fix(ci): keep JVM warnings out of codeql test JSON reports (stacked on #240)

.codeqlversion

@@ -1 +1 @@
-2.27.2
+2.27.3

.github/workflows/ci.yml

@@ -164,7 +164,11 @@ jobs:
               test_log_file = open(test_log_path, 'w')
               files_to_close.append(test_report_file)
               files_to_close.append(test_log_file)
-              procs.append((subprocess.Popen(["codeql", "test", "run", "--failing-exitcode=122", "--verbosity=progress", "--ram=2048", "--format=json", *extra_args], stdout=test_report_file, stderr=test_log_file), test_log_path))
+              # stdout is the JSON report, but the JVM prints its own warnings there too. Four
+              # JVMs start at once, and their /tmp/hsperfdata_<user>/<pid> files can collide
+              # ("Cannot use file ... locked by another process"), corrupting the report.
+              # -XX:-UsePerfData stops the JVM from creating those files at all.
+              procs.append((subprocess.Popen(["codeql", "test", "run", "-J=-XX:-UsePerfData", "--failing-exitcode=122", "--verbosity=progress", "--ram=2048", "--format=json", *extra_args], stdout=test_report_file, stderr=test_log_file), test_log_path))
 
             for p, test_log_path in procs:
               p.wait()
@@ -222,11 +226,30 @@ jobs:
             exit 0
           fi
 
-          for json_report in "${test_reports[@]}"
+          # The JVM can write warnings to stdout ahead of the JSON report. Drop everything before
+          # the opening bracket (a lone `[`, or `[]` for an empty report) so a stray warning
+          # line can't fail validation, but still fail if the remainder isn't valid JSON.
+          cleaned_dir="$(mktemp -d)"
+          cleaned_reports=()
+          for report in "${test_reports[@]}"
+          do
+            cleaned="$cleaned_dir/${report//\//_}"
+            sed -nE '/^\[\]?[[:space:]]*$/,$p' "$report" > "$cleaned"
+            if ! jq -e . "$cleaned" > /dev/null; then
+              echo "ERROR: $report is not valid JSON"
+              exit 1
+            fi
+            if ! cmp -s "$report" "$cleaned"; then
+              echo "::warning::Ignored non-JSON output before the report in $report"
+            fi
+            cleaned_reports+=("$cleaned")
+          done
+
+          for json_report in "${cleaned_reports[@]}"
           do
             jq --raw-output '"PASS \(map(select(.pass == true)) | length)/\(length)"' "$json_report"
           done
-          FAILING_TESTS=$(jq --slurp --raw-output '.[][] | select(.pass == false)' "${test_reports[@]}")
+          FAILING_TESTS=$(jq --slurp --raw-output '.[][] | select(.pass == false)' "${cleaned_reports[@]}")
           if [[ ! -z "$FAILING_TESTS" ]]; then
             echo "ERROR: The following tests failed:"
             echo $FAILING_TESTS | jq .

.github/workflows/hotspots-ci.yml

@@ -25,7 +25,7 @@ name: "Hotspots Build/Validate"
 
 on:
   pull_request:
-    branches: [main]
+    branches: [main, "chore/update-codeql-cli-*"]
     paths:
       - "ql/hotspots/**"
       - ".github/actions/install-codeql/**"
@@ -104,10 +104,74 @@ jobs:
         run: ./scripts/create-extractor-pack.sh
 
       - name: Generate hotspots queries
+        env:
+          HOTSPOTS_DIAGNOSTICS_DIR: ${{ runner.temp }}/hotspots-diagnostics
+          HOTSPOTS_EVALUATOR_LOG: ${{ runner.temp }}/hotspots-diagnostics/evaluator.json
+          HOTSPOTS_MAX_DISK_CACHE_MB: "32768"
         run: |
+          set -euo pipefail
+          mkdir -p "$HOTSPOTS_DIAGNOSTICS_DIR"
+          resource_log="$HOTSPOTS_DIAGNOSTICS_DIR/resource-usage.log"
+          {
+            date --iso-8601=seconds
+            free -b
+            df -B1 /tmp "$GITHUB_WORKSPACE"
+          } > "$resource_log"
+
           python ql/hotspots/scripts/generate-hotspots-queries.py \
             --ql-extractor "$GITHUB_WORKSPACE/codeql/ql/extractor-pack" \
-            --ql-path "$GITHUB_WORKSPACE/codeql"
+            --ql-path "$GITHUB_WORKSPACE/codeql" &
+          generator_pid=$!
+          (
+            sample=0
+            while kill -0 "$generator_pid" 2>/dev/null; do
+              {
+                date --iso-8601=seconds
+                free -b
+                df -B1 /tmp "$GITHUB_WORKSPACE"
+                ps -eo pid,ppid,rss,vsz,%mem,args --sort=-rss | sed -n '1,16p'
+                if ((sample % 4 == 0)); then
+                  du -sh /tmp/codeqldb /tmp/codeqldb/db-ql/default/cache 2>/dev/null || true
+                fi
+              } >> "$resource_log"
+              sample=$((sample + 1))
+              sleep 15
+            done
+          ) &
+          monitor_pid=$!
+          if wait "$generator_pid"; then
+            generator_status=0
+          else
+            generator_status=$?
+          fi
+          kill "$monitor_pid" 2>/dev/null || true
+          wait "$monitor_pid" 2>/dev/null || true
+          {
+            date --iso-8601=seconds
+            free -b
+            df -B1 /tmp "$GITHUB_WORKSPACE"
+            du -sh /tmp/codeqldb /tmp/codeqldb/db-ql/default/cache 2>/dev/null || true
+          } >> "$resource_log"
+          exit "$generator_status"
+
+      - name: Summarize CodeQL evaluator log
+        if: always()
+        env:
+          HOTSPOTS_DIAGNOSTICS_DIR: ${{ runner.temp }}/hotspots-diagnostics
+          HOTSPOTS_EVALUATOR_LOG: ${{ runner.temp }}/hotspots-diagnostics/evaluator.json
+        run: |
+          if [[ -s "$HOTSPOTS_EVALUATOR_LOG" ]]; then
+            codeql generate log-summary --format=text -- "$HOTSPOTS_EVALUATOR_LOG" \
+              "$HOTSPOTS_DIAGNOSTICS_DIR/evaluator-summary.txt" || true
+          fi
+
+      - name: Upload query evaluation diagnostics
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: hotspots-query-diagnostics
+          path: ${{ runner.temp }}/hotspots-diagnostics/
+          if-no-files-found: warn
 
       - name: Check generated queries
         env:

.release.yml

@@ -1,6 +1,6 @@
 name: "CodeQL Community Packs"
 repository: "githubsecuritylab/codeql-community-packs"
-version: "0.8.2"
+version: "0.8.3"
 prerelease: false
 
 ecosystem: CodeQL

cpp/lib/codeql-pack.lock.yml

@@ -2,29 +2,29 @@
 lockVersion: 1.0.0
 dependencies:
   codeql/controlflow:
-    version: 2.0.43
+    version: 2.0.44
   codeql/cpp-all:
-    version: 12.2.0
+    version: 12.3.0
   codeql/dataflow:
-    version: 2.1.15
+    version: 2.1.16
   codeql/mad:
-    version: 1.0.59
+    version: 1.0.60
   codeql/quantum:
-    version: 0.0.37
+    version: 0.0.38
   codeql/rangeanalysis:
-    version: 1.0.59
+    version: 1.0.60
   codeql/regex:
-    version: 1.0.59
+    version: 1.0.60
   codeql/ssa:
-    version: 2.0.35
+    version: 2.0.36
   codeql/tutorial:
-    version: 1.0.59
+    version: 1.0.60
   codeql/typeflow:
-    version: 1.0.59
+    version: 1.0.60
   codeql/typetracking:
-    version: 2.0.43
+    version: 2.0.44
   codeql/util:
-    version: 2.0.46
+    version: 2.0.47
   codeql/xml:
-    version: 1.0.59
+    version: 1.0.60
 compiled: false

cpp/lib/qlpack.yml

@@ -1,5 +1,5 @@
 library: true 
 name: githubsecuritylab/codeql-cpp-libs
-version: 0.8.2
+version: 0.8.3
 dependencies:
-  codeql/cpp-all: '12.2.0'
+  codeql/cpp-all: '12.3.0'

cpp/src/codeql-pack.lock.yml

@@ -2,33 +2,33 @@
 lockVersion: 1.0.0
 dependencies:
   codeql/controlflow:
-    version: 2.0.43
+    version: 2.0.44
   codeql/cpp-all:
-    version: 12.2.0
+    version: 12.3.0
   codeql/cpp-queries:
-    version: 1.9.1
+    version: 1.9.2
   codeql/dataflow:
-    version: 2.1.15
+    version: 2.1.16
   codeql/mad:
-    version: 1.0.59
+    version: 1.0.60
   codeql/quantum:
-    version: 0.0.37
+    version: 0.0.38
   codeql/rangeanalysis:
-    version: 1.0.59
+    version: 1.0.60
   codeql/regex:
-    version: 1.0.59
+    version: 1.0.60
   codeql/ssa:
-    version: 2.0.35
+    version: 2.0.36
   codeql/suite-helpers:
-    version: 1.0.59
+    version: 1.0.60
   codeql/tutorial:
-    version: 1.0.59
+    version: 1.0.60
   codeql/typeflow:
-    version: 1.0.59
+    version: 1.0.60
   codeql/typetracking:
-    version: 2.0.43
+    version: 2.0.44
   codeql/util:
-    version: 2.0.46
+    version: 2.0.47
   codeql/xml:
-    version: 1.0.59
+    version: 1.0.60
 compiled: false

cpp/src/qlpack.yml

@@ -1,9 +1,9 @@
 library: false
 name: githubsecuritylab/codeql-cpp-queries
-version: 0.8.2
+version: 0.8.3
 suites: suites
 defaultSuiteFile: suites/cpp.qls
 dependencies:
-  codeql/cpp-all: '12.2.0'
-  codeql/cpp-queries: '1.9.1'
+  codeql/cpp-all: '12.3.0'
+  codeql/cpp-queries: '1.9.2'
   githubsecuritylab/codeql-cpp-libs: '*'

cpp/test/codeql-pack.lock.yml

@@ -2,33 +2,33 @@
 lockVersion: 1.0.0
 dependencies:
   codeql/controlflow:
-    version: 2.0.43
+    version: 2.0.44
   codeql/cpp-all:
-    version: 12.2.0
+    version: 12.3.0
   codeql/cpp-queries:
-    version: 1.9.1
+    version: 1.9.2
   codeql/dataflow:
-    version: 2.1.15
+    version: 2.1.16
   codeql/mad:
-    version: 1.0.59
+    version: 1.0.60
   codeql/quantum:
-    version: 0.0.37
+    version: 0.0.38
   codeql/rangeanalysis:
-    version: 1.0.59
+    version: 1.0.60
   codeql/regex:
-    version: 1.0.59
+    version: 1.0.60
   codeql/ssa:
-    version: 2.0.35
+    version: 2.0.36
   codeql/suite-helpers:
-    version: 1.0.59
+    version: 1.0.60
   codeql/tutorial:
-    version: 1.0.59
+    version: 1.0.60
   codeql/typeflow:
-    version: 1.0.59
+    version: 1.0.60
   codeql/typetracking:
-    version: 2.0.43
+    version: 2.0.44
   codeql/util:
-    version: 2.0.46
+    version: 2.0.47
   codeql/xml:
-    version: 1.0.59
+    version: 1.0.60
 compiled: false

cpp/test/qlpack.yml

@@ -1,8 +1,8 @@
 name: githubsecurtylab/codeql-cpp-tests
 groups: [cpp, test]
 dependencies:
-    codeql/cpp-all: '12.2.0'
-    codeql/cpp-queries: '1.9.1'
+    codeql/cpp-all: '12.3.0'
+    codeql/cpp-queries: '1.9.2'
     githubsecuritylab/codeql-cpp-queries: '*'
     githubsecuritylab/codeql-cpp-libs: '*'
 extractor: cpp

csharp/ext-library-sources/qlpack.yml

@@ -1,6 +1,6 @@
 library: true
 name: githubsecuritylab/codeql-csharp-library-sources
-version: 0.8.2
+version: 0.8.3
 # Keep this '*' (unconstrained) - never pin/floor it to a specific
 # codeql/csharp-all version. Unlike `dependencies:`, an unsatisfied
 # extensionTargets constraint doesn't fail loudly: it silently drops this

csharp/ext/qlpack.yml

@@ -1,6 +1,6 @@
 library: true
 name: githubsecuritylab/codeql-csharp-extensions
-version: 0.8.2
+version: 0.8.3
 # Keep this '*' (unconstrained) - never pin/floor it to a specific
 # codeql/csharp-all version. Unlike `dependencies:`, an unsatisfied
 # extensionTargets constraint doesn't fail loudly: it silently drops this

csharp/lib/codeql-pack.lock.yml

@@ -2,25 +2,25 @@
 lockVersion: 1.0.0
 dependencies:
   codeql/controlflow:
-    version: 2.0.43
+    version: 2.0.44
   codeql/csharp-all:
-    version: 7.4.0
+    version: 7.4.1
   codeql/dataflow:
-    version: 2.1.15
+    version: 2.1.16
   codeql/mad:
-    version: 1.0.59
+    version: 1.0.60
   codeql/rangeanalysis:
-    version: 1.0.59
+    version: 1.0.60
   codeql/ssa:
-    version: 2.0.35
+    version: 2.0.36
   codeql/threat-models:
-    version: 1.0.59
+    version: 1.1.0
   codeql/tutorial:
-    version: 1.0.59
+    version: 1.0.60
   codeql/typetracking:
-    version: 2.0.43
+    version: 2.0.44
   codeql/util:
-    version: 2.0.46
+    version: 2.0.47
   codeql/xml:
-    version: 1.0.59
+    version: 1.0.60
 compiled: false

csharp/lib/qlpack.yml

@@ -1,5 +1,5 @@
 library: true 
 name: githubsecuritylab/codeql-csharp-libs
-version: 0.8.2
+version: 0.8.3
 dependencies:
-  codeql/csharp-all: "7.4.0"
+  codeql/csharp-all: "7.4.1"