Tianocore/edk2.git/BaseTools/Plugin/CodeQL, branch dependabot/github_actions/actions/setup-python-7

BaseTools/Plugin/CodeQL: Add CodeQL version update script

2026-07-11T01:26:20+00:00

Add a maintenance script that updates the CodeQL CLI dependency YAML files and CodeQlQueries.qls together. The script refreshes the CLI version, release digests, and cpp query pack pin from the GitHub release metadata and the corresponding qlpack.yml in the CodeQL CLI release branch. Add comments to the CodeQL CLI dependency YAML files that direct maintainers to use the script for future version updates. Signed-off-by: Mingjie Shen

BaseTools/Plugin/CodeQL: Update CodeQL CLI to v2.25.3

2026-07-11T01:26:20+00:00

Update CodeQL external dependency definitions to v2.25.3 for generic, Linux, and Windows archives, including refreshed SHA256 hashes from the release metadata. Pin the codeql/cpp-queries query pack to version 1.6.1, as specified in the qlpack.yml at: https://github.com/github/codeql/blob/codeql-cli/v2.25.3/cpp/ql/src/qlpack.yml Signed-off-by: Mingjie Shen

BaseTools: Fix type annotations

2025-05-26T01:02:24+00:00

Fixed type annotations for functions: - `def _parse_pattern(line: str) -> Tuple[str]:` -> `def _parse_pattern(line: str) -> Tuple[bool, str, str]:` - `def get_scopes(codeql_enabled: bool) -> Tuple[str]:` -> `def get_scopes(codeql_enabled: bool) -> Tuple[str, ...]:` Signed-off-by: Roman A

BaseTools/CodeQl: Give preference to Plugin settings

2024-10-09T06:02:34+00:00

For the CodeQl `AuditOnly` flag, prioritize Plugin settings over global settings. This patch adjusts the logic for the global `AuditOnly` setting, placing it before the Plugin setting code. This ensures that Plugin settings take precedence over global settings. Cc: Sean Brogan Cc: Joey Vagedes Cc: Michael D Kinney Cc: Liming Gao Signed-off-by: Abdul Lateef Attar

CodeQlQueries.qls: Pin to the 1.1.0 codeq/cpp-queries pack

2024-07-31T23:02:15+00:00

The codeql/cpp-queries pack used in CodeQlQueries.qls was versioned 1.1.0 for the CodeQL CLI v2.18.1 release currently used. https://github.com/github/codeql/blob/codeql-cli/v2.18.1/cpp/ql/src/qlpack.yml This change pins that pack version to prevent the CodeQL CLI and pack from getting out of sync until explicitly updated. Signed-off-by: Michael Kubacki

BaseTools/codeql: Update to CodeQL 2.18.1

2024-07-26T08:17:11+00:00

Updates to the latest CodeQL version to resolve query dependencies. Signed-off-by: Michael Kubacki

BaseTools/CodeQL: Removed unused static function query

2024-07-16T04:04:33+00:00

This query seems to produce a rate of false positives with some common patterns in edk2 like passing function pointers for callback. Due to the usage of `STATIC` instead of `static` particularly for functions, this query was rarely used in the past. It is removed here to prevent future false positives. Signed-off-by: Michael Kubacki

CodeQL: Update from 2.16.1 to 2.17.3

2024-05-21T02:24:08+00:00

This fixes an issue where the CodeQL queries currently fetched in the pipeline are incompatible with the current executable used. Update to pick up functional and security fixes. See the following comparison for detailed differences: https://github.com/github/codeql-cli-binaries/compare/v2.16.1...v2.17.3 Cc: Bob Feng Cc: Joey Vagedes Cc: Liming Gao Cc: Michael D Kinney Cc: Rebecca Cran Cc: Sean Brogan Cc: Yuwei Chen Signed-off-by: Michael Kubacki Reviewed-by: Michael D Kinney

Update to CodeQL 2.16.1

2024-04-24T23:11:19+00:00

Updates CodeQL to work with the latest queries. Includes functional and security fixes within the CodeQL CLI binary. For more information on release details see: https://github.com/github/codeql-cli-binaries/releases For changes between the previous version (2.14.5) and 2.16.1 see: https://github.com/github/codeql-cli-binaries/compare/v2.14.5...v2.16.1 Cc: Bob Feng Cc: Joey Vagedes Cc: Liming Gao Cc: Michael D Kinney Cc: Rebecca Cran Cc: Sean Brogan Cc: Yuwei Chen Signed-off-by: Michael Kubacki Reviewed-by: Michael D Kinney Reviewed-by: Joey Vagedes

BaseTools/Plugin/CodeQL: Enable 30 queries

2023-11-07T03:19:26+00:00

Updates the CodeQL queries opted into by edk2 to a set of queries from the standard CodeQL query package `codeql/cpp-queries`. After testing a large number of queries the included set here were found to be the most useful with the least number of false positives. Some queries had a number of issues that led to them being placed on the exclusion list so that they are not considered in the future without the notes there being taken into account. General details about queries available in the pack are available here: https://codeql.github.com/codeql-query-help/cpp/ The issues found by these queries will need to be fixed over time. In the meantime, the results will show to those that have permission in the repo's GitHub Code Scanning area. The build will not fail due to CodeQL issues (since they are not all fixed) but that can be enabled in the future. Cc: Bob Feng Cc: Liming Gao Cc: Michael D Kinney Cc: Rebecca Cran Cc: Sean Brogan Cc: Yuwei Chen Signed-off-by: Michael Kubacki Reviewed-by: Sean Brogan Acked-by: Laszlo Ersek Acked-by: Michael D Kinney