fix(ci): build full workspace for CodeQL Rust scan - #229
Closed
jpage-godaddy wants to merge 2 commits into
Closed
Conversation
cargo build in a mixed package+workspace root only builds the root package, silently skipping tools/generate-api-catalog and all test targets/dev-dependencies. CodeQL's Rust database quality metrics flag low call-target/type resolution partly due to that incomplete build.
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the CodeQL Rust workflow build step to compile the entire Rust workspace (including all targets) so CodeQL can observe more dependencies and improve database quality metrics for analysis.
Changes:
- Switch CodeQL build step from
cargo buildtocargo build --workspace --all-targetsto compile all workspace members and targets during tracing.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
The Analyze job's own CodeQL log showed sysroot_src/proc_macro_server unset and ~2800 macro-expansion failures across 135/152 files for completely ordinary macros (format!, vec!, assert!, json!) — the minimal rustup profile installed by dtolnay/rust-toolchain has no rust-src, so CodeQL's semantic analyzer has no std-library source to resolve against. The prior --workspace --all-targets build fix left the quality metrics byte-for-byte unchanged, confirming the Rust extractor performs its own indexing pass independent of the workflow's Build step.
Collaborator
Author
|
Closing; these changes did not fix the CodeQL warning they were meant to address. Will evaluate later if CodeQL is useful at all for Rust. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
rust/Cargo.tomlis a mixed package+workspace root with nodefault-members, socargo buildonly ever built the rootgodaddy-clipackage —tools/generate-api-catalogand all test targets/dev-dependencies were never compiled. Switched tocargo build --workspace --all-targets.dtolnay/rust-toolchain@stableinstalls theminimalrustup profile (norust-src), which looked like a plausible cause for widespread macro-expansion failures. Addedcomponents: rust-src.format!,vec!,assert!/assert_eq!,json!). Digging into theAnalyzejob log: CodeQL's Rust extractor runs its own indexing pass independent of the workflow'sBuildstep, and its internal config showssysroot_src: None/proc_macro_server: Noneeven after confirmingrust-srcwas actually installed — it isn't picking up the active toolchain's sysroot at all. This looks like a current limitation of the bundled Rust extractor (already on the latestcodeql-bundle-v2.26.3) rather than something fixable from our side.Test plan
cargo build --workspace --all-targetssucceeds locally and in CI, now compilinggenerate-api-catalog, test binaries, and dev-dependencies that previously weren't built.