Skip to content

Commit ae3ce28

Browse files
Merge remote-tracking branch 'origin/main' into michaelrfairhurst/resolves-to-type-lib
2 parents d20e6a5 + 743d8ec commit ae3ce28

File tree

391 files changed

+298745
-1572
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

391 files changed

+298745
-1572
lines changed

.github/copilot-instructions.md

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
---
2+
description: 'Code review guidelines for GitHub copilot in this project'
3+
applyTo: '**'
4+
excludeAgent: ["coding-agent"]
5+
---
6+
7+
# Code Review Instructions
8+
9+
A change note is required for any pull request which modifies:
10+
- The structure or layout of the release artifacts.
11+
- The evaluation performance (memory, execution time) of an existing query.
12+
- The results of an existing query in any circumstance.
13+
14+
If the pull request only adds new rule queries, a change note is not required.
15+
Confirm that either a change note is not required or the change note is required and has been added.
16+
17+
For PRs that add new queries or modify existing queries, also consider the following review checklist:
18+
- Confirm that the output format of shared queries is valid.
19+
- Have all the relevant rule package description files been checked in?
20+
- Have you verified that the metadata properties of each new query is set appropriately?
21+
- Do all the unit tests contain both "COMPLIANT" and "NON_COMPLIANT" cases?
22+
- Are all the alerts in the expected file annotated as NON_COMPLIANT in the test source file?
23+
- Are the alert messages properly formatted and consistent with the style guide?
24+
- Does the query have an appropriate level of in-query comments/documentation?
25+
- Does the query not reinvent features in the standard library?
26+
- Can the query be simplified further (not golfed!).
27+
28+
In your review output, list only those checklist items that are not satisfied or are uncertain, but also report any other problems you find outside this checklist; do not mention checklist items that clearly pass.
29+
30+
## Validating tests and .expected files
31+
32+
The test infrastructure for CodeQL that we use in this project involves the creation of a test directory with the following structure:
33+
- Test root is `some/path/test/path/to/feature` (mirrors `some/path/src/path/to/query`)
34+
- At least one test `c` or `c++` file, typically named `test.c`/`test.cpp`, with lines annotated `// COMPLIANT` or `// NON_COMPLIANT`
35+
- A `.ql` file with test query logic, or a `.qlref` file referring to the production query logic
36+
- A matching `FOO.expected` file to go with each `FOO.ql` or `FOO.qlref`, containing the test query results for the test `c` or `c++` files
37+
- Note that some test directories simply have a `testref` file, to document that a certain query is tested in a different directory.
38+
39+
As a code reviewer, it is critical to ensure that the results in the `.expected` file match the comments in the test file.
40+
41+
The `.expected` file uses a columnar format:
42+
- For example, a basic row may look like `| test.cpp:8:22:8:37 | element | message |`.
43+
- For a query with `select x, "test"`, the columns are | x.getLocation() | x.toString() | "test" |`
44+
- An alert with placeholders will use `$@` in the message, and have additional `element`/`string` columns for placeholder, e.g. `| test.cpp:8:22:8:37 | ... + ... | Invalid add of $@. | test.cpp:7:5:7:12 | my_var | deprecated variable my_var |`.
45+
- Remember, there is one `.expected` file for each `.ql` or `.qlref` file.
46+
- Each `.expected` file will contain the results for all test c/cpp files.
47+
- The `toString()` format of QL objects is deliberately terse for performance reasons.
48+
- For certain queries such as "path problems", the results may be grouped into categories via text lines with the category name, e.g. `nodes` and `edges` and `problems`.
49+
50+
Reviewing tests in this style can be tedious and error prone, but fundamental to the effectiveness of our TDD requirements in this project.
51+
52+
When reviewing tests, it is critical to:
53+
- Check that each `NON_COMPLIANT` case in the test file has a row in the correct `.expected` file referring to the correct location.
54+
- Check that each row in each `.expected` file has a `NON_COMPLIANT` case in the test file at the correct location.
55+
- Check that there are no `.expected` rows that refer to test code cases marked as `COMPLIANT`, or with no comment
56+
- Note that it is OK if the locations of the comment are not precisely aligned with the alert
57+
- Check that the alert message and placeholders are accurate and understandable.
58+
- Consider the "test coverage" of the query, are each of its logical statements effectively exercised individually, collectively? The test should neither be overly bloated nor under specified.
59+
- Consider the edge cases of the language itself, will the analysis work in non-trivial cases, are all relevant language concepts tested here? This doesn't need to be exhaustive, but it should be thoughfully thorough.

.github/workflows/code-scanning-pack-gen.yml

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,6 @@
11
name: Code Scanning Query Pack Generation
2+
permissions:
3+
contents: read
24

35
on:
46
merge_group:
@@ -46,7 +48,7 @@ jobs:
4648

4749
- name: Cache CodeQL
4850
id: cache-codeql
49-
uses: actions/cache@v4
51+
uses: actions/cache@v5
5052
with:
5153
path: ${{ github.workspace }}/codeql_home
5254
key: codeql-home-${{ matrix.os }}-${{ matrix.codeql_cli }}-${{ matrix.codeql_standard_library }}
@@ -109,7 +111,7 @@ jobs:
109111
zip -r codeql-coding-standards/code-scanning-cpp-query-pack.zip codeql-coding-standards/c/ codeql-coding-standards/cpp/ codeql-coding-standards/.codeqlmanifest.json codeql-coding-standards/supported_codeql_configs.json codeql-coding-standards/scripts/configuration codeql-coding-standards/scripts/reports codeql-coding-standards/scripts/shared codeql-coding-standards/scripts/guideline_recategorization codeql-coding-standards/schemas
110112
111113
- name: Upload GHAS Query Pack
112-
uses: actions/upload-artifact@v4
114+
uses: actions/upload-artifact@v6
113115
with:
114116
name: code-scanning-cpp-query-pack.zip
115117
path: code-scanning-cpp-query-pack.zip
@@ -130,7 +132,7 @@ jobs:
130132
codeql pack bundle --output=report-coding-standards.tgz cpp/report/src
131133
132134
- name: Upload qlpack bundles
133-
uses: actions/upload-artifact@v4
135+
uses: actions/upload-artifact@v6
134136
with:
135137
name: coding-standards-codeql-packs
136138
path: '*-coding-standards.tgz'

.github/workflows/codeql_unit_tests.yml

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,6 @@
11
name: CodeQL Unit Testing
2+
permissions:
3+
contents: read
24

35
on:
46
merge_group:
@@ -48,7 +50,7 @@ jobs:
4850
uses: actions/checkout@v5
4951

5052
- name: Install Python
51-
uses: actions/setup-python@v5
53+
uses: actions/setup-python@v6
5254
with:
5355
python-version: "3.9"
5456

@@ -57,7 +59,7 @@ jobs:
5759

5860
- name: Cache CodeQL
5961
id: cache-codeql
60-
uses: actions/cache@v4
62+
uses: actions/cache@v5
6163
with:
6264
# A list of files, directories, and wildcard patterns to cache and restore
6365
path: ${{github.workspace}}/codeql_home
@@ -151,7 +153,7 @@ jobs:
151153
file.close()
152154
153155
- name: Upload test results
154-
uses: actions/upload-artifact@v4
156+
uses: actions/upload-artifact@v6
155157
with:
156158
name: ${{ matrix.language }}-test-results-${{ runner.os }}-${{ matrix.codeql_cli }}-${{ matrix.codeql_standard_library_ident }}
157159
path: |
@@ -166,12 +168,12 @@ jobs:
166168
steps:
167169
- name: Check if run-test-suites job failed to complete, if so fail
168170
if: ${{ needs.run-test-suites.result == 'failure' }}
169-
uses: actions/github-script@v7
171+
uses: actions/github-script@v8
170172
with:
171173
script: |
172174
core.setFailed('Test run job failed')
173175
- name: Collect test results
174-
uses: actions/download-artifact@v4
176+
uses: actions/download-artifact@v7
175177

176178
- name: Validate test results
177179
run: |

.github/workflows/dispatch-matrix-test-on-comment.yml

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,8 @@
11
name: 🤖 Run Matrix Check (On Comment)
2+
permissions:
3+
contents: read
4+
actions: write
5+
pull-requests: write
26

37
on:
48
issue_comment:
@@ -40,7 +44,7 @@ jobs:
4044
--json \
4145
-R github/codeql-coding-standards-release-engineering
4246
43-
- uses: actions/github-script@v7
47+
- uses: actions/github-script@v8
4448
if: ${{ github.event.issue.pull_request && contains(github.event.comment.body, '/test-matrix') && steps.check-write-permission.outputs.has-permission }}
4549
with:
4650
script: |

.github/workflows/dispatch-release-performance-check.yml

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,8 @@
11
name: 🏁 Run Release Performance Check
2+
permissions:
3+
contents: read
4+
actions: write
5+
pull-requests: write
26

37
on:
48
issue_comment:
@@ -40,7 +44,7 @@ jobs:
4044
--json \
4145
-R github/codeql-coding-standards-release-engineering
4246
43-
- uses: actions/github-script@v7
47+
- uses: actions/github-script@v8
4448
if: ${{ github.event.issue.pull_request && contains(github.event.comment.body, '/test-performance') && steps.check-write-permission.outputs.has-permission }}
4549
with:
4650
script: |

.github/workflows/extra-rule-validation.yml

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,6 @@
11
name: ⚙️ Extra Rule Validation
2+
permissions:
3+
contents: read
24

35
on:
46
merge_group:
@@ -44,13 +46,13 @@ jobs:
4446
run: scripts/util/Test-SharedImplementationsHaveTestCases.ps1 -Language c -CIMode
4547

4648

47-
- uses: actions/upload-artifact@v4
49+
- uses: actions/upload-artifact@v6
4850
if: failure()
4951
with:
5052
name: missing-test-report.csv
5153
path: MissingTestReport*.csv
5254

53-
- uses: actions/upload-artifact@v4
55+
- uses: actions/upload-artifact@v6
5456
if: failure()
5557
with:
5658
name: test-report.csv

.github/workflows/finalize-release.yml

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
name: Finalize Release
2+
permissions:
3+
contents: write
4+
pull-requests: write
5+
actions: write
6+
27
on:
38
pull_request:
49
types:
@@ -52,7 +57,7 @@ jobs:
5257
path: tooling
5358

5459
- name: Install Python
55-
uses: actions/setup-python@v5
60+
uses: actions/setup-python@v6
5661
with:
5762
python-version: "3.9"
5863

.github/workflows/generate-html-docs.yml

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,6 @@
11
name: Generate HTML documentation
2+
permissions:
3+
contents: read
24

35
on:
46
merge_group:
@@ -23,7 +25,7 @@ jobs:
2325
uses: actions/checkout@v5
2426

2527
- name: Install Python
26-
uses: actions/setup-python@v5
28+
uses: actions/setup-python@v6
2729
with:
2830
python-version: "3.9"
2931

@@ -35,7 +37,7 @@ jobs:
3537
python scripts/documentation/generate_iso26262_docs.py coding-standards-html-docs
3638
3739
- name: Upload HTML documentation
38-
uses: actions/upload-artifact@v4
40+
uses: actions/upload-artifact@v6
3941
with:
4042
name: coding-standards-docs-${{ github.sha }}
4143
path: coding-standards-html-docs/

.github/workflows/prepare-release.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ jobs:
3939
ref: ${{ inputs.ref }}
4040

4141
- name: Install Python
42-
uses: actions/setup-python@v5
42+
uses: actions/setup-python@v6
4343
with:
4444
python-version: "3.9"
4545

.github/workflows/standard_library_upgrade_tests.yml

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,6 @@
11
name: CodeQL Standard Library Upgrade tests
2+
permissions:
3+
contents: read
24

35
# Run this workflow every time the "supported_codeql_configs.json" file is changed
46
on:
@@ -44,13 +46,13 @@ jobs:
4446
uses: actions/checkout@v5
4547

4648
- name: Setup Python 3
47-
uses: actions/setup-python@v5
49+
uses: actions/setup-python@v6
4850
with:
4951
python-version: "3.x"
5052

5153
- name: Cache CodeQL
5254
id: cache-codeql
53-
uses: actions/cache@v4
55+
uses: actions/cache@v5
5456
with:
5557
# A list of files, directories, and wildcard patterns to cache and restore
5658
path: ${{github.workspace}}/codeql_home
@@ -143,7 +145,7 @@ jobs:
143145
}, test_summary_file)
144146
145147
- name: Upload test results
146-
uses: actions/upload-artifact@v4
148+
uses: actions/upload-artifact@v6
147149
with:
148150
name: test-results-${{runner.os}}-${{matrix.codeql_cli}}-${{matrix.codeql_standard_library_ident}}
149151
path: |
@@ -157,12 +159,12 @@ jobs:
157159
runs-on: ubuntu-22.04
158160
steps:
159161
- name: Install Python
160-
uses: actions/setup-python@v5
162+
uses: actions/setup-python@v6
161163
with:
162164
python-version: "3.9"
163165

164166
- name: Collect test results
165-
uses: actions/download-artifact@v4
167+
uses: actions/download-artifact@v7
166168

167169
- name: Validate test results
168170
shell: python

0 commit comments

Comments
 (0)