actions/ql/test/query-tests/Security/CWE-284/CodeExecutionOnSelfHostedRunner.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-284/CodeExecutionOnSelfHostedRunner.qlref
@@ -1,2 +1 @@
-experimental/Security/CWE-284/CodeExecutionOnSelfHostedRunner.ql
+query: experimental/Security/CWE-284/CodeExecutionOnSelfHostedRunner.ql
--- a/actions/ql/test/query-tests/Security/CWE-285/ImproperAccessControl.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-285/ImproperAccessControl.qlref
@@ -1,2 +1 @@
-Security/CWE-285/ImproperAccessControl.ql
+query: Security/CWE-285/ImproperAccessControl.ql
--- a/actions/ql/test/query-tests/Security/CWE-312/ExcessiveSecretsExposure.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-312/ExcessiveSecretsExposure.qlref
@@ -1,2 +1 @@
-Security/CWE-312/ExcessiveSecretsExposure.ql
+query: Security/CWE-312/ExcessiveSecretsExposure.ql
--- a/actions/ql/test/query-tests/Security/CWE-312/SecretsInArtifacts.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-312/SecretsInArtifacts.qlref
@@ -1,2 +1 @@
-Security/CWE-312/SecretsInArtifacts.ql
+query: Security/CWE-312/SecretsInArtifacts.ql
--- a/actions/ql/test/query-tests/Security/CWE-312/UnmaskedSecretExposure.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-312/UnmaskedSecretExposure.qlref
@@ -1,2 +1 @@
-Security/CWE-312/UnmaskedSecretExposure.ql
+query: Security/CWE-312/UnmaskedSecretExposure.ql
--- a/actions/ql/test/query-tests/Security/CWE-349/CachePoisoningViaCodeInjection.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-349/CachePoisoningViaCodeInjection.qlref
@@ -1,2 +1 @@
-Security/CWE-349/CachePoisoningViaCodeInjection.ql
+query: Security/CWE-349/CachePoisoningViaCodeInjection.ql
--- a/actions/ql/test/query-tests/Security/CWE-349/CachePoisoningViaDirectCache.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-349/CachePoisoningViaDirectCache.qlref
@@ -1,2 +1 @@
-Security/CWE-349/CachePoisoningViaDirectCache.ql
+query: Security/CWE-349/CachePoisoningViaDirectCache.ql
--- a/actions/ql/test/query-tests/Security/CWE-349/CachePoisoningViaPoisonableStep.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-349/CachePoisoningViaPoisonableStep.qlref
@@ -1,2 +1 @@
-Security/CWE-349/CachePoisoningViaPoisonableStep.ql
+query: Security/CWE-349/CachePoisoningViaPoisonableStep.ql
--- a/actions/ql/test/query-tests/Security/CWE-367/UntrustedCheckoutTOCTOUCritical.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-367/UntrustedCheckoutTOCTOUCritical.qlref
@@ -1 +1 @@
-Security/CWE-367/UntrustedCheckoutTOCTOUCritical.ql
+query: Security/CWE-367/UntrustedCheckoutTOCTOUCritical.ql
--- a/actions/ql/test/query-tests/Security/CWE-367/UntrustedCheckoutTOCTOUHigh.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-367/UntrustedCheckoutTOCTOUHigh.qlref
@@ -1 +1 @@
-Security/CWE-367/UntrustedCheckoutTOCTOUHigh.ql
+query: Security/CWE-367/UntrustedCheckoutTOCTOUHigh.ql
--- a/actions/ql/test/query-tests/Security/CWE-571/ExpressionIsAlwaysTrueCritical.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-571/ExpressionIsAlwaysTrueCritical.qlref
@@ -1 +1 @@
-Security/CWE-571/ExpressionIsAlwaysTrueCritical.ql
+query: Security/CWE-571/ExpressionIsAlwaysTrueCritical.ql
--- a/actions/ql/test/query-tests/Security/CWE-571/ExpressionIsAlwaysTrueHigh.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-571/ExpressionIsAlwaysTrueHigh.qlref
@@ -1 +1 @@
-Security/CWE-571/ExpressionIsAlwaysTrueHigh.ql
+query: Security/CWE-571/ExpressionIsAlwaysTrueHigh.ql
--- a/actions/ql/test/query-tests/Security/CWE-829/ArtifactPoisoningCritical.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-829/ArtifactPoisoningCritical.qlref
@@ -1,2 +1 @@
-Security/CWE-829/ArtifactPoisoningCritical.ql
+query: Security/CWE-829/ArtifactPoisoningCritical.ql
--- a/actions/ql/test/query-tests/Security/CWE-829/ArtifactPoisoningMedium.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-829/ArtifactPoisoningMedium.qlref
@@ -1,2 +1 @@
-Security/CWE-829/ArtifactPoisoningMedium.ql
+query: Security/CWE-829/ArtifactPoisoningMedium.ql
--- a/actions/ql/test/query-tests/Security/CWE-829/ArtifactPoisoningPathTraversal.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-829/ArtifactPoisoningPathTraversal.qlref
@@ -1,2 +1 @@
-experimental/Security/CWE-829/ArtifactPoisoningPathTraversal.ql
+query: experimental/Security/CWE-829/ArtifactPoisoningPathTraversal.ql
--- a/actions/ql/test/query-tests/Security/CWE-829/UnpinnedActionsTag.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-829/UnpinnedActionsTag.qlref
@@ -1 +1 @@
-Security/CWE-829/UnpinnedActionsTag.ql
+query: Security/CWE-829/UnpinnedActionsTag.ql
--- a/actions/ql/test/query-tests/Security/CWE-829/UntrustedCheckoutCritical.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-829/UntrustedCheckoutCritical.qlref
@@ -1 +1 @@
-Security/CWE-829/UntrustedCheckoutCritical.ql
+query: Security/CWE-829/UntrustedCheckoutCritical.ql
--- a/actions/ql/test/query-tests/Security/CWE-829/UntrustedCheckoutHigh.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-829/UntrustedCheckoutHigh.qlref
@@ -1 +1 @@
-Security/CWE-829/UntrustedCheckoutHigh.ql
+query: Security/CWE-829/UntrustedCheckoutHigh.ql
--- a/actions/ql/test/query-tests/Security/CWE-829/UntrustedCheckoutMedium.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-829/UntrustedCheckoutMedium.qlref
@@ -1 +1 @@
-Security/CWE-829/UntrustedCheckoutMedium.ql
+query: Security/CWE-829/UntrustedCheckoutMedium.ql
--- a/actions/ql/test/query-tests/Security/CWE-829/UnversionedImmutableAction.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-829/UnversionedImmutableAction.qlref
@@ -1 +1 @@
-experimental/Security/CWE-829/UnversionedImmutableAction.ql
+query: experimental/Security/CWE-829/UnversionedImmutableAction.ql
--- a/actions/ql/test/query-tests/Security/CWE-918/RequestForgery.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-918/RequestForgery.qlref
@@ -1 +1 @@
-experimental/Security/CWE-918/RequestForgery.ql
+query: experimental/Security/CWE-918/RequestForgery.ql
--- a/actions/ql/test/query-tests/SyntaxError/SyntaxError.qlref
+++ b/actions/ql/test/query-tests/SyntaxError/SyntaxError.qlref
@@ -1 +1 @@
-Debug/SyntaxError.ql
+query: Debug/SyntaxError.ql
--- a/Practice/CodeQL/UnnecessaryUseOfAdvancedConfig.qlref
+++ b/Practice/CodeQL/UnnecessaryUseOfAdvancedConfig.qlref
@@ -1 +1 @@
-Violations Of Best Practice/CodeQL/UnnecessaryUseOfAdvancedConfig.ql
+query: Violations Of Best Practice/CodeQL/UnnecessaryUseOfAdvancedConfig.ql
--- a/config/identical-files.json
+++ b/config/identical-files.json
@@ -11,10 +11,6 @@
    "java/ql/lib/semmle/code/java/dataflow/internal/rangeanalysis/SignAnalysisCommon.qll",
    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/SignAnalysisCommon.qll"
  ],
  "Bound Java/C#": [
    "java/ql/lib/semmle/code/java/dataflow/Bound.qll",
    "csharp/ql/lib/semmle/code/csharp/dataflow/Bound.qll"
  ],
  "ModulusAnalysis Java/C#": [
    "java/ql/lib/semmle/code/java/dataflow/ModulusAnalysis.qll",
    "csharp/ql/lib/semmle/code/csharp/dataflow/ModulusAnalysis.qll"
--- a/cpp/ql/test/examples/BadLocking/AV
+++ b/cpp/ql/test/examples/BadLocking/AV
@@ -1 +1 @@
-jsf/4.13 Functions/AV Rule 107.ql
+query: jsf/4.13 Functions/AV Rule 107.ql
--- a/cpp/ql/test/examples/BadLocking/LocalVariableHidesGlobalVariable.qlref
+++ b/cpp/ql/test/examples/BadLocking/LocalVariableHidesGlobalVariable.qlref
@@ -1 +1 @@
-Best Practices/Hiding/LocalVariableHidesGlobalVariable.ql
+query: Best Practices/Hiding/LocalVariableHidesGlobalVariable.ql
--- a/cpp/ql/test/examples/expressions/PrintAST.qlref
+++ b/cpp/ql/test/examples/expressions/PrintAST.qlref
@@ -1 +1 @@
-semmle/code/cpp/PrintAST.ql
+query: semmle/code/cpp/PrintAST.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-020/NoCheckBeforeUnsafePutUser/NoCheckBeforeUnsafePutUser.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-020/NoCheckBeforeUnsafePutUser/NoCheckBeforeUnsafePutUser.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-020/NoCheckBeforeUnsafePutUser.ql
+query: experimental/Security/CWE/CWE-020/NoCheckBeforeUnsafePutUser.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-020/semmle/tests/LateCheckOfFunctionArgument.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-020/semmle/tests/LateCheckOfFunctionArgument.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-020/LateCheckOfFunctionArgument.ql
+query: experimental/Security/CWE/CWE-020/LateCheckOfFunctionArgument.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-078/WordexpTainted.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-078/WordexpTainted.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-078/WordexpTainted.ql
+query: experimental/Security/CWE/CWE-078/WordexpTainted.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-1041/semmle/tests/FindWrapperFunctions.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-1041/semmle/tests/FindWrapperFunctions.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-1041/FindWrapperFunctions.ql
+query: experimental/Security/CWE/CWE-1041/FindWrapperFunctions.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-1126/semmle/tests/DeclarationOfVariableWithUnnecessarilyWideScope.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-1126/semmle/tests/DeclarationOfVariableWithUnnecessarilyWideScope.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-1126/DeclarationOfVariableWithUnnecessarilyWideScope.ql
+query: experimental/Security/CWE/CWE-1126/DeclarationOfVariableWithUnnecessarilyWideScope.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-1240/CustomCryptographicPrimitive.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-1240/CustomCryptographicPrimitive.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-1240/CustomCryptographicPrimitive.ql
+query: experimental/Security/CWE/CWE-1240/CustomCryptographicPrimitive.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-125/semmle/tests/DangerousWorksWithMultibyteOrWideCharacters.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-125/semmle/tests/DangerousWorksWithMultibyteOrWideCharacters.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-125/DangerousWorksWithMultibyteOrWideCharacters.ql
+query: experimental/Security/CWE/CWE-125/DangerousWorksWithMultibyteOrWideCharacters.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/AllocMultiplicationOverflow/AllocMultiplicationOverflow.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/AllocMultiplicationOverflow/AllocMultiplicationOverflow.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-190/AllocMultiplicationOverflow.ql
+query: experimental/Security/CWE/CWE-190/AllocMultiplicationOverflow.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/DangerousUseOfTransformationAfterOperation/DangerousUseOfTransformationAfterOperation.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/DangerousUseOfTransformationAfterOperation/DangerousUseOfTransformationAfterOperation.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-190/DangerousUseOfTransformationAfterOperation.ql
+query: experimental/Security/CWE/CWE-190/DangerousUseOfTransformationAfterOperation.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/IfStatementAdditionOverflow/IfStatementAdditionOverflow.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/IfStatementAdditionOverflow/IfStatementAdditionOverflow.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-190/IfStatementAdditionOverflow.ql
+query: experimental/Security/CWE/CWE-190/IfStatementAdditionOverflow.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/array-access/ArrayAccessProductFlow.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/array-access/ArrayAccessProductFlow.qlref
@@ -1 +1 @@
-experimental/Likely Bugs/ArrayAccessProductFlow.ql
+query: experimental/Likely Bugs/ArrayAccessProductFlow.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/constant-size/ConstantSizeArrayOffByOne.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/constant-size/ConstantSizeArrayOffByOne.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-193/ConstantSizeArrayOffByOne.ql
+query: experimental/Security/CWE/CWE-193/ConstantSizeArrayOffByOne.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-200/test1/ExposureSensitiveInformationUnauthorizedActor.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-200/test1/ExposureSensitiveInformationUnauthorizedActor.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-200/ExposureSensitiveInformationUnauthorizedActor.ql
+query: experimental/Security/CWE/CWE-200/ExposureSensitiveInformationUnauthorizedActor.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-200/test2/ExposureSensitiveInformationUnauthorizedActor.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-200/test2/ExposureSensitiveInformationUnauthorizedActor.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-200/ExposureSensitiveInformationUnauthorizedActor.ql
+query: experimental/Security/CWE/CWE-200/ExposureSensitiveInformationUnauthorizedActor.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-200/test3/ExposureSensitiveInformationUnauthorizedActor.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-200/test3/ExposureSensitiveInformationUnauthorizedActor.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-200/ExposureSensitiveInformationUnauthorizedActor.ql
+query: experimental/Security/CWE/CWE-200/ExposureSensitiveInformationUnauthorizedActor.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-243/semmle/tests/IncorrectChangingWorkingDirectory.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-243/semmle/tests/IncorrectChangingWorkingDirectory.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-243/IncorrectChangingWorkingDirectory.ql
+query: experimental/Security/CWE/CWE-243/IncorrectChangingWorkingDirectory.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-266/semmle/tests/IncorrectPrivilegeAssignment.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-266/semmle/tests/IncorrectPrivilegeAssignment.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-266/IncorrectPrivilegeAssignment.ql
+query: experimental/Security/CWE/CWE-266/IncorrectPrivilegeAssignment.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-285/PamAuthorization.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-285/PamAuthorization.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-285/PamAuthorization.ql
+query: experimental/Security/CWE/CWE-285/PamAuthorization.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-295/CurlSSL.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-295/CurlSSL.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-295/CurlSSL.ql
+query: experimental/Security/CWE/CWE-295/CurlSSL.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-359/semmle/tests/PrivateCleartextWrite.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-359/semmle/tests/PrivateCleartextWrite.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-359/PrivateCleartextWrite.ql
+query: experimental/Security/CWE/CWE-359/PrivateCleartextWrite.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-369/semmle/tests/DivideByZeroUsingReturnValue.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-369/semmle/tests/DivideByZeroUsingReturnValue.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-369/DivideByZeroUsingReturnValue.ql
+query: experimental/Security/CWE/CWE-369/DivideByZeroUsingReturnValue.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-377/semmle/tests/InsecureTemporaryFile.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-377/semmle/tests/InsecureTemporaryFile.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-377/InsecureTemporaryFile.ql
+query: experimental/Security/CWE/CWE-377/InsecureTemporaryFile.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-401/semmle/tests/MemoryLeakOnFailedCallToRealloc.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-401/semmle/tests/MemoryLeakOnFailedCallToRealloc.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-401/MemoryLeakOnFailedCallToRealloc.ql
+query: experimental/Security/CWE/CWE-401/MemoryLeakOnFailedCallToRealloc.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs/DecompressionBombs.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs/DecompressionBombs.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-409/DecompressionBombs.ql
+query: experimental/Security/CWE/CWE-409/DecompressionBombs.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-415/semmle/tests/DoubleFree.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-415/semmle/tests/DoubleFree.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-415/DoubleFree.ql
+query: experimental/Security/CWE/CWE-415/DoubleFree.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-476/semmle/tests/DangerousUseOfExceptionBlocks.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-476/semmle/tests/DangerousUseOfExceptionBlocks.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-476/DangerousUseOfExceptionBlocks.ql
+query: experimental/Security/CWE/CWE-476/DangerousUseOfExceptionBlocks.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-561/semmle/tests/FindIncorrectlyUsedSwitch.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-561/semmle/tests/FindIncorrectlyUsedSwitch.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-561/FindIncorrectlyUsedSwitch.ql
+query: experimental/Security/CWE/CWE-561/FindIncorrectlyUsedSwitch.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-670/semmle/tests/DangerousUseSSL_shutdown.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-670/semmle/tests/DangerousUseSSL_shutdown.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-670/DangerousUseSSL_shutdown.ql
+query: experimental/Security/CWE/CWE-670/DangerousUseSSL_shutdown.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-675/semmle/tests/DoubleRelease.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-675/semmle/tests/DoubleRelease.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-675/DoubleRelease.ql
+query: experimental/Security/CWE/CWE-675/DoubleRelease.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/InsufficientControlFlowManagementAfterRefactoringTheCode.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/InsufficientControlFlowManagementAfterRefactoringTheCode.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementAfterRefactoringTheCode.ql
+query: experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementAfterRefactoringTheCode.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/InsufficientControlFlowManagementWhenUsingBitOperations.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/InsufficientControlFlowManagementWhenUsingBitOperations.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementWhenUsingBitOperations.ql
+query: experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementWhenUsingBitOperations.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-703/semmle/tests/FindIncorrectlyUsedExceptions.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-703/semmle/tests/FindIncorrectlyUsedExceptions.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-703/FindIncorrectlyUsedExceptions.ql
+query: experimental/Security/CWE/CWE-703/FindIncorrectlyUsedExceptions.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-754/semmle/tests/ImproperCheckReturnValueScanf.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-754/semmle/tests/ImproperCheckReturnValueScanf.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-754/ImproperCheckReturnValueScanf.ql
+query: experimental/Security/CWE/CWE-754/ImproperCheckReturnValueScanf.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-758/semmle/tests/UndefinedOrImplementationDefinedBehavior.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-758/semmle/tests/UndefinedOrImplementationDefinedBehavior.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-758/UndefinedOrImplementationDefinedBehavior.ql
+query: experimental/Security/CWE/CWE-758/UndefinedOrImplementationDefinedBehavior.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-783/semmle/tests/OperatorPrecedenceLogicErrorWhenUseBitwiseOrLogicalOperations.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-783/semmle/tests/OperatorPrecedenceLogicErrorWhenUseBitwiseOrLogicalOperations.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-783/OperatorPrecedenceLogicErrorWhenUseBitwiseOrLogicalOperations.ql
+query: experimental/Security/CWE/CWE-783/OperatorPrecedenceLogicErrorWhenUseBitwiseOrLogicalOperations.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/AccessOfMemoryLocationAfterEndOfBufferUsingStrlen.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/AccessOfMemoryLocationAfterEndOfBufferUsingStrlen.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrlen.ql
+query: experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrlen.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/OperatorPrecedenceLogicErrorWhenUseBoolType.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/OperatorPrecedenceLogicErrorWhenUseBoolType.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-783/OperatorPrecedenceLogicErrorWhenUseBoolType.ql
+query: experimental/Security/CWE/CWE-783/OperatorPrecedenceLogicErrorWhenUseBoolType.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-805/semmle/tests/BufferAccessWithIncorrectLengthValue.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-805/semmle/tests/BufferAccessWithIncorrectLengthValue.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-805/BufferAccessWithIncorrectLengthValue.ql
+query: experimental/Security/CWE/CWE-805/BufferAccessWithIncorrectLengthValue.ql
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/semmle/tests/MemoryUnsafeFunctionScan.qlref
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/semmle/tests/MemoryUnsafeFunctionScan.qlref
@@ -1 +1 @@
-experimental/Security/CWE/CWE-120/MemoryUnsafeFunctionScan.ql
+query: experimental/Security/CWE/CWE-120/MemoryUnsafeFunctionScan.ql
--- a/cpp/ql/test/library-tests/c11_generic/PrintAST.qlref
+++ b/cpp/ql/test/library-tests/c11_generic/PrintAST.qlref
@@ -1 +1 @@
-semmle/code/cpp/PrintAST.ql
+query: semmle/code/cpp/PrintAST.ql
--- a/cpp/ql/test/library-tests/conversions/consistency.qlref
+++ b/cpp/ql/test/library-tests/conversions/consistency.qlref
@@ -1 +1 @@
-semmle/code/cpp/ASTConsistency.ql
+query: semmle/code/cpp/ASTConsistency.ql
--- a/cpp/ql/test/library-tests/extraction_errors/CompilerErrors.qlref
+++ b/cpp/ql/test/library-tests/extraction_errors/CompilerErrors.qlref
@@ -1 +1 @@
-Telemetry/CompilerErrors.ql
+query: Telemetry/CompilerErrors.ql
--- a/cpp/ql/test/library-tests/extraction_errors/DatabaseQuality.qlref
+++ b/cpp/ql/test/library-tests/extraction_errors/DatabaseQuality.qlref
@@ -1 +1 @@
-Telemetry/DatabaseQuality.ql
+query: Telemetry/DatabaseQuality.ql
--- a/cpp/ql/test/library-tests/extraction_errors/ExtractionMetrics.qlref
+++ b/cpp/ql/test/library-tests/extraction_errors/ExtractionMetrics.qlref
@@ -1 +1 @@
-Telemetry/ExtractionMetrics.ql
+query: Telemetry/ExtractionMetrics.ql
--- a/cpp/ql/test/library-tests/extraction_errors/SucceededIncludes.qlref
+++ b/cpp/ql/test/library-tests/extraction_errors/SucceededIncludes.qlref
@@ -1 +1 @@
-Telemetry/SucceededIncludes.ql
+query: Telemetry/SucceededIncludes.ql
--- a/cpp/ql/test/library-tests/ir/ir/aliased_ssa_consistency_unsound.qlref
+++ b/cpp/ql/test/library-tests/ir/ir/aliased_ssa_consistency_unsound.qlref
@@ -1 +1 @@
-semmle/code/cpp/ir/IRConsistency.ql
+query: semmle/code/cpp/ir/IRConsistency.ql
--- a/cpp/ql/test/library-tests/ir/ir/aliased_ssa_ssa_consistency_unsound.qlref
+++ b/cpp/ql/test/library-tests/ir/ir/aliased_ssa_ssa_consistency_unsound.qlref
@@ -1 +1 @@
-semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConsistency.ql
+query: semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConsistency.ql
--- a/cpp/ql/test/library-tests/ir/ir/raw_consistency.qlref
+++ b/cpp/ql/test/library-tests/ir/ir/raw_consistency.qlref
@@ -1 +1 @@
-semmle/code/cpp/ir/implementation/raw/IRConsistency.ql
+query: semmle/code/cpp/ir/implementation/raw/IRConsistency.ql
--- a/cpp/ql/test/library-tests/ir/ir/unaliased_ssa_consistency_unsound.qlref
+++ b/cpp/ql/test/library-tests/ir/ir/unaliased_ssa_consistency_unsound.qlref
@@ -1 +1 @@
-semmle/code/cpp/ir/implementation/unaliased_ssa/IRConsistency.ql
+query: semmle/code/cpp/ir/implementation/unaliased_ssa/IRConsistency.ql
--- a/cpp/ql/test/library-tests/ir/ir/unaliased_ssa_ssa_consistency_unsound.qlref
+++ b/cpp/ql/test/library-tests/ir/ir/unaliased_ssa_ssa_consistency_unsound.qlref
@@ -1 +1 @@
-semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConsistency.ql
+query: semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConsistency.ql
--- a/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_consistency_unsound.qlref
+++ b/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_consistency_unsound.qlref
@@ -1 +1 @@
-semmle/code/cpp/ir/IRConsistency.ql
+query: semmle/code/cpp/ir/IRConsistency.ql
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
copilot-swe-agent[bot]	1999602836	Convert non-Go/Java qlrefs to query key format	2026-06-10 12:37:39 +00:00
copilot-swe-agent[bot]	c732bd6613	Initial plan	2026-06-10 12:31:19 +00:00
Tom Hvitved	f5919875b7	Merge pull request #21941 from hvitved/python/content-approx Python: Implement `ContentApprox`	2026-06-09 15:46:04 +02:00
Owen Mansel-Chan	8d456df26f	Merge pull request #21960 from github/dependabot/go_modules/go/extractor/extractor-dependencies-28a04969f3 Bump golang.org/x/mod from 0.36.0 to 0.37.0 in /go/extractor in the extractor-dependencies group	2026-06-09 05:30:45 +01:00
dependabot[bot]	72fcf27d1a	Bump golang.org/x/mod Bumps the extractor-dependencies group in /go/extractor with 1 update: [golang.org/x/mod](https://github.com/golang/mod). Updates `golang.org/x/mod` from 0.36.0 to 0.37.0 - [Commits](https://github.com/golang/mod/compare/v0.36.0...v0.37.0) --- updated-dependencies: - dependency-name: golang.org/x/mod dependency-version: 0.37.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: extractor-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>	2026-06-09 03:03:37 +00:00
yoff	0cea01c22f	Merge pull request #21926 from github/yoff/python-simplify-decorator-predicates Python: simplify decorator-detection predicates to pure AST match	2026-06-08 22:04:33 +02:00
Anders Schack-Mulligen	a473565256	Merge pull request #21954 from aschackmull/cfg/consistency-child-idx Cfg: Add consistency check for relevant child indices.	2026-06-08 14:44:20 +02:00
Anders Schack-Mulligen	c47135a40b	Cfg: Add consistency check for relevant child indices.	2026-06-08 13:40:33 +02:00
Owen Mansel-Chan	3cbc8f0262	Merge pull request #21951 from github/workflow/go-version-update Go: Update to 1.26.4	2026-06-08 11:47:47 +01:00
Tom Hvitved	cc1ea25856	Python: Implement `ContentApprox`	2026-06-08 08:41:28 +02:00
github-actions[bot]	5a38cbd5d5	Go: Update to 1.26.4	2026-06-08 04:30:10 +00:00
Owen Mansel-Chan	cf6d94cf8a	Merge pull request #21324 from github/copilot/automate-go-version-updates-again Automate Go version updates via scheduled workflow	2026-06-06 03:03:03 +01:00
Owen Mansel-Chan	292fc8b777	Fix detection of failed text replacement I checked and the comment seems to be correct. Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-06-06 02:52:21 +01:00
Owen Mansel-Chan	a1759d9834	Use --force-with-lease for slightly improved safety Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-06-06 02:51:36 +01:00
Owen Mansel-Chan	6b74874372	Minor improvement to PR text	2026-06-06 02:32:43 +01:00
copilot-swe-agent[bot]	ef29d22c75	Update Go version workflow to include patch numbers in messages	2026-06-06 01:03:44 +00:00
Owen Mansel-Chan	1f91f915c7	Merge pull request #21888 from owen-mc/py/remove-imprecise-container-steps Python: Remove imprecise container steps #2	2026-06-04 22:16:24 +01:00
Jon Janego	ba8eebe2b5	Merge pull request #21948 from github/codeql-spark-run-26974832191 Update changelog documentation site for codeql-cli-2.25.6	2026-06-04 14:55:17 -05:00
github-actions[bot]	dc1409e5f4	update codeql documentation	2026-06-04 19:36:45 +00:00
Mario Campos	284f42bb9e	Merge pull request #21945 from github/codeql-spark-run-26947645690 Update changelog documentation site for codeql-cli-2.25.6	2026-06-04 13:09:04 -05:00
Henry Mercer	2f3524de74	Merge branch 'rc/3.22' into codeql-spark-run-26947645690	2026-06-04 16:01:11 +01:00
github-actions[bot]	b32573b060	update codeql documentation	2026-06-04 14:57:38 +00:00
Owen Mansel-Chan	cd2398aeea	Merge pull request #21936 from github/workflow/coverage/update Update CSV framework coverage reports	2026-06-04 12:45:21 +01:00
Sotiris Dragonas	d6892eaf0d	Merge pull request #21900 from github/bazookamusic/range-analysis-bound-move-to-shared Bound.qll - Replace utility for range analysis duplicate across java and cs with shared file	2026-06-04 12:45:11 +02:00
BazookaMusic	d2972cb53f	Add back alias for module	2026-06-04 11:08:49 +02:00
github-actions[bot]	5576d30780	Add changed framework coverage reports	2026-06-04 01:04:50 +00:00
Owen Mansel-Chan	da999ee440	Address review comments	2026-06-03 21:24:16 +01:00
Tom Hvitved	3da195f50f	Merge pull request #21918 from hvitved/rust/expose-resolution Rust: Add `Impl::getSelf()` and `Impl::getTrait()`	2026-06-03 20:18:05 +02:00
Henry Mercer	93a4b427e3	Merge pull request #21933 from github/post-release-prep/codeql-cli-2.25.6 Post-release preparation for codeql-cli-2.25.6	2026-06-03 16:57:48 +01:00
Tom Hvitved	0430c71318	Merge pull request #21922 from hvitved/rust/static-const-resolution Rust: Path resolution for `static` items	2026-06-03 17:48:21 +02:00
Owen Mansel-Chan	52f2a5825a	Merge pull request #21804 from github/copilot/add-tests-for-models Java: Update CWE-918 model coverage for Apache HttpClient `execute` sinks	2026-06-03 12:55:56 +01:00
Owen Mansel-Chan	d55ff83568	Merge pull request #21269 from owen-mc/go/improve-tests-for-varargs-flow Go: improve tests for varargs flow	2026-06-03 12:39:46 +01:00
BazookaMusic	f34275636c	No duplicate Ssa and remove release changenot	2026-06-03 11:54:24 +02:00
BazookaMusic	0a801440b9	review comments	2026-06-03 10:48:50 +02:00
Asger F	7edf0100cc	Merge pull request #21924 from asgerf/asgerf/yeast-changes Yeast: some fixes	2026-06-03 10:32:38 +02:00
Owen Mansel-Chan	167c837088	Merge pull request #21914 from owen-mc/shared/cfg/if-init Shared CFG: allow init stmts for IfStmt	2026-06-02 22:01:02 +01:00
Owen Mansel-Chan	6f2cc43f32	Remove imprecise model for `tuple()`	2026-06-02 21:59:48 +01:00
Owen Mansel-Chan	5042fdee84	Remove imprecise model for `list()`	2026-06-02 21:59:46 +01:00
Owen Mansel-Chan	04341c47bd	Tweak model for str.join	2026-06-02 21:59:44 +01:00
Tom Hvitved	af45e53e77	Rust: Rename parameter in DB upgrade script	2026-06-02 21:18:53 +02:00
Owen Mansel-Chan	b27d08ee32	Update edges in expected test output	2026-06-02 18:29:56 +01:00
Jeroen Ketema	d11fc3a00e	Merge pull request #21932 from jketema/jketema/vue JS: Add Vue to `file_coverage_languages` and `github_api_languages`	2026-06-02 17:53:25 +02:00
Owen Mansel-Chan	20ce679d61	Accept changed edges in test output No changes to alerts	2026-06-02 16:15:08 +01:00
Owen Mansel-Chan	f62ebef9e0	Adjust expected test output	2026-06-02 16:15:06 +01:00
Owen Mansel-Chan	c3ef1ddd64	Add MaD models for lxml and xml etree.fromstringlist	2026-06-02 16:15:01 +01:00
Owen Mansel-Chan	dede5bc49b	Track flow through `tuple()` with list with tainted elements	2026-06-02 16:14:59 +01:00
Owen Mansel-Chan	ad97b6dd64	Use access path for `str.join` model	2026-06-02 16:14:56 +01:00
Jeroen Ketema	9d5dfea5c5	JS: Add Vue to `file_coverage_languages` and `github_api_languages`	2026-06-02 16:57:51 +02:00
Tom Hvitved	dc0c7d7ec2	Fix `commment` typos	2026-06-02 14:41:27 +02:00
Sotiris Dragonas	61a5cece56	Merge branch 'main' into bazookamusic/range-analysis-bound-move-to-shared	2026-06-02 10:41:49 +02:00
BazookaMusic	566a92e555	formatting again	2026-06-02 10:41:10 +02:00
Owen Mansel-Chan	be9c785cb2	Fix incorrect QLDoc Co-authored-by: Tom Hvitved <hvitved@github.com>	2026-06-02 09:26:13 +01:00
Tom Hvitved	1fd31d0ddd	Rust: Data flow for `const`s and `static`s	2026-06-02 09:55:51 +02:00
Tom Hvitved	c4e3720d8a	Rust: Run codegen	2026-06-02 09:02:57 +02:00
Tom Hvitved	0547e9c98d	Rust: Path resolution for `static` items	2026-06-02 09:02:56 +02:00
BazookaMusic	2a3cff382c	more specific comment	2026-06-01 18:20:50 +02:00
BazookaMusic	c610af88d3	fix comment and add overlay[local?]	2026-06-01 18:18:37 +02:00
BazookaMusic	fa63dad1d1	change note	2026-06-01 18:16:51 +02:00
Sotiris Dragonas	019a5c01ad	Merge branch 'main' into bazookamusic/range-analysis-bound-move-to-shared	2026-06-01 18:10:02 +02:00
yoff	5fb75ac987	Python: simplify decorator-detection predicates to pure AST match The internal predicates that identify `@staticmethod`, `@classmethod` and `@property` decorators previously required the decorator's `NameNode` to satisfy `isGlobal()` (i.e. no SSA def reaches the decorator's name use). That filter was correct but unnecessarily indirect: these three names are builtins, and even when a class body redefines one, the class body has not started executing at the decorator position, so Python uses the builtin. Match the decorator's AST `Name` directly instead, dropping the CFG/SSA detour. The slight semantic change — `isGlobal()` would have rejected module-level shadowing of these builtins — is negligible in practice and explicitly documented in the change note. `hasContextmanagerDecorator` and `hasOverloadDecorator` keep the `NameNode.isGlobal()` check because their target names (`contextmanager`, `overload`) are imported, not builtin, and local shadowing is a real concern. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-06-01 14:04:43 +00:00
BazookaMusic	c1c9287535	restore file header	2026-06-01 15:48:26 +02:00
BazookaMusic	d1226b71de	formatting	2026-06-01 15:46:52 +02:00
BazookaMusic	71a363545a	formatting	2026-06-01 15:24:06 +02:00
Asger F	3f3bed62d3	yeast: type-check for missing required fields Add FieldCardinality to Schema to track required/multiple per field, populated from the ast_types.yml suffixes (bare = required single, ? = optional single, + = required multiple, * = optional multiple). dump_ast_with_type_errors now emits: <-- ERROR: missing required field 'name' for any node in the output AST whose declared schema requires a field that is absent from the actual node. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-06-01 14:18:37 +02:00
Asger F	21f216af8c	yeast-macros: omit empty fields produced by .. splice When a {..expr} splice in an output template is empty (e.g. from an optional capture that did not match), drop the field entirely rather than emitting an empty named field. This lets a single rule with optional captures replace what used to be two near-identical rules. Also re-renders the corpus to drop the now-suppressed empty fields. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-06-01 14:18:37 +02:00
Asger F	1751d70c62	Fix parsing of corpus tests when --- delimiter is missing	2026-06-01 14:18:37 +02:00
Asger F	ac8eb50c26	Yeast: Allow 'r#type' to escape the 'type' keyword in macro	2026-06-01 14:18:37 +02:00
Asger F	1ecdc3614f	Yeast: Fix matching against extras like comments	2026-06-01 14:18:37 +02:00
Asger F	e3b3888bee	Yeast: Fix handling of captures with multiple results	2026-06-01 14:18:36 +02:00
Asger F	ef9306d82c	Yeast: Allow rules that return an empty sequence	2026-06-01 14:18:36 +02:00
Asger F	56822f8ee1	Tree-sitter-extactor: More helpful panic message	2026-06-01 14:04:49 +02:00
Tom Hvitved	62207f152c	Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-06-01 13:55:22 +02:00
Tom Hvitved	d5f94475b5	Rust: DB upgrade/downgrade scripts	2026-06-01 10:38:10 +02:00
Tom Hvitved	00e95a0757	Rust: Add `Impl::getSelf()` and `Impl::getTrait()`	2026-06-01 10:38:09 +02:00
Tom Hvitved	c695c151ea	Rust: Rename `Impl::getTrait` to `Impl::getTraitTy`	2026-06-01 10:38:07 +02:00
Owen Mansel-Chan	b38440490a	Address review comment	2026-05-31 21:47:44 +01:00
Owen Mansel-Chan	5e5a0437e1	Shared CFG: allow init stmts for IfStmt	2026-05-30 07:35:29 +01:00
Owen Mansel-Chan	aee33a0cc9	Add missing code for `TAnyTupleOrDictionaryElement`	2026-05-29 10:26:24 +01:00
Owen Mansel-Chan	df15a719cb	Add a `ContentSet` for any tuple or dictionary element	2026-05-28 16:48:23 +01:00
Owen Mansel-Chan	812e8e6b34	Add change note	2026-05-28 11:37:54 +01:00
Owen Mansel-Chan	80c6f082d1	Fix TODO in `containerStep`	2026-05-28 11:34:02 +01:00
Owen Mansel-Chan	d95d99848c	Build `RequestBuilder` more realistically	2026-05-28 11:05:40 +01:00
Owen Mansel-Chan	8937e22735	Add summary models for `org.apache.http.client.methods.RequestBuilder` Generated by GPT 5.3-codex, verified by me.	2026-05-28 10:56:37 +01:00
Owen Mansel-Chan	37589dd8a0	Improve how `org.apache.http.client.HttpClient` is created in test	2026-05-28 10:30:43 +01:00
Owen Mansel-Chan	a159dc1c66	Change variable name in test	2026-05-28 10:28:14 +01:00
BazookaMusic	cc12740c0e	remove check for files in sync	2026-05-27 17:41:44 +02:00
BazookaMusic	acb5c0e70f	missed changes	2026-05-27 17:23:45 +02:00
BazookaMusic	6042adebae	move identical java and cs bound.qll to shared library	2026-05-27 17:23:28 +02:00
Owen Mansel-Chan	ec13e1bcd3	Add wildcard `ContentSet`s to avoid performance problems	2026-05-27 15:28:07 +01:00
Owen Mansel-Chan	e8779295ee	Update test results	2026-05-22 11:43:18 +01:00
Rasmus Lerchedahl Petersen	fa758d6bf5	python: fix test	2026-05-21 16:59:19 +01:00
Rasmus Lerchedahl Petersen	fa9426c749	Python: extra tests for comprehension	2026-05-21 16:59:18 +01:00
Rasmus Lerchedahl Petersen	0ecca91dea	Python: typo	2026-05-21 16:59:16 +01:00
Rasmus Lerchedahl Petersen	f669a4f3bf	Python: Make sure all imprecise taint bubbles up	2026-05-21 16:59:14 +01:00
Rasmus Lerchedahl Petersen	3275c814bd	Python: reset test expectations	2026-05-21 16:59:11 +01:00
Rasmus Lerchedahl Petersen	9a180036a5	Python: conversion step for `format_map` and adjust collection test	2026-05-21 16:59:08 +01:00
Rasmus Lerchedahl Petersen	93e7ab52b7	Python: adjust test expectations We now find an alert on this line as we hope to It is not an alert for _full_ SSRF, though, since that configuration cannot handle multiple substitutions.	2026-05-21 16:58:51 +01:00
Rasmus Lerchedahl Petersen	facb3b681d	Python: recover taint for % format strings	2026-05-21 16:57:50 +01:00
Rasmus Lerchedahl Petersen	b67694b2ab	Python: Remove imprecise container steps - remove `tupleStoreStep` and `dictStoreStep` from `containerStep` These are imprecise compared to the content being precise. - add implicit reads to recover taint at sinks - add implicit read steps for decoders to supplement the `AdditionalTaintStep` that now only covers when the full container is tainted.	2026-05-21 16:57:44 +01:00
Owen Mansel-Chan	dc864762c3	Add change note	2026-05-07 10:23:50 +01:00
Owen Mansel-Chan	dd35bc0722	Update test output	2026-05-07 10:17:47 +01:00
copilot-swe-agent[bot]	043ec857ab	Replace fluent SSRF changes with Apache HttpClient execute model tests Agent-Logs-Url: https://github.com/github/codeql/sessions/3db201db-a1b5-4353-a94a-14a8d156dd3b Co-authored-by: owen-mc <62447351+owen-mc@users.noreply.github.com>	2026-05-06 20:31:34 +00:00
copilot-swe-agent[bot]	f5b17b0b48	Add SSRF tests and stubs for Apache Http fluent Request models Agent-Logs-Url: https://github.com/github/codeql/sessions/bd4fa112-dbc3-47e8-9cef-9b1b13c7e549 Co-authored-by: owen-mc <62447351+owen-mc@users.noreply.github.com>	2026-05-06 16:08:02 +00:00
copilot-swe-agent[bot]	26dca558c7	Initial plan	2026-05-06 16:02:08 +00:00
Owen Mansel-Chan	a367294c23	Merge branch 'main' into copilot/automate-go-version-updates-again	2026-04-23 14:41:46 +01:00
copilot-swe-agent[bot]	b6004045bd	Clean up Go version workflow - remove unnecessary escaping and checks Co-authored-by: mbg <278086+mbg@users.noreply.github.com>	2026-02-13 11:23:44 +00:00
copilot-swe-agent[bot]	cc7e03b0f5	Add error handling and validation to Go version workflow Co-authored-by: mbg <278086+mbg@users.noreply.github.com>	2026-02-13 11:22:36 +00:00
copilot-swe-agent[bot]	1cbd423251	Improve portability and fix PR detection in Go version workflow Co-authored-by: mbg <278086+mbg@users.noreply.github.com>	2026-02-13 11:21:13 +00:00
copilot-swe-agent[bot]	437244fe90	Fix portability issues in Go version update workflow Co-authored-by: mbg <278086+mbg@users.noreply.github.com>	2026-02-13 11:19:56 +00:00
copilot-swe-agent[bot]	f7cf24d1f9	Add Go version update workflow Co-authored-by: mbg <278086+mbg@users.noreply.github.com>	2026-02-13 11:17:57 +00:00
copilot-swe-agent[bot]	c3bafacf81	Initial plan	2026-02-13 11:15:15 +00:00
Owen Mansel-Chan	57ce0b3d51	Accept data flow consistency result	2026-02-05 22:28:54 +00:00
Owen Mansel-Chan	408ba2e139	(Misc) Delete spuriously committed binary file	2026-02-04 13:41:14 +00:00
Owen Mansel-Chan	7632bdba88	(Misc) fix variable names	2026-02-04 13:40:52 +00:00
Owen Mansel-Chan	4b830c1864	Test varargs flow with models-as-data	2026-02-04 13:40:33 +00:00
Owen Mansel-Chan	d6c8767647	Test flow out of varargs parameter in function model	2026-02-04 13:40:01 +00:00
Owen Mansel-Chan	ec815397a2	Test flow out of varargs parameter in source function	2026-02-04 13:38:48 +00:00
`@@ -1 +1 @@`
	`Models/CompositeActionsSinks.ql`	`query: Models/CompositeActionsSinks.ql`
`@@ -1,2 +1 @@`
	`Models/CompositeActionsSources.ql`	`query: Models/CompositeActionsSources.ql`
`@@ -1,2 +1 @@`
	`Models/CompositeActionsSummaries.ql`	`query: Models/CompositeActionsSummaries.ql`
`@@ -1,2 +1 @@`
	`Models/ReusableWorkflowsSinks.ql`	`query: Models/ReusableWorkflowsSinks.ql`
`@@ -1,2 +1 @@`
	`Models/ReusableWorkflowsSources.ql`	`query: Models/ReusableWorkflowsSources.ql`
`@@ -1,2 +1 @@`
	`Models/ReusableWorkflowsSummaries.ql`	`query: Models/ReusableWorkflowsSummaries.ql`
`@@ -1 +1 @@`
	`experimental/Security/CWE-074/OutputClobberingHigh.ql`	`query: experimental/Security/CWE-074/OutputClobberingHigh.ql`
`@@ -1 +1 @@`
	`Security/CWE-077/EnvPathInjectionCritical.ql`	`query: Security/CWE-077/EnvPathInjectionCritical.ql`
`@@ -1 +1 @@`
	`Security/CWE-077/EnvPathInjectionMedium.ql`	`query: Security/CWE-077/EnvPathInjectionMedium.ql`