fix(hotspots): avoid cartesian product in getImportStringFrom (stacked on #238) (#240)

* chore: bump pinned CodeQL CLI to v2.27.3 and release v0.8.3

* Add Hotspots query resource diagnostics

Co-authored-by: felickz <1760475+felickz@users.noreply.github.com>

* Cap Hotspots evaluator disk cache

Co-authored-by: felickz <1760475+felickz@users.noreply.github.com>

* fix(hotspots): avoid cartesian product when resolving config import strings

getImportStringFrom compared the config file's dotted path against
Import.getImportString() with matches("%" + importString). That non-equality
string join gives the optimizer nothing to bind on, and with CodeQL 2.27.3
(github/codeql codeql-cli/v2.27.3) it planned a cartesian product of ~33k
import tuples with the 15M-row locations_default relation, filling the runner
disk.

Materialize the config's dotted-path suffixes in a pragma[nomagic] helper and
join on string equality instead.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* ci(hotspots): TEMPORARY run Hotspots CI on PRs stacked on CLI bump branches

hotspots-ci.yml only triggers for PRs targeting main, so a PR stacked on
chore/update-codeql-cli-* would get no hotspots signal. Drop this commit before
merging the fix into the bump branch.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: 3 people

.github/workflows/hotspots-ci.yml

@@ -25,7 +25,7 @@ name: "Hotspots Build/Validate"
 
 on:
   pull_request:
-    branches: [main]
+    branches: [main, "chore/update-codeql-cli-*"]
     paths:
       - "ql/hotspots/**"
       - ".github/actions/install-codeql/**"

ql/hotspots/utils/hotspots.qll

@@ -23,6 +23,10 @@ private string getAbsoluteImportString(Import i) {
   result = getFileImport(i.getResolvedModule().getFile()).suffix(1)
 }
 
+/** Gets a non-empty suffix of `s`, including `s` itself. */
+bindingset[s]
+private string getASuffix(string s) { result = s.suffix(any(int n | n in [0 .. s.length() - 1])) }
+
 /**
  * A Taint tracking configuration. Either a Class or a Module.
  */
@@ -83,6 +87,25 @@ abstract class TaintTrackingConfiguration extends ModuleDeclaration {
         else result = "unknown"
   }
 
+  /**
+   * Gets a suffix of the dotted module path of the file this configuration is in.
+   *
+   * This is materialized on its own, and compared with `Import.getImportString()` by equality
+   * rather than with `matches("%" + importString)`: a non-equality string join gives the
+   * optimizer nothing to bind on, and it has been observed to pick a cartesian product with
+   * `locations_default` (billions of tuples) instead of joining on this small relation first.
+   */
+  pragma[nomagic]
+  private string getADottedPathSuffix() {
+    result =
+      getASuffix(this.getLocation()
+            .getFile()
+            .getRelativePath()
+            .splitAt(".", 0)
+            .replaceAll("/", ".")
+            .suffix(1))
+  }
+
   /**
    * Returns the import string necessary to import this configuration.
    */
@@ -94,13 +117,7 @@ abstract class TaintTrackingConfiguration extends ModuleDeclaration {
         else
           exists(Import i |
             i = tl.getAnImport() and
-            this.getLocation()
-                .getFile()
-                .getRelativePath()
-                .splitAt(".", 0)
-                .replaceAll("/", ".")
-                .suffix(1)
-                .matches("%" + i.getImportString()) and
+            i.getImportString() = this.getADottedPathSuffix() and
             result = getAbsoluteImportString(i)
           )
       )