Merge pull request #15 from github/aibaars/ql-folder

Add QL folder structure

Author: nickrolfe

.github/workflows/build.yml

@@ -45,12 +45,12 @@ jobs:
         if: ${{ matrix.os == 'ubuntu-latest' }}
         with:
           name: ruby.dbscheme
-          path: ruby.dbscheme
+          path: ql/src/ruby.dbscheme
       - uses: actions/upload-artifact@v2
         if: ${{ matrix.os == 'ubuntu-latest' }}
         with:
           name: ruby_ast.qll
-          path: ruby_ast.qll
+          path: ql/src/codeql_ruby/ast.qll
       - uses: actions/upload-artifact@v2
         with:
           name: extractor-${{ matrix.os }}
@@ -81,7 +81,7 @@ jobs:
           path: osx64
       - run: |
           mkdir -p ruby
-          cp -r codeql-extractor.yml tools ruby/
+          cp -r codeql-extractor.yml tools ql/src/ruby.dbscheme.stats ruby/
           mkdir -p ruby/tools/{linux64,osx64,win64}
           cp linux64/ruby-extractor ruby/tools/linux64/extractor
           cp osx64/ruby-extractor ruby/tools/osx64/extractor

README.md

@@ -12,11 +12,11 @@ cargo build --release
 
 ## Generating the database schema and QL library
 
-The generated `ruby.dbscheme` and `ruby_ast.qll` files are included in the repository, but they can be re-generated as follows:
+The generated `ql/src/ruby.dbscheme` and `ql/src/codeql_ruby/ast.qll` files are included in the repository, but they can be re-generated as follows:
 
 ```bash
 # Run the generator
 cargo run --release -p ruby-generator
 # Then auto-format the QL library
-codeql query format -i ruby_ast.qll
+codeql query format -i ql/src/codeql_ruby/ast.qll
 ```

generator/src/main.rs

@@ -286,8 +286,8 @@ fn main() {
     let ruby = Language {
         name: "Ruby".to_string(),
         node_types: tree_sitter_ruby::NODE_TYPES,
-        dbscheme_path: PathBuf::from("ruby.dbscheme"),
-        ql_library_path: PathBuf::from("ruby_ast.qll"),
+        dbscheme_path: PathBuf::from("ql/src/ruby.dbscheme"),
+        ql_library_path: PathBuf::from("ql/src/codeql_ruby/ast.qll"),
     };
     match node_types::read_node_types_str(&ruby.node_types) {
         Err(e) => {

ql/docs/experimental.md

@@ -0,0 +1,37 @@
+# Experimental CodeQL queries and libraries
+
+In addition to our standard CodeQL queries and libraries, this repository may also contain queries and libraries of a more experimental nature. Experimental queries and libraries can be improved incrementally and may eventually reach a sufficient maturity to be included in our standard libraries and queries.
+
+Experimental queries and libraries may not be actively maintained as the standard libraries evolve. They may also be changed in backwards-incompatible ways or may be removed entirely in the future without deprecation warnings.
+
+## Requirements
+
+1. **Directory structure**
+
+    - Experimental queries and libraries are stored in the `ql/src/experimental` subdirectory, and any corresponding tests in `ql/test/experimental`.
+    - The structure of an `experimental` subdirectory mirrors the structure of standard queries and libraries (or tests) in the parent directory.
+
+2. **Query metadata**
+
+    - The query `@id` must not clash with any other queries in the repository.
+    - The query must have a `@name` and `@description` to explain its purpose.
+    - The query must have a `@kind` and `@problem.severity` as required by CodeQL tools.
+
+    For details, see the [guide on query metadata](https://github.com/github/codeql/blob/master/docs/query-metadata-style-guide.md).
+
+3. **Formatting**
+
+    - The queries and libraries must be [autoformatted](https://help.semmle.com/codeql/codeql-for-vscode/reference/editor.html#autoformatting).
+
+4. **Compilation**
+
+    - Compilation of the query and any associated libraries and tests must be resilient to future development of the standard libraries. This means that the functionality cannot use internal APIs, cannot depend on the output of `getAQlClass`, and cannot make use of regexp matching on `toString`.
+    - The query and any associated libraries and tests must not cause any compiler warnings to be emitted (such as use of deprecated functionality or missing `override` annotations).
+
+5. **Results**
+
+    - The query must have at least one true positive result on some revision of a real project.
+
+## Non-requirements
+
+Other criteria typically required for our standard queries and libraries are not required for experimental queries and libraries. In particular, fully disciplined query [metadata](https://github.com/github/codeql/blob/master/docs/query-metadata-style-guide.md), query [help](https://github.com/github/codeql/blob/master/docs/query-help-style-guide.md), tests, a low false positive rate and performance tuning are not required (but nonetheless recommended).

ql/examples/qlpack.yml

@@ -0,0 +1,3 @@
+name: codeql-ruby-examples
+version: 0.0.0
+libraryPathDependencies: codeql-ruby

ql/src/codeql-suites/ruby-code-scanning.qls

@@ -0,0 +1,4 @@
+- description: Standard Code Scanning queries for Ruby
+- qlpack: codeql-ruby
+- apply: code-scanning-selectors.yml
+  from: codeql-suite-helpers

ql/src/codeql-suites/ruby-lgtm-full.qls

@@ -0,0 +1,11 @@
+- description: Standard LGTM queries for Ruby, including ones not displayed by default
+- qlpack: codeql-ruby
+- apply: lgtm-selectors.yml
+  from: codeql-suite-helpers
+# These are only for IDE use.
+- exclude:
+    tags contain:
+      - ide-contextual-queries/local-definitions
+      - ide-contextual-queries/local-references
+- query: Metrics/FLinesOfCode.ql
+

ql/src/codeql-suites/ruby-lgtm.qls

@@ -0,0 +1,4 @@
+- description: Standard LGTM queries for Ruby
+- apply: codeql-suites/ruby-lgtm-full.qls
+- apply: lgtm-displayed-only.yml
+  from: codeql-suite-helpers

ql/src/codeql-suites/ruby-security-and-quality.qls

@@ -0,0 +1,4 @@
+- description: Security-and-quality queries for Ruby
+- qlpack: codeql-ruby
+- apply: security-and-quality-selectors.yml
+  from: codeql-suite-helpers

ql/src/codeql-suites/ruby-security-extended.qls

@@ -0,0 +1,4 @@
+- description: Security-extended queries for Ruby
+- qlpack: codeql-ruby
+- apply: security-extended-selectors.yml
+  from: codeql-suite-helpers

ruby_ast.qll renamed to ql/src/codeql_ruby/ast.qll

@@ -0,0 +1 @@
+This directory contains [experimental](../../docs/experimental.md) CodeQL queries and libraries.

ql/src/experimental/README.md

@@ -0,0 +1,5 @@
+name: codeql-ruby
+version: 0.0.0
+dbscheme: ruby.dbscheme
+suites: codeql-suites
+extractor: ruby