Merge branch 'main' into ignore-path-dependent-destructors-in-translation-classes

Author: jketema

.gitattributes

@@ -75,6 +75,9 @@
 /ruby/extractor/cargo-bazel-lock.json linguist-generated=true
 /ruby/extractor/cargo-bazel-lock.json -merge
 
+# GitHub Agentic Workflows compiled output
+.github/workflows/*.lock.yml linguist-generated=true
+
 # auto-generated files for the C# build
 /csharp/paket.lock linguist-generated=true
 # needs eol=crlf, as `paket` touches this file and saves it as crlf

.github/labeler.yml

@@ -38,6 +38,10 @@ Swift:
   - swift/**/*
   - change-notes/**/*swift*
 
+Unified:
+  - unified/**/*
+  - change-notes/**/*unified*
+
 Actions:
   - actions/**/*
   - change-notes/**/*actions*

.github/workflows/label-external-contributions.yml

@@ -20,9 +20,21 @@ jobs:
       pull-requests: write
 
     steps:
+      - name: Create organization membership token
+        id: membership-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.CODEQL_ORG_MEMBERS_APP_CLIENT_ID }}
+          private-key: ${{ secrets.CODEQL_ORG_MEMBERS_APP_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          permission-members: read
+
       - name: Label external contributions
         env:
+          API_URL: ${{ github.api_url }}
           GH_TOKEN: ${{ github.token }}
+          MEMBERS_TOKEN: ${{ steps.membership-token.outputs.token }}
+          ORG: ${{ github.repository_owner }}
           REPO: ${{ github.repository }}
         run: |
           set -euo pipefail
@@ -46,13 +58,13 @@ jobs:
                (.head.repo.full_name | type == "string") and
                .head.repo.full_name != $repo and
                .user.type == "User" and
-               .author_association != "MEMBER" and
-               .author_association != "OWNER" and
+               (.user.login | type == "string" and length > 0) and
                (any(.labels[]?; .name == $label) | not)' \
               >/dev/null <<<"$pr_json"; then
               continue
             fi
 
+            author=$(jq -r '.user.login' <<<"$pr_json")
             events=$(gh api --paginate \
               "repos/$REPO/issues/$pr_number/events?per_page=100" |
               jq -cs 'add')
@@ -63,6 +75,34 @@ jobs:
               continue
             fi
 
+            if ! membership_status=$(curl \
+              --silent \
+              --show-error \
+              --output /dev/null \
+              --write-out '%{http_code}' \
+              --connect-timeout 10 \
+              --max-time 30 \
+              --header "Accept: application/vnd.github+json" \
+              --header "Authorization: Bearer $MEMBERS_TOKEN" \
+              --header "X-GitHub-Api-Version: 2022-11-28" \
+              "$API_URL/orgs/$ORG/members/$author"); then
+              echo "::error::Membership check failed for pull request #$pr_number."
+              exit 1
+            fi
+
+            case "$membership_status" in
+              204)
+                echo "Pull request #$pr_number was opened by an organization member; skipping."
+                continue
+                ;;
+              404)
+                ;;
+              *)
+                echo "::error::Membership check for pull request #$pr_number returned HTTP $membership_status."
+                exit 1
+                ;;
+            esac
+
             jq -n --arg label "$label" '{labels: [$label]}' |
               gh api --method POST \
                 "repos/$REPO/issues/$pr_number/labels" \

.github/workflows/rust-analysis.yml

@@ -57,6 +57,15 @@ jobs:
         languages: ${{ matrix.language }}
         config-file: ./.github/codeql/codeql-config.yml
 
+    # TODO: Remove once Rust extractor no longer errors on this file
+    - name: Remove malformed rust-analyzer parser fixture
+      shell: bash
+      run: |
+        cargo fetch
+        find "${CARGO_HOME:-$HOME/.cargo}/registry/src" \
+          -path '*/ra_ap_parser-0.0.352/test_data/lexer/err/incomplete_frontmatter_before_unicode.rs' \
+          -delete
+
     - name: Autobuild
       uses: github/codeql-action/autobuild@main
 

.github/workflows/update-rust-analyzer.lock.yml

@@ -0,0 +1,139 @@
+---
+name: Update rust-analyzer
+emoji: 🦀
+description: Update the rust-analyzer version used by the Rust extractor and prepare a pull request.
+intent: Keep the Rust extractor on the latest compatible rust-analyzer version with a reviewable, validated pull request.
+on:
+  workflow_dispatch:
+  roles: [admin, maintainer, write]
+permissions:
+  contents: read
+  actions: read
+  pull-requests: read
+  copilot-requests: write
+strict: true
+checkout:
+  fetch-depth: 0
+concurrency:
+  group: update-rust-analyzer
+  cancel-in-progress: false
+timeout-minutes: 180
+tools:
+  github:
+    mode: gh-proxy
+    toolsets: [repos, pull_requests, actions]
+  bash: ["*"]
+  edit: true
+network:
+  allowed:
+    - defaults
+    - github
+    - github-actions
+    - rust
+    - bazel
+    - python
+steps:
+  - name: Configure Git
+    run: |
+      git config user.name "github-actions[bot]"
+      git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+  - name: Install cargo-edit
+    continue-on-error: true
+    run: cargo install cargo-edit@0.13.0 --locked
+
+  - name: Run rust-analyzer updater script
+    run: |
+      mkdir -p /tmp/gh-aw/agent
+      set +e
+      python3 rust/scripts/update_rust_analyzer.py \
+        2>&1 | tee /tmp/gh-aw/agent/rust-analyzer-update.log
+      status=${PIPESTATUS[0]}
+      set -e
+
+      printf '%s\n' "$status" > /tmp/gh-aw/agent/rust-analyzer-update-status.txt
+      if grep -Fxq "No new rust-analyzer version available." \
+        /tmp/gh-aw/agent/rust-analyzer-update.log; then
+        printf '%s\n' "no-update" > /tmp/gh-aw/agent/rust-analyzer-update-result.txt
+      else
+        printf '%s\n' "update" > /tmp/gh-aw/agent/rust-analyzer-update-result.txt
+      fi
+safe-outputs:
+  report-incomplete: {}
+  create-pull-request:
+    title-prefix: "Rust: "
+    branch-prefix: "automation/update-rust-analyzer/"
+    draft: true
+    max-patch-size: 10240
+    max-patch-files: 1000
+    allowed-files:
+      - "Cargo.lock"
+      - "shared/tree-sitter-extractor/Cargo.toml"
+      - "shared/yeast/Cargo.toml"
+      - "shared/yeast-macros/Cargo.toml"
+      - "shared/yeast-schema/Cargo.toml"
+      - "ruby/extractor/Cargo.toml"
+      - "unified/extractor/Cargo.toml"
+      - "unified/swift-syntax-rs/Cargo.toml"
+      # A rust-analyzer update can require a newer Rust toolchain whose Clippy
+      # lints require compatibility fixes in any of the Rust sources.
+      # rust-analyzer dependency updates can also update tree-sitter APIs,
+      # requiring compatibility fixes in the shared extractor implementation.
+      - "shared/yeast/src/**"
+      - "shared/yeast-macros/src/**"
+      - "shared/yeast-schema/src/**"
+      - "shared/tree-sitter-extractor/src/**"
+      - "MODULE.bazel"
+      - "MODULE.bazel.lock"
+      - "rust-toolchain.toml"
+      - "rust/**"
+      - "misc/bazel/3rdparty/**"
+---
+
+# Update rust-analyzer
+
+## Task
+
+The workflow has already run `rust/scripts/update_rust_analyzer.py`. Read:
+
+- `/tmp/gh-aw/agent/rust-analyzer-update.log` for its complete output.
+- `/tmp/gh-aw/agent/rust-analyzer-update-status.txt` for its exit status.
+- `/tmp/gh-aw/agent/rust-analyzer-update-result.txt` for the deterministic result classification.
+
+If the result is `no-update`, call `noop` with the reason
+`No new rust-analyzer version available.` and stop immediately. Do not inspect
+CI, modify files, or create a pull request.
+
+Otherwise, continue the update from the existing working tree and commits:
+
+1. Read `rust/updating-rust-analyzer.md` and all applicable repository
+   instructions.
+2. Review the updater log, exit status, commits, and working tree. Do not rerun
+   the updater script.
+3. Complete as much of the documented update as possible. Fix extractor or
+   code-generation breakage, keep all `ra_ap_` dependency versions aligned,
+   regenerate required files, and add schema upgrade/downgrade scripts, tests,
+   and a change note when the schema changed.
+4. Run the relevant formatting, linting, code generation, build, and tests,
+   including `bazel run //rust:install`. Use `gh` to inspect relevant existing
+   CI configuration and prior failures while diagnosing problems.
+5. Review the complete diff and commits. Do not include secrets. Do not refer
+   to private repositories, internal issues, or internal pull requests in the
+   public pull request.
+6. Use `create_pull_request` exactly once to create a focused draft pull
+   request. Summarize the updater output, changes, and validation. If the
+   update cannot be finished, still create a partial draft pull request when
+   there are useful changes, and clearly list failures, missing work, and the
+   next commands for a maintainer.
+
+The pull request is created after this agent execution, so its newly triggered
+CI cannot be awaited in this run. Compensate with the strongest practical
+local validation and state this limitation accurately in the pull request.
+If the updater did not report `no-update` but no useful patch can be produced,
+call `report_incomplete` with the updater failure and exact blocker.
+
+## Safe Outputs
+
+- Use `create_pull_request` for the update or partial update.
+- Use `noop` only for the exact no-update result.
+- Use `report_incomplete` only when no useful pull request can be created.

.github/workflows/update-rust-analyzer.md

@@ -16,15 +16,17 @@ If you have an idea for a query that you would like to share with other CodeQL u
 
 1. **Directory structure**
 
-    There are eight language-specific query directories in this repository:
+    There are ten language-specific query directories in this repository:
 
+      * Actions: `actions/ql/src`
       * C/C++: `cpp/ql/src`
       * C#: `csharp/ql/src`
       * Go: `go/ql/src`
       * Java/Kotlin: `java/ql/src`
       * JavaScript: `javascript/ql/src`
       * Python: `python/ql/src`
       * Ruby: `ruby/ql/src`
+      * Rust: `rust/ql/src`
       * Swift: `swift/ql/src`
 
     Each language-specific directory contains further subdirectories that group queries based on their `@tags` or purpose.
@@ -75,7 +77,3 @@ After the experimental query is merged, we welcome pull requests to improve it.
 If you contribute to this project, we will record your name and email address (as provided by you with your contributions) as part of the code repositories, which are public. We might also use this information to contact you in relation to your contributions, as well as in the normal course of software development. We also store records of CLA agreements signed in the past, but no longer require contributors to sign a CLA. Under GDPR legislation, we do this on the basis of our legitimate interest in creating the CodeQL product.
 
 Please do get in touch (privacy@github.com) if you have any questions about this or our data protection policies.
-
-## Bazel
-Please notice that any bazel targets and definitions in this repository are currently experimental
-and for internal use only.