Build the PowerShell extractor with Bazel - #398
Open
Paolo Tranquilli (redsun82) wants to merge 5 commits into
Open
Build the PowerShell extractor with Bazel#398Paolo Tranquilli (redsun82) wants to merge 5 commits into
Paolo Tranquilli (redsun82) wants to merge 5 commits into
Conversation
`//csharp/scripts:git-assembly-info-src` depends on `@semmle_code//:git_info`, which only exists in the internal repository, so no `codeql_csharp_binary` could be built from this repository alone. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Packages that only ship assets for a subset of RIDs, such as `Microsoft.Management.Infrastructure.Runtime.Win`, generate a `select` without a `//conditions:default` branch and fail analysis everywhere else. `rid_filegroup` already resolves to an empty list in that case. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
`bazel build //powershell/...` and `bazel run //powershell:install` now produce the same extractor pack as `build-linux64.ps1`, which keeps working. Projects move to `net10.0` to match the shared `codeql_csharp_library` macro, and `GitInfo` goes away because it is an MSBuild-time source generator that cannot run under `rules_dotnet`; the version string now comes from `AssemblyInformationalVersionAttribute`, as in C#. `Semmle.Extraction.Tests` referenced projects that do not exist here and `Semmle.Pipeline.Tests` was in no solution, so both are removed. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
`Semmle.Pipeline.Tests` builds and is self-contained, so removing it was unrelated to this change. `Semmle.Util.Tests` targeted net6.0 against a net10.0 `Semmle.Util`; bumping it makes its 37 tests run again. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Author
|
@microsoft-github-policy-service agree company="Microsoft" |
Three Windows-only problems: MSYS2 read the `:` in `//powershell:install` as a path-list separator and rewrote the label to `/powershell:install`; `install` resolved its destination into the runfiles copy instead of the workspace; and the hand-rolled smoke test hardcoded the extractor binary name. The smoke test now runs a QL test, so the binary name and wiring come from `codeql-extractor.yml`. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Paolo Tranquilli (redsun82)
force-pushed
the
redsun82-powershell-extractor-bazel
branch
from
September 10, 2026 14:27
74525a0 to
824ad3d
Compare
Paolo Tranquilli (redsun82)
marked this pull request as ready for review
September 10, 2026 15:45
Author
|
cc Chanel (@chanel-y) 🙂 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The PowerShell extractor is the only one Bazel does not know about: it is built by
build-{linux64,osx64,win64}.ps1shelling out todotnet publish, so it gets no toolchain pinning, caching,codeql_packlayout or dependency lockfile.This wires
powershell/into the existing Bazel setup, following the C# extractor.bazel build //powershell/...andbazel run //powershell:installnow produce a pack equivalent tobuild-linux64.ps1. The.ps1scripts andpowershell.slnkeep working.Approach
Reuses the
//misc/bazel:csharp.bzlmacros andcodeql_packunchanged. Dependencies get their own paket group rather than sharingcsharp/paket.*, since the two pin differentMicrosoft.CodeAnalysisversions (5.3.0 vs 4.13.0).Two source changes were needed: projects move to
net10.0, andGitInfois dropped (an MSBuild-time generator that cannot run underrules_dotnet) in favour ofAssemblyInformationalVersionAttribute, which C# already uses.Semmle.Extraction.Testsis deleted: it referencesSemmle.Extraction.CSharp*, which does not exist in this repository, so it never built here.Semmle.Util.Testswas left targeting net6.0 against a net10.0Semmle.Util, so it is bumped instead; its 37 tests pass. It is not wired into Bazel becausecodeql_xunit_testhardcodes@paket.mainand//csharp/extractor/Testrunner, and routing PowerShell through those would couple it to the C# paket group. Worth doing separately.Worth a careful look
rules_dotnetbumped to0.21.5-codeql.2with a new patch.System.Management.Automationpulls in a Windows-only package whosetfm_filegroupemits aselectwith no//conditions:default, so analysis fails on every other platform. The patch falls back to an empty filegroup, mirroring the neighbouringrid_filegroup. Needs forward-porting on the next upgrade.Microsoft.ApplicationInsightspinned to 2.22.0.strategy: maxresolved 3.1.2, dragging ~28 OpenTelemetry, Azure and Identity assemblies into the pack thatdotnet publishdoes not produce.git_infostub undermisc/bazel/semmle_code_stub.//csharp/scripts:git-assembly-info-srcdepends on@semmle_code//:git_info, which only exists internally, so previously nocodeql_csharp_binarycould be built from this repository alone. This incidentally fixes//csharp/extractor/...too.build-win64.ps1job is unchanged; apowershell-bazel-buildjob (ubuntu + windows) adds build, install and an extraction smoke test.Validation
bazel build //powershell/...andbazel run //powershell:installsucceed; analysis is clean underwin-x64,osx-arm64andlinux-arm64.dotnet publishof the standalone project, except for_._,build.manifest*and Roslyn satellite.resources.dll/.pdb.dotnet publishbuild.codeql test run powershell/ql/test: 102 of 103. The failure (library-tests/ast/parent.ql) is pre-existing and order-dependent, passing in isolation; traps are identical between builds, so it is not caused by this change.dotnet publish powershell/extractor/powershell.slnstill works.QL library and query pack packaging is intentionally out of scope, left as a follow-up.