Repository navigation
Add Actions, Rust, and Swift CodeQL pack support - #245
Conversation
|
One or more custom setup steps configured for this repository failed during this Copilot code review run: Setup steps run before each review. If the review above is missing context, or no review was posted at all, the failing step above may be the cause. See the workflow run for failure details, fix your setup steps configuration, and re-request a review. Note You can configure setup steps for Copilot code review separately from Copilot cloud agent with a |
There was a problem hiding this comment.
🟡 Changes recommended
The workspace omits the Actions, Rust, and Swift pack paths, so local test-pack dependency installation can fail or use published packs instead of checkout edits.
1 open issue
What changed in this PR
Adds Actions, Rust, and Swift pack scaffolding to the community-pack repository and integrates them into CI and release tooling.
Changes:
- Adds query and test pack definitions, lockfiles, and default suites for all three languages.
- Adds a Rust extensions pack with Diesel SQL injection sink models.
- Updates local pack resolution, publishing matrices, version reporting, and contributor documentation.
| File | Description |
|---|---|
swift/test/qlpack.yml |
Defines the Swift test pack. |
swift/test/codeql-pack.lock.yml |
Locks Swift test dependencies. |
swift/src/suites/swift.qls |
Defines the default Swift query suite. |
swift/src/qlpack.yml |
Defines the Swift query pack. |
swift/src/codeql-pack.lock.yml |
Locks Swift query dependencies. |
rust/test/qlpack.yml |
Defines Rust test dependencies, including extensions. |
rust/test/codeql-pack.lock.yml |
Locks Rust test dependencies. |
rust/src/suites/rust.qls |
Defines the default Rust query suite. |
rust/src/qlpack.yml |
Defines the Rust query pack. |
rust/src/codeql-pack.lock.yml |
Locks Rust query dependencies. |
rust/ext/qlpack.yml |
Defines the Rust extensions pack. |
rust/ext/manual/diesel.model.yml |
Models Diesel SQL injection sinks. |
CONTRIBUTING.md |
Updates language paths and pack contribution guidance. |
configs/README.md |
Clarifies publication prerequisites and audit-suite availability. |
actions/test/qlpack.yml |
Defines the Actions test pack. |
actions/test/codeql-pack.lock.yml |
Locks Actions test dependencies. |
actions/src/suites/actions.qls |
Defines the default Actions query suite. |
actions/src/qlpack.yml |
Defines the Actions query pack. |
actions/src/codeql-pack.lock.yml |
Locks Actions query dependencies. |
.github/workflows/update-codeql-version.yml |
Resolves local packs during dependency upgrades. |
.github/workflows/publish.yml |
Adds publishing entries for the new packs. |
.github/workflows/copilot-setup-steps.yml |
Resolves local dependencies and skips extension-pack installs. |
.github/workflows/ci.yml |
Expands language coverage and supports optional library packs. |
.github/scripts/pr-suites-packs.sh |
Adds local pack resolution to validation commands. |
.github/scripts/pr-compile.sh |
Adds local pack resolution to query compilation. |
.github/scripts/build-publish-summary.sh |
Reports new languages and marks absent library packs as inapplicable. |
.github/scripts/build-codeql-lib-versions-table.sh |
Adds version rows for new languages and handles absent libraries. |
Review effort: Balanced
Co-authored-by: felickz <1760475+felickz@users.noreply.github.com>
There was a problem hiding this comment.
🔵 Needs a closer look
The Diesel sink models lack executable regression fixtures and accessible version-pinned upstream context, leaving API matching, argument selection, and SQL-injection dataflow unvalidated beyond successful pack creation.
Review effort: Balanced
Summary
libandext-library-sourcespacks are not created.Validation
docs/, or `.github/.