Skip to content

Minor improvements for CodeQL ${workspace} pack dependencies and scripts #337

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
data-douser wants to merge 3 commits into from
Closed

Minor improvements for CodeQL ${workspace} pack dependencies and scripts #337

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
a6de846
Only run update-codeql.yml workflow every 3 days
data-douser Mar 25, 2026
0b1d320
Ignore .codeql/ directories in *-packs.sh scripts
data-douser Mar 25, 2026
f6347c2
Use $workspace references for workspace pack deps
data-douser Mar 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/workflows/update-codeql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,9 +2,9 @@ name: Update CodeQL CLI Dependencies

on:
workflow_dispatch:
# Nightly check for new CodeQL CLI releases
# Check for new CodeQL CLI releases every 3 days
Copy link

Copilot AI Mar 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The cron 30 0 */3 * * runs on day-of-month intervals (1,4,7,...) and will not be a strict “every 3 days” cadence across month boundaries. If you need an every-72-hours cadence, GitHub Actions cron can’t express that reliably; otherwise consider wording the comment as “every 3 days (day-of-month step)”.

Suggested change
# Check for new CodeQL CLI releases every 3 days
# Check for new CodeQL CLI releases every 3 days (day-of-month step)

Copilot uses AI. Check for mistakes.
schedule:
- cron: '30 0 * * *'
- cron: '30 0 */3 * *'

permissions:
contents: read
Expand Down
2 changes: 1 addition & 1 deletion javascript/frameworks/cap/src/qlpack.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,5 +6,5 @@ suites: codeql-suites
extractor: javascript
dependencies:
codeql/javascript-all: "^2.6.24"
advanced-security/javascript-sap-cap-all: "2.25.0"
advanced-security/javascript-sap-cap-all: ${workspace}
Copy link

Copilot AI Mar 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

${workspace} makes this dependency resolvable only when the dependent pack is present locally in the same workspace. Since this pack is one of the packs published to GHCR (see scripts/publish-packs.sh), external consumers installing from the registry will likely fail to resolve this dependency. Prefer pinning to the released version (or a compatible range) for published packs, and reserve ${workspace} for local-only/test packs or developer scripts.

Suggested change
advanced-security/javascript-sap-cap-all: ${workspace}
advanced-security/javascript-sap-cap-all: "^2.25.0"

Copilot uses AI. Check for mistakes.
default-suite-file: codeql-suites/javascript-code-scanning.qls
6 changes: 3 additions & 3 deletions javascript/frameworks/cap/test/qlpack.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,6 @@ version: 2.25.0
extractor: javascript
dependencies:
codeql/javascript-all: "^2.6.24"
advanced-security/javascript-sap-cap-queries: "2.25.0"
advanced-security/javascript-sap-cap-models: "2.25.0"
advanced-security/javascript-sap-cap-all: "2.25.0"
advanced-security/javascript-sap-cap-queries: ${workspace}
advanced-security/javascript-sap-cap-models: ${workspace}
advanced-security/javascript-sap-cap-all: ${workspace}
2 changes: 1 addition & 1 deletion javascript/frameworks/ui5-webcomponents/test/qlpack.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,4 +3,4 @@ version: 2.25.0
extractor: javascript
dependencies:
codeql/javascript-all: "^2.6.24"
advanced-security/javascript-sap-ui5-all: "2.25.0"
advanced-security/javascript-sap-ui5-all: ${workspace}
2 changes: 1 addition & 1 deletion javascript/frameworks/ui5/src/qlpack.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,5 +6,5 @@ suites: codeql-suites
extractor: javascript
dependencies:
codeql/javascript-all: "^2.6.24"
advanced-security/javascript-sap-ui5-all: "2.25.0"
advanced-security/javascript-sap-ui5-all: ${workspace}
Copy link

Copilot AI Mar 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using ${workspace} here makes the dependency resolvable only in a local multi-pack workspace. Because this pack is published (per scripts/publish-packs.sh), consumers installing it from GHCR may not be able to resolve the dependency. Consider keeping a concrete version (or range) in published packs and using ${workspace} only for non-published/test packs or local tooling.

Suggested change
advanced-security/javascript-sap-ui5-all: ${workspace}
advanced-security/javascript-sap-ui5-all: "^2.25.0"

Copilot uses AI. Check for mistakes.
default-suite-file: codeql-suites/javascript-code-scanning.qls
6 changes: 3 additions & 3 deletions javascript/frameworks/ui5/test/qlpack.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,6 @@ dependencies:
# no overlap occurs with the SAP UI5 queries. We therefore allow any version
# greater than or equal to 1.2.0, as major breaking changes are not a concern.
codeql/javascript-queries: ">1.2.0"
advanced-security/javascript-sap-ui5-queries: "2.25.0"
advanced-security/javascript-sap-ui5-models: "2.25.0"
advanced-security/javascript-sap-ui5-all: "2.25.0"
advanced-security/javascript-sap-ui5-queries: ${workspace}
advanced-security/javascript-sap-ui5-models: ${workspace}
advanced-security/javascript-sap-ui5-all: ${workspace}
2 changes: 1 addition & 1 deletion javascript/frameworks/xsjs/src/qlpack.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,5 +6,5 @@ suites: codeql-suites
extractor: javascript
dependencies:
codeql/javascript-all: "^2.6.24"
advanced-security/javascript-sap-xsjs-all: "2.25.0"
advanced-security/javascript-sap-xsjs-all: ${workspace}
Copy link

Copilot AI Mar 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

${workspace} ties this dependency to a local workspace layout. Since javascript/frameworks/xsjs/src is a publishable pack, installing it from GHCR is likely to fail unless the dependency can be resolved to a concrete published version. Prefer pinning to the release version (or compatible semver range) in published packs.

Suggested change
advanced-security/javascript-sap-xsjs-all: ${workspace}
advanced-security/javascript-sap-xsjs-all: "^2.25.0"

Copilot uses AI. Check for mistakes.
default-suite-file: codeql-suites/javascript-code-scanning.qls
6 changes: 3 additions & 3 deletions javascript/frameworks/xsjs/test/qlpack.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,6 @@ version: 2.25.0
extractor: javascript
dependencies:
codeql/javascript-all: "^2.6.24"
advanced-security/javascript-sap-xsjs-queries: "2.25.0"
advanced-security/javascript-sap-xsjs-all: "2.25.0"
advanced-security/javascript-sap-xsjs-models: "2.25.0"
advanced-security/javascript-sap-xsjs-queries: ${workspace}
advanced-security/javascript-sap-xsjs-all: ${workspace}
advanced-security/javascript-sap-xsjs-models: ${workspace}
2 changes: 1 addition & 1 deletion javascript/heuristic-models/tests/qlpack.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,4 +5,4 @@ version: 2.25.0
extractor: javascript
dependencies:
"codeql/javascript-all": "^2.6.24"
"advanced-security/javascript-heuristic-models": "2.25.0"
"advanced-security/javascript-heuristic-models": ${workspace}
3 changes: 2 additions & 1 deletion scripts/install-packs.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,7 +92,8 @@ install_framework() {
echo "Installing packs for: ${framework_path}"

# Find all qlpack.yml files under this framework and install their packs
find "${REPO_ROOT}/${framework_path}" -name "qlpack.yml" -type f | sort | while read -r qlpack_file; do
# Exclude .codeql directories which contain cached packs from previous installs
find "${REPO_ROOT}/${framework_path}" -name ".codeql" -prune -o -name "qlpack.yml" -type f -print | sort | while read -r qlpack_file; do
Copy link

Copilot AI Mar 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The find prune expression matches any path named .codeql (including files) and relies on operator precedence, which can behave differently across find implementations. To make the intent unambiguous, restrict pruning to directories and group the expression (e.g., prune only when -type d -name .codeql).

Suggested change
find "${REPO_ROOT}/${framework_path}" -name ".codeql" -prune -o -name "qlpack.yml" -type f -print | sort | while read -r qlpack_file; do
find "${REPO_ROOT}/${framework_path}" \( -type d -name ".codeql" -prune \) -o \( -name "qlpack.yml" -type f -print \) | sort | while read -r qlpack_file; do

Copilot uses AI. Check for mistakes.
local pack_dir
pack_dir=$(dirname "${qlpack_file}")
# Use relative path for cleaner output
Expand Down
3 changes: 2 additions & 1 deletion scripts/upgrade-packs.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,7 +92,8 @@ upgrade_framework() {
echo "Upgrading packs for: ${framework_path}"

# Find all qlpack.yml files under this framework and upgrade their packs
find "${REPO_ROOT}/${framework_path}" -name "qlpack.yml" -type f | sort | while read -r qlpack_file; do
# Exclude .codeql directories which contain cached packs from previous installs
find "${REPO_ROOT}/${framework_path}" -name ".codeql" -prune -o -name "qlpack.yml" -type f -print | sort | while read -r qlpack_file; do
Copy link

Copilot AI Mar 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The find prune expression currently prunes any path named .codeql and depends on find operator precedence. To avoid accidentally pruning non-directories and to keep behavior consistent across platforms, prefer pruning only directories (-type d -name .codeql -prune) with explicit grouping.

Suggested change
find "${REPO_ROOT}/${framework_path}" -name ".codeql" -prune -o -name "qlpack.yml" -type f -print | sort | while read -r qlpack_file; do
find "${REPO_ROOT}/${framework_path}" \( -type d -name ".codeql" -prune \) -o \( -name "qlpack.yml" -type f -print \) | sort | while read -r qlpack_file; do

Copilot uses AI. Check for mistakes.
local pack_dir
pack_dir=$(dirname "${qlpack_file}")
# Use relative path for cleaner output
Expand Down
Loading