Add CallGraphFromTo queries for all supported languages#168
Merged
data-douser merged 11 commits intomainfrom Mar 27, 2026
Merged
Add CallGraphFromTo queries for all supported languages#168data-douser merged 11 commits intomainfrom
data-douser merged 11 commits intomainfrom
Conversation
Contributor
Dependency ReviewThe following issues were found:
Snapshot WarningsEnsure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice. OpenSSF ScorecardScorecard details
Scanned Files
|
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a new CallGraphFromTo CodeQL tool query across all call-graph-enabled languages in this repo, enabling “calls on paths from source → target” exploration with sourceFunction/targetFunction externals, and updates packs/tests/docs for CodeQL v2.25.0 compatibility.
Changes:
- Added
CallGraphFromTo.ql+.mddocumentation and unit tests for cpp, csharp, go, java, javascript, python, ruby, swift. - Bumped CodeQL pack dependencies/locks across language tool packs for v2.25.0 compatibility.
- Updated existing Go
PrintASTand JavaPrintCFGqueries (and expected outputs) for newer CodeQL libraries.
Reviewed changes
Copilot reviewed 70 out of 70 changed files in this pull request and generated 10 comments.
Show a summary per file
| File | Description |
|---|---|
| server/src/resources/languages/java_ast.md | Document Java CFG API change (ControlFlowNode / ControlFlowGraph). |
| server/src/resources/languages/go_ast.md | Note about bundled Go PrintAST implementation details. |
| server/ql/cpp/tools/src/codeql-pack.yml | Update cpp tool pack dependency versions. |
| server/ql/cpp/tools/src/codeql-pack.lock.yml | Update cpp tool pack lock versions. |
| server/ql/cpp/tools/test/codeql-pack.lock.yml | Update cpp tool test pack lock versions. |
| server/ql/cpp/tools/src/CallGraphFromTo/CallGraphFromTo.ql | New cpp CallGraphFromTo query. |
| server/ql/cpp/tools/src/CallGraphFromTo/CallGraphFromTo.md | New cpp CallGraphFromTo documentation. |
| server/ql/cpp/tools/test/CallGraphFromTo/Example1.cpp | New cpp test fixture. |
| server/ql/cpp/tools/test/CallGraphFromTo/CallGraphFromTo.expected | New cpp expected results. |
| server/ql/cpp/tools/test/CallGraphFromTo/CallGraphFromTo.qlref | New cpp test query reference. |
| server/ql/csharp/tools/src/codeql-pack.yml | Update csharp tool pack dependency versions. |
| server/ql/csharp/tools/src/codeql-pack.lock.yml | Update csharp tool pack lock versions. |
| server/ql/csharp/tools/test/codeql-pack.lock.yml | Update csharp tool test pack lock versions. |
| server/ql/csharp/tools/src/CallGraphFromTo/CallGraphFromTo.ql | New csharp CallGraphFromTo query. |
| server/ql/csharp/tools/src/CallGraphFromTo/CallGraphFromTo.md | New csharp CallGraphFromTo documentation. |
| server/ql/csharp/tools/test/CallGraphFromTo/Example1.cs | New csharp test fixture. |
| server/ql/csharp/tools/test/CallGraphFromTo/CallGraphFromTo.expected | New csharp expected results. |
| server/ql/csharp/tools/test/CallGraphFromTo/CallGraphFromTo.qlref | New csharp test query reference. |
| server/ql/go/tools/src/codeql-pack.yml | Update go tool pack dependency versions. |
| server/ql/go/tools/src/codeql-pack.lock.yml | Update go tool pack lock versions. |
| server/ql/go/tools/test/codeql-pack.lock.yml | Update go tool test pack lock versions. |
| server/ql/go/tools/src/PrintAST/PrintAST.ql | Adjust Go PrintAST implementation for new library constraints. |
| server/ql/go/tools/test/PrintAST/PrintAST.expected | Update Go PrintAST expected output. |
| server/ql/go/tools/src/CallGraphFromTo/CallGraphFromTo.ql | New go CallGraphFromTo query. |
| server/ql/go/tools/src/CallGraphFromTo/CallGraphFromTo.md | New go CallGraphFromTo documentation. |
| server/ql/go/tools/test/CallGraphFromTo/Example1.go | New go test fixture. |
| server/ql/go/tools/test/CallGraphFromTo/CallGraphFromTo.expected | New go expected results. |
| server/ql/go/tools/test/CallGraphFromTo/CallGraphFromTo.qlref | New go test query reference. |
| server/ql/java/tools/src/codeql-pack.yml | Update java tool pack dependency versions. |
| server/ql/java/tools/src/codeql-pack.lock.yml | Update java tool pack lock versions. |
| server/ql/java/tools/test/codeql-pack.lock.yml | Update java tool test pack lock versions. |
| server/ql/java/tools/src/PrintCFG/PrintCFG.ql | Update Java PrintCFG to use ControlFlowNode. |
| server/ql/java/tools/test/PrintCFG/PrintCFG.expected | Update Java PrintCFG expected output. |
| server/ql/java/tools/src/CallGraphFromTo/CallGraphFromTo.ql | New java CallGraphFromTo query. |
| server/ql/java/tools/src/CallGraphFromTo/CallGraphFromTo.md | New java CallGraphFromTo documentation. |
| server/ql/java/tools/test/CallGraphFromTo/Example1.java | New java test fixture. |
| server/ql/java/tools/test/CallGraphFromTo/CallGraphFromTo.expected | New java expected results. |
| server/ql/java/tools/test/CallGraphFromTo/CallGraphFromTo.qlref | New java test query reference. |
| server/ql/javascript/tools/src/codeql-pack.yml | Update javascript tool pack dependency versions. |
| server/ql/javascript/tools/src/codeql-pack.lock.yml | Update javascript tool pack lock versions. |
| server/ql/javascript/tools/test/codeql-pack.lock.yml | Update javascript tool test pack lock versions. |
| server/ql/javascript/tools/src/CallGraphFromTo/CallGraphFromTo.ql | New javascript CallGraphFromTo query. |
| server/ql/javascript/tools/src/CallGraphFromTo/CallGraphFromTo.md | New javascript CallGraphFromTo documentation. |
| server/ql/javascript/tools/test/CallGraphFromTo/Example1.js | New javascript test fixture. |
| server/ql/javascript/tools/test/CallGraphFromTo/CallGraphFromTo.expected | New javascript expected results. |
| server/ql/javascript/tools/test/CallGraphFromTo/CallGraphFromTo.qlref | New javascript test query reference. |
| server/ql/python/tools/src/codeql-pack.yml | Update python tool pack dependency versions. |
| server/ql/python/tools/src/codeql-pack.lock.yml | Update python tool pack lock versions. |
| server/ql/python/tools/test/codeql-pack.lock.yml | Update python tool test pack lock versions. |
| server/ql/python/tools/src/CallGraphFromTo/CallGraphFromTo.ql | New python CallGraphFromTo query. |
| server/ql/python/tools/src/CallGraphFromTo/CallGraphFromTo.md | New python CallGraphFromTo documentation. |
| server/ql/python/tools/test/CallGraphFromTo/Example1.py | New python test fixture. |
| server/ql/python/tools/test/CallGraphFromTo/CallGraphFromTo.expected | New python expected results. |
| server/ql/python/tools/test/CallGraphFromTo/CallGraphFromTo.qlref | New python test query reference. |
| server/ql/ruby/tools/src/codeql-pack.yml | Update ruby tool pack dependency versions. |
| server/ql/ruby/tools/src/codeql-pack.lock.yml | Update ruby tool pack lock versions. |
| server/ql/ruby/tools/test/codeql-pack.lock.yml | Update ruby tool test pack lock versions. |
| server/ql/ruby/tools/src/CallGraphFromTo/CallGraphFromTo.ql | New ruby CallGraphFromTo query. |
| server/ql/ruby/tools/src/CallGraphFromTo/CallGraphFromTo.md | New ruby CallGraphFromTo documentation. |
| server/ql/ruby/tools/test/CallGraphFromTo/Example1.rb | New ruby test fixture. |
| server/ql/ruby/tools/test/CallGraphFromTo/CallGraphFromTo.expected | New ruby expected results. |
| server/ql/ruby/tools/test/CallGraphFromTo/CallGraphFromTo.qlref | New ruby test query reference. |
| server/ql/swift/tools/src/codeql-pack.yml | Update swift tool pack dependency versions. |
| server/ql/swift/tools/src/codeql-pack.lock.yml | Update swift tool pack lock versions. |
| server/ql/swift/tools/test/codeql-pack.lock.yml | Update swift tool test pack lock versions. |
| server/ql/swift/tools/src/CallGraphFromTo/CallGraphFromTo.ql | New swift CallGraphFromTo query. |
| server/ql/swift/tools/src/CallGraphFromTo/CallGraphFromTo.md | New swift CallGraphFromTo documentation. |
| server/ql/swift/tools/test/CallGraphFromTo/Example1.swift | New swift test fixture. |
| server/ql/swift/tools/test/CallGraphFromTo/CallGraphFromTo.expected | New swift expected results. |
| server/ql/swift/tools/test/CallGraphFromTo/CallGraphFromTo.qlref | New swift test query reference. |
server/ql/javascript/tools/src/CallGraphFromTo/CallGraphFromTo.md
Outdated
Show resolved
Hide resolved
data-douser
added a commit
that referenced
this pull request
Mar 25, 2026
- Syncs "server/dist/**" - Applies "codeql query format" rules for all server/ql/**/*.ql files - Fixes formatting of markdown text in query markdown docs - Addresses other PR review feedback for #168
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 95 out of 97 changed files in this pull request and generated 1 comment.
Comments suppressed due to low confidence (1)
server/ql/go/tools/test/CallGraphFromTo/CallGraphFromTo.expected:2
CallGraphFromTo.expectedis effectively empty, so the Go CallGraphFromTo unit test isn't asserting any behavior. Please add expected rows for the 3 calls inExample1.go(target→unrelated, intermediate→target, source→intermediate), or adjust the query/test setup so results are produced and verified.
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 173 out of 175 changed files in this pull request and generated 9 comments.
Comments suppressed due to low confidence (1)
server/src/lib/cli-tool-registry.ts:350
- This comment says “Create qlpack.yml for the temporary extension pack”, but the code writes
codeql-pack.yml. Please align the wording with the actual filename to prevent future mistakes.
server/ql/javascript/tools/src/CallGraphFromTo/CallGraphFromTo.md
Outdated
Show resolved
Hide resolved
Collaborator
Author
|
@copilot apply changes based on the comments in this thread |
Contributor
Applied in 254d0d5:
|
Collaborator
Author
|
@copilot apply changes based on the comments in this thread |
Contributor
Applied in 6229b14:
|
- Add CallGraphFromTo.ql for cpp, csharp, go, java, javascript, python, ruby, swift - Each query supports sourceFunction and targetFunction external predicates - Include documentation (.md) and test suites with expected outputs - Update QL pack dependencies to latest versions - Fix go PrintAST query for compatibility with v2.25.0 - Fix java PrintCFG query for compatibility with v2.25.0 Closes #164
- Syncs "server/dist/**" - Applies "codeql query format" rules for all server/ql/**/*.ql files - Fixes formatting of markdown text in query markdown docs - Addresses other PR review feedback for #168
Go query test fixes: - Add go.mod to CallGraphFromTo, CallGraphFrom, CallGraphTo test dirs (Go extractor requires module file for proper extraction) - Add main() function to all Go Example1.go test files - Fix fallback filter in all 3 Go call graph queries: getParentContainer().getParentContainer().getBaseName() = "test" → getFile().getBaseName() = "Example1.go" - Update all Go .expected files with non-empty results (4-5 rows each) VSIX packaging fix: - Add .tmp/** to .vscodeignore (was bundling 177MB of test databases) - VSIX size: 71.48MB → 788KB
Replace `external string` declarations with `extensible predicate` syntax across all 8 languages, enabling YAML-based data extensions for testing instead of fragile fallback hacks. Architecture: - Add ExternalPredicates.qll per language with shared extensible predicate declarations (sourceFunction, targetFunction, selectedSourceFiles) - Add dataExtensions YAML files in test/*/ext/ directories providing test values for each query's external predicates - Add dataExtensions glob to all test pack codeql-pack.yml files - Remove all "Fallback for unit tests" or clauses from queries This means: - Tests now exercise the actual external predicate logic path - No more path-based hacks (getParentContainer().getBaseName() = "test") - CallGraphFromTo tests produce precise source→target results - New queries only need a .model.yml file, not query modifications
… per review feedback Agent-Logs-Url: https://github.com/advanced-security/codeql-development-mcp-server/sessions/e21331aa-0d89-452b-8800-25ac99ac45ef Co-authored-by: data-douser <70299490+data-douser@users.noreply.github.com>
…from comma-split inputs Agent-Logs-Url: https://github.com/advanced-security/codeql-development-mcp-server/sessions/e224fd03-1314-4a18-a417-656beca0e3f3 Co-authored-by: data-douser <70299490+data-douser@users.noreply.github.com>
data-douser
force-pushed
the
dd/call-graph-from-to
branch
from
6229b14 to
f374cb6
Compare
![github-license-compliance[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related to parent #163.
📝 Update Information
Primitive Details
codeql_query_run(newCallGraphFromToquery support across all 8 call-graph-enabled languages)This PR is for updating an existing MCP server primitive and must ONLY include these file types:
✅ ALLOWED FILES:
server/src/**/*.ts)server/src/tools/*.ts)server/test/**/*.ts)README.md, server docs)server/src/types/*.ts)server/src/lib/*.ts)package.json,tsconfig.json)🚫 FORBIDDEN FILES:
Rationale: This PR should contain only the files necessary to update and test the primitive.
🚨 PRs that include forbidden files will be rejected and must be revised.
🛑 MANDATORY PR VALIDATION CHECKLIST
BEFORE SUBMITTING THIS PR, CONFIRM:
Update Metadata
sourceFunctionandtargetFunctionparameters forcodeql_query_runwhen invokingCallGraphFromToqueries🎯 Changes Description
Current Behavior
The
codeql_query_runtool supportedCallGraphFromandCallGraphToqueries for 8 languages, but had noCallGraphFromToquery to find call sites on paths between a specified source and target function. Comma-separated inputs (sourceFiles,sourceFunction,targetFunction) were not filtered for empty entries, which could produce extension rows with empty strings. The--model-packsselector used a broad@*version wildcard, risking ambiguous pack resolution if a pack with the same name already existed on the search path.Updated Behavior
CallGraphFromTo.qlquery is available for all 8 supported languages (cpp, csharp, go, java, javascript, python, ruby, swift), enabling transitive call reachability analysis constrained by both a source and target function.--model-packsselector now uses the exact version@0.0.0instead of@*, making pack resolution deterministic and avoiding collisions with user-supplied packs of the same name.CallGraphFromTo.mddocumentation files correctly describesourceFunction/targetFunctionas extensible predicates populated via CodeQL data extensions / model packs (seeExternalPredicates.qll).server/src/lib/cli-tool-registry.tsconsistently refer tocodeql-pack.yml(notqlpack.yml), matching both the code and repo convention.Motivation
Users needed a way to find all call sites on any transitive call path between a named source function and a named target function. The existing
CallGraphFromandCallGraphToqueries only supported one-sided constraints. Additional robustness fixes address edge cases in pack resolution and input handling that could silently produce wrong or empty results.🔄 Before vs. After Comparison
Functionality Changes
API Changes
Output Format Changes
🧪 Testing & Validation
Test Coverage Updates
.ql+.expected) for all 8CallGraphFromToqueriesCallGraphFrom/CallGraphTo/PrintAST/PrintCFGtests unaffectedValidation Scenarios
CallGraphFromToqueries compile and passcodeql test runTest Results
codeql_pack_installfailure unrelated to these changesCallGraphFromToqueries validated viacodeql test run📋 Implementation Details
Files Modified
server/ql/{cpp,csharp,go,java,javascript,python,ruby,swift}/tools/src/CallGraphFromTo/CallGraphFromTo.qlserver/src/lib/cli-tool-registry.tsserver/ql/{cpp,csharp,go,java,javascript,python,ruby,swift}/tools/test/CallGraphFromTo/server/ql/{cpp,csharp,go,java,javascript,python,ruby,swift}/tools/src/CallGraphFromTo/CallGraphFromTo.mdCode Changes Summary
CallGraphFromTotransitive reachability logic for all 8 languagescli-tool-registry.tscorrected to saycodeql-pack.yml; documentation corrected to say "extensible predicates"Dependencies
🔍 Quality Improvements
Bug Fixes (if applicable)
Issue:
--model-packsused broad@*wildcard, risking wrong pack resolution if a same-named pack existed on the user's search pathRoot Cause: Version selector was not pinned to the exact version written by the code
Solution: Changed to exact
@0.0.0to match the version written in the generatedcodeql-pack.ymlPrevention: Exact version pins are now the standard for runtime-generated extension packs
Issue: Trailing commas in
sourceFiles/sourceFunction/targetFunctioninputs produced empty-string extension rowsRoot Cause:
split(',').map(trim)did not filter empty stringsSolution: Added
.filter(f => f.length > 0)and a guard to skip adding the predicate key if all values are emptyPrevention: All comma-split input processing now consistently filters empty entries
Code Quality Enhancements
codeql-pack.ymlnaming in comments and code🔗 References
Related Issues/PRs
Validation Materials
codeql test runon all 8CallGraphFromTotest suites🚀 Compatibility & Migration
Backward Compatibility
API Evolution
sourceFunctionandtargetFunctionnow also honoured byCallGraphFromToCallGraphFromToresult set available👥 Review Guidelines
For Reviewers
Please verify:
CallGraphFromToqueries work as described for all 8 languagesTesting Instructions
Validation Checklist
CallGraphFromToreturns correct results for all 8 languages📊 Impact Assessment
Performance Impact
Server Impact
AI Assistant Impact
🔄 Deployment Strategy
Rollout Considerations
Post-Deployment Validation
codeql_query_runcalls forCallGraphFromToqueriesUpdate Methodology: This update follows best practices:
💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.