Skip to content

Commit e23c9f4

Browse files
github-actions[bot]data-douserCopilotenyil
authored
Upgrade CodeQL CLI dependency to v2.25.3 (#269)
* Upgrade CodeQL CLI dependency to v2.25.3 * Fix upgrade-packs.sh to actually refresh pack lock files Previously, codeql pack upgrade was a no-op for packs with pinned codeql/<lang>-all dependencies because the existing pin already satisfied the constraint. This left codeql-pack.lock.yml files unchanged across CLI bumps, even though newer compatible library pack versions were available. The fix temporarily rewrites the pinned dependency to a wildcard before running codeql pack upgrade, then restores the manifest and pins it to the version resolved into the lock file. Also regenerates all pack lock files and re-pins manifests against CodeQL CLI v2.25.3, and refreshes ruby/rust/swift PrintAST/PrintCFG .expected files for benign output ordering and library behavior changes introduced by the upgraded codeql/*-all packs. * Skip update-codeql cron run when upgrade branch already exists Adds a 'check-existing-branch' job that runs after detect-update and gates the create-pr job. On scheduled (cron) runs, if the target 'codeql/upgrade-to-vX.Y.Z' branch already exists on origin, the rest of the pipeline is skipped so peter-evans/create-pull-request does not force-push over reviewer commits or follow-up fixes (such as manually-applied lock-file refreshes). The check is bypassed on workflow_dispatch so a maintainer can always force a refresh by re-running the workflow manually. * Refresh rust PrintAST/PrintCFG expected with rust toolchain installed CI runs query unit tests with install-language-runtimes: true, which makes rustc/cargo available to the rust extractor and causes println! and similar macros to be expanded to their stdlib internals was performed without rust installed locally, so the expected files captured the collapsed output and did not match CI. Re-learned with rustc 1.95.0 installed via rustup, matching the CI runner environment. * Refresh rust PrintAST/PrintCFG expected to match macro expansion output (#270) Agent-Logs-Url: https://github.com/advanced-security/codeql-development-mcp-server/sessions/beb1ad8c-da44-4beb-8483-c2b6d9e1f2b7 Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: enyil <87337678+enyil@users.noreply.github.com> --------- Co-authored-by: data-douser <70299490+data-douser@users.noreply.github.com> Co-authored-by: Nathan Randall <data-douser@github.com> Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> Co-authored-by: enyil <87337678+enyil@users.noreply.github.com>
1 parent db62263 commit e23c9f4

55 files changed

Lines changed: 416 additions & 350 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.codeql-version‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
v2.25.2
1+
v2.25.3

‎.github/workflows/update-codeql.yml‎

Lines changed: 68 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -102,17 +102,81 @@ jobs:
102102
fi
103103
104104
# ─────────────────────────────────────────────────────────────────────────────
105-
# Step 2: Update version, build, test, and create PR
105+
# Step 2: Check whether the upgrade branch already exists
106+
#
107+
# When this workflow runs on its nightly cron schedule and an upgrade PR has
108+
# already been opened for the target version, re-running `create-pr` would
109+
# force-push over the existing branch and silently discard any review
110+
# commits already made on top of the bot's initial push (e.g., manual fixes
111+
# to upgrade-packs.sh output or reviewer follow-ups). This job short-circuits
112+
# subsequent work in that case so the existing branch is preserved.
113+
#
114+
# The branch check is skipped on `workflow_dispatch` so a maintainer can
115+
# always re-run the upgrade pipeline on demand to re-create the branch.
116+
# ─────────────────────────────────────────────────────────────────────────────
117+
check-existing-branch:
118+
name: Check for Existing Upgrade Branch
119+
needs: detect-update
120+
if: needs.detect-update.outputs.update_needed == 'true'
121+
runs-on: ubuntu-latest
122+
123+
permissions:
124+
contents: read
125+
126+
outputs:
127+
branch_exists: ${{ steps.check-branch.outputs.branch_exists }}
128+
129+
steps:
130+
- name: Check - Look up upgrade branch on origin
131+
id: check-branch
132+
env:
133+
GH_TOKEN: ${{ github.token }}
134+
BRANCH: 'codeql/upgrade-to-${{ needs.detect-update.outputs.version }}'
135+
EVENT_NAME: ${{ github.event_name }}
136+
run: |
137+
if [ "${EVENT_NAME}" = "workflow_dispatch" ]; then
138+
echo "ℹ️ Manual dispatch — skipping existing-branch check."
139+
echo "branch_exists=false" >> "$GITHUB_OUTPUT"
140+
exit 0
141+
fi
142+
143+
echo "Checking whether branch '${BRANCH}' exists on ${GITHUB_REPOSITORY}..."
144+
if gh api "repos/${GITHUB_REPOSITORY}/branches/${BRANCH}" \
145+
--silent > /dev/null 2>&1; then
146+
echo "✅ Branch '${BRANCH}' already exists — skipping update to preserve manual edits."
147+
echo "branch_exists=true" >> "$GITHUB_OUTPUT"
148+
else
149+
echo "ℹ️ Branch '${BRANCH}' does not exist — proceeding with update."
150+
echo "branch_exists=false" >> "$GITHUB_OUTPUT"
151+
fi
152+
153+
- name: Check - Summary
154+
env:
155+
BRANCH: 'codeql/upgrade-to-${{ needs.detect-update.outputs.version }}'
156+
run: |
157+
echo "## Upgrade Branch Preflight" >> $GITHUB_STEP_SUMMARY
158+
echo "" >> $GITHUB_STEP_SUMMARY
159+
if [ "${{ steps.check-branch.outputs.branch_exists }}" = "true" ]; then
160+
echo "⏭️ Branch \`${BRANCH}\` already exists — skipping the rest of the pipeline to preserve any manual edits or review commits on it." >> $GITHUB_STEP_SUMMARY
161+
echo "" >> $GITHUB_STEP_SUMMARY
162+
echo "Trigger this workflow manually via \`workflow_dispatch\` to force a refresh." >> $GITHUB_STEP_SUMMARY
163+
else
164+
echo "▶️ Branch \`${BRANCH}\` does not exist — proceeding with the update pipeline." >> $GITHUB_STEP_SUMMARY
165+
fi
166+
167+
# ─────────────────────────────────────────────────────────────────────────────
168+
# Step 3: Update version, build, test, and create PR
106169
#
107170
# Updates all version-bearing files, installs dependencies, runs the full
108171
# build-and-test suite, and creates a pull request with the changes.
109172
# ─────────────────────────────────────────────────────────────────────────────
110173
create-pr:
111174
name: Create Update Pull Request
112-
needs: detect-update
113-
if: needs.detect-update.outputs.update_needed == 'true'
175+
needs: [detect-update, check-existing-branch]
176+
if: |
177+
needs.detect-update.outputs.update_needed == 'true' &&
178+
needs.check-existing-branch.outputs.branch_exists != 'true'
114179
runs-on: ubuntu-latest
115-
116180
permissions:
117181
contents: write
118182
pull-requests: write

‎client/integration-tests/primitives/tools/codeql_bqrs_interpret/sarif_format/after/results.sarif‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
{"$schema":"https://json.schemastore.org/sarif-2.1.0.json","version":"2.1.0","runs":[{"tool":{"driver":{"name":"CodeQL","organization":"GitHub","semanticVersion":"2.25.2","rules":[{"id":"test/query","name":"test/query","shortDescription":{"text":"ExampleQuery1"},"fullDescription":{"text":"Example query for integration testing of the codeql_test_extract MCP server tool."},"defaultConfiguration":{"enabled":true,"level":"warning"},"help":{"text":"# Query Help for JavaScript ExampleQuery1\n\nTODO\n","markdown":"# Query Help for JavaScript ExampleQuery1\n\nTODO\n"},"properties":{"tags":["mcp-integration-tests"],"description":"Example query for integration testing of the codeql_test_extract MCP server tool.","id":"test/query","kind":"problem","name":"ExampleQuery1","precision":"medium","problem.severity":"warning"}}]},"extensions":[{"name":"mcp-client-integration-tests-static-javascript-src","semanticVersion":"0.0.1+fe0e7d2a7059ebb6c6075ff8eaea04f382747656","locations":[{"uri":"file:///home/runner/work/codeql-development-mcp-server/codeql-development-mcp-server/client/integration-tests/static/javascript/src/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///home/runner/work/codeql-development-mcp-server/codeql-development-mcp-server/client/integration-tests/static/javascript/src/codeql-pack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/javascript-all","semanticVersion":"2.6.11+ce9c8e6e9fd41ef0967b13849bb6ae2183caf9ad","locations":[{"uri":"file:///home/runner/.codeql/packages/codeql/javascript-all/2.6.11/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///home/runner/.codeql/packages/codeql/javascript-all/2.6.11/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/threat-models","semanticVersion":"1.0.31+ce9c8e6e9fd41ef0967b13849bb6ae2183caf9ad","locations":[{"uri":"file:///home/runner/.codeql/packages/codeql/threat-models/1.0.31/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///home/runner/.codeql/packages/codeql/threat-models/1.0.31/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]}]},"artifacts":[{"location":{"uri":"file:///home/runner/work/codeql-development-mcp-server/codeql-development-mcp-server/client/integration-tests/static/javascript/test/ExampleQuery1/ExampleQuery1.js","index":0}}],"results":[{"ruleId":"test/query","ruleIndex":0,"rule":{"id":"test/query","index":0},"message":{"text":"Example test code file found for codeql_test_extract example query."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"file:///home/runner/work/codeql-development-mcp-server/codeql-development-mcp-server/client/integration-tests/static/javascript/test/ExampleQuery1/ExampleQuery1.js","index":0}}}]}],"columnKind":"utf16CodeUnits","properties":{"semmle.formatSpecifier":"sarif-latest"}}]}
1+
{"$schema":"https://json.schemastore.org/sarif-2.1.0.json","version":"2.1.0","runs":[{"tool":{"driver":{"name":"CodeQL","organization":"GitHub","semanticVersion":"2.25.3","rules":[{"id":"test/query","name":"test/query","shortDescription":{"text":"ExampleQuery1"},"fullDescription":{"text":"Example query for integration testing of the codeql_test_extract MCP server tool."},"defaultConfiguration":{"enabled":true,"level":"warning"},"help":{"text":"# Query Help for JavaScript ExampleQuery1\n\nTODO\n","markdown":"# Query Help for JavaScript ExampleQuery1\n\nTODO\n"},"properties":{"tags":["mcp-integration-tests"],"description":"Example query for integration testing of the codeql_test_extract MCP server tool.","id":"test/query","kind":"problem","name":"ExampleQuery1","precision":"medium","problem.severity":"warning"}}]},"extensions":[{"name":"mcp-client-integration-tests-static-javascript-src","semanticVersion":"0.0.1+fe0e7d2a7059ebb6c6075ff8eaea04f382747656","locations":[{"uri":"file:///home/runner/work/codeql-development-mcp-server/codeql-development-mcp-server/client/integration-tests/static/javascript/src/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///home/runner/work/codeql-development-mcp-server/codeql-development-mcp-server/client/integration-tests/static/javascript/src/codeql-pack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/javascript-all","semanticVersion":"2.6.11+ce9c8e6e9fd41ef0967b13849bb6ae2183caf9ad","locations":[{"uri":"file:///home/runner/.codeql/packages/codeql/javascript-all/2.6.11/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///home/runner/.codeql/packages/codeql/javascript-all/2.6.11/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/threat-models","semanticVersion":"1.0.31+ce9c8e6e9fd41ef0967b13849bb6ae2183caf9ad","locations":[{"uri":"file:///home/runner/.codeql/packages/codeql/threat-models/1.0.31/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///home/runner/.codeql/packages/codeql/threat-models/1.0.31/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]}]},"artifacts":[{"location":{"uri":"file:///home/runner/work/codeql-development-mcp-server/codeql-development-mcp-server/client/integration-tests/static/javascript/test/ExampleQuery1/ExampleQuery1.js","index":0}}],"results":[{"ruleId":"test/query","ruleIndex":0,"rule":{"id":"test/query","index":0},"message":{"text":"Example test code file found for codeql_test_extract example query."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"file:///home/runner/work/codeql-development-mcp-server/codeql-development-mcp-server/client/integration-tests/static/javascript/test/ExampleQuery1/ExampleQuery1.js","index":0}}}]}],"columnKind":"utf16CodeUnits","properties":{"semmle.formatSpecifier":"sarif-latest"}}]}

‎extensions/vscode/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
"name": "vscode-codeql-development-mcp-server",
33
"displayName": "CodeQL Development MCP Server",
44
"description": "LLM-assisted development of CodeQL queries, libraries, and tests via #ql-mcp prompts, resources, and tools.",
5-
"version": "2.25.2",
5+
"version": "2.25.3",
66
"publisher": "advanced-security",
77
"license": "LicenseRef-CodeQL-Terms",
88
"icon": "media/codeql-icon.png",

‎package-lock.json‎

Lines changed: 4 additions & 34 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "codeql-development-mcp-server_repo",
3-
"version": "2.25.2",
3+
"version": "2.25.3",
44
"description": "An MCP server supporting LLM requests for CodeQL development tools and resources.",
55
"private": true,
66
"type": "module",

‎server/dist/codeql-development-mcp-server.js‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -201540,7 +201540,7 @@ init_package_paths();
201540201540
init_logger();
201541201541
import_dotenv.default.config({ path: resolve14(packageRootDir, ".env"), quiet: true });
201542201542
var PACKAGE_NAME = "codeql-development-mcp-server";
201543-
var VERSION = "2.25.2";
201543+
var VERSION = "2.25.3";
201544201544
async function startServer(mode = "stdio") {
201545201545
logger.info(`Starting CodeQL Development MCP McpServer v${VERSION} in ${mode} mode`);
201546201546
const codeqlBinary = resolveCodeQLBinary();

‎server/dist/codeql-development-mcp-server.js.map‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎server/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "codeql-development-mcp-server",
3-
"version": "2.25.2",
3+
"version": "2.25.3",
44
"description": "An MCP server supporting LLM requests for CodeQL development tools and resources.",
55
"main": "dist/codeql-development-mcp-server.js",
66
"type": "module",

‎server/ql/actions/tools/src/codeql-pack.lock.yml‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -2,31 +2,31 @@
22
lockVersion: 1.0.0
33
dependencies:
44
codeql/actions-all:
5-
version: 0.4.32
5+
version: 0.4.34
66
codeql/concepts:
7-
version: 0.0.20
7+
version: 0.0.22
88
codeql/controlflow:
9-
version: 2.0.30
9+
version: 2.0.32
1010
codeql/dataflow:
11-
version: 2.1.2
11+
version: 2.1.4
1212
codeql/javascript-all:
13-
version: 2.6.26
13+
version: 2.6.28
1414
codeql/mad:
15-
version: 1.0.46
15+
version: 1.0.48
1616
codeql/regex:
17-
version: 1.0.46
17+
version: 1.0.48
1818
codeql/ssa:
19-
version: 2.0.22
19+
version: 2.0.24
2020
codeql/threat-models:
21-
version: 1.0.46
21+
version: 1.0.48
2222
codeql/tutorial:
23-
version: 1.0.46
23+
version: 1.0.48
2424
codeql/typetracking:
25-
version: 2.0.30
25+
version: 2.0.32
2626
codeql/util:
27-
version: 2.0.33
27+
version: 2.0.35
2828
codeql/xml:
29-
version: 1.0.46
29+
version: 1.0.48
3030
codeql/yaml:
31-
version: 1.0.46
31+
version: 1.0.48
3232
compiled: false

0 commit comments

Comments
 (0)