From 172d6080181d3998eff50859c2a8ad4189213e1f Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 9 Nov 2026 12:58:45 +0000 Subject: [PATCH 1/3] build(deps): bump rules_pkg from 1.2.0 to 1.3.0 Bumps [rules_pkg](https://github.com/bazelbuild/rules_pkg) from 1.2.0 to 1.3.0. - [Release notes](https://github.com/bazelbuild/rules_pkg/releases) - [Changelog](https://github.com/bazelbuild/rules_pkg/blob/main/CHANGELOG.md) - [Commits](https://github.com/bazelbuild/rules_pkg/compare/1.2.0...1.3) --- updated-dependencies: - dependency-name: rules_pkg dependency-version: 1.3.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- MODULE.bazel | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/MODULE.bazel b/MODULE.bazel index 9ebcf569f563..94098f3b7b58 100644 --- a/MODULE.bazel +++ b/MODULE.bazel @@ -18,7 +18,7 @@ bazel_dep(name = "platforms", version = "1.1.0") bazel_dep(name = "rules_cc", version = "0.2.27") bazel_dep(name = "rules_go", version = "0.65.0") bazel_dep(name = "rules_java", version = "9.9.0") -bazel_dep(name = "rules_pkg", version = "1.2.0") +bazel_dep(name = "rules_pkg", version = "1.3.0") bazel_dep(name = "rules_nodejs", version = "6.7.7") bazel_dep(name = "rules_python", version = "2.4.6") bazel_dep(name = "rules_shell", version = "0.8.0") From 0c0f5f842f0dc7704a5d07d6276110e7ee170e3f Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Mon, 9 Nov 2026 13:03:32 +0000 Subject: [PATCH 2/3] Preserve CODEQL_PLATFORM during rules_pkg prefix expansion Define the variable as its literal pack-routing placeholder in both Bazel configurations so rules_pkg 1.3 leaves it for CodeQL's later expansion. --- .bazelrc | 3 +++ .bazelrc.internal | 3 +++ 2 files changed, 6 insertions(+) diff --git a/.bazelrc b/.bazelrc index e34a363a16fc..98478f4d9965 100644 --- a/.bazelrc +++ b/.bazelrc @@ -5,6 +5,9 @@ common --lockfile_mode=off # Build release binaries by default, can be overwritten to in local.bazelrc and set to `fastbuild` or `dbg` build --compilation_mode opt +# Preserve CodeQL's placeholder during rules_pkg variable substitution. +build --define=CODEQL_PLATFORM={CODEQL_PLATFORM} + # when building from this repository in isolation, the internal repository will not be found at .. # where `MODULE.bazel` looks for it. The following will get us past the module loading phase, so # that we can build things that do not rely on that diff --git a/.bazelrc.internal b/.bazelrc.internal index 245cd98fbd84..3872da2192a8 100644 --- a/.bazelrc.internal +++ b/.bazelrc.internal @@ -1,5 +1,8 @@ # this file should contain bazel settings required to build things from `semmle-code` +# Preserve CodeQL's placeholder during rules_pkg variable substitution. +build --define=CODEQL_PLATFORM={CODEQL_PLATFORM} + common --registry=file:///%workspace%/ql/misc/bazel/registry common --registry=https://bcr.bazel.build From 281f38c291d7cdfb795be96051f8742b165b9c63 Mon Sep 17 00:00:00 2001 From: Jeroen Ketema <93738568+jketema@users.noreply.github.com> Date: Mon, 9 Nov 2026 14:29:31 +0000 Subject: [PATCH 3/3] Package original Swift shared libraries instead of solib artifacts Moving the C++ library target only aligns solib ownership in standalone builds. When CodeQL is a dependency, the solib artifacts still live in the root repository's runfiles but are owned by the CodeQL repository, so rules_pkg 1.3 cannot resolve them. Overlay the extractor's runfiles with the original prebuilt shared libraries at the same installed destinations. This preserves package contents and permissions while using source paths that resolve correctly in both build layouts. --- swift/extractor/BUILD.bazel | 18 ++++++++++++++++-- .../third_party/BUILD.swift-llvm-support.bazel | 10 ++++++++-- swift/third_party/resources/BUILD.bazel | 10 ++++++++++ 3 files changed, 34 insertions(+), 4 deletions(-) diff --git a/swift/extractor/BUILD.bazel b/swift/extractor/BUILD.bazel index 425d72146527..ee8010a20295 100644 --- a/swift/extractor/BUILD.bazel +++ b/swift/extractor/BUILD.bazel @@ -1,5 +1,5 @@ load("@rules_shell//shell:sh_binary.bzl", "sh_binary") -load("//misc/bazel:pkg.bzl", "codeql_pkg_files", "codeql_pkg_runfiles") +load("//misc/bazel:pkg.bzl", "codeql_pkg_files", "codeql_pkg_files_overlay", "codeql_pkg_runfiles") load("//swift:rules.bzl", "swift_cc_binary") swift_cc_binary( @@ -31,9 +31,23 @@ sh_binary( ) codeql_pkg_runfiles( - name = "pkg", + name = "extractor-files", excludes = ["extractor.sh"], # script gets copied as "extractor", no need for the original .sh file exes = [":extractor"], +) + +codeql_pkg_files( + name = "shared-libraries", + exes = ["//swift/third_party/resources:shared-libraries"], +) + +# Use original libraries: _solib artifacts can have owners that do not match their runfiles repository. +codeql_pkg_files_overlay( + name = "pkg", + srcs = [ + ":extractor-files", + ":shared-libraries", + ], visibility = ["//swift:__pkg__"], ) diff --git a/swift/third_party/BUILD.swift-llvm-support.bazel b/swift/third_party/BUILD.swift-llvm-support.bazel index 6390ca31718a..e33a8584af2d 100644 --- a/swift/third_party/BUILD.swift-llvm-support.bazel +++ b/swift/third_party/BUILD.swift-llvm-support.bazel @@ -20,8 +20,8 @@ cc_library( ], ) -cc_library( - name = "swift-llvm-support", +filegroup( + name = "swift-llvm-support-shared", srcs = glob( [ "*.so", @@ -29,6 +29,12 @@ cc_library( ], allow_empty = True, # Either *.so or *.dylib will be empty ), + visibility = ["//visibility:public"], +) + +cc_library( + name = "swift-llvm-support", + srcs = [":swift-llvm-support-shared"], linkopts = [ "-lm", "-lz", diff --git a/swift/third_party/resources/BUILD.bazel b/swift/third_party/resources/BUILD.bazel index 0ceca995b94f..55c6b0eabac7 100644 --- a/swift/third_party/resources/BUILD.bazel +++ b/swift/third_party/resources/BUILD.bazel @@ -12,6 +12,16 @@ alias( visibility = ["//visibility:public"], ) +alias( + name = "shared-libraries", + actual = select({"@platforms//os:" + os: "@swift-prebuilt-%s//:swift-llvm-support-shared" % os for os in _oses}), + target_compatible_with = select({ + "@platforms//os:windows": ["@platforms//:incompatible"], + "//conditions:default": [], + }), + visibility = ["//swift/extractor:__pkg__"], +) + alias( name = "prebuilt", actual = select({"@platforms//os:" + os: "@swift-prebuilt-%s//:swift-llvm-support" % os for os in _oses}),