CodeQL's default configuration generator is inconsistent with CodeQL's internal language detectors

[emeralddcw]

Description of the issue

I've been running CodeQL on an internal repo with the default CodeQL config. That repo contains a python script without a .py extension. The default CodeQL config correctly detects that the repository contains python code, so it ran the CodeQL python analyzer. The CodeQL python analyzer incorrectly detected that there was no python code present in the project, so it emitted an error:

Encountered a fatal error while running "/opt/hostedtoolcache/CodeQL/2.25.3/x64/codeql/codeql database finalize --finalize-dataset --threads=2 --ram=6914 /home/runner/work/_temp/codeql_databases/python". Exit code was 32 and last log line was: CodeQL detected code written in GitHub Actions, but not any written in Python. Confirm that there is some source code for Python in the project. For more information, review our troubleshooting guide at https://gh.io/troubleshooting-code-scanning/no-source-code-seen-during-build . See the logs for more details.

The github/codeql-action/init@v4 action notes that it activated the python analyzer, but does not explain why. Through guess-and-check, I found that adding a .py extension to the python script got the analyzer to run.

Suggestions for improvement

1. Use a single set of filtering rules in the CodeQL init stage and CodeQL analyze stage. As a user of the default CodeQL config, it is surprising to see that CodeQL (the GitHub action) determined this project has python code and CodeQL (the python analyzer) determine this project does not have python code.
2. Make it possible to see why an analyzer was activated so that visitors of the linked troubleshooting page know which flow is applicable to them. For example, make it possible to see a list of the files that the analyzer determined were python files.

Probably related

• False positive — CodeQL failing due to lack of Python files when they only exist on the main branch #21106: This issue is more generally about the action's language detector being inconsistent with each language's own detectors. That issue is about cross-branch inconsistencies.
• CodeQL detected code written in some language, but not any written in GitHub Actions. Confirm that there is some source code for GitHub Actions in the project. #20102: I think that discussion covers multiple issues, one of which is the one under discussion in this issue.

[jketema]

Hi @emeralddcw,

I'd like to reproduce the problem locally, but I don't quite have enough information.

That repo contains a python script without a .py extension.

Presumably that file starts with a #! python or something similar?

[emeralddcw]

Yeah. There's a file at the repo's /bin/some-script path, with contents like:

#!/usr/bin/env python3

...

def main() -> int:
    ...

if __name__ == "__main__":
    sys.exit(main())

I'm trying to shrink this down to a minimal reproducer, but struggling with that now. Looks like I and someone else on my team were making changes in different branches, and one of the two changes contained the first python file in the repo. I think this might just be a dup of #21106.

[jketema]

Thanks. I'll give it a go with the above skeleton.

I think this might just be a dup of #21106.

I doubt it, because that is related to a non-default branch, and you haven't made mention of that.

[jketema]

Hi,

We do pick up on script files like the one you outlines above. So that's not the problem, and from that perspective the error you mentioned in your initial message should not occur.

Looks like I and someone else on my team were making changes in different branches, and one of the two changes contained the first python file in the repo. I think this might just be a dup of #21106.

From your description it is not clear to me that this is going on. This requires a very specific set of circumstances:

• Python scanning is enabled on the default branch and the script file is present there
• The branch you're working on does not have the script file.

Are these conditions satisfied in your case?