Specify default queries in codeql-extractor.yml#20320
Conversation
There was a problem hiding this comment.
Pull Request Overview
This PR adds default query specifications to CodeQL extractor configuration files to enable dynamic language detection. The change moves away from hard-coded language lists in the CodeQL Action to a system where languages are automatically detected based on the presence of extractors with default queries.
- Adds
default_queriesfield to all CodeQL language extractor configuration files - Each language specifies its corresponding query pack (e.g.,
codeql/swift-queries,codeql/rust-queries) - Enables third-party extractor development without requiring Action modifications
Reviewed Changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| swift/codeql-extractor.yml | Adds default_queries pointing to codeql/swift-queries |
| rust/codeql-extractor.yml | Adds default_queries pointing to codeql/rust-queries |
| ruby/codeql-extractor.yml | Adds default_queries pointing to codeql/ruby-queries |
| python/codeql-extractor.yml | Adds default_queries pointing to codeql/python-queries |
| javascript/resources/codeql-extractor.yml | Adds default_queries pointing to codeql/javascript-queries |
| go/codeql-extractor.yml | Adds default_queries pointing to codeql/go-queries |
| csharp/codeql-extractor.yml | Adds default_queries pointing to codeql/csharp-queries |
| actions/extractor/codeql-extractor.yml | Adds default_queries pointing to codeql/actions-queries |
michaelnebel
left a comment
There was a problem hiding this comment.
C# LGTM!
Out of curiosity: Why is the pack name used instead of a query suite?
Each of those packs should have a default query suite. |
|
What about the |
It doesn't have a published query pack, as far as I can tell. We can add the default queries if we end up publishing a query pack. |
What Arthur said, and also we need to know where to find the query suite, e.g. if it's in a repo, what repo, what version, what GitHub instance, whether there's any auth necessary, etc. We already built a bunch of infrastructure around CodeQL packs to do all of this, so it's convenient to reuse that. |
The current CodeQL Action relies on a hard-coded list of supported languages. This PR specifies default queries for each CodeQL language, allowing us to remove that list and instead detect languages dynamically:
We now select languages whose extractors are present in the CodeQL search path and provide default queries.
Reasoning:
codeql/<lang>-queriesdefault queries in the CLI.