Skip to content

chore: bump pinned CodeQL CLI to v2.27.3 and release v0.8.3 #238

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
security-lab-bot wants to merge 2 commits into
base: main
Choose a base branch
from
Open

chore: bump pinned CodeQL CLI to v2.27.3 and release v0.8.3 #238

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6cd49bd
chore: bump pinned CodeQL CLI to v2.27.3 and release v0.8.3
felickz Oct 21, 2026
a460c6a
Add Hotspots query resource diagnostics
Copilot Oct 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .codeqlversion
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1 @@
2.27.2
2.27.3
65 changes: 64 additions & 1 deletion .github/workflows/hotspots-ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -104,10 +104,73 @@ jobs:
run: ./scripts/create-extractor-pack.sh

- name: Generate hotspots queries
env:
HOTSPOTS_DIAGNOSTICS_DIR: ${{ runner.temp }}/hotspots-diagnostics
HOTSPOTS_EVALUATOR_LOG: ${{ runner.temp }}/hotspots-diagnostics/evaluator.json
run: |
set -euo pipefail
mkdir -p "$HOTSPOTS_DIAGNOSTICS_DIR"
resource_log="$HOTSPOTS_DIAGNOSTICS_DIR/resource-usage.log"
{
date --iso-8601=seconds
free -b
df -B1 /tmp "$GITHUB_WORKSPACE"
} > "$resource_log"

python ql/hotspots/scripts/generate-hotspots-queries.py \
--ql-extractor "$GITHUB_WORKSPACE/codeql/ql/extractor-pack" \
--ql-path "$GITHUB_WORKSPACE/codeql"
--ql-path "$GITHUB_WORKSPACE/codeql" &
generator_pid=$!
(
sample=0
while kill -0 "$generator_pid" 2>/dev/null; do
{
date --iso-8601=seconds
free -b
df -B1 /tmp "$GITHUB_WORKSPACE"
ps -eo pid,ppid,rss,vsz,%mem,args --sort=-rss | sed -n '1,16p'
if ((sample % 4 == 0)); then
du -sh /tmp/codeqldb /tmp/codeqldb/db-ql/default/cache 2>/dev/null || true
fi
} >> "$resource_log"
sample=$((sample + 1))
sleep 15
done
) &
monitor_pid=$!
if wait "$generator_pid"; then
generator_status=0
else
generator_status=$?
fi
kill "$monitor_pid" 2>/dev/null || true
wait "$monitor_pid" 2>/dev/null || true
{
date --iso-8601=seconds
free -b
df -B1 /tmp "$GITHUB_WORKSPACE"
du -sh /tmp/codeqldb /tmp/codeqldb/db-ql/default/cache 2>/dev/null || true
} >> "$resource_log"
exit "$generator_status"

- name: Summarize CodeQL evaluator log
if: always()
env:
HOTSPOTS_DIAGNOSTICS_DIR: ${{ runner.temp }}/hotspots-diagnostics
HOTSPOTS_EVALUATOR_LOG: ${{ runner.temp }}/hotspots-diagnostics/evaluator.json
run: |
if [[ -s "$HOTSPOTS_EVALUATOR_LOG" ]]; then
codeql generate log-summary --format=text -- "$HOTSPOTS_EVALUATOR_LOG" \
"$HOTSPOTS_DIAGNOSTICS_DIR/evaluator-summary.txt" || true
fi

- name: Upload query evaluation diagnostics
if: always()
uses: actions/upload-artifact@v7
with:
name: hotspots-query-diagnostics
path: ${{ runner.temp }}/hotspots-diagnostics/
if-no-files-found: warn

- name: Check generated queries
env:
Expand Down
2 changes: 1 addition & 1 deletion .release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
name: "CodeQL Community Packs"
repository: "githubsecuritylab/codeql-community-packs"
version: "0.8.2"
version: "0.8.3"
prerelease: false

ecosystem: CodeQL
Expand Down
26 changes: 13 additions & 13 deletions cpp/lib/codeql-pack.lock.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,29 +2,29 @@
lockVersion: 1.0.0
dependencies:
codeql/controlflow:
version: 2.0.43
version: 2.0.44
codeql/cpp-all:
version: 12.2.0
version: 12.3.0
codeql/dataflow:
version: 2.1.15
version: 2.1.16
codeql/mad:
version: 1.0.59
version: 1.0.60
codeql/quantum:
version: 0.0.37
version: 0.0.38
codeql/rangeanalysis:
version: 1.0.59
version: 1.0.60
codeql/regex:
version: 1.0.59
version: 1.0.60
codeql/ssa:
version: 2.0.35
version: 2.0.36
codeql/tutorial:
version: 1.0.59
version: 1.0.60
codeql/typeflow:
version: 1.0.59
version: 1.0.60
codeql/typetracking:
version: 2.0.43
version: 2.0.44
codeql/util:
version: 2.0.46
version: 2.0.47
codeql/xml:
version: 1.0.59
version: 1.0.60
compiled: false
4 changes: 2 additions & 2 deletions cpp/lib/qlpack.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
library: true
name: githubsecuritylab/codeql-cpp-libs
version: 0.8.2
version: 0.8.3
dependencies:
codeql/cpp-all: '12.2.0'
codeql/cpp-all: '12.3.0'
30 changes: 15 additions & 15 deletions cpp/src/codeql-pack.lock.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,33 +2,33 @@
lockVersion: 1.0.0
dependencies:
codeql/controlflow:
version: 2.0.43
version: 2.0.44
codeql/cpp-all:
version: 12.2.0
version: 12.3.0
codeql/cpp-queries:
version: 1.9.1
version: 1.9.2
codeql/dataflow:
version: 2.1.15
version: 2.1.16
codeql/mad:
version: 1.0.59
version: 1.0.60
codeql/quantum:
version: 0.0.37
version: 0.0.38
codeql/rangeanalysis:
version: 1.0.59
version: 1.0.60
codeql/regex:
version: 1.0.59
version: 1.0.60
codeql/ssa:
version: 2.0.35
version: 2.0.36
codeql/suite-helpers:
version: 1.0.59
version: 1.0.60
codeql/tutorial:
version: 1.0.59
version: 1.0.60
codeql/typeflow:
version: 1.0.59
version: 1.0.60
codeql/typetracking:
version: 2.0.43
version: 2.0.44
codeql/util:
version: 2.0.46
version: 2.0.47
codeql/xml:
version: 1.0.59
version: 1.0.60
compiled: false
6 changes: 3 additions & 3 deletions cpp/src/qlpack.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
library: false
name: githubsecuritylab/codeql-cpp-queries
version: 0.8.2
version: 0.8.3
suites: suites
defaultSuiteFile: suites/cpp.qls
dependencies:
codeql/cpp-all: '12.2.0'
codeql/cpp-queries: '1.9.1'
codeql/cpp-all: '12.3.0'
codeql/cpp-queries: '1.9.2'
githubsecuritylab/codeql-cpp-libs: '*'
30 changes: 15 additions & 15 deletions cpp/test/codeql-pack.lock.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,33 +2,33 @@
lockVersion: 1.0.0
dependencies:
codeql/controlflow:
version: 2.0.43
version: 2.0.44
codeql/cpp-all:
version: 12.2.0
version: 12.3.0
codeql/cpp-queries:
version: 1.9.1
version: 1.9.2
codeql/dataflow:
version: 2.1.15
version: 2.1.16
codeql/mad:
version: 1.0.59
version: 1.0.60
codeql/quantum:
version: 0.0.37
version: 0.0.38
codeql/rangeanalysis:
version: 1.0.59
version: 1.0.60
codeql/regex:
version: 1.0.59
version: 1.0.60
codeql/ssa:
version: 2.0.35
version: 2.0.36
codeql/suite-helpers:
version: 1.0.59
version: 1.0.60
codeql/tutorial:
version: 1.0.59
version: 1.0.60
codeql/typeflow:
version: 1.0.59
version: 1.0.60
codeql/typetracking:
version: 2.0.43
version: 2.0.44
codeql/util:
version: 2.0.46
version: 2.0.47
codeql/xml:
version: 1.0.59
version: 1.0.60
compiled: false
4 changes: 2 additions & 2 deletions cpp/test/qlpack.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
name: githubsecurtylab/codeql-cpp-tests
groups: [cpp, test]
dependencies:
codeql/cpp-all: '12.2.0'
codeql/cpp-queries: '1.9.1'
codeql/cpp-all: '12.3.0'
codeql/cpp-queries: '1.9.2'
githubsecuritylab/codeql-cpp-queries: '*'
githubsecuritylab/codeql-cpp-libs: '*'
extractor: cpp
Expand Down
2 changes: 1 addition & 1 deletion csharp/ext-library-sources/qlpack.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
library: true
name: githubsecuritylab/codeql-csharp-library-sources
version: 0.8.2
version: 0.8.3
# Keep this '*' (unconstrained) - never pin/floor it to a specific
# codeql/csharp-all version. Unlike `dependencies:`, an unsatisfied
# extensionTargets constraint doesn't fail loudly: it silently drops this
Expand Down
2 changes: 1 addition & 1 deletion csharp/ext/qlpack.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
library: true
name: githubsecuritylab/codeql-csharp-extensions
version: 0.8.2
version: 0.8.3
# Keep this '*' (unconstrained) - never pin/floor it to a specific
# codeql/csharp-all version. Unlike `dependencies:`, an unsatisfied
# extensionTargets constraint doesn't fail loudly: it silently drops this
Expand Down
22 changes: 11 additions & 11 deletions csharp/lib/codeql-pack.lock.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,25 +2,25 @@
lockVersion: 1.0.0
dependencies:
codeql/controlflow:
version: 2.0.43
version: 2.0.44
codeql/csharp-all:
version: 7.4.0
version: 7.4.1
codeql/dataflow:
version: 2.1.15
version: 2.1.16
codeql/mad:
version: 1.0.59
version: 1.0.60
codeql/rangeanalysis:
version: 1.0.59
version: 1.0.60
codeql/ssa:
version: 2.0.35
version: 2.0.36
codeql/threat-models:
version: 1.0.59
version: 1.1.0
codeql/tutorial:
version: 1.0.59
version: 1.0.60
codeql/typetracking:
version: 2.0.43
version: 2.0.44
codeql/util:
version: 2.0.46
version: 2.0.47
codeql/xml:
version: 1.0.59
version: 1.0.60
compiled: false
4 changes: 2 additions & 2 deletions csharp/lib/qlpack.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
library: true
name: githubsecuritylab/codeql-csharp-libs
version: 0.8.2
version: 0.8.3
dependencies:
codeql/csharp-all: "7.4.0"
codeql/csharp-all: "7.4.1"
26 changes: 13 additions & 13 deletions csharp/src/codeql-pack.lock.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,29 +2,29 @@
lockVersion: 1.0.0
dependencies:
codeql/controlflow:
version: 2.0.43
version: 2.0.44
codeql/csharp-all:
version: 7.4.0
version: 7.4.1
codeql/csharp-queries:
version: 1.10.1
version: 1.10.2
codeql/dataflow:
version: 2.1.15
version: 2.1.16
codeql/mad:
version: 1.0.59
version: 1.0.60
codeql/rangeanalysis:
version: 1.0.59
version: 1.0.60
codeql/ssa:
version: 2.0.35
version: 2.0.36
codeql/suite-helpers:
version: 1.0.59
version: 1.0.60
codeql/threat-models:
version: 1.0.59
version: 1.1.0
codeql/tutorial:
version: 1.0.59
version: 1.0.60
codeql/typetracking:
version: 2.0.43
version: 2.0.44
codeql/util:
version: 2.0.46
version: 2.0.47
codeql/xml:
version: 1.0.59
version: 1.0.60
compiled: false
6 changes: 3 additions & 3 deletions csharp/src/qlpack.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
library: false
name: githubsecuritylab/codeql-csharp-queries
version: 0.8.2
version: 0.8.3
suites: suites
defaultSuiteFile: suites/csharp.qls
dependencies:
codeql/csharp-all: "7.4.0"
codeql/csharp-queries: "1.10.1" # Required by suites/csharp-audit.qls and suites/csharp-external-api.qls for upstream cs/untrusted-data-to-external-api
codeql/csharp-all: "7.4.1"
codeql/csharp-queries: "1.10.2" # Required by suites/csharp-audit.qls and suites/csharp-external-api.qls for upstream cs/untrusted-data-to-external-api
githubsecuritylab/codeql-csharp-libs: "*"
Loading
Loading