Build tracing filtering: path-based inclusion & content-based exclusion

[megabug]

I'm using the CodeQL CLI with a large Java/Kotlin project that makes heavy use of autogenerated source during the build process. Because of this, I am using build tracing (codeql database trace-command) to extract CodeQL databases.

Is there any way to filter the files processed by the extractor in the following ways? If not, please consider this a feature request :)

---

Include-filtering by path

I'd like to be able to extract databases for certain components of the project. Due to the complexity of the project's build system, it's not easy to just build/trace only those components of the project; instead it would be much easier if I could just restrict extraction to those components' files by providing path globs during build tracing.

I'm aware that files can be excluded using the exclude extractor option, but this only allows certain path globs to be excluded, not included.

Exclude-filtering by file contents

As mentioned earlier, the project has a lot of autogenerated code, some (but only some) of which needs to be ignored. This code is often generated with paths that are not easily excludable using the existing path-glob-based exclusions. It would be great if I can specify regexes to search for in the content of files that indicate that the file should not be extracted (e.g. to look for things like "// Autogenerated file, do not edit", etc.)

---

If there isn't a way to do these, I'm happy to hear about hacky workarounds. For example, the commands I trace are already wrapped in shell scripts that wrap the underlying compilers (javac etc.) in order to provide for more filtering criteria than mentioned here. However, it's hard to do the above properly using such a wrapper because of i.e. the need to properly parse the original compiler command line arguments, handle things like files in JAR files, indirect command line options, etc. The extractor is much better placed to handle such filtering.

[redsun82]

👋 @megabug The easiest way to do include filtering is through a configuration file and the --codescanning-config flag to codeql database init. In particular this part of the docs about the configuration format is most interesting to you.

[redsun82]

ah, sorry, after double checking it does seem the java/kotlin extractor does not currently support paths from the code scanning config in manual build mode, so I'm afraid the options you mentioned might be the best ones. What you could try out alternatively: if you can separate code generation from the actual build, you could run that code generation and then use build mode none extraction with the generated code already in place. In that case paths explicit inclusion is applied.

[redsun82]

About hacky workarounds, while it's true that a general purpose javac wrapper might be hard to pull off, maybe one that works for your specific project might be easier to achieve. I'd probably start with a wrapper that simply logs all command invocations somewhere, and would start from that list to craft a hopefully simpler wrapper that works on those commands even if it wouldn't work on all possible javac invocations.