Failure on Ubuntu 24.04

[kleisauke]

The default CodeQL setup in the libvips repository appears to fail after the after the ubuntu-latest image was migrated to Ubuntu 24.04. For example, compare the following runs:
https://github.com/libvips/libvips/actions/runs/12577488911/job/35054987879#step:1:4
versus:
https://github.com/libvips/libvips/actions/runs/12683554993/job/35350821841#step:1:4

According to CodeQL's system requirements, Ubuntu 24.04 is not (yet?) supported. I suspect this incompatibility is also the root cause of the failure, as indicated by the following error in CodeQL CLI v2.20.0:

[build-stderr] cpp/autobuilder: deptrace not supported in ubuntu 24.04

^{(see: https://github.com/libvips/libvips/actions/runs/12683554993/job/35350821841#step:5:74)}

This specific error message is no longer displayed in CodeQL CLI v2.20.1; however, the workflow still appears to fail. For example:
https://github.com/libvips/libvips/actions/runs/12802008925/job/35692408039#step:6:70

For additional context, I've rerun the latest failed CodeQL workflow with debugging enabled:
https://github.com/libvips/libvips/actions/runs/12802008925/job/35775146400

[redsun82]

Hi @kleisauke, thanks for reaching out.

The system requirements might be out of date at the moment, I would expect analysis to indeed work on 24.04. We did indeed have C/C++ autobuild not working to its full potential in 2.20.0 but as you noticed that was fixed with 2.20.1.

I will have a look. What I also find surprising is that the final error message in the analyze step mentions that CodeQL wasn't able to build any of the code, even though the autobuild step was successful.

[redsun82]

Hmm, seems like for some reason the tracer gave up on tracing the build (there's a bunch of CODEQL_TRACER_LANGUAGES is empty messages in the build_tracer.log file). That is weird, and I will do some more investigation on Monday. I can confirm this should work on 24.04, we even have our own C++ scan running on that (see https://github.com/github/codeql/actions/workflows/cpp-swift-analysis.yml).

[kleisauke]

If it helps, here's another project experiencing similar symptoms:
https://github.com/mm2/Little-CMS/actions/runs/12829208512/job/35774821548

Additionally, I noticed that the deptrace.log file contains numerous client closed connection messages, but I'm uncertain whether this is a real issue.

The system requirements might be out of date at the moment, I would expect analysis to indeed work on 24.04.

Thanks for clarifying! Good to know that CodeQL ought to work on Ubuntu 24.04.

[redsun82]

Hi @kleisauke! I think I might start to understand what's going on. Something about the switch to Ubuntu 24.04 made the build go for using sccache. From https://github.com/libvips/libvips/actions/runs/12802008925/job/35692408039#step:5:82:

  [2025-01-16 04:21:56] [build-stdout] C compiler for the host machine: sccache cc (gcc 13.3.0 "cc (Ubuntu 13.3.0-6ubuntu2~24.04) 13.3.0")

As sccache uses a persistent service to run compilation commands, those compilation commands happen outside the build process and we're therefore unable to follow them.

From what I can tell, this seems to affect all meson builds with default setup, and we'll fix this as soon as possible. We'll try our best, but it might be too late for the fix to land in the upcoming 2.20.2 release (although, never say never 🙂).

In the meantime, I fear the only available workaround is to switch to advanced setup: there, as far as I can tell, you can prevent meson from autodetecting sccache by setting explicit CC and CXX environment variables to the analyze step (see defining env variables in github workflows).

[kleisauke]

Nice catch! However, it looks like sccache is automatically installed by deptrace:
https://github.com/libvips/libvips/actions/runs/12802008925/job/35692408039#step:5:844

So, presumably you could add that package to an internal denylist (if one exists?) to prevent it from being installed.

[redsun82]

Nice catch! However, it looks like sccache is automatically installed by deptrace: https://github.com/libvips/libvips/actions/runs/12802008925/job/35692408039#step:5:844

So, presumably you could add that package to an internal denylist (if one exists?) to prevent it from being installed.

Yep, that is exactly what I'm doing right now 😄. We already have a similar blacklist entry for ccache.

[redsun82]

So, there's currently no way to blacklist package installation for a given run (i.e. the black list is currently hard-coded). I'm thinking about allowing that in the future. In the meantime, the good news is that the fix to this will make it into the next 2.20.2 release, slated for later this week 🎉