Issues using published codeql pack
- 主要語言
- CodeQL
- 星號
- 10.1k
- 分支
- 2.1k
- 平均合併
- 2 天 15 小時
- 30 天內合併 PR
- 141
描述
**Description of the issue**
I published a custom CodeQL pack and am trying to test it on a new machine but I am running into some unexpected behavior. I have reproduced the issue with codeql cli version 2.15.4 and 2.16.0
in the qlpack.yml file I have the following dependencies
```
dependencies:
codeql/cpp-queries: 0.9.0
codeql/cpp-all: 0.12.1
```
(I also tried using "*" as the version instead of specifying a version and get the same result)
I run codeql pack install to install these to my machine before publishing.
I then run codeql pack publish.
On the new machine I run `codeql pack download ` and it successfully downloads the pack.
I then try to use the new pack to analyze a database but get an error stating codeql/cpp-queries@0.9.0 cannot be found.
```
A fatal error occurred: The QL pack 'codeql/cpp-queries@0.9.0' which is referenced from cannot be found.
```
After this I try running `codeql pack install` on the install directory of my codeql pack. This generates several warnings about packs being found via "--additional-packs" and nothing gets installed.
```
WARNING: Pack 'codeql/cpp-all' was found via '--additional-packs'. If the generated 'codeql-pack.lock.yml' file is committed to source control, other users will also have to use '--additional-packs' when compiling or running queries. (\.codeql\libraries\codeql\cpp-all\0.12.3\qlpack.yml:1,1-1)
WARNING: Pack 'codeql/dataflow' was found via '--additional-packs'. If the generated 'codeql-pack.lock.yml' file is committed to source control, other users will also have to use '--additional-packs' when compiling or running queries. (\.codeql\libraries\codeql\dataflow\0.1.6\qlpack.yml:1,1-1)
WARNING: Pack 'codeql/rangeanalysis' was found via '--additional-packs'. If the generated 'codeql-pack.lock.yml' file is committed to source control, other users will also have to use '--additional-packs' when compiling or running queries. (\.codeql\libraries\codeql\rangeanalysis\0.0.5\qlpack.yml:1,1-1)
WARNING: Pack 'codeql/ssa' was found via '--additional-packs'. If the generated 'codeql-pack.lock.yml' file is committed to source control, other users will also have to use '--additional-packs' when compiling or running queries. (.codeql\libraries\codeql\ssa\0.2.6\qlpack.yml:1,1-1)
WARNING: Pack 'codeql/tutorial' was found via '--additional-packs'. If the generated 'codeql-pack.lock.yml' file is committed to source control, other users will also have to use '--additional-packs' when compiling or running queries. (.codeql\libraries\codeql\tutorial\0.2.6\qlpack.yml:1,1-1)
WARNING: Pack 'codeql/typetracking' was found via '--additional-packs'. If the generated 'codeql-pack.lock.yml' file is committed to source control, other users will also have to use '--additional-packs' when compiling or running queries. (.codeql\libraries\codeql\typetracking\0.2.6\qlpack.yml:1,1-1)
WARNING: Pack 'codeql/util' was found via '--additional-packs'. If the generated 'codeql-pack.lock.yml' file is committed to source control, other users will also have to use '--additional-packs' when compiling or running queries. (\.codeql\libraries\codeql\util\0.2.6\qlpack.yml:1,1-1)
WARNING: To avoid these warnings in the future, use the '--no-strict-mode' option. (\qlpack.yml:1,1-1)
Dependencies resolved. Installing packages...
Install location: C:\Users\Administrator\.codeql\packages
Nothing to install.
Package install location: C:\Users\Administrator\.codeql\packages
Nothing downloaded.
```
Trying to analyze a database again results in the same error that codeql/cpp-queries@0.9.0 cannot be found.
However, if again run `codeql pack install` on the install directory of my codeql pack, it runs without warnings, the dependencies are downloaded, and I can run analysis.
If I try using the "--no-strict-mode" flag when running the install command, it will again not install anything the first time (this time without warnings) and I get errors trying to analyze, then if I rung the command a second time it will download the dependencies. (same behavior as without --no-strict-mode but this time without showing warnings)
My main questions are:
1. Why I get these warnings when trying to install dependencies
1. Why I need to run the command twice to get the expected behavior
1. If this behavior actually is expected, is something specific I need to do to avoid it
貢獻指南
評估
這個 Issue 還沒有評估資料。