Merge branch 'main' into mbaluda-next-merge

Author: mbaluda

.github/actions/install-codeql-packs/action.yml

@@ -7,6 +7,11 @@ inputs:
       The path to the CodeQL CLI directory.
     required: false
 
+  common_caches:
+    description: |
+      The path to the CodeQL common caches directory.
+    required: false
+
   mode:
     description: |
       The `--mode` option to `codeql pack install`.
@@ -22,4 +27,6 @@ runs:
         CODEQL_CLI: ${{ inputs.cli_path }}
       run: |
         PATH=$PATH:$CODEQL_CLI
-        python scripts/install-packs.py --mode ${{ inputs.mode }}
+        python scripts/install-packs.py \
+          --mode ${{ inputs.mode }} \
+          --common-caches "${{ inputs.common_caches }}"

.github/workflows/code-scanning-pack-gen.yml

@@ -20,7 +20,6 @@ env:
   XARGS_MAX_PROCS: 4
 
 jobs:
-
   prepare-code-scanning-pack-matrix:
     name: Prepare CodeQL Code Scanning pack matrix
     runs-on: ubuntu-22.04
@@ -62,10 +61,19 @@ jobs:
           codeql-home: ${{ github.workspace }}/codeql_home
           add-to-path: false
 
+      - name: Cache queries compilation
+        id: cache-queries-compilation
+        uses: actions/cache/restore@v6
+        with:
+          path: ${{ github.workspace }}/codeql_cache
+          key: ${{ runner.os }}-codeql-compilation-code-scanning-pack-${{ matrix.codeql_cli }}-${{ matrix.codeql_standard_library }}-${{ github.run_id }}
+          restore-keys: ${{ runner.os }}-codeql-compilation-code-scanning-pack-${{ matrix.codeql_cli }}-${{ matrix.codeql_standard_library }}
+
       - name: Install CodeQL packs
         uses: ./.github/actions/install-codeql-packs
         with:
           cli_path: ${{ github.workspace }}/codeql_home/codeql
+          common_caches: ${{ github.workspace }}/codeql_cache
 
       - name: Determine ref for external help files
         id: determine-ref
@@ -105,11 +113,22 @@ jobs:
           PATH=$PATH:$CODEQL_HOME/codeql
           # Precompile all queries, and use a compilation cache larger than default
           # to ensure we cache all the queries for later steps
-          codeql query compile --precompile --threads 0 --compilation-cache-size=1024 cpp c
+          codeql query compile \
+            --common-caches=${{ github.workspace }}/codeql_cache \
+            --precompile \
+            --threads 0 \
+            --compilation-cache-size=1024 \
+            cpp c
 
           cd ..
           zip -r codeql-coding-standards/code-scanning-cpp-query-pack.zip codeql-coding-standards/c/ codeql-coding-standards/cpp/ codeql-coding-standards/.codeqlmanifest.json codeql-coding-standards/supported_codeql_configs.json codeql-coding-standards/scripts/configuration codeql-coding-standards/scripts/reports codeql-coding-standards/scripts/shared codeql-coding-standards/scripts/guideline_recategorization codeql-coding-standards/schemas
 
+      - name: Save queries compilation cache
+        uses: actions/cache/save@v6
+        with:
+          path: ${{ github.workspace }}/codeql_cache
+          key: ${{ steps.cache-queries-compilation.outputs.cache-primary-key }}
+
       - name: Upload GHAS Query Pack
         uses: actions/upload-artifact@v7
         with:
@@ -119,20 +138,21 @@ jobs:
       - name: Create qlpack bundles
         env:
           CODEQL_HOME: ${{ github.workspace }}/codeql_home
+          CODEQL_CACHE: ${{ github.workspace }}/codeql_cache
         run: |
           PATH=$PATH:$CODEQL_HOME/codeql
 
-          codeql pack bundle --output=common-cpp-coding-standards.tgz cpp/common/src
-          codeql pack bundle --output=common-c-coding-standards.tgz c/common/src
-          codeql pack bundle --output=misra-c-coding-standards.tgz c/misra/src
-          codeql pack bundle --output=cert-c-coding-standards.tgz c/cert/src
-          codeql pack bundle --output=cert-cpp-coding-standards.tgz cpp/cert/src
-          codeql pack bundle --output=autosar-cpp-coding-standards.tgz cpp/autosar/src
-          codeql pack bundle --output=misra-cpp-coding-standards.tgz cpp/misra/src
-          codeql pack bundle --output=report-coding-standards.tgz cpp/report/src
+          codeql pack bundle --common-caches="$CODEQL_CACHE" --output=common-cpp-coding-standards.tgz cpp/common/src
+          codeql pack bundle --common-caches="$CODEQL_CACHE" --output=common-c-coding-standards.tgz c/common/src
+          codeql pack bundle --common-caches="$CODEQL_CACHE" --output=misra-c-coding-standards.tgz c/misra/src
+          codeql pack bundle --common-caches="$CODEQL_CACHE" --output=cert-c-coding-standards.tgz c/cert/src
+          codeql pack bundle --common-caches="$CODEQL_CACHE" --output=cert-cpp-coding-standards.tgz cpp/cert/src
+          codeql pack bundle --common-caches="$CODEQL_CACHE" --output=autosar-cpp-coding-standards.tgz cpp/autosar/src
+          codeql pack bundle --common-caches="$CODEQL_CACHE" --output=misra-cpp-coding-standards.tgz cpp/misra/src
+          codeql pack bundle --common-caches="$CODEQL_CACHE" --output=report-coding-standards.tgz cpp/report/src
 
       - name: Upload qlpack bundles
         uses: actions/upload-artifact@v7
         with:
           name: coding-standards-codeql-packs
-          path: '*-coding-standards.tgz'
+          path: "*-coding-standards.tgz"

.github/workflows/codeql_unit_tests.yml

@@ -17,7 +17,6 @@ on:
       - "rc/**"
 
 jobs:
- 
   prepare-unit-test-matrix:
     name: Prepare CodeQL unit test matrix
     runs-on: ubuntu-22.04
@@ -59,7 +58,7 @@ jobs:
 
       - name: Cache CodeQL
         id: cache-codeql
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           # A list of files, directories, and wildcard patterns to cache and restore
           path: ${{github.workspace}}/codeql_home
@@ -75,16 +74,34 @@ jobs:
           codeql-home: ${{ github.workspace }}/codeql_home
           add-to-path: false
 
+      - name: Cache queries compilation
+        id: cache-queries-compilation
+        uses: actions/cache/restore@v6
+        with:
+          path: ${{ github.workspace }}/codeql_cache
+          key: ${{ runner.os }}-codeql-compilation-${{ matrix.language }}-${{ matrix.codeql_cli }}-${{ matrix.codeql_standard_library_ident }}-${{ github.run_id }}
+          restore-keys: ${{ runner.os }}-codeql-compilation-${{ matrix.language }}-${{ matrix.codeql_cli }}-${{ matrix.codeql_standard_library_ident }}
+
       - name: Install CodeQL packs
         uses: ./.github/actions/install-codeql-packs
         with:
           cli_path: ${{ github.workspace }}/codeql_home/codeql
+          common_caches: ${{ github.workspace }}/codeql_cache
 
       - name: Pre-Compile Queries
         id: pre-compile-queries
         run: |
-         ${{ github.workspace }}/codeql_home/codeql/codeql query compile --threads 0 ${{ matrix.language }}
-
+          ${{ github.workspace }}/codeql_home/codeql/codeql query compile \
+            --common-caches=${{ github.workspace }}/codeql_cache \
+            --compilation-cache-size=1024 \
+            --threads 0 \
+            ${{ matrix.language }}
+
+      - name: Save queries compilation cache
+        uses: actions/cache/save@v6
+        with:
+          path: ${{ github.workspace }}/codeql_cache
+          key: ${{ steps.cache-queries-compilation.outputs.cache-primary-key }}
 
       - name: Run test suites
         id: run-test-suites
@@ -135,7 +152,7 @@ jobs:
               os.makedirs(os.path.dirname(test_report_path), exist_ok=True)
               test_report_file = open(test_report_path, 'w')
               files_to_close.append(test_report_file)
-              procs.append(subprocess.Popen([codeql_bin, "test", "run", "--failing-exitcode=122", f"--slice={slice}/{num_slices}", "--ram=2048", "--format=json", *test_roots], stdout=test_report_file, stderr=subprocess.PIPE))
+              procs.append(subprocess.Popen([codeql_bin, "test", "run", "--common-caches=${{ github.workspace }}/codeql_cache", "--failing-exitcode=122", f"--slice={slice}/{num_slices}", "--ram=2048", "--format=json", *test_roots], stdout=test_report_file, stderr=subprocess.PIPE))
 
             for p in procs:
               _, err = p.communicate()

change_notes/2026-08-03-unused-local-function-false-positives.md

@@ -0,0 +1,16 @@
+- `A0-1-3`, `RULE-0-2-4` - `UnusedLocalFunction.ql`:
+  - Fixed false positives for private pure virtual functions used through the non-virtual
+    interface (NVI) idiom. `DynamicCallGraph::getTarget()` resolves a virtual call to the
+    implementations that may actually run; a pure virtual function has no body, so it is
+    never a viable dispatch target and was reported as unused even when a sibling member
+    called it. A call is now also counted when the function is the statically named
+    callee. Pure virtual functions that are genuinely never called and never overridden
+    are still reported.
+  - Excluded private member functions of class templates that are never concretely
+    instantiated anywhere in the database (and where no sibling member of the same
+    class-template pattern is instantiated either). Clang never elaborates a body for the
+    members of such patterns, so calls between sibling members of the same
+    never-instantiated class (e.g. a public entry point calling a private helper) cannot be
+    resolved by the call graph. This is common for generic "plumbing" library code
+    (CRTP-style wrappers, etc.) that is only ever
+    instantiated by downstream consumers outside of the analyzed codebase.

change_notes/2026-08-04-rule-5-10-1-pretty-function-regression.md

@@ -0,0 +1,2 @@
+- `RULE-5-10-1` - `PoorlyFormedIdentifier.ql`:
+  - Avoid false positives for none user defined identifiers like __PRETTY_FUNCTION__

change_notes/2026-08-19-allow-structured-bindings.md

@@ -0,0 +1,2 @@
+- `RULE-10-0-1`, `M8-0-1` - `MultipleLocalDeclarators.qll`:
+  - Added a check to ignore structured bindings from C++17, which are explicitly allowed by RULE 10-0-1 and serve a unique useful purpose.

change_notes/2026-08-20-fix-fp-rule-7-0-1-bool-reference.md

@@ -0,0 +1,9 @@
+ - `RULE-7-0-1` - `NoConversionFromBool.ql`:
+   - Fixed false positives where a `bool` value is bound to a reference whose
+     referenced type is also `bool` (e.g. `bool&`, `const bool&`), including
+     when this happens via a generic/forwarding-reference parameter (e.g.
+     `template<class T> void f(T&& t)`, or class template forwarding
+     constructors such as `std::pair`'s `pair(U1&&, U2&&)`) that happens to be
+     instantiated with `bool`. Binding a value to a reference of its own type
+     does not change the type or representation of the value, so this is not
+     a conversion from `bool` in the sense intended by the rule.

change_notes/2026-08-20-fix-fp-rule-7-0-4-non-numeric-operand-types.md

@@ -0,0 +1,11 @@
+- `RULE-7-0-4` - `InappropriateBitwiseOrShiftOperands.ql`:
+  - Fixes #1177 - the rule no longer reports operands whose type is not a MISRA numeric type. The
+    operand checks used `not isUnsignedType(operandType)`, which is vacuously true for every type
+    that has no MISRA numeric type at all, such as class types and the unresolved dependent types
+    of uninstantiated template bodies. As a result the rule reported operations that do not use
+    the built-in operators, most notably the stream insertion and extraction operators. The checks
+    now use `isSignedType(operandType)` instead.
+  - Operands of character type, of a non-standard integral type, and of an unscoped enumeration
+    type without a fixed underlying type are consequently no longer reported, because none of them
+    has a MISRA numeric type. Unscoped enumerations without a fixed underlying type are covered by
+    `RULE-10-2-3`.

change_notes/2026-08-24-fix-fp-rule-5-10-1-hash-specialization-reserved-namespace.md

@@ -0,0 +1,5 @@
+- `RULE-5-10-1` - `PoorlyFormedIdentifier.ql`:
+  - Fixed false positives where a local variable or function parameter was reported as
+    "defined in reserved namespace" merely because its enclosing function is the body of
+    an explicit template specialization that C++ permits users to add to namespace `std`
+    (for example, `std::hash<UserType>::operator()`'s parameter and local names).

change_notes/2026-08-25-fix-fp-rule-7-0-2-unknown-and-reference-bool.md

@@ -0,0 +1,13 @@
+- `RULE-7-0-2` - `NoImplicitBoolConversion.ql`:
+   - Fixed false positives where a conversion's source expression type could
+     not be resolved to a concrete type (`UnknownType`), which occurs only in
+     template-dependent contexts that the extractor cannot resolve, e.g. a
+     `constexpr bool` variable template whose initializer is itself another
+     dependent variable template such as `std::conjunction_v<...>`.
+   - Fixed false positives on reference-dereference conversions (`bool&`/
+     `bool&&` to `bool`), which occur e.g. via the compiler-synthesized
+     `std::get<N>(...)` call used to implement structured binding
+     decomposition (`auto [a, b] = some_pair_or_tuple_expr;` where `b` is
+     `bool`). Dereferencing a reference to `bool` does not change the type or
+     representation of the value, so this is not a conversion to `bool` in
+     the sense intended by the rule.