From efc2c86f03d94cfecb3b2c72f2b6508ec1b7ee8a Mon Sep 17 00:00:00 2001 From: Dmitriy Vasyura Date: Sun, 6 Sep 2026 04:03:23 -0700 Subject: [PATCH] Create custom CodeQL workflow (#334739) * Create custom CodeQL workflow * build: Exclude nested esbuild scripts from CodeQL Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * build: Align CodeQL coverage with packaged files Keep Markdown build/test scripts out of the extension package and restore scanning of the shipped chat-library postinstall script. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * ci: Expand CodeQL release coverage and scope permissions Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/codeql/codeql-config.yml | 116 ++++++++++++++++-- .github/workflows/codeql.yml | 51 ++++++++ CodeQL.yml | 30 ----- build/azure-pipelines/dependencies-check.yml | 2 + .../publish-types/publish-types.yml | 4 + extensions/copilot/CodeQL.yml | 5 - extensions/copilot/build/update-assets.yml | 4 + .../markdown-language-features/.vscodeignore | 1 + .../src/task/taskProvider.ts | 12 +- 9 files changed, 172 insertions(+), 53 deletions(-) create mode 100644 .github/workflows/codeql.yml delete mode 100644 CodeQL.yml delete mode 100644 extensions/copilot/CodeQL.yml diff --git a/.github/codeql/codeql-config.yml b/.github/codeql/codeql-config.yml index f9316cdcd7db..e95ecc8404be 100644 --- a/.github/codeql/codeql-config.yml +++ b/.github/codeql/codeql-config.yml @@ -1,21 +1,115 @@ -# Apply this file to CodeQL default setup with the repository property: -# github-codeql-config-file: ./.github/codeql/codeql-config.yml +# Applied by .github/workflows/codeql.yml. paths-ignore: - # Keep directory exclusions scoped: product code imports helpers from some - # extension src/test directories. - - 'test/**' - - 'src/**/test/**' - - 'build/**/test/**' + # Development, build, packaging, and CI tooling, not shipped product code. + - '.agents/**' + - '.eslint-plugin-local/**' + - '.github/**' + - '.vscode-test.js' + - '.vscode/**' + - 'build/**' + - 'cli/build.rs' + - 'eslint.config.js' + - 'extensions/**/.esbuild.*' + - 'extensions/*/build/**' + - 'extensions/*/esbuild*.mts' + - 'extensions/*/scripts/**' + - 'extensions/copilot/.eslintplugin/**' + - 'extensions/copilot/.mocha-multi-reporters.js' + - 'extensions/copilot/.mocharc.js' + - 'extensions/copilot/.vscode-test.mjs' + - 'extensions/copilot/.vscode/**' + - 'extensions/copilot/chat-lib/vitest.config.ts' + - 'extensions/copilot/script/**' + - 'extensions/copilot/vite.config.ts' + - 'extensions/esbuild*.mts' + - 'extensions/postinstall.mjs' + - 'extensions/search-result/syntaxes/generateTMLanguage.js' + - 'gulpfile.mjs' + - 'scripts/**' + + # Generated build output and dependencies; analyze the product sources instead. + - '**/node_modules/**' + - '**/out/**' + - '.build/**' + - 'cli/target/**' + - 'coverage/**' + - 'extensions/**/dist/**' + - 'out*/**' + + # Test directories, fixtures, and helpers. - 'cli/tests/**' - - '.eslint-plugin-local/tests/**' + - 'extensions/*/server/**/test/**' + - 'extensions/*/test-workspace/**' - 'extensions/*/test/**' - 'extensions/*/tests/**' + - 'extensions/configuration-editing/src/test/**' + - 'extensions/copilot/src/extension/**/test/**' + - 'extensions/copilot/src/extension/agents/node/adapters/openaiAdapterForSTests.ts' + - 'extensions/copilot/src/extension/typescriptContext/serverPlugin/fixtures/**' + - 'extensions/copilot/src/lib/**/test/**' + - 'extensions/copilot/src/platform/**/test/**' + - 'extensions/copilot/src/platform/commands/common/mockRunCommandExecutionService.ts' + - 'extensions/copilot/src/platform/notebook/common/mockAlternativeContentService.ts' + - 'extensions/copilot/src/platform/tasks/common/testTasksService.ts' + - 'extensions/copilot/src/sanity-test-extension.ts' + - 'extensions/copilot/src/shared-fetch-utils/**/test/**' + - 'extensions/copilot/src/test-extension.ts' + # Standalone chat-lib rewrites runtime VS Code API imports to util/common/test/shims. + # These are required runtime dependencies, not tests; exclude only their test-only siblings. + - 'extensions/copilot/src/util/common/test/annotatedSrc.ts' + - 'extensions/copilot/src/util/common/test/mockChatResponseStream.ts' + - 'extensions/copilot/src/util/common/test/simpleMock.ts' + - 'extensions/copilot/src/util/common/test/testUtils.ts' + - 'extensions/copilot/src/util/node/test/**' + - 'extensions/copilot/src/util/test/**' + - 'extensions/emmet/src/test/**' + - 'extensions/git-base/src/test/**' + - 'extensions/git/src/test/**' + - 'extensions/github-authentication/src/test/**' + - 'extensions/github/src/test/**' + - 'extensions/ipynb/src/test/**' + - 'extensions/markdown-language-features/src/test/**' + - 'extensions/microsoft-authentication/src/**/test/**' + - 'extensions/notebook-renderers/src/test/**' + - 'extensions/npm/src/test/**' + - 'extensions/terminal-suggest/fixtures/**' + - 'extensions/terminal-suggest/src/**/test/**' + - 'extensions/typescript-language-features/src/test-all.ts' + - 'extensions/typescript-language-features/src/test/**' + - 'extensions/vscode-api-tests/**' + - 'extensions/vscode-colorize-perf-tests/**' + - 'extensions/vscode-colorize-tests/**' + - 'extensions/vscode-test-resolver/**' + - 'src/**/test/**' + - 'src/vs/workbench/contrib/terminal/browser/terminalTestHelpers.ts' + - 'test/**' + # Keep exact suffixes: themes.test.contribution.ts ships in the product. + - '**/*.fixture.cjs' + - '**/*.fixture.cts' + - '**/*.fixture.js' + - '**/*.fixture.jsx' + - '**/*.fixture.mjs' + - '**/*.fixture.mts' + - '**/*.fixture.ts' + - '**/*.fixture.tsx' + - '**/*.sanity-test.ts' + - '**/*.sanity-test.tsx' + - '**/*.spec.cjs' + - '**/*.spec.cts' + - '**/*.spec.js' + - '**/*.spec.jsx' + - '**/*.spec.mjs' + - '**/*.spec.mts' + - '**/*.spec.ts' + - '**/*.spec.tsx' + - '**/*.stest.ts' + - '**/*.stest.tsx' + - '**/*.test.cjs' + - '**/*.test.cts' - '**/*.test.js' - '**/*.test.jsx' - '**/*.test.mjs' - - '**/*.test.cjs' + - '**/*.test.mts' - '**/*.test.ts' - '**/*.test.tsx' - - '**/*.test.mts' - - '**/*.test.cts' diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 000000000000..b662810c09cf --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,51 @@ +name: CodeQL + +on: + push: + branches: + - main + - 'release/**/*' + pull_request: + branches: + - main + - 'release/**/*' + schedule: + - cron: '17 19 * * 6' + +permissions: {} + +jobs: + analyze: + name: Analyze (${{ matrix.language }}) + runs-on: ubuntu-latest + permissions: + actions: read + contents: read + packages: read + security-events: write + strategy: + fail-fast: false + matrix: + # Other detected languages occur only in test fixtures or build tooling. + include: + - language: javascript-typescript + build-mode: none + - language: rust + build-mode: none + + steps: + - name: Checkout repository + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + + - name: Initialize CodeQL + uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 + with: + languages: ${{ matrix.language }} + build-mode: ${{ matrix.build-mode }} + dependency-caching: true + config-file: ./.github/codeql/codeql-config.yml + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 + with: + category: /language:${{ matrix.language }} diff --git a/CodeQL.yml b/CodeQL.yml deleted file mode 100644 index ca99d172935b..000000000000 --- a/CodeQL.yml +++ /dev/null @@ -1,30 +0,0 @@ -path_classifiers: - test: - # Classify all files in the top-level directories test/ and testsuites/ as test code. - - test - # Classify all files with suffix `.test` as test code. - # Note: use only forward slash / as a path separator. - # * Matches any sequence of characters except a forward slash. - # ** Matches any sequence of characters, including a forward slash. - # This wildcard must either be surrounded by forward slash symbols, or used as the first segment of a path. - # It matches zero or more whole directory segments. There is no need to use a wildcard at the end of a directory path because all sub-directories are automatically matched. - # That is, /anything/ matches the anything directory and all its subdirectories. - # Always enclose the expression in double quotes if it includes *. - - "**/*.test.ts" - - # The default behavior is to tag all files created during the - # build as `generated`. Results are hidden for generated code. You can tag - # further files as being generated by adding them to the `generated` section. - generated: - # generated code. - - out - - "out-build" - - "out-vscode" - - "**/out/**" - - ".build/distro/cli-patches/index.js" - - # The default behavior is to tag library code as `library`. Results are hidden - # for library code. You can tag further files as being library code by adding them - # to the `library` section. - library: - - "**/node_modules/**" diff --git a/build/azure-pipelines/dependencies-check.yml b/build/azure-pipelines/dependencies-check.yml index af659e714bdc..804aedc22042 100644 --- a/build/azure-pipelines/dependencies-check.yml +++ b/build/azure-pipelines/dependencies-check.yml @@ -7,6 +7,8 @@ parameters: type: string variables: + - name: Codeql.SkipTaskAutoInjection + value: true - name: NPM_REGISTRY value: "https://pkgs.dev.azure.com/monacotools/Monaco/_packaging/vscode/npm/registry/" - name: VSCODE_QUALITY diff --git a/build/azure-pipelines/publish-types/publish-types.yml b/build/azure-pipelines/publish-types/publish-types.yml index 25dbf1f185a4..28e0c44a9b6d 100644 --- a/build/azure-pipelines/publish-types/publish-types.yml +++ b/build/azure-pipelines/publish-types/publish-types.yml @@ -6,6 +6,10 @@ trigger: pr: none +variables: + - name: Codeql.SkipTaskAutoInjection + value: true + pool: vmImage: ubuntu-latest diff --git a/extensions/copilot/CodeQL.yml b/extensions/copilot/CodeQL.yml deleted file mode 100644 index 8862580602e0..000000000000 --- a/extensions/copilot/CodeQL.yml +++ /dev/null @@ -1,5 +0,0 @@ -path_classifiers: - tests: - - "test/simulation/fixtures/edit-asyncawait-4151/*.ts" - - "test/simulation/fixtures/edit-slice-4149/*.ts" - - src/platform/parser/test/node/fixtures diff --git a/extensions/copilot/build/update-assets.yml b/extensions/copilot/build/update-assets.yml index ca729aef0dd3..a76c72f27d98 100644 --- a/extensions/copilot/build/update-assets.yml +++ b/extensions/copilot/build/update-assets.yml @@ -1,6 +1,10 @@ trigger: none pr: none +variables: + - name: Codeql.SkipTaskAutoInjection + value: true + resources: repositories: - repository: 1esPipelines diff --git a/extensions/markdown-language-features/.vscodeignore b/extensions/markdown-language-features/.vscodeignore index 31ae4c0eb0bb..0875889991d7 100644 --- a/extensions/markdown-language-features/.vscodeignore +++ b/extensions/markdown-language-features/.vscodeignore @@ -1,5 +1,6 @@ test/** test-workspace/** +scripts/** src/** notebook/** tsconfig*.json diff --git a/extensions/typescript-language-features/src/task/taskProvider.ts b/extensions/typescript-language-features/src/task/taskProvider.ts index b38469ba58d7..c951206d0714 100644 --- a/extensions/typescript-language-features/src/task/taskProvider.ts +++ b/extensions/typescript-language-features/src/task/taskProvider.ts @@ -6,9 +6,9 @@ import * as jsonc from 'jsonc-parser'; import * as path from 'path'; import * as vscode from 'vscode'; -import { wait } from '../test/testUtils'; import { ITypeScriptServiceClient, ServerResponse } from '../typescriptService'; import { coalesce } from '../utils/arrays'; +import { raceTimeout } from '../utils/async'; import { readUnifiedConfig } from '../utils/configuration'; import { Disposable } from '../utils/dispose'; import { exists } from '../utils/fs'; @@ -157,13 +157,11 @@ class TscTaskProvider extends Disposable implements vscode.TaskProvider { const getConfigsTimeout = new vscode.CancellationTokenSource(); token.onCancellationRequested(() => getConfigsTimeout.cancel()); - return Promise.race([ + return (await raceTimeout( this.tsconfigProvider.getConfigsForWorkspace(getConfigsTimeout.token).then(x => Array.from(x)), - wait(this.findConfigFilesTimeout).then(() => { - getConfigsTimeout.cancel(); - return []; - }), - ]); + this.findConfigFilesTimeout, + () => getConfigsTimeout.cancel(), + )) ?? []; } private static async getCommand(project: TSConfig): Promise {