Skip to content

Conversation

@allsmog
Copy link

@allsmog allsmog commented Oct 22, 2025

Summary

Fixes a bug where cross-module workspace dependencies were incorrectly excluded from extraction.

Problem

When using go.work workspaces with multiple modules:

  1. Only input packages ModDirs were added to wantedRoots
  2. Cross-module dependencies had their ModDir excluded
  3. Checking dependencies against sibling packages produced .. paths → excluded

Example

/project/
  go.work
  configmodule/config/config.go  <-- Excluded
  mainmodule/app/jobs/worker/worker.go

Solution

Add ModDir to wantedRoots for all packages (6-line change in type extraction loop).

Testing

Integration test at go/ql/integration-tests/package-exclusion-fix/:

  • Without fix: 2 files (config.go missing)
  • With fix: 4 files (config.go present)

Run: pytest go/ql/integration-tests/package-exclusion-fix/

Impact

Low risk, high value for multi-module workspaces, backward compatible.

@allsmog allsmog requested a review from a team as a code owner October 22, 2025 18:48
@github-actions github-actions bot added the Go label Oct 22, 2025
@owen-mc
Copy link
Contributor

owen-mc commented Oct 22, 2025

Thank you for this contribution to CodeQL. Would it be possible to turn your example into a test, to make it easier to confirm that this was failing without your change and passing with it, and to make sure it doesn't regress in future? You could start with a copy of go/ql/integration-tests/two-go-mods-not-nested/ (or one of its siblings) to get the basic structure. To run this test, the command pytest go/ql/integration-tests/two-go-mods-not-nested/ from the repository root should work.

@allsmog allsmog force-pushed the fix-go-extractor-package-exclusion branch 2 times, most recently from 86a4c86 to df5c62c Compare October 23, 2025 17:24
The Go extractor was incorrectly excluding valid packages from cross-module
workspace dependencies when their relative path from a wantedRoot contained
'..' (parent directory references).

Problem:
When using trace-command or specific package patterns (e.g., ./mainmodule/...),
only the input packages' ModDirs were added to wantedRoots. Cross-module
dependencies had their ModDir excluded, causing them to be skipped during
extraction when checked against unrelated sibling package directories.

Solution:
Add ModDir to wantedRoots for all packages during type extraction, including
cross-module workspace dependencies. This ensures dependency module roots are
valid extraction targets.

Testing:
- Added integration test at go/ql/integration-tests/package-exclusion-fix/
- Two-module workspace: configmodule and mainmodule
- Without fix: 2 files extracted (config.go missing)
- With fix: 4 files extracted (config.go present)

Run test: pytest go/ql/integration-tests/package-exclusion-fix/
@allsmog allsmog force-pushed the fix-go-extractor-package-exclusion branch from df5c62c to 692f25e Compare October 23, 2025 17:25
@allsmog allsmog changed the title Fix Go extractor incorrectly excluding packages with .. in relative paths [WIP ] Fix Go extractor incorrectly excluding packages with .. in relative paths Oct 23, 2025
@allsmog allsmog marked this pull request as draft October 23, 2025 17:46
@allsmog allsmog changed the title [WIP ] Fix Go extractor incorrectly excluding packages with .. in relative paths Fix Go extractor incorrectly excluding packages with .. in relative paths Oct 23, 2025
@allsmog allsmog marked this pull request as ready for review October 23, 2025 18:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants