Skip to content

Commit 9aa3789

Browse files
authored
Merge branch 'main' into michaelrfairhurst/implement-deadcode-10-rule-0-2-4
2 parents b6ea3a9 + df3074e commit 9aa3789

File tree

44 files changed

+1438
-42
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

44 files changed

+1438
-42
lines changed

.github/copilot-instructions.md

Lines changed: 201 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,3 +58,204 @@ When reviewing tests, it is critical to:
5858
- Check that the locations do not refer to files in the standard library, as these have issues in GitHub's Code Scanning UI and complicate our compiler compatibility tests.
5959
- Consider the "test coverage" of the query, are each of its logical statements effectively exercised individually, collectively? The test should neither be overly bloated nor under specified.
6060
- Consider the edge cases of the language itself, will the analysis work in non-trivial cases, are all relevant language concepts tested here? This doesn't need to be exhaustive, but it should be thoughfully thorough.
61+
62+
## Validating Query Style
63+
64+
The following list describes the required style guides for a query that **must** be validated during the code-review process.
65+
66+
A query **must** include:
67+
68+
- A use of the `isExcluded` predicate on the element reported as the primary location. This predicate ensures that we have a central mechanism for excluding results. This predicate may also be used on other elements relevant to the alert, but only if a suppression on that element should also cause alerts on the current element to be suppressed.
69+
- A well formatted alert message:
70+
- The message should be a complete standalone sentence, with punctuation and a period.
71+
- The message should refer to this particular instance of the problem, rather than repeating the generic rule. e.g. "Call to banned function x." instead of "Do not use function x."
72+
- Code elements should be placed in 'single quotes', unless they are formatted as links.
73+
- Avoid value judgments such as "dubious" and "suspicious", and focus on factual statements about the problem.
74+
- If possible, avoid constant alert messages. Either add placeholders and links (using $@), or concatenate element names to the alert message. Non-constant messages make it easier to find particular results, and links to other program elements can help provide additional context to help a developer understand the results. Examples:
75+
- Instead of `Call to banned function.` prefer `Call to banned function foobar.`.
76+
- Instead of `Return value from call is unused.` prefer `Return value from call to function [x] is unused.`, where `[x]` is a link to the function itself.
77+
- Do not try to explain the solution in the message; instead that should be provided in the help for the query.
78+
79+
All lines in CodeQL source files and test files should be kept to a maximum of 100 characters.
80+
81+
All public predicates, classes, modules and files should be documented with QLDoc. All QLDoc should follow the following QLDoc style guide:
82+
83+
### General QLDoc requirements
84+
85+
1. Documentation must adhere to the [QLDoc specification](https://codeql.github.com/docs/ql-language-reference/ql-language-specification/#qldoc).
86+
1. Documentation comments should be appropriate for users of the code.
87+
1. Documentation for maintainers of the code must use normal comments.
88+
1. Use `/** ... */` for documentation, even for single line comments.
89+
- For single-line documentation, the `/**` and `*/` are written on the same line as the comment.
90+
- For multi-line documentation, the `/**` and `*/` are written on separate lines. There is a `*` preceding each comment line, aligned on the first `*`.
91+
1. Use code formatting (backticks) within comments for code from the source language, and also for QL code (for example, names of classes, predicates, and variables).
92+
1. Give explanatory examples of code in the target language, enclosed in ```` ```<target language> ```` or `` ` ``.
93+
94+
95+
### Language requirements
96+
97+
1. Use American English.
98+
1. Use full sentences, with capital letters and periods, except for the initial sentence of the comment, which may be fragmentary as described below.
99+
1. Use simple sentence structures and avoid complex or academic language.
100+
1. Avoid colloquialisms and contractions.
101+
1. Use words that are in common usage.
102+
103+
104+
### Requirements for specific items
105+
106+
1. Public declarations must be documented.
107+
1. Non-public declarations should be documented.
108+
1. Declarations in query files should be documented.
109+
1. Library files (`.qll` files) should have a documentation comment at the top of the file.
110+
1. Query files, except for tests, must have a QLDoc query documentation comment at the top of the file.
111+
112+
### QLDoc for predicates
113+
114+
1. Refer to all predicate parameters in the predicate documentation.
115+
1. Reference names, such as types and parameters, using backticks `` ` ``.
116+
1. Give examples of code in the target language, enclosed in ```` ```<target language> ```` or `` ` ``.
117+
1. Predicates that override a single predicate don't need QLDoc, as they will inherit it.
118+
119+
#### Predicates without result
120+
121+
1. Use a third-person verb phrase of the form ``Holds if `arg` has <property>.``
122+
1. Avoid:
123+
- `/** Whether ... */`
124+
- `/** Relates ... */`
125+
- Question forms:
126+
- ``/** Is `x` a foo? */``
127+
- ``/** Does `x` have a bar? */``
128+
129+
##### Example
130+
131+
```ql
132+
/**
133+
* Holds if the qualifier of this call has type `qualifierType`.
134+
* `isExactType` indicates whether the type is exact, that is, whether
135+
* the qualifier is guaranteed not to be a subtype of `qualifierType`.
136+
*/
137+
```
138+
139+
#### Predicates with result
140+
141+
1. Use a third-person verb phrase of the form `Gets (a|the) <thing>.`
142+
1. Use "if any" if the item is usually unique but might be missing. For example
143+
`Gets the body of this method, if any.`
144+
1. If the predicate has more complex behaviour, for example multiple arguments are conceptually "outputs", it can be described like a predicate without a result. For example
145+
``Holds if `result` is a child of this expression.``
146+
1. Avoid:
147+
- `Get a ...`
148+
- `The ...`
149+
- `Results in ...`
150+
- Any use of `return`
151+
152+
##### Example
153+
```ql
154+
/**
155+
* Gets the expression denoting the super class of this class,
156+
* or nothing if this is an interface or a class without an `extends` clause.
157+
*/
158+
```
159+
160+
#### Deprecated predicates
161+
162+
The documentation for deprecated predicates should be updated to emphasize the deprecation and specify what predicate to use as an alternative.
163+
Insert a sentence of the form `DEPRECATED: Use <other predicate> instead.` at the start of the QLDoc comment.
164+
165+
##### Example
166+
167+
```ql
168+
/** DEPRECATED: Use `getAnExpr()` instead. */
169+
deprecated Expr getInitializer()
170+
```
171+
172+
#### Internal predicates
173+
174+
Some predicates are internal-only declarations that cannot be made private. The documentation for internal predicates should begin with `INTERNAL: Do not use.`
175+
176+
##### Example
177+
178+
```ql
179+
/**
180+
* INTERNAL: Do not use.
181+
*/
182+
```
183+
184+
#### Special predicates
185+
186+
Certain special predicates should be documented consistently.
187+
188+
- Always document `toString` as
189+
190+
```ql
191+
/** Gets a textual representation of this element. */
192+
string toString() { ... }
193+
```
194+
195+
- Always document `hasLocationInfo` as
196+
197+
```ql
198+
/**
199+
* Holds if this element is at the specified location.
200+
* The location spans column `startcolumn` of line `startline` to
201+
* column `endcolumn` of line `endline` in file `filepath`.
202+
* For more information, see
203+
* [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
204+
*/
205+
206+
predicate hasLocationInfo(string filepath, int startline, int startcolumn, int endline, int endcolumn) { ... }
207+
```
208+
209+
### QLDoc for classes
210+
211+
1. Document classes using a noun phrase of the form `A <domain element> that <has property>.`
212+
1. Use "that", not "which".
213+
1. Refer to member elements in the singular.
214+
1. Where a class denotes a generic concept with subclasses, list those subclasses.
215+
216+
##### Example
217+
218+
```ql
219+
/**
220+
* A delegate declaration, for example
221+
* ```
222+
* delegate void Logger(string text);
223+
* ```
224+
*/
225+
class Delegate extends ...
226+
```
227+
228+
```ql
229+
/**
230+
* An element that can be called.
231+
*
232+
* Either a method (`Method`), a constructor (`Constructor`), a destructor
233+
* (`Destructor`), an operator (`Operator`), an accessor (`Accessor`),
234+
* an anonymous function (`AnonymousFunctionExpr`), or a local function
235+
* (`LocalFunction`).
236+
*/
237+
class Callable extends ...
238+
```
239+
240+
### QLDoc for modules
241+
242+
Modules should be documented using a third-person verb phrase of the form `Provides <classes and predicates to do something>.`
243+
244+
##### Example
245+
246+
```ql
247+
/** Provides logic for determining constant expressions. */
248+
```
249+
```ql
250+
/** Provides classes representing the control flow graph within functions. */
251+
```
252+
253+
### Special variables
254+
255+
When referring to `this`, you may either refer to it as `` `this` `` or `this <type>`. For example:
256+
- ``Holds if `this` is static.``
257+
- `Holds if this method is static.`
258+
259+
When referring to `result`, you may either refer to it as `` `result` `` or as `the result`. For example:
260+
- ``Holds if `result` is a child of this expression.``
261+
- `Holds if the result is a child of this expression.`

.github/workflows/code-scanning-pack-gen.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ jobs:
2828
matrix: ${{ steps.export-code-scanning-pack-matrix.outputs.matrix }}
2929
steps:
3030
- name: Checkout repository
31-
uses: actions/checkout@v5
31+
uses: actions/checkout@v6
3232
- name: Export Code Scanning pack matrix
3333
id: export-code-scanning-pack-matrix
3434
run: |
@@ -44,7 +44,7 @@ jobs:
4444
fail-fast: false
4545
matrix: ${{ fromJSON(needs.prepare-code-scanning-pack-matrix.outputs.matrix) }}
4646
steps:
47-
- uses: actions/checkout@v5
47+
- uses: actions/checkout@v6
4848

4949
- name: Cache CodeQL
5050
id: cache-codeql
@@ -84,7 +84,7 @@ jobs:
8484
id: checkout-external-help-files
8585
# PRs from forks and dependabot do not have access to an appropriate token for cloning the help files repos
8686
if: ${{ !github.event.pull_request.head.repo.fork && github.actor != 'dependabot[bot]' }}
87-
uses: actions/checkout@v5
87+
uses: actions/checkout@v6
8888
with:
8989
ssh-key: ${{ secrets.CODEQL_CODING_STANDARDS_HELP_KEY }}
9090
repository: "github/codeql-coding-standards-help"

.github/workflows/codeql_unit_tests.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ jobs:
2525
matrix: ${{ steps.export-unit-test-matrix.outputs.matrix }}
2626
steps:
2727
- name: Checkout repository
28-
uses: actions/checkout@v5
28+
uses: actions/checkout@v6
2929

3030
- name: Export unit test matrix
3131
id: export-unit-test-matrix
@@ -47,7 +47,7 @@ jobs:
4747

4848
steps:
4949
- name: Checkout repository
50-
uses: actions/checkout@v5
50+
uses: actions/checkout@v6
5151

5252
- name: Install Python
5353
uses: actions/setup-python@v6

.github/workflows/dispatch-matrix-test-on-comment.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ jobs:
1313
runs-on: ubuntu-22.04
1414
steps:
1515
- name: Checkout repository
16-
uses: actions/checkout@v5
16+
uses: actions/checkout@v6
1717

1818
- name: Check permission
1919
id: check-write-permission
@@ -23,7 +23,7 @@ jobs:
2323

2424
- name: Generate token
2525
id: generate-token
26-
uses: actions/create-github-app-token@v2
26+
uses: actions/create-github-app-token@v3
2727
with:
2828
app-id: ${{ vars.AUTOMATION_APP_ID }}
2929
private-key: ${{ secrets.AUTOMATION_PRIVATE_KEY }}

.github/workflows/dispatch-release-performance-check.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ jobs:
1313
runs-on: ubuntu-22.04
1414
steps:
1515
- name: Checkout repository
16-
uses: actions/checkout@v5
16+
uses: actions/checkout@v6
1717

1818
- name: Check permission
1919
id: check-write-permission
@@ -23,7 +23,7 @@ jobs:
2323

2424
- name: Generate token
2525
id: generate-token
26-
uses: actions/create-github-app-token@v2
26+
uses: actions/create-github-app-token@v3
2727
with:
2828
app-id: ${{ vars.AUTOMATION_APP_ID }}
2929
private-key: ${{ secrets.AUTOMATION_PRIVATE_KEY }}

.github/workflows/extra-rule-validation.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ jobs:
2323
runs-on: ubuntu-22.04
2424
steps:
2525
- name: Checkout
26-
uses: actions/checkout@v5
26+
uses: actions/checkout@v6
2727

2828
- name: Check Rules
2929
shell: pwsh
@@ -35,7 +35,7 @@ jobs:
3535
runs-on: ubuntu-22.04
3636
steps:
3737
- name: Checkout
38-
uses: actions/checkout@v5
38+
uses: actions/checkout@v6
3939

4040
- name: Ensure CPP Shared Rules Have Valid Structure
4141
shell: pwsh

.github/workflows/finalize-release.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -44,14 +44,14 @@ jobs:
4444
fi
4545
4646
- name: Checkout
47-
uses: actions/checkout@v5
47+
uses: actions/checkout@v6
4848
with:
4949
ref: ${{ env.REF }}
5050
fetch-depth: 0
5151
path: release
5252

5353
- name: Checkout
54-
uses: actions/checkout@v5
54+
uses: actions/checkout@v6
5555
with:
5656
ref: ${{ env.TOOL_REF }}
5757
path: tooling
@@ -108,7 +108,7 @@ jobs:
108108
- name: Generate token
109109
if: env.HOTFIX_RELEASE == 'false'
110110
id: generate-token
111-
uses: actions/create-github-app-token@v2
111+
uses: actions/create-github-app-token@v3
112112
with:
113113
app-id: ${{ vars.AUTOMATION_APP_ID }}
114114
private-key: ${{ secrets.AUTOMATION_PRIVATE_KEY }}

.github/workflows/generate-html-docs.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ jobs:
2222
runs-on: ubuntu-22.04
2323
steps:
2424
- name: Checkout
25-
uses: actions/checkout@v5
25+
uses: actions/checkout@v6
2626

2727
- name: Install Python
2828
uses: actions/setup-python@v6

.github/workflows/prepare-release.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ jobs:
3434
runs-on: ubuntu-22.04
3535
steps:
3636
- name: Checkout
37-
uses: actions/checkout@v5
37+
uses: actions/checkout@v6
3838
with:
3939
ref: ${{ inputs.ref }}
4040

@@ -143,7 +143,7 @@ jobs:
143143
144144
- name: Generate token
145145
id: generate-token
146-
uses: actions/create-github-app-token@v2
146+
uses: actions/create-github-app-token@v3
147147
with:
148148
app-id: ${{ vars.AUTOMATION_APP_ID }}
149149
private-key: ${{ secrets.AUTOMATION_PRIVATE_KEY }}

.github/workflows/standard_library_upgrade_tests.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ jobs:
2121
matrix: ${{ steps.export-unit-test-matrix.outputs.matrix }}
2222
steps:
2323
- name: Checkout repository
24-
uses: actions/checkout@v5
24+
uses: actions/checkout@v6
2525

2626
- name: Export unit test matrix
2727
id: export-unit-test-matrix
@@ -43,7 +43,7 @@ jobs:
4343

4444
steps:
4545
- name: Checkout repository
46-
uses: actions/checkout@v5
46+
uses: actions/checkout@v6
4747

4848
- name: Setup Python 3
4949
uses: actions/setup-python@v6

0 commit comments

Comments
 (0)