Repository navigation
ci(codeql): resolve sidecar crates before the Rust scan - #1352
Conversation
The sidecar's Ratspeak crates are path dependencies under the gitignored .rsstack/, which only scripts/clone-ratspeak-stack.sh creates. CodeQL default setup cannot run it, so Cargo cannot load the sidecar and its serde_json and tracing macros fail to expand: on main at 9834208, 35 of 102 Rust files extracted with errors, which the CodeQL status page reports. The advanced workflow now clones the stack for the Rust job and ignores .rsstack/ so the upstream crates resolve the sidecar without being scanned. The status page clears once the repository switches to the advanced workflow (.github/codeql/README.md, activation steps).
github-actions
Bot
added
the
chore
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Prepare and verify Rust analysis .github/workflows/codeql.yaml, .github/codeql/README.md, scripts/codeql-workflow.test.mjs |
The workflow clones the Ratspeak stack before CodeQL initialization and excludes .rsstack from scanning. Documentation describes the setup, and tests verify the workflow configuration and sidecar path dependencies. |
Estimated code review effort: 2 (Simple) | ~10 minutes
Suggested reviewers: rinchen
Merge Risk: 
d92a5
-
The change makes the advanced CodeQL Rust job clone the Ratspeak dependencies and exclude them from results. No concrete merge-blocking problem was found. Once the advanced workflow runs, maintainers should check the Rust extraction summary for any native-library errors.
Pre-merge checks: 
-
Check name Status Explanation Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title clearly and concisely describes the main change: resolving the sidecar crates before the Rust CodeQL scan. Docstring Coverage No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat… Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Full details: Docstring Coverage
-
Explanation
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 1 files. (2 skipped: 2 unsupported.)
-
Finishing Touches
-
📝 Generate docstrings
-
- Commit to this branch
- Create a new PR
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
Summary
The CodeQL status page warns about Rust because the sidecar can't be fully analyzed. There are no open code scanning alerts. This is a coverage warning.
reticulum-sidecar/Cargo.tomlpulls its Ratspeak crates from../.rsstack/..., which onlyscripts/clone-ratspeak-stack.shcreates. Default setup can't run that script, so Cargo can't load the sidecar and itsserde_json::json!andtracingmacros fail to expand. Onmainat98342088, the default-setup Rust job reported 35 of 102 Rust files extracted with errors (run). A Rust job from October 11 logged the same macro failures, so this predates the recent merges.Change
codeql.yaml: the Rust job runsbash scripts/clone-ratspeak-stack.shbeforeInitialize CodeQL, the same wayreticulum-sidecar.yamldoes.paths-ignore: [.rsstack], so the cloned upstream crates resolve the sidecar without being scanned as this repo's code. GitHub supportspaths-ignorefor Rust analyzed without a build (docs).scripts/codeql-workflow.test.mjs: covers the config, checks that the clone step runs only for Rust and before init, and checks that every sidecar path dependency lives under.rsstack/..github/codeql/README.md: a short Rust section.What still needs a maintainer
Default setup is still the scanner that uploads, and it can't run custom steps, so the status page warning stays until the switch in
.github/codeql/README.md("Activation after the PR is merged"): disable default setup, setCODEQL_ADVANCED_ENABLED=true, then dispatch CodeQL (advanced) onmain. That's a repository settings change, so this PR can't do it.Testing
scripts/codeql-workflow.test.mjs: 22 passed.actionlint, Prettier and markdownlint on the changed files: clean.json!call in a#[cfg(not(feature = "rns-stack"))]branch (stack/mod.rs:3484), an extractor quirk rather than a missing dependency..rsstack/. Default setup's Rust analysis onmainalso reports 0 results, so findings are unchanged.