[bug] CodeQL error says goto https://docs.github.com/en/code-security/code-scanning/troubleshooting-code-scanning/automatic-build-failed.

[SwuduSusuwu]

Select Topic Area

Bug

Body

If you remove the trailing . the URL https://docs.github.com/en/code-security/code-scanning/troubleshooting-code-scanning/automatic-build-failed launches.
https://docs.github.com/en/code-security/code-scanning/troubleshooting-code-scanning/automatic-build-failed. is from https://github.com/SwuduSusuwu/SubStack/actions/runs/9693135643/job/26747940322

  [2024-06-27 08:20:32] [build-stderr] cpp/autobuilder: using built-in deptrace DB
  [2024-06-27 08:20:33] [build-stderr] cpp/autobuilder: launched deptrace server
  [2024-06-27 08:20:34] [build-stderr] cpp/autobuilder: Build will be attempted from '.' even though no build system was found there.
  [2024-06-27 08:20:34] [build-stdout] ~/work/SubStack/SubStack ~/work/SubStack/SubStack
  [2024-06-27 08:20:34] [build-stdout] ~/work/SubStack/SubStack
  [2024-06-27 08:20:34] [build-stderr] cpp/autobuilder: No supported build system detected.
  [2024-06-27 08:20:34] [build-stderr] cpp/autobuilder: deptrace was enabled.
  [2024-06-27 08:20:34] [build-stderr] cpp/autobuilder: autobuild summary.
  Error: 6-27 08:20:34] [ERROR] Spawned process exited abnormally (code 1; tried to run: [/opt/hostedtoolcache/CodeQL/2.17.5/x64/codeql/tools/linux64/preload_tracer, /opt/hostedtoolcache/CodeQL/2.17.5/x64/codeql/cpp/tools/autobuild.sh])
  A fatal error occurred: Exit status 1 from command: [/opt/hostedtoolcache/CodeQL/2.17.5/x64/codeql/cpp/tools/autobuild.sh]
  Error: We were unable to automatically build your code. Please replace the call to the autobuild action with your custom build steps. We were unable to automatically build your code. Please change the build mode for this language to manual and specify build steps for your project. For more information, see https://docs.github.com/en/code-security/code-scanning/troubleshooting-code-scanning/automatic-build-failed. Encountered a fatal error while running "/opt/hostedtoolcache/CodeQL/2.17.5/x64/codeql/codeql database trace-command --use-build-mode --working-dir /home/runner/work/SubStack/SubStack -O=cpp.trap.cache.dir=/home/runner/work/_temp/trapCaches/cpp -O=cpp.trap.cache.bound=1024 -O=cpp.trap.cache.write=true /home/runner/work/_temp/codeql_databases/cpp". Exit code was 2 and error was: A fatal error occurred: Exit status 1 from command: [/opt/hostedtoolcache/CodeQL/2.17.5/x64/codeql/cpp/tools/autobuild.sh] See the logs for more details.

[SwuduSusuwu]

https://docs.github.com/en/code-security/code-scanning/troubleshooting-code-scanning/automatic-build-failed just says

If an automatic build of code for a compiled language within your project fails, you can try changing to the manual build mode or removing the autobuild step from your code scanning workflow and adding specific build steps. If you're not already using advanced setup, you'll need to enable it first to create a workflow you can edit.

How to access /opt/hostedtoolcache/CodeQL/2.17.5/x64/codeql/cpp/tools/autobuild.sh (to figure out what is required to auto build this)?
Is not enough for the repository's root to have make.sh?

[SwuduSusuwu]

github/codeql-cli-binaries#121 (comment) implies that the repository's root shall have Automake
What is the best format for this?
What have now is https://github.com/SwuduSusuwu/SubStack/blob/trunk/make.sh
Want this to run on all Unixes/Linuxes/MinGW/OSX

[jketema]

Hi @SwuduSusuwu,

If you remove the trailing . the URL https://docs.github.com/en/code-security/code-scanning/troubleshooting-code-scanning/automatic-build-failed launches.

I believe the links in the action output are best effort, and it clearly fails here because of the period. We can potentially work around this by rephrasing the sentence. I'd like to suggest opening an issue for this problem in the https://github.com/github/codeql-action repo.

Is not enough for the repository's root to have make.sh?

The autobuild.sh script recognises a number of well-known (meta-)build systems (for example, automake, CMake, and scons). As a fall-back it also looks for scripts called build and build.sh. It does not look for a script called make.sh. Hence, the failure you're seeing. You're options here are to either to (a) rename the script to build.sh, (b) switch to a one of the well-known (meta-)build systems, or (c) switch from default to advanced code scanning setup and call make.sh instead of using autobuild.

[SwuduSusuwu]

https://github.com/github/codeql-action/issues/new/choose just has

Report a security vulnerability
Privately report a security vulnerability.
Contact GitHub Support
Contact Support

[jketema]

https://github.com/github/codeql-action/issues/new/choose just has

Just use "Open a blank issue." near the bottom.

[SwuduSusuwu]

Just use "Open a blank issue." near the bottom.

The DevOps produced URL fix
github/codeql-action#2354 (comment)

The autobuild.sh script recognises a number of well-known (meta-)build systems (for example, automake, CMake, and scons). As a fall-back it also looks for scripts called build and build.sh. It does not look for a script called make.sh. Hence, the failure you're seeing. You're options here are to either to (a) rename the script to build.sh

Cool fix. build.sh is lowest effort, now passes.
Is this preferred, or, to maximize compatible platforms, am to use automake ,cmake or scons (if latter, which?)

[jketema]

That is up to you. We cannot advise you here.

[SwuduSusuwu]

https://github.com/SwuduSusuwu/SubStack/actions/runs/9713651479/job/26810897728 has Perform CodeQL Analysis as

Run github/codeql-action/analyze@v3
/opt/hostedtoolcache/CodeQL/2.17.5/x64/codeql/codeql version --format=json
{
  "productName" : "CodeQL",
  "vendor" : "GitHub",
  "version" : "2.17.5",
  "sha" : "0ee7464b4be95bced213b1f3892929d427edb9a0",
  "branches" : [
    "codeql-cli-2.17.5"
  ],
  "copyright" : "Copyright (C) 2019-2024 GitHub, Inc.",
  "unpackedLocation" : "/opt/hostedtoolcache/CodeQL/2.17.5/x64/codeql",
  "configFileLocation" : "/home/runner/.config/codeql/config",
  "configFileFound" : false,
  "features" : {
    "analysisSummaryV2Default" : true,
    "buildModeOption" : true,
    "bundleSupportsIncludeDiagnostics" : true,
    "featuresInVersionResult" : true,
    "indirectTracingSupportsStaticBinaries" : false,
    "informsAboutUnsupportedPathFilters" : true,
    "supportsPython312" : true,
    "mrvaPackCreate" : true,
    "threatModelOption" : true,
    "traceCommandUseBuildMode" : true,
    "v2ramSizing" : true,
    "mrvaPackCreateMultipleQueries" : true,
    "setsCodeqlRunnerEnvVar" : true,
    "sarifMergeRunsFromEqualCategory" : true
  }
}
While resolving threads, found a cgroup CPUs file with 4 CPUs in /sys/fs/cgroup/cpuset.cpus.effective.
Finalizing cpp
Running queries for cpp
Interpreting results for cpp
CodeQL scanned 13 out of 14 C++ files and 5 out of 10 C files in this invocation. Check the status page for overall coverage information: https://github.com/SwuduSusuwu/SubStack/security/code-scanning/tools/CodeQL/status/

Cleaning up databases
Uploading results
/opt/hostedtoolcache/CodeQL/2.17.5/x64/codeql/codeql database bundle /home/runner/work/_temp/codeql_databases/cpp --output=/home/runner/work/_temp/codeql_databases/cpp.zip --name=cpp
Creating bundle metadata for /home/runner/work/_temp/codeql_databases/cpp...
Creating zip file at /home/runner/work/_temp/codeql_databases/cpp.zip.
Skipping upload of TRAP cache for cpp as it is too small
Waiting for processing to finish

all of the checks show green, thus the repository passes? Or is it just that "To execute WebGL was success, must download /home/runner/work/_temp/codeql_databases/cpp.zip to view results" (if this, .zip is processed with what tools?)

[jketema]

all of the checks show green, thus the repository passes?

Not quite. This just means that code scanning managed to execute. The results of all the scans you can see at: https://github.com/SwuduSusuwu/SubStack/security/code-scanning (of which there are none, so that's good). If a PR would introduce an alert, you will also be notified on the PR in the form of something that looks like a comment.

Or is it just that "To execute WebGL was success, must download /home/runner/work/_temp/codeql_databases/cpp.zip to view results" (if this, .zip is processed with what tools?)

It mentions this, because some files were detected in the repository, but not part of the scan. Presumably because not all files were compiled by your build script. If you want to figure out which files we scanned, you can have a look at the contents of the mentioned file.

[SwuduSusuwu]

all of the checks show green, thus the repository passes?

Not quite. This just means that code scanning managed to execute. The results of all the scans you can see at: https://github.com/SwuduSusuwu/SubStack/security/code-scanning (of which there are none, so that's good).

Cool

ProTip! You can configure CodeQL to run with additional queries. Learn more

Due to no results with defaults, have now include the "extra" queries, + set CodeQL thresholds to lowest.