Skip to content

IaC: Do not pin CodeQL to a specific commit. - #409

Merged
Mathias Vorreiter Pedersen (MathiasVP) merged 1 commit into
mainfrom
do-not-pin-codeql
Oct 27, 2026
Merged

Mathias Vorreiter Pedersen (MathiasVP) merged 1 commit into
mainfrom
do-not-pin-codeql

Conversation

@MathiasVP

Copy link
Copy Markdown
Collaborator

For some reason the IaC extractor was hardcoded to use a specific (old) version of CodeQL from February last year. This version has a bug in the tree-sitter-based that's been fixed in github#18770. However, since the IaC extractor (which uses tree-sitter for extraction) was pinned to an older version we still had this bug lying around.

Chanel (@chanel-y) noticed this problem in an issue where she got a database consistency error:

+[INVALID_KEY] predicate containerparent(@container parent, @container child): The key set {child} does not functionally determine all fields.
+Here is a pair of tuples that agree on the key set but differ at index 0:
+Tuple 1 in row 13: (13,12)
+Tuple 2 in row 14: (143,12)
+	Relevant element: Tuple 1: parent=13
+		Full ID for 13: @"D:/;folder"
+	Relevant element: Tuple 2: parent=143
+		Full ID for 143: @"D:;folder"
+	Relevant element: child=12
+		Full ID for 12: @"D:/a;folder"
[39/79 eval 62ms] FAILED(EXTRACTION) D:\a\_work\1\s\codeql\iac\ql\test\queries-tests\CloudFormation\ECS\PublicIP\DB-CHECK

Ideally, this PR should just be changing:

codeql-extractor = { git = "https://github.com/github/codeql", rev = "c524a98eb91c769cb2994b8373181c2ebd27c20f" }

to

codeql-extractor = { path = "../../shared/tree-sitter-extractor" }

However, a bunch of packages had to be updated to account for the fact that newer versions of the tree-sitter extractor uses more packages (and newer versions of existing packages).

@MathiasVP
Mathias Vorreiter Pedersen (MathiasVP) merged commit 193c01b into main Oct 27, 2026
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants