github / github/codeql

Issues using published codeql pack

Đang mở
#15,400 17 bình luận 0 reaction 0 người được giao Xem trên GitHub
question
Ngôn ngữ chính
CodeQL
Star
10.1k
Fork
2.1k
Merge trung bình
2 ngày 15 giờ
Pull request đã merge (30 ngày)
141

Mô tả

**Description of the issue**
I published a custom CodeQL pack and am trying to test it on a new machine but I am running into some unexpected behavior. I have reproduced the issue with codeql cli version 2.15.4 and 2.16.0

in the qlpack.yml file I have the following dependencies
```
dependencies:
codeql/cpp-queries: 0.9.0
codeql/cpp-all: 0.12.1
```
(I also tried using "*" as the version instead of specifying a version and get the same result)

I run codeql pack install to install these to my machine before publishing.

I then run codeql pack publish.

On the new machine I run `codeql pack download ` and it successfully downloads the pack.

I then try to use the new pack to analyze a database but get an error stating codeql/cpp-queries@0.9.0 cannot be found.
```
A fatal error occurred: The QL pack 'codeql/cpp-queries@0.9.0' which is referenced from cannot be found.
```
After this I try running `codeql pack install` on the install directory of my codeql pack. This generates several warnings about packs being found via "--additional-packs" and nothing gets installed.
```

WARNING: Pack 'codeql/cpp-all' was found via '--additional-packs'. If the generated 'codeql-pack.lock.yml' file is committed to source control, other users will also have to use '--additional-packs' when compiling or running queries. (\.codeql\libraries\codeql\cpp-all\0.12.3\qlpack.yml:1,1-1)
WARNING: Pack 'codeql/dataflow' was found via '--additional-packs'. If the generated 'codeql-pack.lock.yml' file is committed to source control, other users will also have to use '--additional-packs' when compiling or running queries. (\.codeql\libraries\codeql\dataflow\0.1.6\qlpack.yml:1,1-1)
WARNING: Pack 'codeql/rangeanalysis' was found via '--additional-packs'. If the generated 'codeql-pack.lock.yml' file is committed to source control, other users will also have to use '--additional-packs' when compiling or running queries. (\.codeql\libraries\codeql\rangeanalysis\0.0.5\qlpack.yml:1,1-1)
WARNING: Pack 'codeql/ssa' was found via '--additional-packs'. If the generated 'codeql-pack.lock.yml' file is committed to source control, other users will also have to use '--additional-packs' when compiling or running queries. (.codeql\libraries\codeql\ssa\0.2.6\qlpack.yml:1,1-1)
WARNING: Pack 'codeql/tutorial' was found via '--additional-packs'. If the generated 'codeql-pack.lock.yml' file is committed to source control, other users will also have to use '--additional-packs' when compiling or running queries. (.codeql\libraries\codeql\tutorial\0.2.6\qlpack.yml:1,1-1)
WARNING: Pack 'codeql/typetracking' was found via '--additional-packs'. If the generated 'codeql-pack.lock.yml' file is committed to source control, other users will also have to use '--additional-packs' when compiling or running queries. (.codeql\libraries\codeql\typetracking\0.2.6\qlpack.yml:1,1-1)
WARNING: Pack 'codeql/util' was found via '--additional-packs'. If the generated 'codeql-pack.lock.yml' file is committed to source control, other users will also have to use '--additional-packs' when compiling or running queries. (\.codeql\libraries\codeql\util\0.2.6\qlpack.yml:1,1-1)
WARNING: To avoid these warnings in the future, use the '--no-strict-mode' option. (\qlpack.yml:1,1-1)
Dependencies resolved. Installing packages...
Install location: C:\Users\Administrator\.codeql\packages
Nothing to install.
Package install location: C:\Users\Administrator\.codeql\packages
Nothing downloaded.
```

Trying to analyze a database again results in the same error that codeql/cpp-queries@0.9.0 cannot be found.

However, if again run `codeql pack install` on the install directory of my codeql pack, it runs without warnings, the dependencies are downloaded, and I can run analysis.

If I try using the "--no-strict-mode" flag when running the install command, it will again not install anything the first time (this time without warnings) and I get errors trying to analyze, then if I rung the command a second time it will download the dependencies. (same behavior as without --no-strict-mode but this time without showing warnings)

My main questions are:

1. Why I get these warnings when trying to install dependencies
1. Why I need to run the command twice to get the expected behavior
1. If this behavior actually is expected, is something specific I need to do to avoid it

Hướng dẫn đóng góp

Mở hướng dẫn đóng góp

Đánh giá

Issue này chưa được đánh giá.

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.