Make CODEQL_PLATFORM architecture-aware for linux-arm64 - #22247
Merged
Conversation
CODEQL_PLATFORM is OS-only today (linux->linux64, macos->osx64, windows->win64). ELF has no fat-binary equivalent, so Linux arm64 needs its own string. Add `linux-arm64` for os:linux AND cpu:arm64 while keeping every existing string byte-identical. - Add a public `//misc/bazel:linux_arm64` config_setting (os:linux + cpu:arm64). - Turn `os_select` into `codeql_platform_select`, a full selector over the four CodeQL platforms (`linux64`, `linux_arm64`, `osx64`, `win64`, plus `otherwise`), working in both macro (select) and rule (target_platform_has_constraint) contexts. There is deliberately no fallback between the two Linux slots. - Re-express `os_select` as a thin OS-only wrapper around it (Linux maps to both `linux64` and `linux_arm64`), so its existing swift/xcode callers keep working unchanged. - Add an `_arm64_constraint` entry to OS_DETECTION_ATTRS. - Drive the platform string from `codeql_platform_select` in pkg.bzl's `_detect_platform` and defs.bzl's `codeql_platform`. macOS keeps osx64 for both arch slices (universal binary): the linux_arm64 key requires both constraints, so the OS discriminator dominates. The new branch is dormant on existing CI (no job builds linux-on-arm64), so all current configs produce byte-identical outputs. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: c5c5b0bf-4afa-468c-b2dd-197d80932b4b
Contributor
There was a problem hiding this comment.
Pull request overview
Adds architecture-aware CodeQL platform selection for Linux ARM64.
Changes:
- Introduces
codeql_platform_select. - Maps Linux ARM64 to
linux-arm64. - Preserves existing OS-only selection behavior.
Show a summary per file
| File | Description |
|---|---|
defs.bzl |
Uses the architecture-aware selector. |
misc/bazel/BUILD.bazel |
Defines the Linux ARM64 configuration. |
misc/bazel/os.bzl |
Implements platform and OS selectors. |
misc/bazel/pkg.bzl |
Resolves ARM64 package paths and names. |
Review details
- Files reviewed: 4/4 changed files
- Comments generated: 2
- Review effort level: Medium
- codeql_pack docstring: include `linux-arm64` in the exhaustive list of
values the `{CODEQL_PLATFORM}` placeholder expands to (both mentions).
- codeql_platform_select: only fall back to `otherwise` on `None`, not on
any falsey value, via a small `_or_otherwise` helper, matching the
documented `None` defaults.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c5c5b0bf-4afa-468c-b2dd-197d80932b4b
`posix` sets the shared value for both `linux` and `macos`. It is mutually exclusive with either of them and fails if supplied together with `linux` or `macos`. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: c5c5b0bf-4afa-468c-b2dd-197d80932b4b
Contributor
|
The C# checks seem to be broken now. The error is so generic that I have a hard time to understand what's going on though. |
Contributor
Author
hmm, might be some sparse checkout problem, let me investigate |
When `codeql_platform_select` builds its `select` from a macro invoked in another workspace (e.g. semmle-code consuming this repo as `@codeql`), a bare `//misc/bazel:linux_arm64` string key resolves against the consuming repo and fails with "no such package 'misc/bazel'". Use `Label(...)`, which resolves relative to this file's own repo, so the key always binds to `@codeql//misc/bazel:linux_arm64` regardless of the calling workspace. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: c5c5b0bf-4afa-468c-b2dd-197d80932b4b
Contributor
Author
Rerun has been triggered: 2 restarted 🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Today
CODEQL_PLATFORMis OS-only:linux->linux64,macos->osx64,windows->win64. There is no architecture dimension. macOS ships a single universal (lipo) binary that serves both arches, so it can keeposx64, but ELF has no fat-binary equivalent, so Linux arm64 needs its own distinct platform string.What
Introduces a single source of truth,
codeql_platform_select, and derives the platform string fromos:linux AND cpu:arm64->linux-arm64, with every other configuration resolving byte-identically to its existing string.misc/bazel/os.bzl: addscodeql_platform_select(linux64, linux_arm64, osx64, win64, otherwise)which works in both macro (select) and rule (ctx) contexts.os_selectis kept as a thin OS-only wrapper implemented on top of it (Linux gets the same value on both arches), so all existing callers are unchanged. A_arm64_constraintattr is added toOS_DETECTION_ATTRSfor the rule path.misc/bazel/BUILD.bazel: adds alinux_arm64config_setting(os:linux+cpu:arm64), a strict specialization of@platforms//os:linuxso Bazel picks it unambiguously.defs.bzlandmisc/bazel/pkg.bzl(_detect_platform, the load-bearing resolver for the{CODEQL_PLATFORM}placeholder): switched tocodeql_platform_selectand map the Linux arm64 slot tolinux-arm64.The
linux-arm64token is deliberate: the legacylinux64/osx64/win64are CodeQL's own public release-asset identifiers and cannot be renamed, only added to.${os}-arm64matches the wider ecosystem (Node/.NET/Go) and codeql-action already uses thearm64token.There is intentionally no fallback between
linux64andlinux_arm64incodeql_platform_select: callers that only care about the OS should useos_select.Additive and inert
Every configuration CI builds today resolves to the identical string, producing byte-identical outputs. Critically, the macOS universal build runs an
@platforms//cpu:arm64transition slice, but its OS is macos, so the OS discriminator dominates and it still resolves toosx64. The newlinux-arm64branch stays dormant because no current job builds Linux-on-arm64.Validation (x86_64 host)
bazel cquerythat existing configs still resolve exactly: linux x86_64 ->linux64, macos ->osx64, windows ->win64(zero diff vsmain).--platformsto anos:linux+cpu:arm64platform and confirmed it resolves tolinux-arm64(analysis), with thelinux_arm64config_setting selected unambiguously over@platforms//os:linux.osx64using a real macOS analysis platform.os_selectconsumers (e.g. Swift) re-checked and clean; buildifier/format clean.