docs: document CodeQL version pinning and pack compatibility#154
Merged
Conversation
- Add a consumer-facing compatibility note in README linking to GitHub's official CodeQL pack compatibility docs, reassuring users that older published packs generally keep working with newer CLIs (with caveats). - Add a maintainer-facing 'Supported CodeQL versions' section in CONTRIBUTING.md documenting the two-file pinning mechanism (.codeqlversion for the CLI, <lang>/src/codeql-pack.lock.yml for the locked library version) with a table of current locked versions per language, including the upstream *-queries dependency used by C/C++ and C# only. - Link out to the community CodeQL Bundle Version Tracker for the broader CLI-to-library version mapping. Motivated by GHSL PR #151 (java-all API rename between 7.1.3 and 9.1.2 causing local/CI compile mismatches) and issue #145 (stale packs). Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
Pull request overview
This PR documents how the repository pins the CodeQL CLI and standard library versions used to compile and test the community packs, clarifying compatibility expectations for both consumers and contributors.
Changes:
- Adds a compatibility note to the README explaining why older published packs often work with newer CodeQL CLIs, with a link to official documentation.
- Adds a “Supported CodeQL versions” section to CONTRIBUTING.md describing the repo’s pinning/lock mechanism and listing the currently locked versions per language.
Show a summary per file
| File | Description |
|---|---|
| README.md | Adds a “Getting started” note about CodeQL pack compatibility and a short “Contributing” section linking to version-pin documentation. |
| CONTRIBUTING.md | Documents the CLI/library pinning mechanism and provides a per-language table of the pinned *-all / *-queries versions. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 2/2 changed files
- Comments generated: 1
- Review effort level: Low
👍
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Documents which CodeQL CLI/library versions this repo pins to and tested against, for both maintainers and consumers of the published query packs.
For consumers (README.md)
Adds a short compatibility note under "Getting started" linking to GitHub's official CodeQL pack compatibility docs — reassuring users that older published packs generally keep working against newer CLIs (precompiled
.qlxqueries), with a link to the version table for details.For maintainers/contributors (CONTRIBUTING.md)
Adds a Supported CodeQL versions section explaining:
.codeqlversion(repo root) pins the CLI version CI installs;<lang>/src/codeql-pack.lock.ymllocks the resolved*-alllibrary version compiled against.*-all) and upstream query pack (*-queries) versions per language (C/C++ and C# are the only two that depend on an upstream*-queriespack, due to Dependencies.ql's use of Metrics.Dependencies.ExternalDependencies).Motivation
No code or query changes - documentation only.