CodeQL: Have better pack selection (use really the vendored one)

MODULE.bazel

@@ -433,20 +433,45 @@ bazel_dep(name = "rules_pkg", version = "1.2.0", dev_dependency = True)
 
 http_archive = use_repo_rule("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 
+# CodeQL Coding Standards release used for BOTH the query sources / report
+# scripts (@codeql_coding_standards) and the pre-compiled query pack
+# (@codeql_coding_standards_compiled). These two must always come from the same
+# release, so their version is defined once here and both derive their download
+# URL from it.
+CODING_STANDARDS_VERSION = "2.61.0"
+
+# The version of this tool needs to be deduced by the mentioned compatible version of the codeql_coding_standards release!
 http_archive(
     name = "codeql_bundle",
     build_file = "//third_party/codeql:codeql.BUILD",
-    sha256 = "0144d4bc415aee0d5638119dfb626a2d8689e2ff21758ba211a3984862b8522c",
-    url = "https://github.com/github/codeql-action/releases/download/codeql-bundle-v2.26.0/codeql-bundle-linux64.tar.gz",
+    sha256 = "a94f674bb3c23ea5e9a2ad06b64847dd0277b15014d2517ecd9c41c88e6caa65",
+    url = "https://github.com/github/codeql-action/releases/download/codeql-bundle-v2.21.4/codeql-bundle-linux64.tar.gz",
 )
 
-git_repository = use_repo_rule("@bazel_tools//tools/build_defs/repo:git.bzl", "git_repository")
-
-git_repository(
+http_archive(
     name = "codeql_coding_standards",
     build_file = "//third_party/codeql:codeql_coding_standards.BUILD",
-    commit = "06dc6bc32b05152fbe94dbf341a3e854574c9df5",  # v2.61.0
-    remote = "https://github.com/github/codeql-coding-standards.git",
+    patch_args = ["-p1"],
+    patches = ["//third_party/codeql:codeql_coding_standards_misra.patch"],
+    sha256 = "a0ab708bfcd06e29b5f1ddaf49470bd5f234aa23de527aa893572a25a6ff7f47",
+    strip_prefix = "codeql-coding-standards-{version}".format(version = CODING_STANDARDS_VERSION),
+    urls = ["https://github.com/github/codeql-coding-standards/archive/refs/tags/v{version}.tar.gz".format(version = CODING_STANDARDS_VERSION)],
+)
+
+# The MISRA C++ analysis runs a pre-compiled query pack published with the
+# codeql-coding-standards release (see codeql_release_pack.bzl). This avoids
+# compiling the queries locally while keeping the analysis hermetic (pinned by
+# sha256) and aligned with the pinned coding_standards version above.
+codeql_release_pack = use_repo_rule(
+    "//third_party/codeql:codeql_release_pack.bzl",
+    "codeql_release_pack",
+)
+
+codeql_release_pack(
+    name = "codeql_coding_standards_compiled",
+    pack_tarball = "misra-cpp-coding-standards.tgz",
+    sha256 = "fdddef5a7ca1c66ebdbe6c79c60c7b5b6b274dbc3c9ecbc4bb9a0a13cead20a1",
+    urls = ["https://github.com/github/codeql-coding-standards/releases/download/v{version}/coding-standards-codeql-packs.zip".format(version = CODING_STANDARDS_VERSION)],
 )
 
 register_toolchains(

quality/static_analysis/BUILD

@@ -23,6 +23,7 @@ py_binary(
         "@codeql_bundle//:codeql_cli",
         "@codeql_coding_standards//:analysis_report",
         "@codeql_coding_standards//:process_coding_standards_config",
+        "@codeql_coding_standards_compiled//:pack",
     ],
     main = "codeql_lint.py",
     tags = ["local"],

quality/static_analysis/codeql_lint.py

@@ -22,28 +22,101 @@
 TMP_PATH_FOR_DATABASES = "/var/tmp/codeql_databases"
 
 
-def _find_pack_root():
-    """Locate the MISRA C++ query pack root (cpp/common/src) via Bazel runfiles.
-
-    The codeql_coding_standards repo's cpp/** sources are already declared as a
-    `data` dependency of @codeql_coding_standards//:analysis_report, which is in
-    turn a `data` dependency of this py_binary. That means Bazel places them in
-    our own runfiles tree, so we can resolve the pack root the same way
-    everywhere (locally and in CI) without any manual filesystem searching.
+# Default query suite (relative to the MISRA C++ pack root) run by the analysis.
+# Forward-slash relative path, used both to locate the suite on disk and as the
+# suite selector in the `<pack>@<version>:<suite>` query specifier.
+MISRA_DEFAULT_SUITE_NAME = "codeql-suites/misra-cpp-default.qls"
+
+# Runfiles path of the vendored pre-compiled MISRA C++ query pack's manifest,
+# used to anchor the pack root. Provided by the @codeql_coding_standards_compiled
+# repository (see third_party/codeql/codeql_release_pack.bzl).
+COMPILED_PACK_RUNFILE = "codeql_coding_standards_compiled/pack/qlpack.yml"
+
+
+def _find_coding_standards_root():
+    """Locate the vendored codeql-coding-standards repo root (the dir containing cpp/).
+
+    The codeql_coding_standards repo's cpp/** sources are declared as a `data`
+    dependency of @codeql_coding_standards//:analysis_report, which is in turn a
+    `data` dependency of this py_binary, so Bazel places them in our runfiles
+    tree. Only used for the `--query-spec` override, which analyzes a query from
+    these sources rather than the pre-compiled release pack.
     """
     from python.runfiles import Runfiles
 
     runfiles = Runfiles.Create()
     anchor = runfiles.Rlocation("codeql_coding_standards/cpp/common/src/qlpack.yml")
     if not anchor or not os.path.exists(anchor):
-        raise RuntimeError("Unable to locate CodeQL pack root (cpp/common/src)")
-    return os.path.dirname(anchor)
+        raise RuntimeError("Unable to locate CodeQL coding standards repo root")
+    # anchor = <repo_root>/cpp/common/src/qlpack.yml -> go up four levels.
+    return os.path.dirname(os.path.dirname(os.path.dirname(os.path.dirname(anchor))))
+
+
+def _find_compiled_pack_root():
+    """Locate the pre-compiled MISRA C++ query pack root from runfiles.
+
+    The pack is vendored by the @codeql_coding_standards_compiled repository
+    (see third_party/codeql/codeql_release_pack.bzl): a pre-compiled pack
+    published with the codeql-coding-standards release, containing the compiled
+    queries (`.qlx`), the default suites and all library dependencies bundled
+    under `.codeql/libraries/`. Analyzing against this pack (referenced by its
+    `<name>@<version>:<suite>` specifier and made discoverable via
+    --search-path) runs exactly the pinned ruleset without recompiling the
+    queries and without downloading anything from the registry.
 
+    This vendored pack is the ONLY supported query source: if it cannot be
+    located we raise an error instead of silently falling back to any other pack (e.g. a
+    registry download or a runtime-compiled pack), so that the analysis always
+    runs exactly the pinned, hermetic ruleset.
 
-def _install_query_pack(code_ql_path):
-    """Resolve the MISRA C++ query pack's own dependencies (like `npm install`)."""
-    pack_root = _find_pack_root()
-    subprocess.run(f"{code_ql_path} pack install {pack_root}", shell=True, check=True)
+    Returns the pack root directory (the one containing qlpack.yml).
+    """
+    from python.runfiles import Runfiles
+
+    runfiles = Runfiles.Create()
+    anchor = runfiles.Rlocation(COMPILED_PACK_RUNFILE)
+    if not anchor or not os.path.exists(anchor):
+        raise RuntimeError(
+            "Vendored pre-compiled MISRA C++ query pack not found (expected "
+            f"runfile '{COMPILED_PACK_RUNFILE}'). "
+            "Ensure the @codeql_coding_standards_compiled//:pack dependency is "
+            "in this target's `data`. Refusing to fall back to any other query "
+            "source.")
+    # anchor = <pack_root>/qlpack.yml
+    pack_root = os.path.dirname(anchor)
+
+    suite_path = os.path.join(pack_root, MISRA_DEFAULT_SUITE_NAME)
+    if not os.path.exists(suite_path):
+        raise RuntimeError(
+            "Vendored pre-compiled MISRA C++ query pack is incomplete: default "
+            f"suite '{suite_path}' is missing. Refusing to fall back to any "
+            "other query source.")
+    return pack_root
+
+
+def _read_pack_identity(pack_root):
+    """Return the (name, version) declared in the pack's qlpack.yml.
+
+    The codeql-coding-standards user manual recommends referencing a downloaded
+    release pack by its `<name>@<version>:<suite>` specifier (with the pack made
+    discoverable via --search-path) rather than by a bare suite path. Reading the
+    declared identity here lets CodeQL validate the pack's name and version, so
+    an accidental pack/version drift fails loudly instead of silently analyzing
+    whatever suite happens to live at a path.
+    """
+    name = None
+    version = None
+    with open(os.path.join(pack_root, "qlpack.yml")) as handle:
+        for line in handle:
+            stripped = line.strip()
+            if name is None and stripped.startswith("name:"):
+                name = stripped.split(":", 1)[1].strip().strip("'\"")
+            elif version is None and stripped.startswith("version:"):
+                version = stripped.split(":", 1)[1].strip().strip("'\"")
+    if not name or not version:
+        raise RuntimeError(
+            f"Could not read pack name/version from {pack_root}/qlpack.yml")
+    return name, version
 
 
 def create_database(code_ql_path, config_path, target, source_root, database_path):
@@ -86,20 +159,42 @@ def analyze_database(
     output_base = output_dir or _get_bazel_info(source_root).get('output_path')
     os.makedirs(output_base, exist_ok=True)
 
-    query_arg = f" {query_spec}" if query_spec else ""
+    # Analyze against the pre-compiled MISRA C++ query pack published with the
+    # codeql-coding-standards release and vendored by the
+    # @codeql_coding_standards_compiled repository (see _find_compiled_pack_root).
+    # Following the codeql-coding-standards user manual's recommended approach for
+    # released pack artifacts, the pack is referenced by its
+    # `<name>@<version>:<suite>` specifier and made discoverable via
+    # --search-path. The pack already contains the compiled queries and all their
+    # library dependencies, so this runs exactly the pinned ruleset without
+    # recompiling the queries and without downloading anything from the registry.
+    #
+    # --query-spec overrides this to analyze a single query straight from the
+    # vendored coding-standards sources (used for debugging individual rules).
+    if query_spec:
+        query_target = query_spec
+        common_analyze_flags = f"--additional-packs={_find_coding_standards_root()}"
+    else:
+        pack_root = _find_compiled_pack_root()
+        pack_name, pack_version = _read_pack_identity(pack_root)
+        query_target = f"{pack_name}@{pack_version}:{MISRA_DEFAULT_SUITE_NAME}"
+        common_analyze_flags = f"--search-path={pack_root}"
+    query_arg = f" {query_target}"
     sarif_path = f"{output_base}/{output_prefix}.sarif"
     csv_path = f"{output_base}/{output_prefix}.csv"
 
     # Run CodeQL analysis (generates SARIF)
     print("\n Running CodeQL analysis...")
     subprocess.run(
         f"{code_ql_path} database analyze -j=0 {database_path}{query_arg} "
+        f"{common_analyze_flags} "
         f"--format=sarifv2.1.0 --output={sarif_path}",
         shell=True, check=True)
 
     # Generate CSV results
     subprocess.run(
         f"{code_ql_path} database analyze -j=0 {database_path}{query_arg} "
+        f"{common_analyze_flags} "
         f"--format=csv --output={csv_path}",
         shell=True, check=True)
 
@@ -166,9 +261,6 @@ def main():
     # Make codeql_path absolute
     codeql_path = os.path.abspath(args.codeql_path) if args.codeql_path else None
 
-    if codeql_path:
-        _install_query_pack(codeql_path)
-
     if args.phase == "create-database":
         os.makedirs(os.path.dirname(args.database_path), exist_ok=True)
         create_database(codeql_path, args.config_path, target, source_root, args.database_path)

quality/static_analysis/config.yaml

@@ -1,5 +1,9 @@
-packs:
-  - codeql/misra-cpp-coding-standards@2.61.0
+# CodeQL code-scanning configuration passed to `codeql database init`
+# (--codescanning-config). The MISRA C++ pack to run is intentionally NOT listed
+# here: it is pinned once by the vendored pre-compiled pack (see MODULE.bazel /
+# @codeql_coding_standards_compiled) and passed explicitly to `database analyze`
+# by codeql_lint.py, so the pack name and version have a single source of truth.
+# This file only carries analysis-wide query filters.
 query-filters:
   - exclude:
       tags: exclude-from-incremental

third_party/codeql/codeql_coding_standards_misra.patch

@@ -0,0 +1,16 @@
+diff --git a/scripts/reports/utils.py b/scripts/reports/utils.py
+index 5751139..6fbf353 100644
+--- a/scripts/reports/utils.py
++++ b/scripts/reports/utils.py
+@@ -183,7 +183,10 @@ def generate_guideline_compliance_summary(output_directory, results_summary):
+                 print(
+                     "**Result**: " + ("Not compliant" if total_guidelines_violated > 0 else "Compliant"))
+                 standard_pretty_name = {
+-                    "cert": "CERT C++ 2016", "autosar": "AUTOSAR C++  R22-11, R21-11, R20-11, R19-11 and R19-03"}
++                    "cert": "CERT C++ 2016",
++                    "autosar": "AUTOSAR C++  R22-11, R21-11, R20-11, R19-11 and R19-03",
++                    "misra": "MISRA C++:2023",
++                }
+                 print("**Coding Standards applied**: " + ", ".join([standard_pretty_name[standard_short_name]
+                       for standard_short_name in results_summary.guideline_violation_count.keys()]))
+

third_party/codeql/codeql_release_pack.bzl

@@ -0,0 +1,73 @@
+# *******************************************************************************
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+"""Repository rule that vendors a pre-compiled CodeQL coding-standards pack.
+
+The github/codeql-coding-standards project publishes, for every release, a
+`coding-standards-codeql-packs.zip` asset that bundles each standard's query
+pack **already compiled** (`.qlx` files plus all library dependencies vendored
+under `.codeql/libraries/`). Using these avoids compiling the queries ourselves
+(which is slow and, via `codeql pack create`, does not work inside Bazel's
+sandbox), while still keeping the analysis hermetic and pinned: the download is
+content-addressed by sha256 and the pack is fetched from the same release we pin
+elsewhere.
+
+The zip contains one `<standard>-coding-standards.tgz` per standard; this rule
+extracts the requested one and exposes its contents as a `pack` filegroup whose
+root is the pack directory (containing `qlpack.yml`, `codeql-suites/`, `rules/`
+and `.codeql/libraries/`).
+"""
+
+def _codeql_release_pack_impl(repository_ctx):
+    repository_ctx.download(
+        url = repository_ctx.attr.urls,
+        output = "packs.zip",
+        sha256 = repository_ctx.attr.sha256,
+    )
+
+    # The outer zip contains per-standard tarballs; extract only the one we need
+    # into the `pack/` subdirectory, which becomes the pack root.
+    repository_ctx.extract(archive = "packs.zip", output = "_packs")
+    repository_ctx.extract(
+        archive = "_packs/" + repository_ctx.attr.pack_tarball,
+        output = "pack",
+    )
+    repository_ctx.delete("packs.zip")
+    repository_ctx.delete("_packs")
+
+    repository_ctx.file(
+        "BUILD.bazel",
+        "filegroup(\n" +
+        "    name = \"pack\",\n" +
+        "    srcs = glob([\"pack/**\"], allow_empty = False),\n" +
+        "    visibility = [\"//visibility:public\"],\n" +
+        ")\n",
+    )
+
+codeql_release_pack = repository_rule(
+    implementation = _codeql_release_pack_impl,
+    doc = "Downloads and unpacks a pre-compiled coding-standards CodeQL pack.",
+    attrs = {
+        "urls": attr.string_list(
+            mandatory = True,
+            doc = "URL(s) of the coding-standards-codeql-packs.zip release asset.",
+        ),
+        "sha256": attr.string(
+            mandatory = True,
+            doc = "Expected sha256 of the downloaded zip.",
+        ),
+        "pack_tarball": attr.string(
+            mandatory = True,
+            doc = "Name of the per-standard .tgz inside the zip to extract.",
+        ),
+    },
+)