Skip to content

Commit c148d75

Browse files
authored
Merge branch 'main' into michaelrfairhurst/package-undefined-behavior-mismatched-list-delete
2 parents 9e62570 + df3074e commit c148d75

File tree

85 files changed

+2005
-65
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

85 files changed

+2005
-65
lines changed

.github/copilot-instructions.md

Lines changed: 201 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,3 +58,204 @@ When reviewing tests, it is critical to:
5858
- Check that the locations do not refer to files in the standard library, as these have issues in GitHub's Code Scanning UI and complicate our compiler compatibility tests.
5959
- Consider the "test coverage" of the query, are each of its logical statements effectively exercised individually, collectively? The test should neither be overly bloated nor under specified.
6060
- Consider the edge cases of the language itself, will the analysis work in non-trivial cases, are all relevant language concepts tested here? This doesn't need to be exhaustive, but it should be thoughfully thorough.
61+
62+
## Validating Query Style
63+
64+
The following list describes the required style guides for a query that **must** be validated during the code-review process.
65+
66+
A query **must** include:
67+
68+
- A use of the `isExcluded` predicate on the element reported as the primary location. This predicate ensures that we have a central mechanism for excluding results. This predicate may also be used on other elements relevant to the alert, but only if a suppression on that element should also cause alerts on the current element to be suppressed.
69+
- A well formatted alert message:
70+
- The message should be a complete standalone sentence, with punctuation and a period.
71+
- The message should refer to this particular instance of the problem, rather than repeating the generic rule. e.g. "Call to banned function x." instead of "Do not use function x."
72+
- Code elements should be placed in 'single quotes', unless they are formatted as links.
73+
- Avoid value judgments such as "dubious" and "suspicious", and focus on factual statements about the problem.
74+
- If possible, avoid constant alert messages. Either add placeholders and links (using $@), or concatenate element names to the alert message. Non-constant messages make it easier to find particular results, and links to other program elements can help provide additional context to help a developer understand the results. Examples:
75+
- Instead of `Call to banned function.` prefer `Call to banned function foobar.`.
76+
- Instead of `Return value from call is unused.` prefer `Return value from call to function [x] is unused.`, where `[x]` is a link to the function itself.
77+
- Do not try to explain the solution in the message; instead that should be provided in the help for the query.
78+
79+
All lines in CodeQL source files and test files should be kept to a maximum of 100 characters.
80+
81+
All public predicates, classes, modules and files should be documented with QLDoc. All QLDoc should follow the following QLDoc style guide:
82+
83+
### General QLDoc requirements
84+
85+
1. Documentation must adhere to the [QLDoc specification](https://codeql.github.com/docs/ql-language-reference/ql-language-specification/#qldoc).
86+
1. Documentation comments should be appropriate for users of the code.
87+
1. Documentation for maintainers of the code must use normal comments.
88+
1. Use `/** ... */` for documentation, even for single line comments.
89+
- For single-line documentation, the `/**` and `*/` are written on the same line as the comment.
90+
- For multi-line documentation, the `/**` and `*/` are written on separate lines. There is a `*` preceding each comment line, aligned on the first `*`.
91+
1. Use code formatting (backticks) within comments for code from the source language, and also for QL code (for example, names of classes, predicates, and variables).
92+
1. Give explanatory examples of code in the target language, enclosed in ```` ```<target language> ```` or `` ` ``.
93+
94+
95+
### Language requirements
96+
97+
1. Use American English.
98+
1. Use full sentences, with capital letters and periods, except for the initial sentence of the comment, which may be fragmentary as described below.
99+
1. Use simple sentence structures and avoid complex or academic language.
100+
1. Avoid colloquialisms and contractions.
101+
1. Use words that are in common usage.
102+
103+
104+
### Requirements for specific items
105+
106+
1. Public declarations must be documented.
107+
1. Non-public declarations should be documented.
108+
1. Declarations in query files should be documented.
109+
1. Library files (`.qll` files) should have a documentation comment at the top of the file.
110+
1. Query files, except for tests, must have a QLDoc query documentation comment at the top of the file.
111+
112+
### QLDoc for predicates
113+
114+
1. Refer to all predicate parameters in the predicate documentation.
115+
1. Reference names, such as types and parameters, using backticks `` ` ``.
116+
1. Give examples of code in the target language, enclosed in ```` ```<target language> ```` or `` ` ``.
117+
1. Predicates that override a single predicate don't need QLDoc, as they will inherit it.
118+
119+
#### Predicates without result
120+
121+
1. Use a third-person verb phrase of the form ``Holds if `arg` has <property>.``
122+
1. Avoid:
123+
- `/** Whether ... */`
124+
- `/** Relates ... */`
125+
- Question forms:
126+
- ``/** Is `x` a foo? */``
127+
- ``/** Does `x` have a bar? */``
128+
129+
##### Example
130+
131+
```ql
132+
/**
133+
* Holds if the qualifier of this call has type `qualifierType`.
134+
* `isExactType` indicates whether the type is exact, that is, whether
135+
* the qualifier is guaranteed not to be a subtype of `qualifierType`.
136+
*/
137+
```
138+
139+
#### Predicates with result
140+
141+
1. Use a third-person verb phrase of the form `Gets (a|the) <thing>.`
142+
1. Use "if any" if the item is usually unique but might be missing. For example
143+
`Gets the body of this method, if any.`
144+
1. If the predicate has more complex behaviour, for example multiple arguments are conceptually "outputs", it can be described like a predicate without a result. For example
145+
``Holds if `result` is a child of this expression.``
146+
1. Avoid:
147+
- `Get a ...`
148+
- `The ...`
149+
- `Results in ...`
150+
- Any use of `return`
151+
152+
##### Example
153+
```ql
154+
/**
155+
* Gets the expression denoting the super class of this class,
156+
* or nothing if this is an interface or a class without an `extends` clause.
157+
*/
158+
```
159+
160+
#### Deprecated predicates
161+
162+
The documentation for deprecated predicates should be updated to emphasize the deprecation and specify what predicate to use as an alternative.
163+
Insert a sentence of the form `DEPRECATED: Use <other predicate> instead.` at the start of the QLDoc comment.
164+
165+
##### Example
166+
167+
```ql
168+
/** DEPRECATED: Use `getAnExpr()` instead. */
169+
deprecated Expr getInitializer()
170+
```
171+
172+
#### Internal predicates
173+
174+
Some predicates are internal-only declarations that cannot be made private. The documentation for internal predicates should begin with `INTERNAL: Do not use.`
175+
176+
##### Example
177+
178+
```ql
179+
/**
180+
* INTERNAL: Do not use.
181+
*/
182+
```
183+
184+
#### Special predicates
185+
186+
Certain special predicates should be documented consistently.
187+
188+
- Always document `toString` as
189+
190+
```ql
191+
/** Gets a textual representation of this element. */
192+
string toString() { ... }
193+
```
194+
195+
- Always document `hasLocationInfo` as
196+
197+
```ql
198+
/**
199+
* Holds if this element is at the specified location.
200+
* The location spans column `startcolumn` of line `startline` to
201+
* column `endcolumn` of line `endline` in file `filepath`.
202+
* For more information, see
203+
* [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
204+
*/
205+
206+
predicate hasLocationInfo(string filepath, int startline, int startcolumn, int endline, int endcolumn) { ... }
207+
```
208+
209+
### QLDoc for classes
210+
211+
1. Document classes using a noun phrase of the form `A <domain element> that <has property>.`
212+
1. Use "that", not "which".
213+
1. Refer to member elements in the singular.
214+
1. Where a class denotes a generic concept with subclasses, list those subclasses.
215+
216+
##### Example
217+
218+
```ql
219+
/**
220+
* A delegate declaration, for example
221+
* ```
222+
* delegate void Logger(string text);
223+
* ```
224+
*/
225+
class Delegate extends ...
226+
```
227+
228+
```ql
229+
/**
230+
* An element that can be called.
231+
*
232+
* Either a method (`Method`), a constructor (`Constructor`), a destructor
233+
* (`Destructor`), an operator (`Operator`), an accessor (`Accessor`),
234+
* an anonymous function (`AnonymousFunctionExpr`), or a local function
235+
* (`LocalFunction`).
236+
*/
237+
class Callable extends ...
238+
```
239+
240+
### QLDoc for modules
241+
242+
Modules should be documented using a third-person verb phrase of the form `Provides <classes and predicates to do something>.`
243+
244+
##### Example
245+
246+
```ql
247+
/** Provides logic for determining constant expressions. */
248+
```
249+
```ql
250+
/** Provides classes representing the control flow graph within functions. */
251+
```
252+
253+
### Special variables
254+
255+
When referring to `this`, you may either refer to it as `` `this` `` or `this <type>`. For example:
256+
- ``Holds if `this` is static.``
257+
- `Holds if this method is static.`
258+
259+
When referring to `result`, you may either refer to it as `` `result` `` or as `the result`. For example:
260+
- ``Holds if `result` is a child of this expression.``
261+
- `Holds if the result is a child of this expression.`

.github/workflows/code-scanning-pack-gen.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ jobs:
2828
matrix: ${{ steps.export-code-scanning-pack-matrix.outputs.matrix }}
2929
steps:
3030
- name: Checkout repository
31-
uses: actions/checkout@v5
31+
uses: actions/checkout@v6
3232
- name: Export Code Scanning pack matrix
3333
id: export-code-scanning-pack-matrix
3434
run: |
@@ -44,7 +44,7 @@ jobs:
4444
fail-fast: false
4545
matrix: ${{ fromJSON(needs.prepare-code-scanning-pack-matrix.outputs.matrix) }}
4646
steps:
47-
- uses: actions/checkout@v5
47+
- uses: actions/checkout@v6
4848

4949
- name: Cache CodeQL
5050
id: cache-codeql
@@ -84,7 +84,7 @@ jobs:
8484
id: checkout-external-help-files
8585
# PRs from forks and dependabot do not have access to an appropriate token for cloning the help files repos
8686
if: ${{ !github.event.pull_request.head.repo.fork && github.actor != 'dependabot[bot]' }}
87-
uses: actions/checkout@v5
87+
uses: actions/checkout@v6
8888
with:
8989
ssh-key: ${{ secrets.CODEQL_CODING_STANDARDS_HELP_KEY }}
9090
repository: "github/codeql-coding-standards-help"

.github/workflows/codeql_unit_tests.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ jobs:
2626
matrix: ${{ steps.export-unit-test-matrix.outputs.matrix }}
2727
steps:
2828
- name: Checkout repository
29-
uses: actions/checkout@v5
29+
uses: actions/checkout@v6
3030

3131
- name: Export unit test matrix
3232
id: export-unit-test-matrix
@@ -48,7 +48,7 @@ jobs:
4848

4949
steps:
5050
- name: Checkout repository
51-
uses: actions/checkout@v5
51+
uses: actions/checkout@v6
5252

5353
- name: Install Python
5454
uses: actions/setup-python@v6

.github/workflows/dispatch-matrix-test-on-comment.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ jobs:
1313
runs-on: ubuntu-22.04
1414
steps:
1515
- name: Checkout repository
16-
uses: actions/checkout@v5
16+
uses: actions/checkout@v6
1717

1818
- name: Check permission
1919
id: check-write-permission
@@ -23,7 +23,7 @@ jobs:
2323

2424
- name: Generate token
2525
id: generate-token
26-
uses: actions/create-github-app-token@v2
26+
uses: actions/create-github-app-token@v3
2727
with:
2828
app-id: ${{ vars.AUTOMATION_APP_ID }}
2929
private-key: ${{ secrets.AUTOMATION_PRIVATE_KEY }}

.github/workflows/dispatch-release-performance-check.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ jobs:
1313
runs-on: ubuntu-22.04
1414
steps:
1515
- name: Checkout repository
16-
uses: actions/checkout@v5
16+
uses: actions/checkout@v6
1717

1818
- name: Check permission
1919
id: check-write-permission
@@ -23,7 +23,7 @@ jobs:
2323

2424
- name: Generate token
2525
id: generate-token
26-
uses: actions/create-github-app-token@v2
26+
uses: actions/create-github-app-token@v3
2727
with:
2828
app-id: ${{ vars.AUTOMATION_APP_ID }}
2929
private-key: ${{ secrets.AUTOMATION_PRIVATE_KEY }}

.github/workflows/extra-rule-validation.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ jobs:
2424
runs-on: ubuntu-22.04
2525
steps:
2626
- name: Checkout
27-
uses: actions/checkout@v5
27+
uses: actions/checkout@v6
2828

2929
- name: Check Rules
3030
shell: pwsh
@@ -36,7 +36,7 @@ jobs:
3636
runs-on: ubuntu-22.04
3737
steps:
3838
- name: Checkout
39-
uses: actions/checkout@v5
39+
uses: actions/checkout@v6
4040

4141
- name: Ensure CPP Shared Rules Have Valid Structure
4242
shell: pwsh

.github/workflows/finalize-release.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -44,14 +44,14 @@ jobs:
4444
fi
4545
4646
- name: Checkout
47-
uses: actions/checkout@v5
47+
uses: actions/checkout@v6
4848
with:
4949
ref: ${{ env.REF }}
5050
fetch-depth: 0
5151
path: release
5252

5353
- name: Checkout
54-
uses: actions/checkout@v5
54+
uses: actions/checkout@v6
5555
with:
5656
ref: ${{ env.TOOL_REF }}
5757
path: tooling
@@ -108,7 +108,7 @@ jobs:
108108
- name: Generate token
109109
if: env.HOTFIX_RELEASE == 'false'
110110
id: generate-token
111-
uses: actions/create-github-app-token@v2
111+
uses: actions/create-github-app-token@v3
112112
with:
113113
app-id: ${{ vars.AUTOMATION_APP_ID }}
114114
private-key: ${{ secrets.AUTOMATION_PRIVATE_KEY }}

.github/workflows/generate-html-docs.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ jobs:
2222
runs-on: ubuntu-22.04
2323
steps:
2424
- name: Checkout
25-
uses: actions/checkout@v5
25+
uses: actions/checkout@v6
2626

2727
- name: Install Python
2828
uses: actions/setup-python@v6

.github/workflows/prepare-release.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ jobs:
3434
runs-on: ubuntu-22.04
3535
steps:
3636
- name: Checkout
37-
uses: actions/checkout@v5
37+
uses: actions/checkout@v6
3838
with:
3939
ref: ${{ inputs.ref }}
4040

@@ -143,7 +143,7 @@ jobs:
143143
144144
- name: Generate token
145145
id: generate-token
146-
uses: actions/create-github-app-token@v2
146+
uses: actions/create-github-app-token@v3
147147
with:
148148
app-id: ${{ vars.AUTOMATION_APP_ID }}
149149
private-key: ${{ secrets.AUTOMATION_PRIVATE_KEY }}

.github/workflows/standard_library_upgrade_tests.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ jobs:
2121
matrix: ${{ steps.export-unit-test-matrix.outputs.matrix }}
2222
steps:
2323
- name: Checkout repository
24-
uses: actions/checkout@v5
24+
uses: actions/checkout@v6
2525

2626
- name: Export unit test matrix
2727
id: export-unit-test-matrix
@@ -43,7 +43,7 @@ jobs:
4343

4444
steps:
4545
- name: Checkout repository
46-
uses: actions/checkout@v5
46+
uses: actions/checkout@v6
4747

4848
- name: Setup Python 3
4949
uses: actions/setup-python@v6

0 commit comments

Comments
 (0)