Skip to content

Commit 097d518

Browse files
cklincklin
committed
Merge branch 'main' into cklin/merge-codeql-go-prep
2 parents aa514ff + 439dcc0 commit 097d518

File tree

31,990 files changed

+3132971
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

31,990 files changed

+3132971
-0
lines changed

‎.bazelrc

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
build --repo_env=CC=clang --repo_env=CXX=clang++ --copt="-std=c++17"
2+
3+
try-import %workspace%/local.bazelrc

‎.bazelversion

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
5.0.0

‎.codeqlmanifest.json

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
{
2+
"provide": [
3+
"*/ql/src/qlpack.yml",
4+
"*/ql/lib/qlpack.yml",
5+
"*/ql/test/qlpack.yml",
6+
"*/ql/examples/qlpack.yml",
7+
"*/ql/consistency-queries/qlpack.yml",
8+
"cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/qlpack.yml",
9+
"javascript/ql/experimental/adaptivethreatmodeling/lib/qlpack.yml",
10+
"javascript/ql/experimental/adaptivethreatmodeling/modelbuilding/qlpack.yml",
11+
"javascript/ql/experimental/adaptivethreatmodeling/src/qlpack.yml",
12+
"csharp/ql/campaigns/Solorigate/lib/qlpack.yml",
13+
"csharp/ql/campaigns/Solorigate/src/qlpack.yml",
14+
"csharp/ql/campaigns/Solorigate/test/qlpack.yml",
15+
"misc/legacy-support/*/qlpack.yml",
16+
"misc/suite-helpers/qlpack.yml",
17+
"ruby/extractor-pack/codeql-extractor.yml",
18+
"ql/extractor-pack/codeql-extractor.yml"
19+
],
20+
"versionPolicies": {
21+
"default": {
22+
"requireChangeNotes": true,
23+
"committedPrereleaseSuffix": "dev",
24+
"committedVersion": "nextPatchRelease"
25+
}
26+
}
27+
}

‎.devcontainer/devcontainer.json

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
{
2+
"extensions": [
3+
"rust-lang.rust",
4+
"bungcip.better-toml",
5+
"github.vscode-codeql",
6+
"hbenl.vscode-test-explorer",
7+
"ms-vscode.test-adapter-converter",
8+
"slevesque.vscode-zipexplorer"
9+
],
10+
"settings": {
11+
"files.watcherExclude": {
12+
"**/target/**": true
13+
},
14+
"codeQL.runningQueries.memory": 2048
15+
}
16+
}

‎.editorconfig

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
[*]
2+
end_of_line = lf

‎.gitattributes

+64
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
# Text files will be normalized to LF line endings in the Git database, and will keep those LF line
2+
# endings in the working tree even on Windows. If you make changes below, you should renormalize the
3+
# affected files by running the following from the root of this repo (requires Git 2.16 or greater):
4+
#
5+
# git add --renormalize .
6+
# git status [just to show what files were renormalized]
7+
# git commit -m "Normalize line endings"
8+
9+
# Anything Git auto-detects as text gets normalized and checked out as LF
10+
* text=auto eol=lf
11+
12+
# Explicitly set a bunch of known extensions to text, in case auto detection gets confused.
13+
*.ql text
14+
*.qll text
15+
*.qlref text
16+
*.dbscheme text
17+
*.qhelp text
18+
*.html text
19+
*.htm text
20+
*.xhtml text
21+
*.xhtm text
22+
*.js text
23+
*.mjs text
24+
*.ts text
25+
*.json text
26+
*.yml text
27+
*.yaml text
28+
*.c text
29+
*.cpp text
30+
*.h text
31+
*.hpp text
32+
*.md text
33+
*.stats text
34+
*.xml text
35+
*.sh text
36+
*.pl text
37+
*.java text
38+
*.cs text
39+
*.py text
40+
*.lua text
41+
*.expected text
42+
43+
# Explicitly set a bunch of known extensions to binary, because Git < 2.10 will treat
44+
# `* text=auto eol=lf` as `* text eol=lf`
45+
*.png -text
46+
*.jpg -text
47+
*.jpeg -text
48+
*.gif -text
49+
*.dll -text
50+
*.pdb -text
51+
52+
java/ql/test/stubs/**/*.java linguist-generated=true
53+
java/ql/test/experimental/stubs/**/*.java linguist-generated=true
54+
55+
# For some languages, upgrade script testing references really old dbscheme
56+
# files from legacy upgrades that have CRLF line endings. Since upgrade
57+
# resolution relies on object hashes, we must suppress line ending conversion
58+
# for those testing dbscheme files.
59+
*/ql/lib/upgrades/initial/*.dbscheme -text
60+
61+
# Generated test files - these are synced from the standard JavaScript libraries using
62+
# `javascript/ql/experimental/adaptivethreatmodeling/test/update_endpoint_test_files.py`.
63+
javascript/ql/experimental/adaptivethreatmodeling/test/endpoint_large_scale/autogenerated/**/*.js linguist-generated=true -merge
64+
javascript/ql/experimental/adaptivethreatmodeling/test/endpoint_large_scale/autogenerated/**/*.ts linguist-generated=true -merge

‎.github/ISSUE_TEMPLATE/lgtm-com---false-positive.md

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
---
2+
name: LGTM.com - false positive
3+
about: Tell us about an alert that shouldn't be reported
4+
title: LGTM.com - false positive
5+
labels: false-positive
6+
assignees: ''
7+
8+
---
9+
10+
**Description of the false positive**
11+
12+
<!-- Please explain briefly why you think it shouldn't be included. -->
13+
14+
**URL to the alert on the project page on LGTM.com**
15+
16+
<!--
17+
1. Open the project on LGTM.com.
18+
For example, https://lgtm.com/projects/g/pallets/click/.
19+
2. Switch to the `Alerts` tab. For example, https://lgtm.com/projects/g/pallets/click/alerts/.
20+
3. Scroll to the alert that you would like to report.
21+
4. Click on the right most icon `View this alert within the complete file`.
22+
5. A new browser tab opens. Copy and paste the page URL here.
23+
For example, https://lgtm.com/projects/g/pallets/click/snapshot/719fb7d8322b0767cdd1e5903ba3eb3233ba8dd5/files/click/_winconsole.py#xa08d213ab3289f87:1.
24+
-->

‎.github/ISSUE_TEMPLATE/ql---general.md

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
---
2+
name: General issue
3+
about: Tell us if you think something is wrong or if you have a question
4+
title: General issue
5+
labels: question
6+
assignees: ''
7+
8+
---
9+
10+
**Description of the issue**
11+
12+
<!-- Please explain briefly what is the problem.
13+
If it is about an LGTM project, please include its URL.-->
14+

‎.github/actions/fetch-codeql/action.yml

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
name: Fetch CodeQL
2+
description: Fetches the latest version of CodeQL
3+
runs:
4+
using: composite
5+
steps:
6+
- name: Select platform - Linux
7+
if: runner.os == 'Linux'
8+
shell: bash
9+
run: echo "GA_CODEQL_CLI_PLATFORM=linux64" >> $GITHUB_ENV
10+
11+
- name: Select platform - MacOS
12+
if: runner.os == 'MacOS'
13+
shell: bash
14+
run: echo "GA_CODEQL_CLI_PLATFORM=osx64" >> $GITHUB_ENV
15+
16+
- name: Fetch CodeQL
17+
shell: bash
18+
run: |
19+
LATEST=$(gh release list --repo https://github.com/github/codeql-cli-binaries | cut -f 1 | grep -v beta | sort --version-sort | tail -1)
20+
gh release download --repo https://github.com/github/codeql-cli-binaries --pattern codeql-$GA_CODEQL_CLI_PLATFORM.zip "$LATEST"
21+
unzip -q -d "${RUNNER_TEMP}" codeql-$GA_CODEQL_CLI_PLATFORM.zip
22+
echo "${RUNNER_TEMP}/codeql" >> "${GITHUB_PATH}"
23+
env:
24+
GITHUB_TOKEN: ${{ github.token }}

‎.github/codeql/codeql-config.yml

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
name: "CodeQL config"
2+
3+
queries:
4+
- uses: security-and-quality
5+
6+
paths-ignore:
7+
- '/cpp/'
8+
- '/java/'
9+
- '/python/'
10+
- '/javascript/ql/test'
11+
- '/javascript/extractor/tests'

‎.github/dependabot.yml

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: "cargo"
4+
directory: "ruby/node-types"
5+
schedule:
6+
interval: "daily"
7+
- package-ecosystem: "cargo"
8+
directory: "ruby/generator"
9+
schedule:
10+
interval: "daily"
11+
- package-ecosystem: "cargo"
12+
directory: "ruby/extractor"
13+
schedule:
14+
interval: "daily"
15+
- package-ecosystem: "cargo"
16+
directory: "ruby/autobuilder"
17+
schedule:
18+
interval: "daily"
19+
20+
- package-ecosystem: "github-actions"
21+
directory: "/"
22+
schedule:
23+
interval: "daily"
24+
ignore:
25+
- dependency-name: '*'
26+
update-types: ['version-update:semver-patch', 'version-update:semver-minor']

‎.github/labeler.yml

+35
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
"C++":
2+
- cpp/**/*
3+
- change-notes/**/*cpp*
4+
5+
"C#":
6+
- csharp/**/*
7+
- change-notes/**/*csharp*
8+
9+
Java:
10+
- java/**/*
11+
- change-notes/**/*java.*
12+
13+
JS:
14+
- any: [ 'javascript/**/*', '!javascript/ql/experimental/adaptivethreatmodeling/**/*' ]
15+
- change-notes/**/*javascript*
16+
17+
Python:
18+
- python/**/*
19+
- change-notes/**/*python*
20+
21+
Ruby:
22+
- ruby/**/*
23+
- change-notes/**/*ruby*
24+
25+
Swift:
26+
- swift/**/*
27+
- change-notes/**/*swift*
28+
29+
documentation:
30+
- "**/*.qhelp"
31+
- "**/*.md"
32+
- docs/**/*
33+
34+
"QL-for-QL":
35+
- ql/**/*

‎.github/workflows/check-change-note.yml

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
name: Check change note
2+
3+
on:
4+
pull_request_target:
5+
types: [labeled, unlabeled, opened, synchronize, reopened, ready_for_review]
6+
paths:
7+
- "*/ql/src/**/*.ql"
8+
- "*/ql/src/**/*.qll"
9+
- "*/ql/lib/**/*.ql"
10+
- "*/ql/lib/**/*.qll"
11+
- "!**/experimental/**"
12+
- "!ql/**"
13+
- ".github/workflows/check-change-note.yml"
14+
15+
jobs:
16+
check-change-note:
17+
runs-on: ubuntu-latest
18+
steps:
19+
- name: Fail if no change note found. To fix, either add one, or add the `no-change-note-required` label.
20+
if: |
21+
github.event.pull_request.draft == false &&
22+
!contains(github.event.pull_request.labels.*.name, 'no-change-note-required')
23+
env:
24+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
25+
run: |
26+
gh api 'repos/${{github.repository}}/pulls/${{github.event.number}}/files' --paginate --jq 'any(.[].filename ; test("/change-notes/.*[.]md$"))' |
27+
grep true -c

‎.github/workflows/check-qldoc.yml

+54
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
name: "Check QLdoc coverage"
2+
3+
on:
4+
pull_request:
5+
paths:
6+
- "*/ql/lib/**"
7+
- .github/workflows/check-qldoc.yml
8+
branches:
9+
- main
10+
- "rc/*"
11+
12+
jobs:
13+
qldoc:
14+
runs-on: ubuntu-latest
15+
16+
steps:
17+
- name: Install CodeQL
18+
run: |
19+
gh extension install github/gh-codeql
20+
gh codeql set-channel nightly
21+
gh codeql version
22+
env:
23+
GITHUB_TOKEN: ${{ github.token }}
24+
25+
- uses: actions/checkout@v3
26+
with:
27+
fetch-depth: 2
28+
29+
- name: Check QLdoc coverage
30+
shell: bash
31+
run: |
32+
EXIT_CODE=0
33+
# TODO: remove the swift exception from the regex when we fix generated QLdoc
34+
changed_lib_packs="$(git diff --name-only --diff-filter=ACMRT HEAD^ HEAD | { grep -Po '^(?!swift)[a-z]*/ql/lib' || true; } | sort -u)"
35+
for pack_dir in ${changed_lib_packs}; do
36+
lang="${pack_dir%/ql/lib}"
37+
gh codeql generate library-doc-coverage --output="${RUNNER_TEMP}/${lang}-current.txt" --dir="${pack_dir}"
38+
done
39+
git checkout HEAD^
40+
for pack_dir in ${changed_lib_packs}; do
41+
# When we add a new language, pack_dir would not exist in HEAD^.
42+
# In this case the right thing to do is to skip the check.
43+
[[ ! -d "${pack_dir}" ]] && continue
44+
lang="${pack_dir%/ql/lib}"
45+
gh codeql generate library-doc-coverage --output="${RUNNER_TEMP}/${lang}-baseline.txt" --dir="${pack_dir}"
46+
awk -F, '{gsub(/"/,""); if ($4==0 && $6=="public") print "\""$3"\"" }' "${RUNNER_TEMP}/${lang}-current.txt" | sort -u > "${RUNNER_TEMP}/current-undocumented.txt"
47+
awk -F, '{gsub(/"/,""); if ($4==0 && $6=="public") print "\""$3"\"" }' "${RUNNER_TEMP}/${lang}-baseline.txt" | sort -u > "${RUNNER_TEMP}/baseline-undocumented.txt"
48+
UNDOCUMENTED="$(grep -f <(comm -13 "${RUNNER_TEMP}/baseline-undocumented.txt" "${RUNNER_TEMP}/current-undocumented.txt") "${RUNNER_TEMP}/${lang}-current.txt" || true)"
49+
if [ -n "$UNDOCUMENTED" ]; then
50+
echo "$UNDOCUMENTED" | awk -F, '{gsub(/"/,""); print "::warning file='"${pack_dir}"'/"$1",line="$2"::Missing QLdoc for "$5, $3 }'
51+
EXIT_CODE=1
52+
fi
53+
done
54+
exit "${EXIT_CODE}"

‎.github/workflows/close-stale.yml

+30
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
name: Mark stale issues
2+
3+
on:
4+
workflow_dispatch:
5+
schedule:
6+
- cron: "30 1 * * *"
7+
8+
jobs:
9+
stale:
10+
if: github.repository == 'github/codeql'
11+
12+
runs-on: ubuntu-latest
13+
14+
steps:
15+
- uses: actions/stale@v5
16+
with:
17+
repo-token: ${{ secrets.GITHUB_TOKEN }}
18+
stale-issue-message: 'This issue is stale because it has been open 14 days with no activity. Comment or remove the `Stale` label in order to avoid having this issue closed in 7 days.'
19+
close-issue-message: 'This issue was closed because it has been inactive for 7 days.'
20+
days-before-stale: 14
21+
days-before-close: 7
22+
only-labels: awaiting-response
23+
24+
# do not mark PRs as stale
25+
days-before-pr-stale: -1
26+
days-before-pr-close: -1
27+
28+
# Uncomment for dry-run
29+
# debug-only: true
30+
# operations-per-run: 1000

0 commit comments

Comments
 (0)