Re: [PATCH 2/7] Add support for CodeQL 2.20.1

[Owen Smith <owen.smith@xxxxxxxxxx>]

Comments inline
_____________________________________
From: Tu Dinh <ngoc-tu.dinh@xxxxxxxxxx>
Sent: 12 November 2025 8:08 AM
To: Owen Smith; win-pv-devel@xxxxxxxxxxxxxxxxxxxx
Cc: Owen Smith
Subject: Re: [PATCH 2/7] Add support for CodeQL 2.20.1

Hi,

On 11/11/2025 09:34, Owen Smith wrote:
> From: Owen Smith <owen.smith@xxxxxxxxx>
>
<snip>
> @@ -154,8 +155,10 @@ Function Run-CodeQL {
>       $c += " database"
>       $c += " analyze "
>       $c += $database
> -     $c += " windows_driver_recommended.qls"
> +     $c += " "
> +     $c += $QueryFile
>       $c += " --format=sarifv2.1.0"
> +     $c += " --threads=0"
>       $c += " --output="
>       $c += $sarif
>       $c += " --search-path="

Using the & operator to call MSBuild and CodeQL may be cleaner here,
though it can be done later.

    I had issues with the & operator calling msbuild and codeql - issues around 
quoting quoted strings,
    escaping strings and using different quotes did not help.
    Creating a bat file to run the build from the codeql command line was the 
only method I could get working.


> @@ -199,8 +202,22 @@ if ($Type -eq "codeql") {
>       }
>       New-Item -ItemType Directory "database"
>
> +     $queryfile = "windows_driver_recommended.qls"
> +     Try {
> +             $ver = New-Object System.Version((& "codeql" 
> "--version")[0].Split(" ")[-1] + "0")
> +             Write-Host -ForegroundColor Cyan "INFO: CodeQL version " $ver
> +             $minver = New-Object System.Version("2.20.1.0")
> +             if ($ver -ge $minver) {
> +                     $queryfile = "mustfix.qls"

You can just use
"microsoft/windows-drivers:windows-driver-suites/mustfix.qls" to target
a specific pack, or a versioned form like
"microsoft/windows-drivers@1.8.0:windows-driver-suites/mustfix.qls".

Also, why is mustfix.qls being used with the new pack instead of
recommended.qls? I did notice new false positives in the newer 1.8.0
pack, was this the cause of the change?

    recommended.qls generates several false positives, and apparent incorrect 
analysis, which would
    prevent these codeql logs from being valid for WHQL submissions.
    The CODEQL_QUERY_FILE environment variable can be set to override the QLS 
file selection, to 
    test recommended.qls while resolving issues

> +             }
> +     } Catch {
> +     }


Owen