Unpin CodeQL pack dependencies by removing committed lock files by Copilot · Pull Request #45 · advanced-security/codeql-development-template

Copilot · 2026-04-21T21:18:51Z

📝 Query Update

Query File: N/A — repository-wide pack configuration change
Language: all (actions, cpp, csharp, go, java, javascript, python, ruby)
Update Type: dependency unpinning

🎯 Changes

What Changed

Deleted all 32 committed codeql-pack.lock.yml files under languages/<lang>/{custom,tools}/{src,test}/.
Added codeql-pack.lock.yml to .gitignore so locally generated lock files are not re-committed.
No changes to qlpack.yml files — they already declare codeql/*-all (and *-queries) as "*".

Why This Change

Committed lock files pinned packs to old versions (e.g. codeql/java-all 7.7.0), blocking template consumers from using features tied to newer libraries — for example, the barrierModel extensible predicate, which requires codeql/java-all shipped with CodeQL 2.25.2+.

Impact

Consumers of this template generate their own codeql-pack.lock.yml on codeql pack install, resolving against whichever CodeQL CLI they have installed. The template no longer dictates a CodeQL version floor/ceiling.

🔍 Before vs. After

Previous Behavior

codeql-pack.lock.yml checked into the repo pinned every transitive dependency, e.g.:

dependencies:
  codeql/java-all:
    version: 7.7.0

New Behavior

Only qlpack.yml is tracked, with floating versions:

dependencies:
  codeql/java-all: "*"

Lock files are produced locally per consumer and ignored by git.

🧪 Testing

New/updated test cases added
All tests pass
Regression tests validated
No unintended side effects

📊 Impact Analysis

Compatibility: backward compatible for consumers on a recent CodeQL CLI; consumers on very old CLIs may resolve different (newer) library versions than before
Performance: neutral
Accuracy: unchanged at the query level; unblocks adoption of newer library features (e.g. sanitizer/validator MaD, barrierModel)

📋 Checklist

Query compiles without errors
Documentation updated
Tests updated with new expectations
Metadata updated if needed

🔗 References

GitHub Changelog: CodeQL now supports sanitizers and validators in models as data
Related: Add data extension prompts, templates, and barrier/barrierGuard support #42

Agent-Logs-Url: https://github.com/advanced-security/codeql-development-template/sessions/a6282c16-1661-4d3b-b8ae-3a50f516d757 Co-authored-by: data-douser <70299490+data-douser@users.noreply.github.com>

data-douser

Review: Additional changes needed before merge

This PR correctly removes committed codeql-pack.lock.yml files and .gitignores future ones — addressing the core issue of lock files pinning pack versions and causing unnecessary churn. However, two follow-up changes are needed to complete this work (per #43):

1. Add `scripts/install-codeql-packs.sh`

Without lock files, users need a clear way to install all workspace packs after cloning. A script similar to codeql-development-mcp-server's install-packs.sh should be added that:

Uses codeql pack ls --format=json to dynamically discover packs from the workspace
Iterates and runs codeql pack install for each pack directory
Includes retry logic for network resilience
Supports --language <lang> filtering

2. Update `qlpack.yml` workspace references from `"*"` to `${workspace}`

All 16 test packs use "*" for their intra-workspace dependency on the corresponding src pack. Per the CodeQL docs, ${workspace} is the recommended placeholder — it makes the workspace-local nature explicit and resolves correctly during both development and publishing.

See file-level comments for details.

- Add scripts/install-codeql-packs.sh using codeql pack ls for dynamic pack discovery with retry and --language filter - Use ${workspace} for intra-workspace deps in test packs - Bump all 32 workspace packs from 0.0.1 to 0.0.2 - Add pack install step to copilot-setup-steps workflow - Add README Step 2 for post-clone pack installation - Revert .gitignore: keep lock files in template-derived repos Resolves review feedback from #45. See also #43.

Copilot

Pull request overview

This PR updates the template’s CodeQL pack dependency strategy by removing committed codeql-pack.lock.yml files (to avoid pinning transitive versions) and introducing automation to (re)generate/install pack dependencies locally/on-CI.

Changes:

Remove committed codeql-pack.lock.yml files across language workspaces to unpin transitive pack versions.
Add a helper script to discover workspace packs and run codeql pack install for each.
Update per-language qlpack.yml versions and adjust test-pack dependencies to reference workspace packs.

Show a summary per file

File	Description
scripts/install-codeql-packs.sh	New script to discover workspace packs and install pack dependencies with retry logic.
resources/cli/codeql/codeql_execute_query-server2.prompt.md	Fixes prompt formatting (removes stray fenced block markers; adds spacing).
README.md	Adds a setup step instructing users to install CodeQL pack dependencies via the new script.
.github/workflows/copilot-setup-steps.yml	Runs pack installation as part of the Copilot setup workflow.
languages/actions/tools/test/qlpack.yml	Bumps pack version; switches local dependency reference style.
languages/actions/tools/test/codeql-pack.lock.yml	Removes committed lockfile to avoid pinning dependencies.
languages/actions/tools/src/qlpack.yml	Bumps pack version to reflect dependency strategy change.
languages/actions/tools/src/codeql-pack.lock.yml	Removes committed lockfile to avoid pinning dependencies.
languages/actions/custom/test/qlpack.yml	Bumps pack version; switches local dependency reference style.
languages/actions/custom/test/codeql-pack.lock.yml	Removes committed lockfile to avoid pinning dependencies.
languages/actions/custom/src/qlpack.yml	Bumps pack version to reflect dependency strategy change.
languages/actions/custom/src/codeql-pack.lock.yml	Removes committed lockfile to avoid pinning dependencies.
languages/cpp/tools/test/qlpack.yml	Bumps pack version; switches local dependency reference style.
languages/cpp/tools/test/codeql-pack.lock.yml	Removes committed lockfile to avoid pinning dependencies.
languages/cpp/tools/src/qlpack.yml	Bumps pack version to reflect dependency strategy change.
languages/cpp/tools/src/codeql-pack.lock.yml	Removes committed lockfile to avoid pinning dependencies.
languages/cpp/custom/test/qlpack.yml	Bumps pack version; switches local dependency reference style.
languages/cpp/custom/test/codeql-pack.lock.yml	Removes committed lockfile to avoid pinning dependencies.
languages/cpp/custom/src/qlpack.yml	Bumps pack version to reflect dependency strategy change.
languages/cpp/custom/src/codeql-pack.lock.yml	Removes committed lockfile to avoid pinning dependencies.
languages/csharp/tools/test/qlpack.yml	Bumps pack version; switches local dependency reference style.
languages/csharp/tools/test/codeql-pack.lock.yml	Removes committed lockfile to avoid pinning dependencies.
languages/csharp/tools/src/qlpack.yml	Bumps pack version to reflect dependency strategy change.
languages/csharp/tools/src/codeql-pack.lock.yml	Removes committed lockfile to avoid pinning dependencies.
languages/csharp/custom/test/qlpack.yml	Bumps pack version; switches local dependency reference style.
languages/csharp/custom/test/codeql-pack.lock.yml	Removes committed lockfile to avoid pinning dependencies.
languages/csharp/custom/src/qlpack.yml	Bumps pack version to reflect dependency strategy change.
languages/csharp/custom/src/codeql-pack.lock.yml	Removes committed lockfile to avoid pinning dependencies.
languages/go/tools/test/qlpack.yml	Bumps pack version; switches local dependency reference style.
languages/go/tools/test/codeql-pack.lock.yml	Removes committed lockfile to avoid pinning dependencies.
languages/go/tools/src/qlpack.yml	Bumps pack version to reflect dependency strategy change.
languages/go/tools/src/codeql-pack.lock.yml	Removes committed lockfile to avoid pinning dependencies.
languages/go/custom/test/qlpack.yml	Bumps pack version; switches local dependency reference style.
languages/go/custom/test/codeql-pack.lock.yml	Removes committed lockfile to avoid pinning dependencies.
languages/go/custom/src/qlpack.yml	Bumps pack version to reflect dependency strategy change.
languages/go/custom/src/codeql-pack.lock.yml	Removes committed lockfile to avoid pinning dependencies.
languages/java/tools/test/qlpack.yml	Bumps pack version; switches local dependency reference style.
languages/java/tools/test/codeql-pack.lock.yml	Removes committed lockfile to avoid pinning dependencies.
languages/java/tools/src/qlpack.yml	Bumps pack version to reflect dependency strategy change.
languages/java/tools/src/codeql-pack.lock.yml	Removes committed lockfile to avoid pinning dependencies.
languages/java/custom/test/qlpack.yml	Bumps pack version; switches local dependency reference style.
languages/java/custom/test/codeql-pack.lock.yml	Removes committed lockfile to avoid pinning dependencies.
languages/java/custom/src/qlpack.yml	Bumps pack version to reflect dependency strategy change.
languages/java/custom/src/codeql-pack.lock.yml	Removes committed lockfile to avoid pinning dependencies.
languages/javascript/tools/test/qlpack.yml	Bumps pack version; switches local dependency reference style.
languages/javascript/tools/test/codeql-pack.lock.yml	Removes committed lockfile to avoid pinning dependencies.
languages/javascript/tools/src/qlpack.yml	Bumps pack version to reflect dependency strategy change.
languages/javascript/tools/src/codeql-pack.lock.yml	Removes committed lockfile to avoid pinning dependencies.
languages/javascript/custom/test/qlpack.yml	Bumps pack version; switches local dependency reference style.
languages/javascript/custom/test/codeql-pack.lock.yml	Removes committed lockfile to avoid pinning dependencies.
languages/javascript/custom/src/qlpack.yml	Bumps pack version to reflect dependency strategy change.
languages/javascript/custom/src/codeql-pack.lock.yml	Removes committed lockfile to avoid pinning dependencies.
languages/python/tools/test/qlpack.yml	Bumps pack version; switches local dependency reference style.
languages/python/tools/test/codeql-pack.lock.yml	Removes committed lockfile to avoid pinning dependencies.
languages/python/tools/src/qlpack.yml	Bumps pack version to reflect dependency strategy change.
languages/python/tools/src/codeql-pack.lock.yml	Removes committed lockfile to avoid pinning dependencies.
languages/python/custom/test/qlpack.yml	Bumps pack version; switches local dependency reference style.
languages/python/custom/test/codeql-pack.lock.yml	Removes committed lockfile to avoid pinning dependencies.
languages/python/custom/src/qlpack.yml	Bumps pack version to reflect dependency strategy change.
languages/python/custom/src/codeql-pack.lock.yml	Removes committed lockfile to avoid pinning dependencies.
languages/ruby/tools/test/qlpack.yml	Bumps pack version; switches local dependency reference style.
languages/ruby/tools/test/codeql-pack.lock.yml	Removes committed lockfile to avoid pinning dependencies.
languages/ruby/tools/src/qlpack.yml	Bumps pack version to reflect dependency strategy change.
languages/ruby/tools/src/codeql-pack.lock.yml	Removes committed lockfile to avoid pinning dependencies.
languages/ruby/custom/test/qlpack.yml	Bumps pack version; switches local dependency reference style.
languages/ruby/custom/test/codeql-pack.lock.yml	Removes committed lockfile to avoid pinning dependencies.
languages/ruby/custom/src/qlpack.yml	Bumps pack version to reflect dependency strategy change.
languages/ruby/custom/src/codeql-pack.lock.yml	Removes committed lockfile to avoid pinning dependencies.

Copilot's findings

Files reviewed: 68/68 changed files
Comments generated: 3

Copilot

Copilot's findings

Files reviewed: 67/67 changed files
Comments generated: 1

felickz

👍

Initial plan

123fba6

Copilot AI assigned Copilot and data-douser Apr 21, 2026

Copilot started work on behalf of data-douser April 21, 2026 21:18 View session

Copilot AI linked an issue Apr 21, 2026 that may be closed by this pull request

Update Packs #43

Closed

Remove pinned codeql-pack.lock.yml files and ignore future ones

efac579

Agent-Logs-Url: https://github.com/advanced-security/codeql-development-template/sessions/a6282c16-1661-4d3b-b8ae-3a50f516d757 Co-authored-by: data-douser <70299490+data-douser@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Remove specific CodeQL versions and update packs~~ Unpin CodeQL pack dependencies by removing committed lock files Apr 21, 2026

Copilot finished work on behalf of data-douser April 21, 2026 21:27

Copilot AI requested a review from data-douser April 21, 2026 21:27

data-douser reviewed Apr 22, 2026

View reviewed changes

Comment thread .gitignore Outdated

Comment thread languages/actions/custom/test/codeql-pack.lock.yml

data-douser marked this pull request as ready for review April 22, 2026 16:36

data-douser requested review from a team and enyil as code owners April 22, 2026 16:36

data-douser requested a review from felickz April 22, 2026 16:37

data-douser and others added 2 commits April 22, 2026 10:48

Fixes for prompt tidy/lint

b6ae257

Merge branch 'main' into copilot/update-packs-to-latest-versions

cb920ce

data-douser unassigned Copilot Apr 22, 2026

data-douser requested a review from Copilot April 22, 2026 20:30

Copilot started reviewing on behalf of data-douser April 22, 2026 20:30 View session

Copilot AI reviewed Apr 22, 2026

View reviewed changes

Comment thread README.md

Comment thread scripts/install-codeql-packs.sh

Comment thread scripts/install-codeql-packs.sh

data-douser and others added 2 commits April 22, 2026 15:13

Fixes for install-codeql-packs.sh

90bbcaf

Merge branch 'main' into copilot/update-packs-to-latest-versions

1786021

data-douser requested a review from Copilot April 22, 2026 21:14

Copilot started reviewing on behalf of data-douser April 22, 2026 21:14 View session

Copilot AI reviewed Apr 22, 2026

View reviewed changes

Comment thread .github/workflows/copilot-setup-steps.yml

Update copilot-setup-steps workflow "on:{push,pull_request}paths"

937b711

data-douser enabled auto-merge April 22, 2026 21:26

data-douser added this pull request to the merge queue Apr 22, 2026

Merged via the queue into main with commit df23b56 Apr 22, 2026
11 checks passed

data-douser deleted the copilot/update-packs-to-latest-versions branch April 22, 2026 21:26

felickz reviewed Apr 23, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Unpin CodeQL pack dependencies by removing committed lock files#45

Unpin CodeQL pack dependencies by removing committed lock files#45
data-douser merged 8 commits intomainfrom
copilot/update-packs-to-latest-versions

Copilot AI commented Apr 21, 2026 •

edited

Loading

Uh oh!

data-douser left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

felickz left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

Copilot AI commented Apr 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📝 Query Update

🎯 Changes

What Changed

Why This Change

Impact

🔍 Before vs. After

Previous Behavior

New Behavior

🧪 Testing

📊 Impact Analysis

📋 Checklist

🔗 References

Uh oh!

data-douser left a comment

Choose a reason for hiding this comment

Review: Additional changes needed before merge

1. Add scripts/install-codeql-packs.sh

2. Update qlpack.yml workspace references from "*" to ${workspace}

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot's findings

Uh oh!

Uh oh!

Uh oh!

felickz left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Apr 21, 2026 •

edited

Loading

1. Add `scripts/install-codeql-packs.sh`

2. Update `qlpack.yml` workspace references from `"*"` to `${workspace}`