Codeql rollout by ANegm-ETAS · Pull Request #698 · eclipse-score/lifecycle

ANegm-ETAS · 2026-09-24T14:54:58Z

Introduction of codeql nightly workflow

NicolasFussberger · 2026-09-25T05:58:07Z

+- you are bumping the CodeQL bundle or the coding-standards pack version.
+
+## The pipeline in one picture
+`bazel run //quality/static_analysis:codeql_lint -- --target //score/message_passing //score/mw/com`


Target names are from mw::com and do not fit to lifecycle

NicolasFussberger · 2026-09-25T05:58:57Z

+
+### 4. Diagnosing local-vs-CI divergence: check the published number's provenance FIRST
+CI publishes its results to GitHub Pages (no auth needed):
+`https://eclipse-score.github.io/communication/latest/quality/codeql_findings.sarif` (full SARIF) and


Link to com repo

NicolasFussberger · 2026-09-25T06:01:06Z

+bazel run //quality/static_analysis:codeql_lint -- \
+  --build-config qnx \
+  --output-dir /tmp/codeql-results/qnx --output-prefix codeql-nightly-qnx \
+  --target //score/message_passing //score/mw/com


com targets

NicolasFussberger · 2026-09-25T06:03:48Z

+CPP_CODE_SCANNING_SPEC = "codeql/cpp-queries:codeql-suites/cpp-code-scanning.qls"
+ALERT_SUPPRESSION_SPEC = "codeql/cpp-queries:AlertSuppression.ql"
+
+# Local, uncompiled query pack (ported from vsps_quality_packages//tools/codeql/


I guess any references to internal repos shall be removed

NicolasFussberger · 2026-09-25T06:08:50Z

+          bazel run --config=x86_64-linux //quality/static_analysis:codeql_lint -- \
+            --output-dir /tmp/codeql-results/linux \
+            --output-prefix codeql-nightly \
+            --target //score/...


This does not have "--report" - if I understood correctly - it runs only the misra checks, is this intended?

NicolasFussberger · 2026-09-25T06:10:46Z

+# to apply those patches back to the workspace.
+build:clang-tidy-fix --config=clang-tidy
+build:clang-tidy-fix --@aspect_rules_lint//lint:fix
+build:clang-tidy-fix --output_groups=+rules_lint_patch


There is a lot of other stuff in here unrelated to codeql which is partially conflicting to this repo (e.g. different clang-tidy setup).

I would recommend to only keep the codeql part here for this PR

NicolasFussberger · 2026-09-25T06:12:12Z

@@ -0,0 +1,203 @@
+# MISRA C++:2023 Guideline Enforcement Plan (GEP)
+
+This is the guideline enforcement plan for S-CORE communication for MISRA C++:2023.


This seems specific to communication repo. I would prefer to remove it

NicolasFussberger · 2026-09-25T06:12:58Z

+# it runs standalone. `data = glob(["**"])` keeps its (unused but harmless)
+# companion files (*.pdb, *.xml, *.dll.config) alongside it in runfiles, in
+# case of any relative-path lookups.
+sh_binary(


Can this just go into the BUILD file (which is currently empty)?

NicolasFussberger · 2026-09-25T06:14:10Z

+# union). Fetched by pinned URL + sha256 (like codeql_bundle above) rather
+# than via `npx` at runtime, so the merge step needs no network access and is
+# fully reproducible.
+http_archive(


I would prefer to remove the overly detailed comments from the file

NicolasFussberger · 2026-09-25T06:24:05Z

@@ -0,0 +1,315 @@
+---


I cannot really judge the content due to lack of experience with codeql.

I wonder if we shall keep this PR minimal and only take over additional stuff on demand.
I would be in favor of removing the .github/skills/codeql-analysis for now and first getting some experience with the new tool

NicolasFussberger · 2026-09-25T06:33:49Z

When running the following locally I get the following error:

bazel run --config=x86_64-linux //quality/static_analysis:codeql_lint --   --output-dir ./_SCA/codeql-results/linux   --target //score/...

Error:

Shutting down query evaluator.
Interpreting results.
CodeQL scanned 229 out of 596 C/C++ files in this invocation. Typically CodeQL is configured to analyze a single CodeQL language per invocation, so check other invocations to determine overall coverage information.
 Generating MISRA/CERT compliance reports...
 Resolved CodeQL bin dir: /var/cache/bazel/625205d1e0aa59ca514fd964120d6a8a/external/+_repo_rules2+codeql_bundle/codeql
 CodeQL bin dir exists: True
 PATH for analysis_report: /var/cache/bazel/625205d1e0aa59ca514fd964120d6a8a/external/+_repo_rules2+codeql_bundle/codeql:/home/vscode/.cache/bazelisk/downloads/sha256/d7606e679b78067c811096fb3d6cf135225b528835ca396e3a4dddf957859544/bin:/home/vscode/.vscode-server/data/User/globalStorage/github.copilot-chat/debugCommand:/home/vscode/.vscode-server/data/User/globalStorage/github.copilot-chat/copilotCli:/vscode/vscode-server/bin/linux-x64/2242ebbb54efeeb0129e08e919e7e8d43033cd83/bin/remote-cli:/home/vscode/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/home/vscode/.local/bin:/home/vscode/.vscode-server/extensions/ms-python.debugpy-2026.6.0-linux-x64/bundled/scripts/noConfigScripts
 [analysis_report stdout]: Running the diagnostic queries...
Decoding diagnostic query results
Running the deviation query...
 [analysis_report stderr]: /var/cache/bazel/625205d1e0aa59ca514fd964120d6a8a/execroot/_main/bazel-out/k8-fastbuild/bin/quality/static_analysis/codeql_lint.runfiles/+_repo_rules2+codeql_coding_standards/scripts/reports/utils.py:15: SyntaxWarning: invalid escape sequence '\d'
  return tuple(int(x) if x.isdigit() else x for x in filter(len, filter(None, re.split("(\d+)|-", rule_id))))
Error: Failed to run deviation query
==== reason ====
Unable to run queries: /var/cache/bazel/625205d1e0aa59ca514fd964120d6a8a/execroot/_main/bazel-out/k8-fastbuild/bin/quality/static_analysis/codeql_lint.runfiles/+_repo_rules2+codeql_coding_standards/cpp/common/src/codingstandards/cpp/deviations/ListDeviationRecords.ql,/var/cache/bazel/625205d1e0aa59ca514fd964120d6a8a/execroot/_main/bazel-out/k8-fastbuild/bin/quality/static_analysis/codeql_lint.runfiles/+_repo_rules2+codeql_coding_standards/cpp/common/src/codingstandards/cpp/deviations/InvalidDeviationRecords.ql,/var/cache/bazel/625205d1e0aa59ca514fd964120d6a8a/execroot/_main/bazel-out/k8-fastbuild/bin/quality/static_analysis/codeql_lint.runfiles/+_repo_rules2+codeql_coding_standards/cpp/common/src/codingstandards/cpp/deviations/ListDeviationPermits.ql,/var/cache/bazel/625205d1e0aa59ca514fd964120d6a8a/execroot/_main/bazel-out/k8-fastbuild/bin/quality/static_analysis/codeql_lint.runfiles/+_repo_rules2+codeql_coding_standards/cpp/common/src/codingstandards/cpp/deviations/InvalidDeviationPermits.ql!
==== returncode ====
2
   analysis_report exited with code 1

NicolasFussberger · 2026-09-25T06:38:09Z

From the codeql output:

CodeQL scanned 229 out of 596 C/C++ files in this invocation. Typically CodeQL is configured to analyze a single CodeQL language per invocation, so check other invocations to determine overall coverage information.

We have rust and C++ code in the repo. Do we need to handle them separately in codeql?

NicolasFussberger · 2026-09-25T06:43:11Z

+          bazel run --config=x86_64-linux //quality/static_analysis:codeql_lint -- \
+            --output-dir /tmp/codeql-results/linux \
+            --output-prefix codeql-nightly \
+            --target //score/...


I think this does the analysis as well for test code, is this intended?

NicolasFussberger · 2026-09-25T07:03:27Z

+| `cpp-code-scanning` | CodeQL security/quality suite (`cpp-code-scanning.qls`) | 57 |
+| `cert-cpp-l1` | CERT C++ L1 (`cert-cpp-l1.qls`) | 23 |
+| `cert-c-l1` | CERT C L1 (`cert-c-l1.qls`) | 18 |
+| `code-complexity` | local metrics pack (`code-complexity-queries:suites/thresholds.qls`) | 6 |


Is this list up to date?

codeql_lint.py: error: argument --report: invalid choice: 'cert-cpp-l1' (choose from default, codeql-report-complexity)

NicolasFussberger · 2026-09-25T09:44:55Z

+# Optional record fields: `raised-by` / `approved-by` (name + date) and
+# `permit-id` (see `deviation-permits`).
+# -----------------------------------------------------------------------------
+deviations: []


Do direct inline suppressions in the code also work without any reference to a deviation in this yaml file?

AdhamN861 added 2 commits September 23, 2026 16:06

Codeql Initial Rollout

790c270

Add options to run specific reports

a9e36b0

ANegm-ETAS requested review from FScholPer, MaciejKaszynski, NicolasFussberger, anmittag, antonkri, pawelrutkaq and ramceb as code owners September 24, 2026 14:54

github-project-automation Bot added this to LCM - Lifecycle & Health FT Sep 24, 2026

github-project-automation Bot moved this to Backlog in LCM - Lifecycle & Health FT Sep 24, 2026

ANegm-ETAS requested a deployment to workflow-approval September 24, 2026 14:55 — with GitHub Actions Waiting

Merge branch 'main' into codeql-rollout

58aa62e

ANegm-ETAS requested a deployment to workflow-approval September 24, 2026 14:55 — with GitHub Actions Waiting

NicolasFussberger reviewed Sep 25, 2026

View reviewed changes

NicolasFussberger requested changes Sep 25, 2026

View reviewed changes

NicolasFussberger reviewed Sep 25, 2026

View reviewed changes

change placement of generated report

99d83d7

ANegm-ETAS requested a deployment to workflow-approval September 25, 2026 11:29 — with GitHub Actions Waiting

update toolchain config

6a0519b

ANegm-ETAS requested a deployment to workflow-approval September 25, 2026 13:32 — with GitHub Actions Waiting

fix codeql tracing

819897e

ANegm-ETAS requested a deployment to workflow-approval September 25, 2026 14:26 — with GitHub Actions Waiting

		@@ -0,0 +1,203 @@
		# MISRA C++:2023 Guideline Enforcement Plan (GEP)

		This is the guideline enforcement plan for S-CORE communication for MISRA C++:2023.

Conversation

ANegm-ETAS commented Sep 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

NicolasFussberger commented Sep 25, 2026

Uh oh!

NicolasFussberger commented Sep 25, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

This branch is waiting to be deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

ANegm-ETAS commented Sep 24, 2026 •

edited

Loading