You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This introduces common "verbs" (build, test, format, lint, generate) that individual parts of the project can implement, and the shared infrastructure in misc/just/ behind them.
This supersedes #19978, which had accumulated too much history to review. Same content, recreated as a readable commit series on top of main, plus the fixes listed below.
# name a single test directory — goes straight to the suite that owns it
just test rust/ql/test/query-tests/diagnostics
# aim at a tree — every recipe found underneath runs
just format cpp # → bazel files under cpp/, then cpp/ql QL formatting
just generate .# → rust, then swift# several arguments, grouped by the recipe that serves them
just build rust java
just test java/ql/test java/ql/integration-tests
# flags reach the runner
just test go/ql/test + # + is short for --all-checks# repo-wide: runs what is cheap, names what it passed over
just test.# each verb has a short alias: t, b, f, l, g (and gen)
just t rust/ql/test/query-tests/diagnostics
just f cpp
Forwarding
A verb is spelled the same everywhere, but what it means is defined per language, next to the code it acts on. The forwarder finds the justfiles implementing a verb for each of its arguments, so there is no central list of who implements what.
Justfiles are looked for in both directions from an argument:
above it, where the recipe is passed the argument itself, as that says what to act on
below it, where the recipe is passed its own directory, as there the argument only said where to look
Every distinct recipe found this way runs. Recipes are compared by value, so one reached through import is recognised as the same job and runs once, while a cross-cutting recipe higher up composes with the more specific ones below instead of hiding them. Arguments are grouped by the recipe they resolve to, so just build rust java works.
Two things keep the search useful:
a justfile can set explicit_verbs to stay out of reach of a verb aimed at one of its parents. QL test suites use this: just test . no longer sweeps whole language suites, which take a long time. A verb that passes over such a directory says so and names it.
a root that forwards a verb has already spent the plain name on the forwarder, so it names its own implementation _root_<verb>. That is how the root formats bazel files, which belong to no single language, while just format cpp stays within cpp.
Running QL tests
by default the CLI is built from the internal repo; nothing is built when working in codeql standalone
--all-checks, abbreviated +, adds the extra checks CI runs, configured per language
--codeql=built skips the build step, consistent with the same pytest option
set lists (casey/just#1988, now fixed) replaces the whitespace-separated string blobs that the old version used to encode recipe arguments, along with the re-splitting in the Python helpers. That encoding could not carry an argument faithfully: one containing a space was silently split in two, and a value that was set but empty could not be written at all, which is why the Kotlin tests spelled CODEQL_EXTRACTOR_KOTLIN_DIAGNOSTIC_LIMIT with a literal space, to leave something for the split to find.
Bugs fixed along the way:
formatting no longer breaks on the many paths in this repository containing spaces
go language-tests-386 is restored
RAM_PER_THREAD and the nolang search path are passed through
Caveats
When one verb runs several recipes, any non-positional argument has to be understood by all of them. This works for options like --learn or --codeql, which the shared test definitions all accept.
Companion PR
The internal repo companion PR ports all languages to this infrastructure and updates CI accordingly.
ARGS is accepted but never appended to the Bazel invocation, so forwarded options such as just test misc/codegen --test_output=errors are silently discarded. The other Bazel-backed test recipes concatenate their variadic arguments; this recipe should do the same.
Do not treat an unreadable justfile as successfully skipped
misc/just/forward_command.py:149
A failed just --dump is only printed and then removed from parsed. If another recipe is found, forwarding runs it and returns success even though the unreadable justfile may implement the requested verb, so automation can silently skip part of the requested tree. Propagate probe failures to forward and make the overall command fail after reporting them.
Propagate Git discovery failures
misc/just/forward_command.py:162
Returning an empty list makes a failed git ls-files indistinguishable from a directory containing no justfiles. When an enclosing recipe is still found, the command can complete with status 0 while all implementations below the argument were never discovered. Preserve this failure and return a nonzero forwarding status instead of treating it as an empty result.
Group invocations by recipe identity, not justfile path
misc/just/forward_command.py:359
The PR promises that imported recipes are compared by value and run once, but aggregation here keys only by the justfile path after resolve has discarded the recipe value. The same imported recipe reached through different justfiles across arguments therefore runs twice—for example, python/justfile imports python/ql/justfile, so just format python python/ql creates separate invocations for one QL-formatting recipe. Preserve the recipe identity from resolution and use it to group arguments while retaining one invocation context.
Require the internal checkout before creating the long path
python/justfile:9
In a standalone checkout SEMMLE_CODE is the empty stub value, so this recipe constructs /ql/python/... and attempts to create directories at the filesystem root before _language_tests can report that an internal checkout is required. Add _require_semmle_code as this helper's dependency so standalone invocations fail safely before running the body.
These examples use the internal checkout's ql/<language> layout, while this repository has rust/... and cpp/... (as line 17 itself notes). They therefore fail when copied from this README in codeql; moreover, cpp/ql/test opts out of downward test, so just test cpp would not illustrate that behavior. Use public-repository paths and a discoverable subtree such as unified for the downward-test example.
Canonicalize justfiles before grouping invocations
misc/just/forward_command.py:393
The dictionary is keyed by the spelling returned for each argument, so one logical justfile is treated as two jobs when arguments mix relative and absolute paths (or aliases through symlinks). For example, paths under pkg and /checkout/pkg produce two invocations of the same variadic recipe, contradicting the run-once guarantee. Key by the resolved justfile while retaining one spelling for invocation.
Normalize paths when applying whole-directory subsumption
misc/just/forward_command.py:398
This lexical string comparison misses equivalent spellings such as ./rust/ql/test versus rust/ql/test. If that whole directory and a child path are both supplied, both reach the recipe even though the comment promises the child will be subsumed, potentially running overlapping tests twice. Compare resolved paths instead.
Run the real-just compatibility tests in CI
misc/just/test_forward_command.py:419
Both compatibility classes are skipped unless just is already on PATH, but the new ubuntu-latest job only runs Bazel and the current runner image does not include just. Consequently CI reports success without executing the tests that validate the hand-written dump fixtures and recipe deduplication against the required tool. Provision a pinned supported just binary to this test or the workflow instead of silently skipping.
Use the repository's actual Rust test path
misc/just/README.md:22
From this repository root, ql/rust/ql/test/{a,b} does not exist; the Rust suite introduced by this PR is at rust/ql/test, as the following sentence itself states. The documented command therefore fails in the standalone checkout.
This issue also appears in the following locations of the same file:
Canonicalize justfiles before grouping forwarded work
misc/just/forward_command.py:393
The same physical justfile is keyed by its user-facing spelling here. If one argument is relative and another absolute (or reached through a symlink), invocation_path returns different Path values, so the implementation is invoked more than once despite the documented once-per-recipe behavior. Key the group by the resolved justfile while retaining one spelling for the eventual invocation.
These queries live next to the C++ QL tests they check, so that `codeql test
run --consistency-queries` can find them without an internal checkout.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
`lint.py --format-only` gives the upcoming `just format` verb a way to
reformat without failing on pre-existing lint findings.
codegen.sh looked up its runfiles via `external/ql+`, which only resolves
in a main-repository layout. `../ql+` works from both, so codegen keeps
working when the repository is consumed as a bazel dependency.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Adds a shared `just` infrastructure for `build`, `test`, `format`, `lint` and
`generate`, and wires every language into it.
A verb is discovered by walking up from the current directory to find the nearest
justfile that implements it (with a forwarder retrying `just <verb>` from there), and
by walking down to find every recipe nested under the argument, since a verb higher up
usually does a different job rather than a broader version of one further down. Both
directions run, and every distinct recipe found runs; one reached only through `import`
is the same job and runs once. QL test suites opt out of the downward search, since
running one implicitly would be slow and not something a broad `just test` should
decide unasked.
The initial rollout immediately turned up gaps once every language actually used it:
`format` broke on paths containing spaces, since the file list came from splitting a
shell command's output rather than a proper argument list; a verb run from a nested
directory did not look above it, even though an absolute argument already did; a
directory that only makes sense named explicitly had no way to opt out of implicit
discovery; a passed-over directory marked an otherwise successful run as failed instead
of just being reported; the bazel file walker needed to select by name and skip
generated trees; a forwarding justfile had no way to answer a verb itself rather than
only ever delegating to what it imports; and output needed to be flushed before a
forwarded child writes, so the account of what is about to run cannot land after that
command's own output when both share a redirected stream.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
`format` learns to reformat bazel files (`BUILD.bazel`, `WORKSPACE`, `*.bzl`) through
buildifier, alongside the existing QL and C++ formatters. The root justfile owns it,
since bazel files are spread across the tree rather than gathered under one language;
the buildifier target cannot be driven directly, since its generated wrapper ignores
the paths given to it, so the binary is invoked instead. Formatting reports which files
it rewrote and nothing else, filtering out buildifier's and bazel's noise about files
left untouched.
The internal checkout gets bazel formatting too, rather than being excluded because the
target here is a bazel dev dependency unreachable from a build rooted there: both
repositories depend on the same buildifier binary as the root module of their own
checkout, so asking for it directly resolves either way. What differs is which bazel to
ask and from where, which the file runner can now be told.
Also stops the distribution install log from printing on every command that happens to
need one, showing it only when the install actually fails.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Needing a CodeQL CLI is not a reason to hide a suite, as every QL recipe here needs one
and the rest stay discoverable. Being slow is the whole of it.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Asking bazel from this repository's root formatted a checkout enclosing this one with
this repository's own buildifier version and exclusions, rather than the other's own.
Formatting now bounds the files to the root doing the asking, so each repository
formats what it owns, with its own pin, and a verb spanning both is answered once by
each root.
Along with that:
- a repository can name several sets of generated files to exclude, rather than
spelling the option twice
- a file named `BUILD.<something>` that is not `BUILD.bazel` is not a bazel file, since
bazel only knows `BUILD`/`WORKSPACE` by name and the rest by extension; matching such
templates failed every format whose scope contained one
- batches are sized to the argument limit a command actually hands on to a child
process, not to the shell's own line length limit
- a directory's own formatter recipe no longer looks up its argument twice, once
itself and once via `cd`
- `[no-cd]` is documented, since the forwarder relies on it to keep a relative
argument meaning the caller's directory
- the formatter's exclusions are back in step with the canonical bazel target's,
which also excludes `.git`
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Two comments record traps in the `_root_<verb>` pattern for whoever extends it next: a
body added to it is easy to reach for, but that is exactly where a relative argument
stops meaning the caller's directory; and two roots are told apart only by comparing
their recipes with `doc` excluded, which silently collapses several of the paired-repo
cases if that exclusion is removed as an obvious cleanup.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
…n verbs
A handful of unrelated fixups surfaced while wiring each language into the shared
verbs:
- Go's 32-bit language test recipe was dropped by the rollout; restored
- the Kotlin diagnostic limit reads as empty rather than as a lone space when unset
- Rust's integration tests ask for codegen without also saying where to put it, which
is now the callee's job
- the C++ consistency queries moved earlier opt into implicit-this warnings, matching
the rest of the C++ QL libraries
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
`set allow-duplicate-variables` lets an importing justfile assign a variable defined
here and win, which is how a consuming root points the bazel formatter at its own
workspace, buildifier and exclusions. That makes these variables an interface, not an
implementation detail: `just` has no notion of an assignment that fails to override, so
renaming one leaves a root parsing, listing and passing CI while silently reverting to
the value here, and it stays invisible since the leading underscore that keeps these
out of `just --list` also hides them from `--variables` and a bare `--evaluate`. Asked
by name they do answer, which is the diagnostic worth reaching for.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Two things made the output of a forwarded command hard to follow: the separator
between commands was a fixed 56 dashes, reading as a short dash in a wide terminal
rather than a break between commands; and the banner shown before each one was `just`
echoing the recipe line verbatim, over 500 characters for the bazel one and carrying
an unexpanded `"$@"` that matched no file in another shell.
The separator is now drawn from `stty`-measured terminal width, repeating `#` rather
than following it with dashes so the whole line reads as one thing, a shell comment,
instead of two -- which also matters because the line is interpolated into a shell
script, so a value that is not itself a shell comment would silently run. The width is
exported as `JUST_CMD_RULE` so a forwarded verb inherits it instead of re-measuring in
every justfile it reaches, and nothing changes without a terminal: piped output, CI
logs and Windows still get the original 56 dashes.
The banner is replaced by a `-> `-prefixed report of what the command actually is,
built by the same file runner that decides which files matched, so it reports rather
than merely intends. Buildifier's own output is filtered down to the files it actually
rewrote, keeping only the tally of warnings it could not fix, since fix mode reports
no other detail and always exits 0; its Starlark-file detection gains the one name
this repository's list was missing (`*.star`); an exclusion is now matched against the
absolute path as well as the given one, and resolved through symlinks first, both of
which had let a repository excluding a nested one format it anyway; and naming a path
that does not exist is now an error rather than silent, exit-0 success.
Also folds in a few nearby fixes found the same way: opting out of MSYS2's path-like
argument rewriting once, centrally, instead of per bazel-invoking recipe; printing the
actual `error:` prefix instead of `{error}`, which was Python's interpolation syntax
rather than just's; and moving each formatter's own values next to the recipe that
reads them, instead of a shared header that had to be read whole to make sense of any
one of them.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
…aught
Nothing under `misc/just` had tests, and most of the ways it can break exit zero: an
exclusion that stops excluding, a verb that stops being found, an argument that arrives
split in two. Adds a plain-`unittest` suite, each case paired with a positive control
so a passing test means the rule held rather than that nothing ran, reachable through
the usual `test` recipe and run in CI on any change here.
Writing it immediately caught real bugs: `just --dump` maps an alias name to an object
rather than to its target, so resolving one handed a dict to a dict lookup and raised;
fixed by reading the target where the plain recipe is looked up, and doing so once
rather than once per use, so an alias landing on a forwarder is recognised as that
forwarder rather than reached under the wrong root recipe. The two shapes a consuming
root can actually take -- inheriting a `_root_<verb>` or replacing it -- are pinned by a
test, since neither had ever been exercised; the README's claim about which paired
repository gets a shared root recipe for free is dropped along with it, since it is no
longer true of the one repository it named and nothing here could have caught it going
stale.
The suite itself gets fixed along the way: fixtures are checked against a real
`just --dump`, comparing only the fields the code reads so they stay valid as `just`
gains more; it honours `JUST_EXECUTABLE` so it runs reliably under `bazel test`'s
sandboxed `PATH`; a mis-scoped entry point had left two thirds of it never run at all;
and a verb now fails outright when a candidate justfile cannot be parsed, instead of
silently dropping it and still exiting zero.
Also points the Python tooling workflow's own path filter at itself, rather than at a
file that does not exist in this repository, so editing the tooling actually triggers
its CI.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Overriding one of the shared bazel-formatting variables replaces the whole value, so a
root wanting most of the default exclusions plus one of its own must restate all of
them, not just add to the list. The same `--evaluate name=value` diagnostic used
elsewhere for the override contract itself also shows this in practice.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
`set lists` is what makes argument forwarding work and it did not exist
before 1.58, but nothing here said so. The error an older `just` gives is
clear and points at the line, yet names no version to move to, which is
the gap worth closing in prose rather than with a check.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
`--extra-check` had grown to also select which checks to run at all, so a language
wanting a single non-default check enabled had no way to say so without also asking
for the others; splits it into `--extra-check=` for adding one and `--all-checks` for
running everything, leaving each option meaning one thing.
The three options private to the runner (target, checks, extra checks) were parsed
apart from the CodeQL CLI arguments they are mixed in with, then reassembled by hand
into a dataclass alongside the parsed remainder; argparse now owns all three itself,
removing that reassembly along with a class that existed only to hold it. Along the
way: an argument list containing only blanks is treated as empty, matching how the
tooling handles that elsewhere; passing an empty value later in a merged list now
overrides an earlier non-empty one, since a later assignment doing nothing was
surprising and made per-language justfiles no longer resettable field by field;
and the test runner's own file is brought under `black`, having been the one file
here that was not.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
- restate which `just` version these recipes actually need, correcting the earlier
guess
- three recipes (Kotlin extractor generation and codegen) do what their name promised,
which they had stopped doing since being folded into the shared verbs
- a coding-standards reference in `cpp/justfile` follows the fragment to where it now
lives
- `format` reaches the rest of the checked Python, including the models-as-data
scripts, which had no justfile of their own
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
github-actions
Bot
added
C#
JS
C++
documentation
Java
Python
Go
Ruby
Rust
This introduces common "verbs" (
build,test,format,lint,generate) that individual parts of the project can implement, and the shared infrastructure inmisc/just/behind them.This supersedes #19978, which had accumulated too much history to review. Same content, recreated as a readable commit series on top of
main, plus the fixes listed below.Forwarding
A verb is spelled the same everywhere, but what it means is defined per language, next to the code it acts on. The forwarder finds the justfiles implementing a verb for each of its arguments, so there is no central list of who implements what.
Justfiles are looked for in both directions from an argument:
Every distinct recipe found this way runs. Recipes are compared by value, so one reached through
importis recognised as the same job and runs once, while a cross-cutting recipe higher up composes with the more specific ones below instead of hiding them. Arguments are grouped by the recipe they resolve to, sojust build rust javaworks.Two things keep the search useful:
explicit_verbsto stay out of reach of a verb aimed at one of its parents. QL test suites use this:just test .no longer sweeps whole language suites, which take a long time. A verb that passes over such a directory says so and names it._root_<verb>. That is how the root formats bazel files, which belong to no single language, whilejust format cppstays withincpp.Running QL tests
codeqlstandalone--all-checks, abbreviated+, adds the extra checks CI runs, configured per language--codeql=builtskips the build step, consistent with the same pytest optionWhat changed since #19978
The reason for recreating rather than squashing:
set lists(casey/just#1988, now fixed) replaces the whitespace-separated string blobs that the old version used to encode recipe arguments, along with the re-splitting in the Python helpers. That encoding could not carry an argument faithfully: one containing a space was silently split in two, and a value that was set but empty could not be written at all, which is why the Kotlin tests spelledCODEQL_EXTRACTOR_KOTLIN_DIAGNOSTIC_LIMITwith a literal space, to leave something for the split to find.Bugs fixed along the way:
go language-tests-386is restoredRAM_PER_THREADand the nolang search path are passed throughCaveats
When one verb runs several recipes, any non-positional argument has to be understood by all of them. This works for options like
--learnor--codeql, which the shared test definitions all accept.Companion PR
The internal repo companion PR ports all languages to this infrastructure and updates CI accordingly.