From 2f0551411a26b001d870530bc331dc5ac6b11b2d Mon Sep 17 00:00:00 2001 From: Jan Schlosser Date: Thu, 23 Jul 2026 16:55:06 +0200 Subject: [PATCH 1/7] build(codeql): downgrade CodeQL bundle to 2.21.4 The MISRA C++ pack from codeql-coding-standards v2.61.0 is incompatible with the CodeQL 2.26.0 standard library (it fails to compile against the newer cpp-all, e.g. the removed TemplateParameter API). Pin the bundle to 2.21.4, which is one of the CodeQL versions the v2.61.0 release officially supports. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- MODULE.bazel | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/MODULE.bazel b/MODULE.bazel index 8748511e7..fae5973c1 100644 --- a/MODULE.bazel +++ b/MODULE.bazel @@ -436,8 +436,8 @@ http_archive = use_repo_rule("@bazel_tools//tools/build_defs/repo:http.bzl", "ht http_archive( name = "codeql_bundle", build_file = "//third_party/codeql:codeql.BUILD", - sha256 = "0144d4bc415aee0d5638119dfb626a2d8689e2ff21758ba211a3984862b8522c", - url = "https://github.com/github/codeql-action/releases/download/codeql-bundle-v2.26.0/codeql-bundle-linux64.tar.gz", + sha256 = "a94f674bb3c23ea5e9a2ad06b64847dd0277b15014d2517ecd9c41c88e6caa65", + url = "https://github.com/github/codeql-action/releases/download/codeql-bundle-v2.21.4/codeql-bundle-linux64.tar.gz", ) git_repository = use_repo_rule("@bazel_tools//tools/build_defs/repo:git.bzl", "git_repository") From f9ad8bda36fe2421ab82fbd1dede27be3bbe549a Mon Sep 17 00:00:00 2001 From: Jan Schlosser Date: Thu, 23 Jul 2026 16:55:15 +0200 Subject: [PATCH 2/7] fix(codeql): stop analysis_report crashing on MISRA results generate_guideline_compliance_summary() looks up each applied standard's pretty name in a hard-coded dict that only contained "cert" and "autosar", so a MISRA C++ run aborted with KeyError: 'misra' while rendering the compliance summary. Patch the vendored codeql-coding-standards checkout to add the "misra" -> "MISRA C++ 2023" mapping, and wire the patch into the codeql_coding_standards git_repository. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- MODULE.bazel | 2 ++ .../codeql/codeql_coding_standards_misra.patch | 16 ++++++++++++++++ 2 files changed, 18 insertions(+) create mode 100644 third_party/codeql/codeql_coding_standards_misra.patch diff --git a/MODULE.bazel b/MODULE.bazel index fae5973c1..1fee7b5e8 100644 --- a/MODULE.bazel +++ b/MODULE.bazel @@ -446,6 +446,8 @@ git_repository( name = "codeql_coding_standards", build_file = "//third_party/codeql:codeql_coding_standards.BUILD", commit = "06dc6bc32b05152fbe94dbf341a3e854574c9df5", # v2.61.0 + patch_args = ["-p1"], + patches = ["//third_party/codeql:codeql_coding_standards_misra.patch"], remote = "https://github.com/github/codeql-coding-standards.git", ) diff --git a/third_party/codeql/codeql_coding_standards_misra.patch b/third_party/codeql/codeql_coding_standards_misra.patch new file mode 100644 index 000000000..079a3ee2e --- /dev/null +++ b/third_party/codeql/codeql_coding_standards_misra.patch @@ -0,0 +1,16 @@ +diff --git a/scripts/reports/utils.py b/scripts/reports/utils.py +index 5751139..6fbf353 100644 +--- a/scripts/reports/utils.py ++++ b/scripts/reports/utils.py +@@ -183,7 +183,10 @@ def generate_guideline_compliance_summary(output_directory, results_summary): + print( + "**Result**: " + ("Not compliant" if total_guidelines_violated > 0 else "Compliant")) + standard_pretty_name = { +- "cert": "CERT C++ 2016", "autosar": "AUTOSAR C++ R22-11, R21-11, R20-11, R19-11 and R19-03"} ++ "cert": "CERT C++ 2016", ++ "autosar": "AUTOSAR C++ R22-11, R21-11, R20-11, R19-11 and R19-03", ++ "misra": "MISRA C++:2023", ++ } + print("**Coding Standards applied**: " + ", ".join([standard_pretty_name[standard_short_name] + for standard_short_name in results_summary.guideline_violation_count.keys()])) + From f5075f96b4078c0f7095eca4bafd324bfa6a1874 Mon Sep 17 00:00:00 2001 From: Jan Schlosser Date: Thu, 23 Jul 2026 16:55:35 +0200 Subject: [PATCH 3/7] feat(codeql): run MISRA analysis from vendored pre-compiled release pack Analyze against the pre-compiled MISRA C++ query pack that ships with the codeql-coding-standards v2.61.0 release instead of resolving/compiling the pack at analysis time. The github/codeql-coding-standards release publishes a coding-standards-codeql-packs.zip asset containing each standard's pack already compiled (.qlx files plus every library dependency vendored under .codeql/libraries/). A new repository rule (codeql_release_pack) downloads that zip (pinned by sha256), extracts misra-cpp-coding-standards.tgz and exposes it as @codeql_coding_standards_compiled//:pack. This keeps the analysis hermetic and pinned, needs no network at analysis time, requires no query recompilation, and avoids 'codeql pack create', which crashes inside Bazel's linux sandbox. codeql_lint.py now resolves this vendored pack from runfiles and analyzes the bundled misra-cpp-default.qls suite with --additional-packs. The vendored pack is the only supported query source: if it (or its default suite) cannot be located, analysis fails loudly rather than falling back to a registry download or a runtime-compiled pack. 'codeql pack install' is no longer needed and has been dropped. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- MODULE.bazel | 16 ++++ quality/static_analysis/BUILD | 1 + quality/static_analysis/codeql_lint.py | 95 ++++++++++++++++++---- third_party/codeql/codeql_release_pack.bzl | 73 +++++++++++++++++ 4 files changed, 167 insertions(+), 18 deletions(-) create mode 100644 third_party/codeql/codeql_release_pack.bzl diff --git a/MODULE.bazel b/MODULE.bazel index 1fee7b5e8..65a17c451 100644 --- a/MODULE.bazel +++ b/MODULE.bazel @@ -451,6 +451,22 @@ git_repository( remote = "https://github.com/github/codeql-coding-standards.git", ) +# The MISRA C++ analysis runs a pre-compiled query pack published with the +# codeql-coding-standards release (see codeql_release_pack.bzl). This avoids +# compiling the queries locally while keeping the analysis hermetic (pinned by +# sha256) and aligned with the pinned coding_standards version above. +codeql_release_pack = use_repo_rule( + "//third_party/codeql:codeql_release_pack.bzl", + "codeql_release_pack", +) + +codeql_release_pack( + name = "codeql_coding_standards_compiled", + pack_tarball = "misra-cpp-coding-standards.tgz", + sha256 = "fdddef5a7ca1c66ebdbe6c79c60c7b5b6b274dbc3c9ecbc4bb9a0a13cead20a1", + urls = ["https://github.com/github/codeql-coding-standards/releases/download/v2.61.0/coding-standards-codeql-packs.zip"], +) + register_toolchains( "//bazel/toolchains:sphinx_toolchain", dev_dependency = True, diff --git a/quality/static_analysis/BUILD b/quality/static_analysis/BUILD index cf40ab76a..36a70408f 100644 --- a/quality/static_analysis/BUILD +++ b/quality/static_analysis/BUILD @@ -23,6 +23,7 @@ py_binary( "@codeql_bundle//:codeql_cli", "@codeql_coding_standards//:analysis_report", "@codeql_coding_standards//:process_coding_standards_config", + "@codeql_coding_standards_compiled//:pack", ], main = "codeql_lint.py", tags = ["local"], diff --git a/quality/static_analysis/codeql_lint.py b/quality/static_analysis/codeql_lint.py index f46b70d34..5718cedda 100644 --- a/quality/static_analysis/codeql_lint.py +++ b/quality/static_analysis/codeql_lint.py @@ -22,28 +22,70 @@ TMP_PATH_FOR_DATABASES = "/var/tmp/codeql_databases" -def _find_pack_root(): - """Locate the MISRA C++ query pack root (cpp/common/src) via Bazel runfiles. - - The codeql_coding_standards repo's cpp/** sources are already declared as a - `data` dependency of @codeql_coding_standards//:analysis_report, which is in - turn a `data` dependency of this py_binary. That means Bazel places them in - our own runfiles tree, so we can resolve the pack root the same way - everywhere (locally and in CI) without any manual filesystem searching. +# Default query suite (relative to the MISRA C++ pack root) run by the analysis. +MISRA_DEFAULT_SUITE_NAME = os.path.join( + "codeql-suites", "misra-cpp-default.qls") + + +def _find_coding_standards_root(): + """Locate the vendored codeql-coding-standards repo root (the dir containing cpp/). + + The codeql_coding_standards repo's cpp/** sources are declared as a `data` + dependency of @codeql_coding_standards//:analysis_report, which is in turn a + `data` dependency of this py_binary, so Bazel places them in our runfiles + tree. Only used for the `--query-spec` override, which analyzes a query from + these sources rather than the pre-compiled release pack. """ from python.runfiles import Runfiles runfiles = Runfiles.Create() anchor = runfiles.Rlocation("codeql_coding_standards/cpp/common/src/qlpack.yml") if not anchor or not os.path.exists(anchor): - raise RuntimeError("Unable to locate CodeQL pack root (cpp/common/src)") - return os.path.dirname(anchor) + raise RuntimeError("Unable to locate CodeQL coding standards repo root") + # anchor = /cpp/common/src/qlpack.yml -> go up four levels. + return os.path.dirname(os.path.dirname(os.path.dirname(os.path.dirname(anchor)))) + + +def _find_compiled_pack_root(): + """Locate the pre-compiled MISRA C++ query pack root from runfiles. + + The pack is vendored by the @codeql_coding_standards_compiled repository + (see third_party/codeql/codeql_release_pack.bzl): a pre-compiled pack + published with the codeql-coding-standards release, containing the compiled + queries (`.qlx`), the default suites and all library dependencies bundled + under `.codeql/libraries/`. Analyzing against this pack (via an explicit + suite path + `--additional-packs`) runs exactly the pinned ruleset without + recompiling the queries and without downloading anything from the registry. + This vendored pack is the ONLY supported query source: if it cannot be + located we raise instead of silently falling back to any other pack (e.g. a + registry download or a runtime-compiled pack), so that the analysis always + runs exactly the pinned, hermetic ruleset. -def _install_query_pack(code_ql_path): - """Resolve the MISRA C++ query pack's own dependencies (like `npm install`).""" - pack_root = _find_pack_root() - subprocess.run(f"{code_ql_path} pack install {pack_root}", shell=True, check=True) + Returns the pack root directory (the one containing qlpack.yml). + """ + from python.runfiles import Runfiles + + runfiles = Runfiles.Create() + anchor = runfiles.Rlocation( + "codeql_coding_standards_compiled/pack/qlpack.yml") + if not anchor or not os.path.exists(anchor): + raise RuntimeError( + "Vendored pre-compiled MISRA C++ query pack not found (expected " + "runfile 'codeql_coding_standards_compiled/pack/qlpack.yml'). " + "Ensure the @codeql_coding_standards_compiled//:pack dependency is " + "in this target's `data`. Refusing to fall back to any other query " + "source.") + # anchor = /qlpack.yml + pack_root = os.path.dirname(anchor) + + suite_path = os.path.join(pack_root, MISRA_DEFAULT_SUITE_NAME) + if not os.path.exists(suite_path): + raise RuntimeError( + "Vendored pre-compiled MISRA C++ query pack is incomplete: default " + f"suite '{suite_path}' is missing. Refusing to fall back to any " + "other query source.") + return pack_root def create_database(code_ql_path, config_path, target, source_root, database_path): @@ -86,7 +128,25 @@ def analyze_database( output_base = output_dir or _get_bazel_info(source_root).get('output_path') os.makedirs(output_base, exist_ok=True) - query_arg = f" {query_spec}" if query_spec else "" + # Analyze against the pre-compiled MISRA C++ query pack published with the + # codeql-coding-standards release and vendored by the + # @codeql_coding_standards_compiled repository (see _find_compiled_pack_root). + # The pack already contains the compiled queries and all their library + # dependencies, so passing an explicit suite from it together with + # --additional-packs runs exactly the pinned ruleset without recompiling the + # queries and without downloading anything from the registry. + # + # --query-spec overrides this to analyze a single query straight from the + # vendored coding-standards sources (used for debugging individual rules). + if query_spec: + query_target = query_spec + additional_packs = _find_coding_standards_root() + else: + pack_root = _find_compiled_pack_root() + query_target = os.path.join(pack_root, MISRA_DEFAULT_SUITE_NAME) + additional_packs = pack_root + query_arg = f" {query_target}" + common_analyze_flags = f"--additional-packs={additional_packs}" sarif_path = f"{output_base}/{output_prefix}.sarif" csv_path = f"{output_base}/{output_prefix}.csv" @@ -94,12 +154,14 @@ def analyze_database( print("\n Running CodeQL analysis...") subprocess.run( f"{code_ql_path} database analyze -j=0 {database_path}{query_arg} " + f"{common_analyze_flags} " f"--format=sarifv2.1.0 --output={sarif_path}", shell=True, check=True) # Generate CSV results subprocess.run( f"{code_ql_path} database analyze -j=0 {database_path}{query_arg} " + f"{common_analyze_flags} " f"--format=csv --output={csv_path}", shell=True, check=True) @@ -166,9 +228,6 @@ def main(): # Make codeql_path absolute codeql_path = os.path.abspath(args.codeql_path) if args.codeql_path else None - if codeql_path: - _install_query_pack(codeql_path) - if args.phase == "create-database": os.makedirs(os.path.dirname(args.database_path), exist_ok=True) create_database(codeql_path, args.config_path, target, source_root, args.database_path) diff --git a/third_party/codeql/codeql_release_pack.bzl b/third_party/codeql/codeql_release_pack.bzl new file mode 100644 index 000000000..76dce2d57 --- /dev/null +++ b/third_party/codeql/codeql_release_pack.bzl @@ -0,0 +1,73 @@ +# ******************************************************************************* +# Copyright (c) 2026 Contributors to the Eclipse Foundation +# +# See the NOTICE file(s) distributed with this work for additional +# information regarding copyright ownership. +# +# This program and the accompanying materials are made available under the +# terms of the Apache License Version 2.0 which is available at +# https://www.apache.org/licenses/LICENSE-2.0 +# +# SPDX-License-Identifier: Apache-2.0 +# ******************************************************************************* +"""Repository rule that vendors a pre-compiled CodeQL coding-standards pack. + +The github/codeql-coding-standards project publishes, for every release, a +`coding-standards-codeql-packs.zip` asset that bundles each standard's query +pack **already compiled** (`.qlx` files plus all library dependencies vendored +under `.codeql/libraries/`). Using these avoids compiling the queries ourselves +(which is slow and, via `codeql pack create`, does not work inside Bazel's +sandbox), while still keeping the analysis hermetic and pinned: the download is +content-addressed by sha256 and the pack is fetched from the same release we pin +elsewhere. + +The zip contains one `-coding-standards.tgz` per standard; this rule +extracts the requested one and exposes its contents as a `pack` filegroup whose +root is the pack directory (containing `qlpack.yml`, `codeql-suites/`, `rules/` +and `.codeql/libraries/`). +""" + +def _codeql_release_pack_impl(repository_ctx): + repository_ctx.download( + url = repository_ctx.attr.urls, + output = "packs.zip", + sha256 = repository_ctx.attr.sha256, + ) + + # The outer zip contains per-standard tarballs; extract only the one we need + # into the `pack/` subdirectory, which becomes the pack root. + repository_ctx.extract(archive = "packs.zip", output = "_packs") + repository_ctx.extract( + archive = "_packs/" + repository_ctx.attr.pack_tarball, + output = "pack", + ) + repository_ctx.delete("packs.zip") + repository_ctx.delete("_packs") + + repository_ctx.file( + "BUILD.bazel", + "filegroup(\n" + + " name = \"pack\",\n" + + " srcs = glob([\"pack/**\"], allow_empty = False),\n" + + " visibility = [\"//visibility:public\"],\n" + + ")\n", + ) + +codeql_release_pack = repository_rule( + implementation = _codeql_release_pack_impl, + doc = "Downloads and unpacks a pre-compiled coding-standards CodeQL pack.", + attrs = { + "urls": attr.string_list( + mandatory = True, + doc = "URL(s) of the coding-standards-codeql-packs.zip release asset.", + ), + "sha256": attr.string( + mandatory = True, + doc = "Expected sha256 of the downloaded zip.", + ), + "pack_tarball": attr.string( + mandatory = True, + doc = "Name of the per-standard .tgz inside the zip to extract.", + ), + }, +) From d9dc397a15574b2f0deb472b5b5111df304e5651 Mon Sep 17 00:00:00 2001 From: Jan Schlosser Date: Thu, 23 Jul 2026 23:55:34 +0200 Subject: [PATCH 4/7] refactor(codeql): reference release pack by name@version per user manual Switch the MISRA analysis to the codeql-coding-standards user manual's recommended (non-legacy) invocation for released pack artifacts: reference the pack by its declared '@:' specifier and make it discoverable via --search-path, instead of passing a bare filesystem path to the suite .qls together with --additional-packs (the legacy-style form). The pack name and version are read from the vendored pack's qlpack.yml, so CodeQL now validates the pack's declared identity and an accidental pack or version drift fails loudly rather than silently analyzing whatever suite sits at a path. Verified end to end: 218/218 queries reuse the pre-compiled results (no recompilation), SARIF reports CodeQL 2.21.4 and codeql/misra-cpp-coding-standards 2.61.0. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- quality/static_analysis/codeql_lint.py | 55 ++++++++++++++++++++------ 1 file changed, 42 insertions(+), 13 deletions(-) diff --git a/quality/static_analysis/codeql_lint.py b/quality/static_analysis/codeql_lint.py index 5718cedda..7c313ae12 100644 --- a/quality/static_analysis/codeql_lint.py +++ b/quality/static_analysis/codeql_lint.py @@ -23,8 +23,9 @@ # Default query suite (relative to the MISRA C++ pack root) run by the analysis. -MISRA_DEFAULT_SUITE_NAME = os.path.join( - "codeql-suites", "misra-cpp-default.qls") +# Forward-slash relative path, used both to locate the suite on disk and as the +# suite selector in the `@:` query specifier. +MISRA_DEFAULT_SUITE_NAME = "codeql-suites/misra-cpp-default.qls" def _find_coding_standards_root(): @@ -53,9 +54,10 @@ def _find_compiled_pack_root(): (see third_party/codeql/codeql_release_pack.bzl): a pre-compiled pack published with the codeql-coding-standards release, containing the compiled queries (`.qlx`), the default suites and all library dependencies bundled - under `.codeql/libraries/`. Analyzing against this pack (via an explicit - suite path + `--additional-packs`) runs exactly the pinned ruleset without - recompiling the queries and without downloading anything from the registry. + under `.codeql/libraries/`. Analyzing against this pack (referenced by its + `@:` specifier and made discoverable via + --search-path) runs exactly the pinned ruleset without recompiling the + queries and without downloading anything from the registry. This vendored pack is the ONLY supported query source: if it cannot be located we raise instead of silently falling back to any other pack (e.g. a @@ -88,6 +90,31 @@ def _find_compiled_pack_root(): return pack_root +def _read_pack_identity(pack_root): + """Return the (name, version) declared in the pack's qlpack.yml. + + The codeql-coding-standards user manual recommends referencing a downloaded + release pack by its `@:` specifier (with the pack made + discoverable via --search-path) rather than by a bare suite path. Reading the + declared identity here lets CodeQL validate the pack's name and version, so + an accidental pack/version drift fails loudly instead of silently analyzing + whatever suite happens to live at a path. + """ + name = None + version = None + with open(os.path.join(pack_root, "qlpack.yml")) as handle: + for line in handle: + stripped = line.strip() + if name is None and stripped.startswith("name:"): + name = stripped.split(":", 1)[1].strip().strip("'\"") + elif version is None and stripped.startswith("version:"): + version = stripped.split(":", 1)[1].strip().strip("'\"") + if not name or not version: + raise RuntimeError( + f"Could not read pack name/version from {pack_root}/qlpack.yml") + return name, version + + def create_database(code_ql_path, config_path, target, source_root, database_path): """Create the CodeQL database: init, build with tracing, finalize.""" subprocess.run( @@ -131,22 +158,24 @@ def analyze_database( # Analyze against the pre-compiled MISRA C++ query pack published with the # codeql-coding-standards release and vendored by the # @codeql_coding_standards_compiled repository (see _find_compiled_pack_root). - # The pack already contains the compiled queries and all their library - # dependencies, so passing an explicit suite from it together with - # --additional-packs runs exactly the pinned ruleset without recompiling the - # queries and without downloading anything from the registry. + # Following the codeql-coding-standards user manual's recommended approach for + # released pack artifacts, the pack is referenced by its + # `@:` specifier and made discoverable via + # --search-path. The pack already contains the compiled queries and all their + # library dependencies, so this runs exactly the pinned ruleset without + # recompiling the queries and without downloading anything from the registry. # # --query-spec overrides this to analyze a single query straight from the # vendored coding-standards sources (used for debugging individual rules). if query_spec: query_target = query_spec - additional_packs = _find_coding_standards_root() + common_analyze_flags = f"--additional-packs={_find_coding_standards_root()}" else: pack_root = _find_compiled_pack_root() - query_target = os.path.join(pack_root, MISRA_DEFAULT_SUITE_NAME) - additional_packs = pack_root + pack_name, pack_version = _read_pack_identity(pack_root) + query_target = f"{pack_name}@{pack_version}:{MISRA_DEFAULT_SUITE_NAME}" + common_analyze_flags = f"--search-path={pack_root}" query_arg = f" {query_target}" - common_analyze_flags = f"--additional-packs={additional_packs}" sarif_path = f"{output_base}/{output_prefix}.sarif" csv_path = f"{output_base}/{output_prefix}.csv" From 50059e7cda959229fc36fe8513f1a01dc003f3cd Mon Sep 17 00:00:00 2001 From: Jan Schlosser Date: Fri, 24 Jul 2026 00:06:31 +0200 Subject: [PATCH 5/7] refactor(codeql): stop duplicating the pack pin in config.yaml The MISRA C++ pack version was pinned in two places: the vendored pre-compiled pack (MODULE.bazel -> @codeql_coding_standards_compiled -> qlpack.yml, which codeql_lint.py reads and passes to 'database analyze') and, redundantly, the 'packs:' list in the code-scanning config.yaml passed to 'database init'. These could drift out of sync. Since the analysis selects the pack explicitly from the vendored pack's declared name@version, the config.yaml 'packs:' entry was dead weight (overridden by the explicit query spec at analyze time). Remove it so the pack has a single source of truth; config.yaml now only carries the analysis-wide query-filters. Verified end to end: unchanged 218/218 queries reuse the pre-compiled results, no registry download, SARIF reports CodeQL 2.21.4 and codeql/misra-cpp-coding-standards 2.61.0. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- quality/static_analysis/config.yaml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/quality/static_analysis/config.yaml b/quality/static_analysis/config.yaml index b6d627e72..75166fd6a 100644 --- a/quality/static_analysis/config.yaml +++ b/quality/static_analysis/config.yaml @@ -1,5 +1,9 @@ -packs: - - codeql/misra-cpp-coding-standards@2.61.0 +# CodeQL code-scanning configuration passed to `codeql database init` +# (--codescanning-config). The MISRA C++ pack to run is intentionally NOT listed +# here: it is pinned once by the vendored pre-compiled pack (see MODULE.bazel / +# @codeql_coding_standards_compiled) and passed explicitly to `database analyze` +# by codeql_lint.py, so the pack name and version have a single source of truth. +# This file only carries analysis-wide query filters. query-filters: - exclude: tags: exclude-from-incremental From 819d6c1fcd88db8c848d521273581405a9eeb634 Mon Sep 17 00:00:00 2001 From: Jan Schlosser Date: Fri, 24 Jul 2026 09:56:02 +0200 Subject: [PATCH 6/7] build(codeql): single-source the coding-standards version Address PR review: the query sources/report scripts (@codeql_coding_standards) and the pre-compiled query pack (@codeql_coding_standards_compiled) must come from the same codeql-coding-standards release, but @codeql_coding_standards was a git_repository pinned by commit hash while the pack was pinned by version string, so the two could silently drift and had to be updated in lock-step by hand. Convert @codeql_coding_standards from git_repository (commit) to an http_archive of the release's version tag source tarball, and introduce a single CODING_STANDARDS_VERSION variable that both downloads derive their URL from. A version bump is now a one-line change (plus refreshing the two content sha256s), and the two repositories can no longer reference different versions. Verified end to end: the MISRA patch still applies to the tarball source, and analysis produces the same 218/218 result with reports generated. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- MODULE.bazel | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) diff --git a/MODULE.bazel b/MODULE.bazel index 65a17c451..9b7a46f58 100644 --- a/MODULE.bazel +++ b/MODULE.bazel @@ -433,6 +433,14 @@ bazel_dep(name = "rules_pkg", version = "1.2.0", dev_dependency = True) http_archive = use_repo_rule("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive") +# CodeQL Coding Standards release used for BOTH the query sources / report +# scripts (@codeql_coding_standards) and the pre-compiled query pack +# (@codeql_coding_standards_compiled). These two must always come from the same +# release, so their version is defined once here and both derive their download +# URL from it. +CODING_STANDARDS_VERSION = "2.61.0" + +# The version of this tool needs to be deduced by the mentioned compatible version of the codeql_coding_standards release! http_archive( name = "codeql_bundle", build_file = "//third_party/codeql:codeql.BUILD", @@ -440,15 +448,14 @@ http_archive( url = "https://github.com/github/codeql-action/releases/download/codeql-bundle-v2.21.4/codeql-bundle-linux64.tar.gz", ) -git_repository = use_repo_rule("@bazel_tools//tools/build_defs/repo:git.bzl", "git_repository") - -git_repository( +http_archive( name = "codeql_coding_standards", build_file = "//third_party/codeql:codeql_coding_standards.BUILD", - commit = "06dc6bc32b05152fbe94dbf341a3e854574c9df5", # v2.61.0 patch_args = ["-p1"], patches = ["//third_party/codeql:codeql_coding_standards_misra.patch"], - remote = "https://github.com/github/codeql-coding-standards.git", + sha256 = "a0ab708bfcd06e29b5f1ddaf49470bd5f234aa23de527aa893572a25a6ff7f47", + strip_prefix = "codeql-coding-standards-{version}".format(version = CODING_STANDARDS_VERSION), + urls = ["https://github.com/github/codeql-coding-standards/archive/refs/tags/v{version}.tar.gz".format(version = CODING_STANDARDS_VERSION)], ) # The MISRA C++ analysis runs a pre-compiled query pack published with the @@ -464,7 +471,7 @@ codeql_release_pack( name = "codeql_coding_standards_compiled", pack_tarball = "misra-cpp-coding-standards.tgz", sha256 = "fdddef5a7ca1c66ebdbe6c79c60c7b5b6b274dbc3c9ecbc4bb9a0a13cead20a1", - urls = ["https://github.com/github/codeql-coding-standards/releases/download/v2.61.0/coding-standards-codeql-packs.zip"], + urls = ["https://github.com/github/codeql-coding-standards/releases/download/v{version}/coding-standards-codeql-packs.zip".format(version = CODING_STANDARDS_VERSION)], ) register_toolchains( From 3c9846af9ea3b5741ac5f4d6694ae42465443a8c Mon Sep 17 00:00:00 2001 From: Jan Schlosser Date: Fri, 24 Jul 2026 10:07:38 +0200 Subject: [PATCH 7/7] refactor(codeql): extract compiled-pack runfile path into a constant Address PR review nitpick: the vendored pack's runfile path 'codeql_coding_standards_compiled/pack/qlpack.yml' was duplicated in the Rlocation lookup and in the RuntimeError message, so the two could drift if the path ever changes. Hoist it into a single COMPILED_PACK_RUNFILE constant and reference it from both places. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- quality/static_analysis/codeql_lint.py | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/quality/static_analysis/codeql_lint.py b/quality/static_analysis/codeql_lint.py index 7c313ae12..2f1f23d78 100644 --- a/quality/static_analysis/codeql_lint.py +++ b/quality/static_analysis/codeql_lint.py @@ -27,6 +27,11 @@ # suite selector in the `@:` query specifier. MISRA_DEFAULT_SUITE_NAME = "codeql-suites/misra-cpp-default.qls" +# Runfiles path of the vendored pre-compiled MISRA C++ query pack's manifest, +# used to anchor the pack root. Provided by the @codeql_coding_standards_compiled +# repository (see third_party/codeql/codeql_release_pack.bzl). +COMPILED_PACK_RUNFILE = "codeql_coding_standards_compiled/pack/qlpack.yml" + def _find_coding_standards_root(): """Locate the vendored codeql-coding-standards repo root (the dir containing cpp/). @@ -60,7 +65,7 @@ def _find_compiled_pack_root(): queries and without downloading anything from the registry. This vendored pack is the ONLY supported query source: if it cannot be - located we raise instead of silently falling back to any other pack (e.g. a + located we raise an error instead of silently falling back to any other pack (e.g. a registry download or a runtime-compiled pack), so that the analysis always runs exactly the pinned, hermetic ruleset. @@ -69,12 +74,11 @@ def _find_compiled_pack_root(): from python.runfiles import Runfiles runfiles = Runfiles.Create() - anchor = runfiles.Rlocation( - "codeql_coding_standards_compiled/pack/qlpack.yml") + anchor = runfiles.Rlocation(COMPILED_PACK_RUNFILE) if not anchor or not os.path.exists(anchor): raise RuntimeError( "Vendored pre-compiled MISRA C++ query pack not found (expected " - "runfile 'codeql_coding_standards_compiled/pack/qlpack.yml'). " + f"runfile '{COMPILED_PACK_RUNFILE}'). " "Ensure the @codeql_coding_standards_compiled//:pack dependency is " "in this target's `data`. Refusing to fall back to any other query " "source.")