Skip to content

Commit 7a3ca86

Browse files
security-lab-bot[bot]felickzCopilot
authored
chore: bump pinned CodeQL CLI to v2.27.3 and release v0.8.3 (#238)
* chore: bump pinned CodeQL CLI to v2.27.3 and release v0.8.3 * Add Hotspots query resource diagnostics Co-authored-by: felickz <1760475+felickz@users.noreply.github.com> * Cap Hotspots evaluator disk cache Co-authored-by: felickz <1760475+felickz@users.noreply.github.com> --------- Co-authored-by: felickz <1760475+felickz@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
1 parent da85721 commit 7a3ca86

52 files changed

Lines changed: 390 additions & 320 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.codeqlversion‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
2.27.2
1+
2.27.3

‎.github/workflows/hotspots-ci.yml‎

Lines changed: 65 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -104,10 +104,74 @@ jobs:
104104
run: ./scripts/create-extractor-pack.sh
105105

106106
- name: Generate hotspots queries
107+
env:
108+
HOTSPOTS_DIAGNOSTICS_DIR: ${{ runner.temp }}/hotspots-diagnostics
109+
HOTSPOTS_EVALUATOR_LOG: ${{ runner.temp }}/hotspots-diagnostics/evaluator.json
110+
HOTSPOTS_MAX_DISK_CACHE_MB: "32768"
107111
run: |
112+
set -euo pipefail
113+
mkdir -p "$HOTSPOTS_DIAGNOSTICS_DIR"
114+
resource_log="$HOTSPOTS_DIAGNOSTICS_DIR/resource-usage.log"
115+
{
116+
date --iso-8601=seconds
117+
free -b
118+
df -B1 /tmp "$GITHUB_WORKSPACE"
119+
} > "$resource_log"
120+
108121
python ql/hotspots/scripts/generate-hotspots-queries.py \
109122
--ql-extractor "$GITHUB_WORKSPACE/codeql/ql/extractor-pack" \
110-
--ql-path "$GITHUB_WORKSPACE/codeql"
123+
--ql-path "$GITHUB_WORKSPACE/codeql" &
124+
generator_pid=$!
125+
(
126+
sample=0
127+
while kill -0 "$generator_pid" 2>/dev/null; do
128+
{
129+
date --iso-8601=seconds
130+
free -b
131+
df -B1 /tmp "$GITHUB_WORKSPACE"
132+
ps -eo pid,ppid,rss,vsz,%mem,args --sort=-rss | sed -n '1,16p'
133+
if ((sample % 4 == 0)); then
134+
du -sh /tmp/codeqldb /tmp/codeqldb/db-ql/default/cache 2>/dev/null || true
135+
fi
136+
} >> "$resource_log"
137+
sample=$((sample + 1))
138+
sleep 15
139+
done
140+
) &
141+
monitor_pid=$!
142+
if wait "$generator_pid"; then
143+
generator_status=0
144+
else
145+
generator_status=$?
146+
fi
147+
kill "$monitor_pid" 2>/dev/null || true
148+
wait "$monitor_pid" 2>/dev/null || true
149+
{
150+
date --iso-8601=seconds
151+
free -b
152+
df -B1 /tmp "$GITHUB_WORKSPACE"
153+
du -sh /tmp/codeqldb /tmp/codeqldb/db-ql/default/cache 2>/dev/null || true
154+
} >> "$resource_log"
155+
exit "$generator_status"
156+
157+
- name: Summarize CodeQL evaluator log
158+
if: always()
159+
env:
160+
HOTSPOTS_DIAGNOSTICS_DIR: ${{ runner.temp }}/hotspots-diagnostics
161+
HOTSPOTS_EVALUATOR_LOG: ${{ runner.temp }}/hotspots-diagnostics/evaluator.json
162+
run: |
163+
if [[ -s "$HOTSPOTS_EVALUATOR_LOG" ]]; then
164+
codeql generate log-summary --format=text -- "$HOTSPOTS_EVALUATOR_LOG" \
165+
"$HOTSPOTS_DIAGNOSTICS_DIR/evaluator-summary.txt" || true
166+
fi
167+
168+
- name: Upload query evaluation diagnostics
169+
if: always()
170+
uses: actions/upload-artifact@v7
171+
with:
172+
name: hotspots-query-diagnostics
173+
path: ${{ runner.temp }}/hotspots-diagnostics/
174+
if-no-files-found: warn
111175

112176
- name: Check generated queries
113177
env:

‎.release.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: "CodeQL Community Packs"
22
repository: "githubsecuritylab/codeql-community-packs"
3-
version: "0.8.2"
3+
version: "0.8.3"
44
prerelease: false
55

66
ecosystem: CodeQL

‎cpp/lib/codeql-pack.lock.yml‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -2,29 +2,29 @@
22
lockVersion: 1.0.0
33
dependencies:
44
codeql/controlflow:
5-
version: 2.0.43
5+
version: 2.0.44
66
codeql/cpp-all:
7-
version: 12.2.0
7+
version: 12.3.0
88
codeql/dataflow:
9-
version: 2.1.15
9+
version: 2.1.16
1010
codeql/mad:
11-
version: 1.0.59
11+
version: 1.0.60
1212
codeql/quantum:
13-
version: 0.0.37
13+
version: 0.0.38
1414
codeql/rangeanalysis:
15-
version: 1.0.59
15+
version: 1.0.60
1616
codeql/regex:
17-
version: 1.0.59
17+
version: 1.0.60
1818
codeql/ssa:
19-
version: 2.0.35
19+
version: 2.0.36
2020
codeql/tutorial:
21-
version: 1.0.59
21+
version: 1.0.60
2222
codeql/typeflow:
23-
version: 1.0.59
23+
version: 1.0.60
2424
codeql/typetracking:
25-
version: 2.0.43
25+
version: 2.0.44
2626
codeql/util:
27-
version: 2.0.46
27+
version: 2.0.47
2828
codeql/xml:
29-
version: 1.0.59
29+
version: 1.0.60
3030
compiled: false

‎cpp/lib/qlpack.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
library: true
22
name: githubsecuritylab/codeql-cpp-libs
3-
version: 0.8.2
3+
version: 0.8.3
44
dependencies:
5-
codeql/cpp-all: '12.2.0'
5+
codeql/cpp-all: '12.3.0'

‎cpp/src/codeql-pack.lock.yml‎

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -2,33 +2,33 @@
22
lockVersion: 1.0.0
33
dependencies:
44
codeql/controlflow:
5-
version: 2.0.43
5+
version: 2.0.44
66
codeql/cpp-all:
7-
version: 12.2.0
7+
version: 12.3.0
88
codeql/cpp-queries:
9-
version: 1.9.1
9+
version: 1.9.2
1010
codeql/dataflow:
11-
version: 2.1.15
11+
version: 2.1.16
1212
codeql/mad:
13-
version: 1.0.59
13+
version: 1.0.60
1414
codeql/quantum:
15-
version: 0.0.37
15+
version: 0.0.38
1616
codeql/rangeanalysis:
17-
version: 1.0.59
17+
version: 1.0.60
1818
codeql/regex:
19-
version: 1.0.59
19+
version: 1.0.60
2020
codeql/ssa:
21-
version: 2.0.35
21+
version: 2.0.36
2222
codeql/suite-helpers:
23-
version: 1.0.59
23+
version: 1.0.60
2424
codeql/tutorial:
25-
version: 1.0.59
25+
version: 1.0.60
2626
codeql/typeflow:
27-
version: 1.0.59
27+
version: 1.0.60
2828
codeql/typetracking:
29-
version: 2.0.43
29+
version: 2.0.44
3030
codeql/util:
31-
version: 2.0.46
31+
version: 2.0.47
3232
codeql/xml:
33-
version: 1.0.59
33+
version: 1.0.60
3434
compiled: false

‎cpp/src/qlpack.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
library: false
22
name: githubsecuritylab/codeql-cpp-queries
3-
version: 0.8.2
3+
version: 0.8.3
44
suites: suites
55
defaultSuiteFile: suites/cpp.qls
66
dependencies:
7-
codeql/cpp-all: '12.2.0'
8-
codeql/cpp-queries: '1.9.1'
7+
codeql/cpp-all: '12.3.0'
8+
codeql/cpp-queries: '1.9.2'
99
githubsecuritylab/codeql-cpp-libs: '*'

‎cpp/test/codeql-pack.lock.yml‎

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -2,33 +2,33 @@
22
lockVersion: 1.0.0
33
dependencies:
44
codeql/controlflow:
5-
version: 2.0.43
5+
version: 2.0.44
66
codeql/cpp-all:
7-
version: 12.2.0
7+
version: 12.3.0
88
codeql/cpp-queries:
9-
version: 1.9.1
9+
version: 1.9.2
1010
codeql/dataflow:
11-
version: 2.1.15
11+
version: 2.1.16
1212
codeql/mad:
13-
version: 1.0.59
13+
version: 1.0.60
1414
codeql/quantum:
15-
version: 0.0.37
15+
version: 0.0.38
1616
codeql/rangeanalysis:
17-
version: 1.0.59
17+
version: 1.0.60
1818
codeql/regex:
19-
version: 1.0.59
19+
version: 1.0.60
2020
codeql/ssa:
21-
version: 2.0.35
21+
version: 2.0.36
2222
codeql/suite-helpers:
23-
version: 1.0.59
23+
version: 1.0.60
2424
codeql/tutorial:
25-
version: 1.0.59
25+
version: 1.0.60
2626
codeql/typeflow:
27-
version: 1.0.59
27+
version: 1.0.60
2828
codeql/typetracking:
29-
version: 2.0.43
29+
version: 2.0.44
3030
codeql/util:
31-
version: 2.0.46
31+
version: 2.0.47
3232
codeql/xml:
33-
version: 1.0.59
33+
version: 1.0.60
3434
compiled: false

‎cpp/test/qlpack.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
name: githubsecurtylab/codeql-cpp-tests
22
groups: [cpp, test]
33
dependencies:
4-
codeql/cpp-all: '12.2.0'
5-
codeql/cpp-queries: '1.9.1'
4+
codeql/cpp-all: '12.3.0'
5+
codeql/cpp-queries: '1.9.2'
66
githubsecuritylab/codeql-cpp-queries: '*'
77
githubsecuritylab/codeql-cpp-libs: '*'
88
extractor: cpp

‎csharp/ext-library-sources/qlpack.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
library: true
22
name: githubsecuritylab/codeql-csharp-library-sources
3-
version: 0.8.2
3+
version: 0.8.3
44
# Keep this '*' (unconstrained) - never pin/floor it to a specific
55
# codeql/csharp-all version. Unlike `dependencies:`, an unsatisfied
66
# extensionTargets constraint doesn't fail loudly: it silently drops this

0 commit comments

Comments
 (0)