ci(codeql): enable c-cpp and java-kotlin analyses#1244
Merged
Conversation
Re-enable the C/C++ and Java/Kotlin CodeQL analyses that have been commented out since PR #807, switching from autobuild (which failed at the time) to manual builds scoped to the user-written code. c-cpp: install clang-20 from apt.llvm.org (matches LLVM_VERSION pinned in bin/apt-install.sh), init the libbacktrace submodule for headers, and build skiplang/prelude/runtime/libskip_runtime64.a. The node-gyp addon and skiplang compiler outputs are intentionally skipped — they require the full skiplang toolchain. java-kotlin: install JDK 20 (matches the Gradle java.toolchain pin in sql/server) and run `./gradlew classes testClasses` in sql/server, which is the only Kotlin code in the repo. paths-ignore for sql/** is kept for the existing javascript-typescript and python analyses but lifted for java-kotlin since the Kotlin code lives in sql/server. Also adds workflow_dispatch so the workflow can be triggered manually instead of waiting for the Sunday cron, and clears out boilerplate comments left from the GitHub-generated starter file. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Contributor
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
ubuntu-latest already registers clang++ as a master alternative, so slaving it under clang failed with "alternative clang++ can't be slave of clang: it is a master alternative". Register each separately. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The paths-ignore was added in ad3aaca back when the workflow first moved off default setup, but sql/ts/ contains the actively-maintained SKDB TS client where alerts have been triaged and fixed historically (#6, #7, #8, #9, #10, #11). Filtering it out silences real findings. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
c-cppandjava-kotlinCodeQL analyses that have been commented out since CodeQL: switch to advanced setup #807 (March 2025), where they failed with autobuild.LLVM_VERSIONinbin/apt-install.sh), init thelibbacktracesubmodule, buildskiplang/prelude/runtime/libskip_runtime64.a. The node-gyp addon and skiplang-compiler-generated.cfiles are intentionally skipped — they need the full skiplang toolchain.java.toolchainpin insql/server) and run./gradlew classes testClassesinsql/server, which is the only Kotlin code in the repo.paths-ignore: sql/**filter for javascript-typescript and python (unchanged behavior) but lifts it forjava-kotlin, since the Kotlin code lives insql/server.workflow_dispatchso the workflow can be triggered manually rather than waiting for the Sunday cron.Why
The repo's Security → Code scanning tool-status page reports "CodeQL is reporting errors" — the only errored analyses on file are the c-cpp / java-kotlin runs from 2025-03-13 (commit
eeae5593c) under the "automatic" configuration. Re-enabling these analyses with working builds replaces the stale errored state with current analyses.Test plan
workflow_dispatchfor all four languages🤖 Generated with Claude Code