From f2d958a39287af61566bd20ef3ea7f87b8d8178d Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 30 Oct 2026 19:46:01 +0000 Subject: [PATCH 1/2] Add Actions, Rust, and Swift pack support --- .../build-codeql-lib-versions-table.sh | 21 ++++++++-- .github/scripts/build-publish-summary.sh | 22 +++++++++- .github/scripts/pr-compile.sh | 8 ++-- .github/scripts/pr-suites-packs.sh | 14 +++---- .github/workflows/ci.yml | 18 +++++---- .github/workflows/copilot-setup-steps.yml | 9 +++-- .github/workflows/publish.yml | 4 +- .github/workflows/update-codeql-version.yml | 2 +- CONTRIBUTING.md | 40 +++++++++++-------- actions/src/codeql-pack.lock.yml | 32 +++++++++++++++ actions/src/qlpack.yml | 8 ++++ actions/src/suites/actions.qls | 19 +++++++++ actions/test/codeql-pack.lock.yml | 32 +++++++++++++++ actions/test/qlpack.yml | 8 ++++ configs/README.md | 6 ++- rust/ext/manual/diesel.model.yml | 9 +++++ rust/ext/qlpack.yml | 10 +++++ rust/src/codeql-pack.lock.yml | 30 ++++++++++++++ rust/src/qlpack.yml | 8 ++++ rust/src/suites/rust.qls | 19 +++++++++ rust/test/codeql-pack.lock.yml | 30 ++++++++++++++ rust/test/qlpack.yml | 9 +++++ swift/src/codeql-pack.lock.yml | 24 +++++++++++ swift/src/qlpack.yml | 8 ++++ swift/src/suites/swift.qls | 19 +++++++++ swift/test/codeql-pack.lock.yml | 24 +++++++++++ swift/test/qlpack.yml | 8 ++++ 27 files changed, 393 insertions(+), 48 deletions(-) create mode 100644 actions/src/codeql-pack.lock.yml create mode 100644 actions/src/qlpack.yml create mode 100644 actions/src/suites/actions.qls create mode 100644 actions/test/codeql-pack.lock.yml create mode 100644 actions/test/qlpack.yml create mode 100644 rust/ext/manual/diesel.model.yml create mode 100644 rust/ext/qlpack.yml create mode 100644 rust/src/codeql-pack.lock.yml create mode 100644 rust/src/qlpack.yml create mode 100644 rust/src/suites/rust.qls create mode 100644 rust/test/codeql-pack.lock.yml create mode 100644 rust/test/qlpack.yml create mode 100644 swift/src/codeql-pack.lock.yml create mode 100644 swift/src/qlpack.yml create mode 100644 swift/src/suites/swift.qls create mode 100644 swift/test/codeql-pack.lock.yml create mode 100644 swift/test/qlpack.yml diff --git a/.github/scripts/build-codeql-lib-versions-table.sh b/.github/scripts/build-codeql-lib-versions-table.sh index 8a7e6436..79f8ff41 100755 --- a/.github/scripts/build-codeql-lib-versions-table.sh +++ b/.github/scripts/build-codeql-lib-versions-table.sh @@ -51,11 +51,12 @@ if [ -z "$CODEQL_VERSION" ]; then exit 1 fi -LANGUAGES=(cpp csharp go java javascript python ruby) -PACKTYPES=(src lib) +LANGUAGES=(actions cpp csharp go java javascript python ruby rust swift) +LIB_LANGUAGES=(cpp csharp go java javascript python ruby) lang_label() { case "$1" in + actions) echo "Actions" ;; cpp) echo "C++" ;; csharp) echo "C#" ;; go) echo "Go" ;; @@ -63,6 +64,8 @@ lang_label() { javascript) echo "JavaScript" ;; python) echo "Python" ;; ruby) echo "Ruby" ;; + rust) echo "Rust" ;; + swift) echo "Swift" ;; *) echo "$1" ;; esac } @@ -127,6 +130,14 @@ upstream_version_and_line() { MISMATCH=0 +is_lib_language() { + local lang="$1" + for supported in "${LIB_LANGUAGES[@]}"; do + [ "$supported" == "$lang" ] && return 0 + done + return 1 +} + echo "## CodeQL standard library & query pack versions" echo echo "Pinned CodeQL CLI/library version ([\`.codeqlversion\`](https://github.com/${REPO}/blob/${REPO_SHA}/.codeqlversion)): [\`v${CODEQL_VERSION}\`](https://github.com/github/codeql-cli-binaries/releases/tag/v${CODEQL_VERSION})" @@ -139,7 +150,11 @@ echo "| --- | --- | --- | --- | --- | --- |" for lang in "${LANGUAGES[@]}"; do label=$(lang_label "$lang") - for packtype in "${PACKTYPES[@]}"; do + for packtype in src lib; do + if [ "$packtype" == "lib" ] && ! is_lib_language "$lang"; then + echo "| $label | \`$packtype\` | - | n/a | - | n/a |" + continue + fi qlpackfile="${lang}/${packtype}/qlpack.yml" lockfile="${lang}/${packtype}/codeql-pack.lock.yml" diff --git a/.github/scripts/build-publish-summary.sh b/.github/scripts/build-publish-summary.sh index ed6d909c..596362d9 100755 --- a/.github/scripts/build-publish-summary.sh +++ b/.github/scripts/build-publish-summary.sh @@ -34,10 +34,13 @@ else MERGED=$(jq -s '.' "${FRAGMENTS[@]}") fi -LANGUAGES=(cpp csharp go java javascript python ruby) +LANGUAGES=(actions cpp csharp go java javascript python ruby rust swift) TYPES=(src lib ext ext-library-sources) +# Languages with a published `lib` pack - the remaining languages currently +# have no shared library use cases and should not produce empty placeholder packs. +LIB_LANGUAGES=(cpp csharp go java javascript python ruby) # Languages with an `ext` (model/extension) pack - matches the `extensions` job's matrix. -EXT_LANGUAGES=(csharp go java python) +EXT_LANGUAGES=(csharp go java python rust) # Languages with an `ext-library-sources` pack - matches the `library_sources_extensions` # job's matrix. This is a strict subset of EXT_LANGUAGES: go/python ship `ext` packs but # have no `ext-library-sources` pack, so they must not be expected to have a result for it. @@ -45,6 +48,7 @@ EXT_LIBRARY_SOURCES_LANGUAGES=(csharp java) lang_label() { case "$1" in + actions) echo "Actions" ;; cpp) echo "C++" ;; csharp) echo "C#" ;; go) echo "Go" ;; @@ -52,6 +56,8 @@ lang_label() { javascript) echo "JavaScript" ;; python) echo "Python" ;; ruby) echo "Ruby" ;; + rust) echo "Rust" ;; + swift) echo "Swift" ;; *) echo "$1" ;; esac } @@ -64,6 +70,14 @@ is_ext_language() { return 1 } +is_lib_language() { + local lang="$1" + for l in "${LIB_LANGUAGES[@]}"; do + [ "$l" == "$lang" ] && return 0 + done + return 1 +} + is_ext_library_sources_language() { local lang="$1" for l in "${EXT_LIBRARY_SOURCES_LANGUAGES[@]}"; do @@ -163,6 +177,10 @@ for lang in "${LANGUAGES[@]}"; do row="$row n/a |" continue fi + if [ "$type" == "lib" ] && ! is_lib_language "$lang"; then + row="$row n/a |" + continue + fi if [ "$type" == "ext-library-sources" ] && ! is_ext_library_sources_language "$lang"; then row="$row n/a |" continue diff --git a/.github/scripts/pr-compile.sh b/.github/scripts/pr-compile.sh index d7345414..7d56a61a 100755 --- a/.github/scripts/pr-compile.sh +++ b/.github/scripts/pr-compile.sh @@ -10,12 +10,12 @@ run_lenient_full_compile() { # all of them at once. Failing on that backlog would block CI-infra validation # (workflow_dispatch, or a PR that only touches .github/**) on unrelated debt. echo "[+] Compiling all queries in $LANGUAGE" - codeql query compile --threads=0 --check-only "./$LANGUAGE/" + codeql query compile --additional-packs "$LANGUAGE" --threads=0 --check-only "./$LANGUAGE/" } run_strict_full_compile() { echo "[+] Compiling all queries in $LANGUAGE (strict)" - codeql query compile --threads=0 --check-only --warnings=error "./$LANGUAGE/" + codeql query compile --additional-packs "$LANGUAGE" --threads=0 --check-only --warnings=error "./$LANGUAGE/" } if [[ -z "$PR_NUMBER" ]]; then @@ -74,7 +74,7 @@ if [[ "$WORKFLOW_CHANGED" == true ]]; then continue fi echo "[+] Compiling $file (in $LANGUAGE)" - codeql query compile --threads=0 --check-only --warnings=error "./$file" + codeql query compile --additional-packs "$LANGUAGE" --threads=0 --check-only --warnings=error "./$file" done echo "[+] Complete" exit 0 @@ -92,7 +92,7 @@ for file in "${TOUCHED_QUERIES[@]}"; do continue fi echo "[+] Compiling $file (in $LANGUAGE)" - codeql query compile --threads=0 --check-only --warnings=error "./$file" + codeql query compile --additional-packs "$LANGUAGE" --threads=0 --check-only --warnings=error "./$file" done echo "[+] Complete" \ No newline at end of file diff --git a/.github/scripts/pr-suites-packs.sh b/.github/scripts/pr-suites-packs.sh index 8d109693..63aeecf7 100755 --- a/.github/scripts/pr-suites-packs.sh +++ b/.github/scripts/pr-suites-packs.sh @@ -15,7 +15,7 @@ if [[ -z "$PR_NUMBER" ]]; then if [[ -d "$LANGUAGE/suites" ]]; then while IFS= read -r -d '' suite; do echo "[+] Compiling Suite: $suite" - codeql resolve queries "$suite" + codeql resolve queries --additional-packs "$LANGUAGE" "$suite" done < <(find "$LANGUAGE/suites" -name '*.qls' -print0) fi @@ -30,9 +30,9 @@ if [[ -z "$PR_NUMBER" ]]; then # extension in the pack (a known CodeQL CLI bug, see # https://github.com/github/codeql/issues/20211). See CONTRIBUTING.md. if [[ "$pack_dir" != "$LANGUAGE/ext" && "$pack_dir" != "$LANGUAGE/ext-library-sources" ]]; then - codeql pack install "$pack_dir" + codeql pack install --additional-packs "$LANGUAGE" "$pack_dir" fi - codeql pack create "$pack_dir" + codeql pack create --additional-packs "$LANGUAGE" "$pack_dir" fi done @@ -48,7 +48,7 @@ for file in $(gh pr view "$PR_NUMBER" --json files --jq '.files.[].path'); do # suite folder if [[ "$file" == $LANGUAGE/suites/**.qls ]]; then echo "[+] Compiling Suite: $file" - codeql resolve queries "$file" + codeql resolve queries --additional-packs "$LANGUAGE" "$file" # qlpack file and lock file elif [[ "$file" == $LANGUAGE/qlpack.yml ]] || [[ "$file" == $LANGUAGE/codeql-pack.lock.yml ]]; then @@ -57,9 +57,9 @@ for file in $(gh pr view "$PR_NUMBER" --json files --jq '.files.[].path'); do fi echo "[+] Compiling Pack: $LANGUAGE" # install deps - codeql pack install "$LANGUAGE" + codeql pack install --additional-packs "$LANGUAGE" "$LANGUAGE" # compile / create pack - codeql pack create "$LANGUAGE" + codeql pack create --additional-packs "$LANGUAGE" "$LANGUAGE" # if the version of the pack is changed, comment in the PR PUBLISHED_VERSION=$(gh api /orgs/githubsecuritylab/packages/container/codeql-"$LANGUAGE"-queries/versions --jq '.[0].metadata.container.tags[0]') @@ -75,7 +75,7 @@ for file in $(gh pr view "$PR_NUMBER" --json files --jq '.files.[].path'); do fi fi - # Same for the libs pack + # Same for the libs pack, when this language has one PUBLISHED_VERSION=$(gh api /orgs/githubsecuritylab/packages/container/codeql-"$LANGUAGE"-libs/versions --jq '.[0].metadata.container.tags[0]') CURRENT_VERSION=$(grep version "$LANGUAGE"/lib/qlpack.yml | awk '{print $2}') diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e99dfa3d..3a44fdc0 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -22,7 +22,7 @@ jobs: strategy: fail-fast: false matrix: - language: [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ] + language: [ 'actions', 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby', 'rust', 'swift' ] steps: - uses: actions/checkout@v7 @@ -50,9 +50,13 @@ jobs: CODEQL_CLI_VERSION: ${{ steps.install-codeql.outputs.codeql-cli-version }} run: | gh repo clone github/codeql -- -b codeql-cli-${CODEQL_CLI_VERSION} # to make stubs available for tests - codeql pack install "${{ matrix.language }}/lib" - codeql pack install "${{ matrix.language }}/src" - codeql pack install "${{ matrix.language }}/test" + # Resolve this language's local query/library/extension packs before GHCR so + # tests can use packs that have not been published yet. + if [[ -f "${{ matrix.language }}/lib/qlpack.yml" ]]; then + codeql pack install --additional-packs "$GITHUB_WORKSPACE/${{ matrix.language }}" "${{ matrix.language }}/lib" + fi + codeql pack install --additional-packs "$GITHUB_WORKSPACE/${{ matrix.language }}" "${{ matrix.language }}/src" + codeql pack install --additional-packs "$GITHUB_WORKSPACE/${{ matrix.language }}" "${{ matrix.language }}/test" - name: Compile Queries if: steps.changes.outputs.src == 'true' || github.event_name == 'workflow_dispatch' @@ -168,7 +172,7 @@ jobs: # JVMs start at once, and their /tmp/hsperfdata_/ files can collide # ("Cannot use file ... locked by another process"), corrupting the report. # -XX:-UsePerfData stops the JVM from creating those files at all. - procs.append((subprocess.Popen(["codeql", "test", "run", "-J=-XX:-UsePerfData", "--failing-exitcode=122", "--verbosity=progress", "--ram=2048", "--format=json", *extra_args], stdout=test_report_file, stderr=test_log_file), test_log_path)) + procs.append((subprocess.Popen(["codeql", "test", "run", "--additional-packs", language, "-J=-XX:-UsePerfData", "--failing-exitcode=122", "--verbosity=progress", "--ram=2048", "--format=json", *extra_args], stdout=test_report_file, stderr=test_log_file), test_log_path)) for p, test_log_path in procs: p.wait() @@ -262,7 +266,7 @@ jobs: strategy: fail-fast: false matrix: - language: [ 'csharp', 'go', 'java', 'python' ] + language: [ 'csharp', 'go', 'java', 'python', 'rust' ] steps: - uses: actions/checkout@v7 @@ -355,7 +359,7 @@ jobs: env: GITHUB_TOKEN: ${{ github.token }} run: | - for lang in cpp csharp go java javascript python ruby; do + for lang in actions cpp csharp go java javascript python ruby rust swift; do if [[ -d "${lang}/src" ]]; then codeql pack install "${lang}/src" fi diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml index 6cf70abf..ec511f67 100644 --- a/.github/workflows/copilot-setup-steps.yml +++ b/.github/workflows/copilot-setup-steps.yml @@ -50,17 +50,18 @@ jobs: # hole before running `codeql pack install` and immediately finding/ # fixing the real one-line bug. # - # We install every pack (not just the language the agent will end up + # We install every dependency-bearing pack (not just the language the agent will end up # touching) because we don't know ahead of time which one it'll be # asked to fix - the extra cost is a few seconds per pack, which is # trivial next to the minutes it can save. Same exclude list as # update-codeql-version.yml's `codeql pack upgrade` loop: skip # ql/hotspots (standalone tool, not a real GHCR-resolvable pack), # codeql_home (vendored CLI packs), and codeql/ + */.codeql (the test- - # stubs clone below and CodeQL's own per-pack build caches). - for dir in $(find . -name qlpack.yml -not -path "./ql/hotspots/*" -not -path "./codeql_home/*" -not -path "./codeql/*" -not -path "*/.codeql/*" -exec dirname {} \;); do + # stubs clone below and CodeQL's own per-pack build caches). Model/extension + # packs are also skipped because they must not be installed or have lockfiles. + for dir in $(find . -name qlpack.yml -not -path "./ql/hotspots/*" -not -path "./codeql_home/*" -not -path "./codeql/*" -not -path "*/.codeql/*" -not -path "*/ext/*" -not -path "*/ext-library-sources/*" -exec dirname {} \;); do echo "::group::codeql pack install $dir" - codeql pack install "$dir" + codeql pack install --additional-packs "$(dirname "$dir")" "$dir" echo "::endgroup::" done diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 9078b0ec..6674908e 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -24,7 +24,7 @@ jobs: strategy: fail-fast: false matrix: - language: ["cpp", "csharp", "go", "java", "javascript", "python", "ruby"] + language: ["actions", "cpp", "csharp", "go", "java", "javascript", "python", "ruby", "rust", "swift"] steps: - uses: actions/checkout@v7 @@ -211,7 +211,7 @@ jobs: strategy: fail-fast: false matrix: - language: ["csharp", "go", "java", "python"] + language: ["csharp", "go", "java", "python", "rust"] steps: - uses: actions/checkout@v7 diff --git a/.github/workflows/update-codeql-version.yml b/.github/workflows/update-codeql-version.yml index 2602f94b..12004258 100644 --- a/.github/workflows/update-codeql-version.yml +++ b/.github/workflows/update-codeql-version.yml @@ -130,7 +130,7 @@ jobs: # GitHubSecurityLab/CodeQL-Community-Packs#206. for dir in $(find . -name qlpack.yml -not -path "./ql/hotspots/*" -not -path "./codeql_home/*" -not -path "./codeql/*" -not -path "*/.codeql/*" -not -path "*/ext/*" -not -path "*/ext-library-sources/*" -exec dirname {} \;); do echo "::group::codeql pack upgrade $dir" - codeql pack upgrade "$dir" + codeql pack upgrade --additional-packs "$(dirname "$dir")" "$dir" echo "::endgroup::" done diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index c824483a..b4757cd0 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -6,20 +6,22 @@ There is lots of useful documentation to help you write queries, ranging from in ## Submitting a new query -If you have an idea for a query that you would like to share with other CodeQL users, please open a pull request to add it to this repository. New queries start out in a `/ql/src/` directory, to which they can be merged when they meet the following requirements. +If you have an idea for a query that you would like to share with other CodeQL users, please open a pull request to add it to this repository. New queries start out in a `/src/` directory, to which they can be merged when they meet the following requirements. 1. **Directory structure** - There are eight language-specific query directories in this repository: + Query packs are available for the following CodeQL languages: - * C/C++: `cpp/ql/src` - * C#: `csharp/ql/src` - * Go: `go/ql/src` - * Java/Kotlin: `java/ql/src` - * JavaScript: `javascript/ql/src` - * Python: `python/ql/src` - * Ruby: `ruby/ql/src` - * Swift: `swift/ql/src` + * GitHub Actions: `actions/src` + * C/C++: `cpp/src` + * C#: `csharp/src` + * Go: `go/src` + * Java/Kotlin: `java/src` + * JavaScript/TypeScript: `javascript/src` + * Python: `python/src` + * Ruby: `ruby/src` + * Rust: `rust/src` + * Swift: `swift/src` Each language-specific directory contains further subdirectories that group queries based on their `@tags` or purpose. @@ -71,7 +73,7 @@ instead of, or alongside, a query change. 1. **Pick the right pack: `ext` vs `ext-library-sources`** Every language with data-extension support has a `/ext` pack (`csharp`/`go`/`java`/ - `python`). Two of those languages additionally have a second, narrower pack, + `python`/`rust`). Two of those languages additionally have a second, narrower pack, `/ext-library-sources` (`csharp`/`java` only). They hold different *kinds* of models, and picking the right one matters: @@ -82,7 +84,8 @@ instead of, or alongside, a query change. well-known framework API (e.g. a web framework's `getParameter()`-style methods). This is where our own [Spring R2DBC `DatabaseClient` SQL injection sink models][pr-204] live (`java/ext/manual/org.springframework.r2dbc.model.yml`) — use it as a concrete reference for - both the file layout and the row shape. + both the file layout and the row shape. For example, Rust models for Diesel SQL sinks belong + in `rust/ext/manual/diesel.model.yml`. - **`/ext-library-sources`** (published as `githubsecuritylab/codeql--library-sources`) exists only for `csharp`/`java` and holds a narrower category: `sourceModel` rows (almost always `kind: "remote"`) that flag a @@ -96,7 +99,8 @@ instead of, or alongside, a query change. **Rule of thumb: if you're modeling a dangerous sink, or how taint flows through a library method, use `ext`. Only reach for `ext-library-sources` if you're contributing a genuinely new - remote-data-entry-point (source) model, and only for csharp/java.** + remote-data-entry-point (source) model, and only for csharp/java. Do not add an empty + `ext-library-sources` pack for other languages.** 2. **Row shape** @@ -135,8 +139,9 @@ instead of, or alongside, a query change. Add a test under `/test/security///`: minimal source stubs that reproduce the vulnerable call shape, a `.ql` query that imports the *real* standard query (e.g. `SqlInjectionQuery`/`QueryInjectionFlow`, not a reimplementation of it), and a `.expected` file. - Check that `/test/qlpack.yml` depends on `githubsecuritylab/codeql--extensions` - (and `-library-sources` where applicable) — that dependency is what makes `codeql test run`'s + If the language has an `ext` pack, check that `/test/qlpack.yml` depends on + `githubsecuritylab/codeql--extensions` (and `-library-sources` where applicable) — + that dependency is what makes `codeql test run`'s normal dependency resolution load your data extensions automatically, unlike ad-hoc `codeql database analyze`/`query run`, which need an explicit `--model-packs` flag. Add the dependency if it's missing. Confirm the test actually exercises your model (not just that it compiles) by @@ -308,7 +313,7 @@ process for each; most of it is manual today. [`publish.yml`][publish-workflow] is organized as five jobs: four publish jobs, one per pack type (`queries` for `src`, `library` for `lib`, `extensions` for `ext`, `library_sources_extensions` for `ext-library-sources`), each matrixed over every language that has that pack type -(`ext` runs for `csharp`/`go`/`java`/`python`; `ext-library-sources` only runs for `csharp`/`java`, the only languages with that pack) - plus a fifth +(`src` includes Actions, Rust, and Swift; `lib` is only created where there is shared library code; `ext` runs for `csharp`/`go`/`java`/`python`/`rust`; `ext-library-sources` only runs for `csharp`/`java`, the only languages with that pack) - plus a fifth `summary` job that runs after the other four (`if: always()`, so it still runs even if one of them fails), aggregates their per-pack results into the publish-summary and CodeQL library/query pack version tables, and (on the release-cut `push` trigger only) upserts both tables into the GitHub @@ -344,7 +349,8 @@ merge. Bumping your pack's own `version:` in a regular PR just *stages* the chan To ship a change: - [ ] Make your change in the pack directory you intend to publish: `/src` (queries), - `/lib` (library), `/ext` (extensions, `csharp`/`go`/`java`/`python` only), + `/lib` (shared library code, only where needed), `/ext` (extensions, + `csharp`/`go`/`java`/`python`/`rust`), or `/ext-library-sources` (extensions, `csharp`/`java` only). See [Adding a data extension](#adding-a-data-extension) above if you're not sure which extensions pack to use. - [ ] Bump `version:` in that pack's `qlpack.yml`, following [semver](https://semver.org/). Only bump diff --git a/actions/src/codeql-pack.lock.yml b/actions/src/codeql-pack.lock.yml new file mode 100644 index 00000000..8a9b8340 --- /dev/null +++ b/actions/src/codeql-pack.lock.yml @@ -0,0 +1,32 @@ +--- +lockVersion: 1.0.0 +dependencies: + codeql/actions-all: + version: 0.7.0 + codeql/concepts: + version: 0.0.34 + codeql/controlflow: + version: 2.0.44 + codeql/dataflow: + version: 2.1.16 + codeql/javascript-all: + version: 2.10.4 + codeql/mad: + version: 1.0.60 + codeql/regex: + version: 1.0.60 + codeql/ssa: + version: 2.0.36 + codeql/threat-models: + version: 1.1.0 + codeql/tutorial: + version: 1.0.60 + codeql/typetracking: + version: 2.0.44 + codeql/util: + version: 2.0.47 + codeql/xml: + version: 1.0.60 + codeql/yaml: + version: 1.0.60 +compiled: false diff --git a/actions/src/qlpack.yml b/actions/src/qlpack.yml new file mode 100644 index 00000000..51c15dc5 --- /dev/null +++ b/actions/src/qlpack.yml @@ -0,0 +1,8 @@ +library: false +name: githubsecuritylab/codeql-actions-queries +version: 0.8.3 +suites: suites +defaultSuiteFile: suites/actions.qls +dependencies: + codeql/actions-all: '0.7.0' +extractor: actions diff --git a/actions/src/suites/actions.qls b/actions/src/suites/actions.qls new file mode 100644 index 00000000..6bbe4942 --- /dev/null +++ b/actions/src/suites/actions.qls @@ -0,0 +1,19 @@ +- description: "GitHub Security Lab's Actions query suite" + +- queries: '.' + from: githubsecuritylab/codeql-actions-queries + +- include: + kind: + - problem + - path-problem + precision: + - very-high + - high + - medium + - low + +- exclude: + tags contain: + - debugging + - audit diff --git a/actions/test/codeql-pack.lock.yml b/actions/test/codeql-pack.lock.yml new file mode 100644 index 00000000..8a9b8340 --- /dev/null +++ b/actions/test/codeql-pack.lock.yml @@ -0,0 +1,32 @@ +--- +lockVersion: 1.0.0 +dependencies: + codeql/actions-all: + version: 0.7.0 + codeql/concepts: + version: 0.0.34 + codeql/controlflow: + version: 2.0.44 + codeql/dataflow: + version: 2.1.16 + codeql/javascript-all: + version: 2.10.4 + codeql/mad: + version: 1.0.60 + codeql/regex: + version: 1.0.60 + codeql/ssa: + version: 2.0.36 + codeql/threat-models: + version: 1.1.0 + codeql/tutorial: + version: 1.0.60 + codeql/typetracking: + version: 2.0.44 + codeql/util: + version: 2.0.47 + codeql/xml: + version: 1.0.60 + codeql/yaml: + version: 1.0.60 +compiled: false diff --git a/actions/test/qlpack.yml b/actions/test/qlpack.yml new file mode 100644 index 00000000..a871f392 --- /dev/null +++ b/actions/test/qlpack.yml @@ -0,0 +1,8 @@ +name: githubsecuritylab/codeql-actions-tests +groups: [actions, test] +dependencies: + codeql/actions-all: '0.7.0' + githubsecuritylab/codeql-actions-queries: '*' + +extractor: actions +tests: . diff --git a/configs/README.md b/configs/README.md index 35363851..5c424ca5 100644 --- a/configs/README.md +++ b/configs/README.md @@ -1,5 +1,9 @@ # Community Configurations +The checked-in configurations reference community packs that have already been published to GHCR. +Add new language packs to the relevant configurations after their first release so they do not +point to packages that consumers cannot download yet. + ## [Default / CodeQL](default.yml) The `default.yml` configuration is the default config file used to make it easy to use the CodeQL Community Packs. The queries included here are pulled in from the language `default suites` automatically when referencing the community packs. The default suites as specified in each language's `{LANG}/src/qlpack.yml`. The standard configuration is: @@ -14,7 +18,7 @@ The `audit.yml` configuration is used primarily to conduct a security assessment These are based on the suite in each language suites folder called `{LANG}-audit.qls` > [!NOTE] -> Current Ruby and Swift are not supported +> Ruby, Actions, Rust, and Swift do not currently have audit suites in this configuration. ## [Synthetics](synthetics.yml) diff --git a/rust/ext/manual/diesel.model.yml b/rust/ext/manual/diesel.model.yml new file mode 100644 index 00000000..7fd26f36 --- /dev/null +++ b/rust/ext/manual/diesel.model.yml @@ -0,0 +1,9 @@ +extensions: + - addsTo: + pack: codeql/rust-all + extensible: sinkModel + data: + - ["::batch_execute", "Argument[0]", "sql-injection", "manual"] + - ["::sql", "Argument[0]", "sql-injection", "manual"] + - ["diesel::expression::sql_literal::sql", "Argument[0]", "sql-injection", "manual"] + - ["diesel::query_builder::functions::sql_query", "Argument[0]", "sql-injection", "manual"] diff --git a/rust/ext/qlpack.yml b/rust/ext/qlpack.yml new file mode 100644 index 00000000..b0d4a3b3 --- /dev/null +++ b/rust/ext/qlpack.yml @@ -0,0 +1,10 @@ +library: true +name: githubsecuritylab/codeql-rust-extensions +version: 0.8.3 +extensionTargets: + codeql/rust-all: '*' +dataExtensions: + - 'manual/*.yml' + - 'manual/**/*.yml' + - 'generated/*.yml' + - 'generated/**/*.yml' diff --git a/rust/src/codeql-pack.lock.yml b/rust/src/codeql-pack.lock.yml new file mode 100644 index 00000000..184032a8 --- /dev/null +++ b/rust/src/codeql-pack.lock.yml @@ -0,0 +1,30 @@ +--- +lockVersion: 1.0.0 +dependencies: + codeql/concepts: + version: 0.0.34 + codeql/controlflow: + version: 2.0.44 + codeql/dataflow: + version: 2.1.16 + codeql/mad: + version: 1.0.60 + codeql/namebinding: + version: 0.0.9 + codeql/regex: + version: 1.0.60 + codeql/rust-all: + version: 0.2.24 + codeql/ssa: + version: 2.0.36 + codeql/threat-models: + version: 1.1.0 + codeql/tutorial: + version: 1.0.60 + codeql/typeinference: + version: 0.0.41 + codeql/typetracking: + version: 2.0.44 + codeql/util: + version: 2.0.47 +compiled: false diff --git a/rust/src/qlpack.yml b/rust/src/qlpack.yml new file mode 100644 index 00000000..0053b943 --- /dev/null +++ b/rust/src/qlpack.yml @@ -0,0 +1,8 @@ +library: false +name: githubsecuritylab/codeql-rust-queries +version: 0.8.3 +suites: suites +defaultSuiteFile: suites/rust.qls +dependencies: + codeql/rust-all: '0.2.24' +extractor: rust diff --git a/rust/src/suites/rust.qls b/rust/src/suites/rust.qls new file mode 100644 index 00000000..dfdd12f1 --- /dev/null +++ b/rust/src/suites/rust.qls @@ -0,0 +1,19 @@ +- description: "GitHub Security Lab's Rust query suite" + +- queries: '.' + from: githubsecuritylab/codeql-rust-queries + +- include: + kind: + - problem + - path-problem + precision: + - very-high + - high + - medium + - low + +- exclude: + tags contain: + - debugging + - audit diff --git a/rust/test/codeql-pack.lock.yml b/rust/test/codeql-pack.lock.yml new file mode 100644 index 00000000..184032a8 --- /dev/null +++ b/rust/test/codeql-pack.lock.yml @@ -0,0 +1,30 @@ +--- +lockVersion: 1.0.0 +dependencies: + codeql/concepts: + version: 0.0.34 + codeql/controlflow: + version: 2.0.44 + codeql/dataflow: + version: 2.1.16 + codeql/mad: + version: 1.0.60 + codeql/namebinding: + version: 0.0.9 + codeql/regex: + version: 1.0.60 + codeql/rust-all: + version: 0.2.24 + codeql/ssa: + version: 2.0.36 + codeql/threat-models: + version: 1.1.0 + codeql/tutorial: + version: 1.0.60 + codeql/typeinference: + version: 0.0.41 + codeql/typetracking: + version: 2.0.44 + codeql/util: + version: 2.0.47 +compiled: false diff --git a/rust/test/qlpack.yml b/rust/test/qlpack.yml new file mode 100644 index 00000000..7729ec62 --- /dev/null +++ b/rust/test/qlpack.yml @@ -0,0 +1,9 @@ +name: githubsecuritylab/codeql-rust-tests +groups: [rust, test] +dependencies: + codeql/rust-all: '0.2.24' + githubsecuritylab/codeql-rust-queries: '*' + githubsecuritylab/codeql-rust-extensions: '*' + +extractor: rust +tests: . diff --git a/swift/src/codeql-pack.lock.yml b/swift/src/codeql-pack.lock.yml new file mode 100644 index 00000000..74eb069e --- /dev/null +++ b/swift/src/codeql-pack.lock.yml @@ -0,0 +1,24 @@ +--- +lockVersion: 1.0.0 +dependencies: + codeql/concepts: + version: 0.0.34 + codeql/controlflow: + version: 2.0.44 + codeql/dataflow: + version: 2.1.16 + codeql/mad: + version: 1.0.60 + codeql/regex: + version: 1.0.60 + codeql/ssa: + version: 2.0.36 + codeql/swift-all: + version: 6.8.6 + codeql/tutorial: + version: 1.0.60 + codeql/typetracking: + version: 2.0.44 + codeql/util: + version: 2.0.47 +compiled: false diff --git a/swift/src/qlpack.yml b/swift/src/qlpack.yml new file mode 100644 index 00000000..590d8ebd --- /dev/null +++ b/swift/src/qlpack.yml @@ -0,0 +1,8 @@ +library: false +name: githubsecuritylab/codeql-swift-queries +version: 0.8.3 +suites: suites +defaultSuiteFile: suites/swift.qls +dependencies: + codeql/swift-all: '6.8.6' +extractor: swift diff --git a/swift/src/suites/swift.qls b/swift/src/suites/swift.qls new file mode 100644 index 00000000..f265b4cb --- /dev/null +++ b/swift/src/suites/swift.qls @@ -0,0 +1,19 @@ +- description: "GitHub Security Lab's Swift query suite" + +- queries: '.' + from: githubsecuritylab/codeql-swift-queries + +- include: + kind: + - problem + - path-problem + precision: + - very-high + - high + - medium + - low + +- exclude: + tags contain: + - debugging + - audit diff --git a/swift/test/codeql-pack.lock.yml b/swift/test/codeql-pack.lock.yml new file mode 100644 index 00000000..74eb069e --- /dev/null +++ b/swift/test/codeql-pack.lock.yml @@ -0,0 +1,24 @@ +--- +lockVersion: 1.0.0 +dependencies: + codeql/concepts: + version: 0.0.34 + codeql/controlflow: + version: 2.0.44 + codeql/dataflow: + version: 2.1.16 + codeql/mad: + version: 1.0.60 + codeql/regex: + version: 1.0.60 + codeql/ssa: + version: 2.0.36 + codeql/swift-all: + version: 6.8.6 + codeql/tutorial: + version: 1.0.60 + codeql/typetracking: + version: 2.0.44 + codeql/util: + version: 2.0.47 +compiled: false diff --git a/swift/test/qlpack.yml b/swift/test/qlpack.yml new file mode 100644 index 00000000..b0a287d4 --- /dev/null +++ b/swift/test/qlpack.yml @@ -0,0 +1,8 @@ +name: githubsecuritylab/codeql-swift-tests +groups: [swift, test] +dependencies: + codeql/swift-all: '6.8.6' + githubsecuritylab/codeql-swift-queries: '*' + +extractor: swift +tests: . From ed341882b1f88eea00642ccf90497e0c5a8882a0 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 30 Oct 2026 20:46:23 +0000 Subject: [PATCH 2/2] Include new language packs in workspace Co-authored-by: felickz <1760475+felickz@users.noreply.github.com> --- codeql-workspace.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/codeql-workspace.yml b/codeql-workspace.yml index 96d59cf1..0e8418f8 100644 --- a/codeql-workspace.yml +++ b/codeql-workspace.yml @@ -6,4 +6,6 @@ provide: - javascript/**/qlpack.yml - python/**/qlpack.yml - ruby/**/qlpack.yml - +- actions/**/qlpack.yml +- rust/**/qlpack.yml +- swift/**/qlpack.yml