Skip to content

Commit d231f83

Browse files
geoffw0geoffw0
authored
Merge branch 'main' into rust-cwe-502-unsafe-deserialization
2 parents 1c65c98 + a79e645 commit d231f83

2,352 files changed

Lines changed: 117812 additions & 63267 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.bazelrc‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,9 @@ build --compilation_mode opt
1111
common --override_module=semmle_code=%workspace%/misc/bazel/semmle_code_stub
1212

1313
build --repo_env=CC=clang --repo_env=CXX=clang++
14+
# The standalone Linux toolchain uses gold, which does not support the
15+
# LLD-specific -z nostart-stop-gc workaround enabled by rules_swift.
16+
build:linux --features=-swift.lld_gc_workaround
1417
# Disable Android SDK auto-detection (we don't use it, and rules_android has Bazel 9 compatibility issues)
1518
build --repo_env=ANDROID_HOME=
1619

‎.github/instructions/ql-files.instructions.md‎

Lines changed: 0 additions & 6 deletions
This file was deleted.

‎.github/workflows/check-change-note.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,11 @@
11
name: Check change note
22

33
permissions:
4+
contents: read
45
pull-requests: read
56

67
on:
7-
pull_request_target:
8+
pull_request:
89
types: [labeled, unlabeled, opened, synchronize, reopened, ready_for_review]
910
paths:
1011
- "*/ql/src/**/*.ql"
@@ -23,7 +24,7 @@ jobs:
2324
env:
2425
REPO: ${{ github.repository }}
2526
PULL_REQUEST_NUMBER: ${{ github.event.number }}
26-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
27+
GH_TOKEN: ${{ github.token }}
2728
runs-on: ubuntu-latest
2829
steps:
2930

‎.github/workflows/labeler.yml‎

Lines changed: 136 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,144 @@
11
name: "Pull Request Labeler"
2+
23
on:
3-
- pull_request_target
4+
schedule:
5+
# Reconcile recently updated PRs promptly, including unapproved forks and
6+
# conflicted PRs for which pull_request workflows do not run.
7+
- cron: "7,22,37,52 * * * *"
8+
# Reconcile one stable shard of all open PRs each hour to recover from
9+
# delayed or missed scheduled runs.
10+
- cron: "12 * * * *"
11+
workflow_dispatch:
12+
inputs:
13+
pr_number:
14+
description: "Open pull request number to reconcile"
15+
required: true
16+
type: string
17+
18+
permissions: {}
419

5-
permissions:
6-
contents: read
7-
pull-requests: write
20+
concurrency:
21+
group: pull-request-labeler
22+
cancel-in-progress: false
823

924
jobs:
1025
triage:
26+
if: github.ref_name == github.event.repository.default_branch
1127
runs-on: ubuntu-latest
28+
timeout-minutes: 30
29+
permissions:
30+
contents: read
31+
pull-requests: write
1232
steps:
13-
- uses: actions/labeler@v4
14-
with:
15-
repo-token: "${{ secrets.GITHUB_TOKEN }}"
33+
- uses: actions/checkout@v5
34+
with:
35+
persist-credentials: false
36+
sparse-checkout: .github/labeler.yml
37+
sparse-checkout-cone-mode: false
38+
39+
- name: Collect pull requests to reconcile
40+
id: collect
41+
env:
42+
GH_TOKEN: ${{ github.token }}
43+
REPO: ${{ github.repository }}
44+
EVENT_NAME: ${{ github.event_name }}
45+
SCHEDULE: ${{ github.event.schedule }}
46+
REQUESTED_PR: ${{ inputs.pr_number }}
47+
run: |
48+
set -euo pipefail
49+
50+
if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
51+
if [[ ! "$REQUESTED_PR" =~ ^[1-9][0-9]*$ ]]; then
52+
echo "Invalid pull request number: $REQUESTED_PR"
53+
exit 1
54+
fi
55+
56+
pr_json=$(gh api "repos/$REPO/pulls/$REQUESTED_PR")
57+
candidates=$(jq -c '[{
58+
number: .number,
59+
head_sha: .head.sha
60+
}]' <<<"$pr_json")
61+
else
62+
pulls_json=$(gh api --paginate \
63+
"repos/$REPO/pulls?state=open&sort=updated&direction=desc&per_page=100" |
64+
jq -cs 'add')
65+
66+
if [ "$SCHEDULE" = "12 * * * *" ]; then
67+
shard=$(( ($(date -u +%s) / 3600) % 6 ))
68+
candidates=$(jq -c --argjson shard "$shard" \
69+
'[.[] | select((.number % 6) == $shard) | {
70+
number: .number,
71+
head_sha: .head.sha
72+
}]' <<<"$pulls_json")
73+
else
74+
cutoff=$(date -u -d "1 hour ago" "+%Y-%m-%dT%H:%M:%SZ")
75+
# Hourly shards reconcile any candidates beyond this API budget.
76+
candidates=$(jq -c --arg cutoff "$cutoff" \
77+
'[.[] | select(.updated_at >= $cutoff) | {
78+
number: .number,
79+
head_sha: .head.sha
80+
}][0:100]' <<<"$pulls_json")
81+
fi
82+
fi
83+
84+
echo "Collected $(jq 'length' <<<"$candidates") pull request(s)."
85+
{
86+
echo "candidates<<EOF"
87+
echo "$candidates"
88+
echo "EOF"
89+
} >> "$GITHUB_OUTPUT"
90+
91+
- name: Validate pull request state
92+
id: validate
93+
env:
94+
GH_TOKEN: ${{ github.token }}
95+
REPO: ${{ github.repository }}
96+
CANDIDATES: ${{ steps.collect.outputs.candidates }}
97+
run: |
98+
set -euo pipefail
99+
100+
valid_numbers=()
101+
while IFS=$'\t' read -r pr_number expected_sha; do
102+
if [[ ! "$pr_number" =~ ^[1-9][0-9]*$ ]] ||
103+
[[ ! "$expected_sha" =~ ^[0-9a-f]{40}$ ]]; then
104+
echo "Skipping malformed pull request candidate."
105+
continue
106+
fi
107+
108+
if ! pr_json=$(gh api "repos/$REPO/pulls/$pr_number"); then
109+
echo "Pull request #$pr_number could not be fetched; skipping."
110+
continue
111+
fi
112+
113+
if ! jq -e \
114+
--arg repo "$REPO" \
115+
--arg sha "$expected_sha" \
116+
'.state == "open" and
117+
.base.repo.full_name == $repo and
118+
.head.sha == $sha and
119+
(.head.repo.full_name | type == "string")' \
120+
>/dev/null <<<"$pr_json"; then
121+
echo "Pull request #$pr_number changed or is no longer open; skipping."
122+
continue
123+
fi
124+
125+
valid_numbers+=("$pr_number")
126+
done < <(jq -r '.[] | [.number, .head_sha] | @tsv' <<<"$CANDIDATES")
127+
128+
if [ "${#valid_numbers[@]}" -eq 0 ]; then
129+
echo "has_prs=false" >> "$GITHUB_OUTPUT"
130+
exit 0
131+
fi
132+
133+
{
134+
echo "has_prs=true"
135+
echo "pr_numbers<<EOF"
136+
printf '%s\n' "${valid_numbers[@]}"
137+
echo "EOF"
138+
} >> "$GITHUB_OUTPUT"
139+
140+
- uses: actions/labeler@v4
141+
if: steps.validate.outputs.has_prs == 'true'
142+
with:
143+
repo-token: "${{ github.token }}"
144+
pr-number: ${{ steps.validate.outputs.pr_numbers }}

‎BUILD.bazel‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,3 +3,11 @@ exports_files([
33
"Cargo.lock",
44
"Cargo.toml",
55
])
6+
7+
constraint_setting(name = "swift_runtime_linkage")
8+
9+
constraint_value(
10+
name = "static_swift_runtime",
11+
constraint_setting = ":swift_runtime_linkage",
12+
visibility = ["//visibility:public"],
13+
)

‎CODEOWNERS‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,6 @@
1111
/go/codeql-tools/ @github/codeql-go @github/code-scanning-language-coverage
1212
/go/downgrades/ @github/codeql-go @github/code-scanning-language-coverage
1313
/go/extractor/ @github/codeql-go @github/code-scanning-language-coverage
14-
/go/extractor-smoke-test/ @github/codeql-go @github/code-scanning-language-coverage
1514
/go/ql/test/extractor-tests/ @github/codeql-go @github/code-scanning-language-coverage
1615
/java/ @github/codeql-java
1716
/javascript/ @github/codeql-javascript

0 commit comments

Comments
 (0)