From 53fb85dced69781721f43b95599ccf76ad5e2391 Mon Sep 17 00:00:00 2001 From: Charlie Date: Sun, 23 Aug 2026 03:24:59 +0100 Subject: [PATCH 1/3] Stop the sandbox projects sharing one PDB, in both ways they did CodeQL has been failing every scheduled run on master with error C1041: cannot open program database ... if multiple CL.EXE write to the same .PDB file. Two independent causes, and fixing only the first leaves it red. Across projects: all seven sandbox targets defaulted IntDir to $(Platform)\$(Configuration)\ beside the project, so their object files and one shared vc*.pdb landed in the same folder. MSBuild has been saying so on every build as MSB8028, "can lead to incorrect clean and rebuild behavior". Each target now gets its own directory. Within a project: every sandbox target mixes C and C++ sources, and MSBuild compiles the two groups in separate CL.EXE invocations because their command lines differ. Both write the project PDB, so they race and one loses -- the same error, one level down. /FS is what the error message itself prescribes. Why it looked intermittent, and why nobody saw it locally: the second race needs two language groups compiling at once, which normally only happens on a full rebuild, and build.yml plus Invoke-BlorgChecks.ps1 both build serially. codeql.yml is the only thing passing /m. So a warm incremental tree stayed green while CI and any fresh checkout failed. Verified in a throwaway worktree, which is the condition that reproduces it -- a full rebuild with nothing cached. Before: exit -1, C1041. After, both the Build tier and the exact CI command (msbuild BlorgFS.sln /p:Configuration=Release /p:Platform=x64 /m) exit 0 with zero C1041 and zero MSB8028. Not a consequence of the query-pack bump. It predates it; that bump's pull request is simply the first thing that ever ran the workflow. --- tests/sandbox/ClientFuzz.vcxproj | 35 +++++++++++++++++++++++ tests/sandbox/ClientSandbox.vcxproj | 35 +++++++++++++++++++++++ tests/sandbox/DispatchSandbox.vcxproj | 35 +++++++++++++++++++++++ tests/sandbox/NodeTableSandbox.vcxproj | 35 +++++++++++++++++++++++ tests/sandbox/PrefetchSandbox.vcxproj | 35 +++++++++++++++++++++++ tests/sandbox/SocketSandbox.vcxproj | 35 +++++++++++++++++++++++ tests/sandbox/TlsHandshakeSandbox.vcxproj | 35 +++++++++++++++++++++++ 7 files changed, 245 insertions(+) diff --git a/tests/sandbox/ClientFuzz.vcxproj b/tests/sandbox/ClientFuzz.vcxproj index f1b27da..6bfe4db 100644 --- a/tests/sandbox/ClientFuzz.vcxproj +++ b/tests/sandbox/ClientFuzz.vcxproj @@ -41,6 +41,41 @@ + + + $(Platform)\$(Configuration)\$(ProjectName)\ + + + + + + true + + + Level3 diff --git a/tests/sandbox/ClientSandbox.vcxproj b/tests/sandbox/ClientSandbox.vcxproj index f17cb8f..98f81c2 100644 --- a/tests/sandbox/ClientSandbox.vcxproj +++ b/tests/sandbox/ClientSandbox.vcxproj @@ -41,6 +41,41 @@ + + + $(Platform)\$(Configuration)\$(ProjectName)\ + + + + + + true + + + Level3 diff --git a/tests/sandbox/DispatchSandbox.vcxproj b/tests/sandbox/DispatchSandbox.vcxproj index 0a8fc76..7baf95d 100644 --- a/tests/sandbox/DispatchSandbox.vcxproj +++ b/tests/sandbox/DispatchSandbox.vcxproj @@ -41,6 +41,41 @@ + + + $(Platform)\$(Configuration)\$(ProjectName)\ + + + + + + true + + + Level3 diff --git a/tests/sandbox/NodeTableSandbox.vcxproj b/tests/sandbox/NodeTableSandbox.vcxproj index 8bd7f3c..f8607db 100644 --- a/tests/sandbox/NodeTableSandbox.vcxproj +++ b/tests/sandbox/NodeTableSandbox.vcxproj @@ -41,6 +41,41 @@ + + + $(Platform)\$(Configuration)\$(ProjectName)\ + + + + + + true + + + Level3 diff --git a/tests/sandbox/PrefetchSandbox.vcxproj b/tests/sandbox/PrefetchSandbox.vcxproj index 9cd1a51..7378754 100644 --- a/tests/sandbox/PrefetchSandbox.vcxproj +++ b/tests/sandbox/PrefetchSandbox.vcxproj @@ -41,6 +41,41 @@ + + + $(Platform)\$(Configuration)\$(ProjectName)\ + + + + + + true + + + Level3 diff --git a/tests/sandbox/SocketSandbox.vcxproj b/tests/sandbox/SocketSandbox.vcxproj index 75d735d..4a84d8a 100644 --- a/tests/sandbox/SocketSandbox.vcxproj +++ b/tests/sandbox/SocketSandbox.vcxproj @@ -41,6 +41,41 @@ + + + $(Platform)\$(Configuration)\$(ProjectName)\ + + + + + + true + + + Level3 diff --git a/tests/sandbox/TlsHandshakeSandbox.vcxproj b/tests/sandbox/TlsHandshakeSandbox.vcxproj index 5687bb0..f22bb73 100644 --- a/tests/sandbox/TlsHandshakeSandbox.vcxproj +++ b/tests/sandbox/TlsHandshakeSandbox.vcxproj @@ -41,6 +41,41 @@ + + + $(Platform)\$(Configuration)\$(ProjectName)\ + + + + + + true + + + Level3 From 3bd4b21541b59018d06bb63ded22e345eab46276 Mon Sep 17 00:00:00 2001 From: Charlie Date: Sat, 22 Aug 2026 22:59:48 +0100 Subject: [PATCH 2/3] Let a CodeQL config change actually run CodeQL The workflow is schedule-only, and scheduled workflows run only on the default branch. So the one change that decides what CodeQL reports -- a query-pack pin in .github/codeql/codeql-config.yml -- could only ever be merged unrun, with the first evidence that it builds, resolves and reports arriving the following Saturday, on master. Two triggers fix that. A pull request touching this workflow or .github/codeql/ runs the analysis it is changing, which is precisely when a run is worth paying for. workflow_dispatch covers re-scans on demand -- after a pack bump, or after a batch of fixes -- instead of a seven-day wait. Neither makes CodeQL a per-push gate. PREfast already runs on every build.yml push and PR, which is why this was weekly to begin with. README gains a CI section, since when each of the three workflows runs, and why they are split that way, was previously only discoverable by reading three YAML files. --- .github/workflows/codeql.yml | 20 +++++++++++++++++--- README.md | 30 ++++++++++++++++++++++++++++++ 2 files changed, 47 insertions(+), 3 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index a1d3a56..bf8420a 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,11 +1,25 @@ name: "CodeQL Advanced" -# Schedule-only on purpose: PREfast (RunCodeAnalysis=true in BlorgFS.vcxproj) -# already gates every build.yml run on push/PR, so CodeQL runs weekly as a -# deeper second opinion rather than duplicating that cost per push. +# Weekly rather than per-push: PREfast (RunCodeAnalysis=true in +# BlorgFS.vcxproj) already gates every build.yml run on push/PR, so CodeQL +# is a deeper second opinion rather than a duplicate of that cost. +# +# The other two triggers exist because a schedule alone cannot validate a +# change to this analysis. Scheduled workflows only ever run on the default +# branch, so anything that alters what CodeQL reports -- a query-pack pin in +# codeql-config.yml above all -- would be merged unrun and only surface as a +# changed finding set the following Saturday. A pull request touching this +# workflow or its config therefore runs the analysis it is changing, and +# workflow_dispatch makes a re-scan available on demand rather than on a +# seven-day wait (a pack bump, or re-triaging after a fix). on: schedule: - cron: '41 23 * * 6' + workflow_dispatch: + pull_request: + paths: + - '.github/workflows/codeql.yml' + - '.github/codeql/**' env: SOLUTION_NAME: BlorgFS.sln diff --git a/README.md b/README.md index e869673..2b07c8b 100644 --- a/README.md +++ b/README.md @@ -69,6 +69,36 @@ not a substitute for running `Fast` yourself.) script reports this as `CLOCK`, not `FAIL`. Confirm with `Inf2Cat.exe /driver:x64\Debug\BlorgFS /os:10_x64 /uselocaltime`. +## Continuous integration + +Three workflows, split by what a failure should cost you. + +| Workflow | Runs on | What it does | +|---|---|---| +| `build.yml` | push and PR to master | Both configurations, Fast tier. The merge gate. | +| `verify.yml` | 03:00 UTC daily, or on demand | CBMC proofs and extended fuzz/interleaving runs. | +| `codeql.yml` | Saturdays 23:41 UTC, on demand, and on any PR touching its own config | CodeQL with the pinned Microsoft driver query packs. | + +The daily and weekly ones are deliberately not gates: a CBMC regression or +a new CodeQL finding is worth waking up to, not worth blocking a merge that +PREfast and the Fast tier already cleared. + +`codeql.yml`'s third trigger is the one worth understanding. Scheduled +workflows only ever run on the default branch, so a change to what CodeQL +analyses -- above all a query-pack pin in `.github/codeql/codeql-config.yml` +-- could otherwise only be merged unrun, and would first show up as a +changed finding set the following Saturday. A PR touching that config or +the workflow runs the analysis it is changing. `workflow_dispatch` covers +the rest: re-scanning after a pack bump or a batch of fixes, without a +seven-day wait. + +Both packs are pinned on purpose. A pack release must not silently change +what a scheduled run reports -- but a pin that is never reviewed is lost +coverage, and the windows-drivers pack is the one carrying the +driver-specific IRQL and annotation queries. Bump it deliberately, let the +PR trigger run it, and re-triage: previous false-positive verdicts do not +carry across a pack version. + ## Sanitizers The usermode sandbox targets build with **ASan** (`EnableASAN`) — it owns From fa1ce1a6668f82600787fc0145af34b1ac181afe Mon Sep 17 00:00:00 2001 From: Charlie Date: Sat, 22 Aug 2026 22:59:48 +0100 Subject: [PATCH 3/3] Bump the windows-drivers CodeQL pack to 1.10.0 Pinned at 1.1.0 and well behind. Pinning itself is right -- a pack release must not silently change what a scheduled scan reports -- but a pin still has to be reviewed rather than frozen, and this is the pack carrying the driver-specific IRQL and annotation queries, so a stale one is lost coverage on exactly the class of bug hardest to find any other way. Ordered after the trigger change on purpose: with it in place, the pull request carrying this bump runs the analysis under the new pack rather than merging it unverified. The previous triage (0 IRQL findings, 31 own-code hits all dismissed as false positives with reasons) will need redoing against the new queries rather than assuming those verdicts still hold. --- .github/codeql/codeql-config.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/codeql/codeql-config.yml b/.github/codeql/codeql-config.yml index 965dcb2..2364b2c 100644 --- a/.github/codeql/codeql-config.yml +++ b/.github/codeql/codeql-config.yml @@ -3,7 +3,7 @@ name: "BlorgFS CodeQL" # Both packs pinned so a pack release can't silently change what a weekly # run reports. packs: - - microsoft/windows-drivers@1.1.0 + - microsoft/windows-drivers@1.10.0 - microsoft/cpp-queries@0.0.5 query-filters: - include: