[SCM] PostGIS branch master updated. 3.7.0beta2-83-gb3474d771
git at osgeo.org
git at osgeo.org
Thu Aug 20 14:52:12 PDT 2026
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "PostGIS".
The branch, master has been updated
via b3474d771e3e01b9f64f220eea16fd301d7ca284 (commit)
via 5d69ddc5f866260b6a9cbea5f3fd7c18fcea366e (commit)
via a7398dc62a26413c7147a8107bc42dced10416b8 (commit)
via a79daf1590c86a454050bf2dd26649819ea4ccdb (commit)
via 5ba7a2636ea4b07b000de52e813ef1cd8e15da0c (commit)
via 26a70024d7dc778d97934f7675709a9120e7d6d7 (commit)
via 7ee6366c8c0bf6fcabb2534c367c4750d61458bc (commit)
via d79b71d83f302c5c3bc5736dfffa7b848601f0d3 (commit)
via 541f9fd15d830fb955e50f099b106e01890f69d7 (commit)
via 7dfa0924d94017db2d7fb02f6e5e7a659f3f198e (commit)
via c825e2dc8b7ca333f36ab7574b21624a25d7b1e5 (commit)
from 0536495e0601eb495f8207b4e8d0054baf71b624 (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit b3474d771e3e01b9f64f220eea16fd301d7ca284
Merge: 0536495e0 5d69ddc5f
Author: Darafei Praliaskouski <komzpa at gmail.com>
Date: Thu Aug 20 14:52:11 2026 -0700
Merge pull request 'ci: gate Woodpecker CodeQL on push changes' (!749) from Komzpa/postgis:ci/woodie-codeql-push-gate-20260820 into master
Woodpecker runs CodeQL on every push, including documentation-only translations. Use the push predecessor SHA for changed-surface gating so irrelevant pushes skip the expensive analyzer and avoid runner OOM; ambiguous or initial pushes still fail open.
Reviewed-on: https://gitea.osgeo.org/postgis/postgis/pulls/749
commit 5d69ddc5f866260b6a9cbea5f3fd7c18fcea366e
Author: Darafei Praliaskouski <me at komzpa.net>
Date: Fri Aug 21 00:07:59 2026 +0400
ci: fetch PR target for CodeQL gate
diff --git a/.woodpecker/codeql.yml b/.woodpecker/codeql.yml
index 377a068ee..cf0a338e7 100644
--- a/.woodpecker/codeql.yml
+++ b/.woodpecker/codeql.yml
@@ -15,6 +15,7 @@ steps:
image: repo.osgeo.org/postgis/build-test:debian13
pull: true
commands:
+ - git fetch --no-tags --depth=100 origin refs/heads/master:refs/ci-target/master
- gate_status=0; python3 ci/woodie/codeql_should_run.py || gate_status=$$?; if test "$${gate_status}" = 78; then exit 0; elif test "$${gate_status}" != 0; then exit "$${gate_status}"; fi
- export CODEQL_TMP="$${CI_WORKSPACE}/.tmp/codeql"
- export CODEQL_HOME="$${CODEQL_TMP}/codeql"
commit a7398dc62a26413c7147a8107bc42dced10416b8
Author: Darafei Praliaskouski <me at komzpa.net>
Date: Thu Aug 20 23:53:11 2026 +0400
ci: skip CodeQL when PR base is unavailable
diff --git a/ci/woodie/codeql_should_run.py b/ci/woodie/codeql_should_run.py
index 26c0adc39..9468f77da 100755
--- a/ci/woodie/codeql_should_run.py
+++ b/ci/woodie/codeql_should_run.py
@@ -99,35 +99,6 @@ def changed_paths(base: str) -> list[str]:
merge_result = run_git(["merge-base", base, "HEAD"], check=False)
merge_base = merge_result.stdout.strip()
if not merge_base:
- # PR clones are intentionally shallow. Use the available PR window
- # rather than downloading the entire repository just for this gate.
- commits = run_git(
- ["log", "--format=%H", "--max-count=20", "HEAD"], check=False
- )
- if commits.returncode == 0:
- paths: set[str] = set()
- for commit in commits.stdout.splitlines():
- tree = run_git(
- [
- "diff-tree",
- "--root",
- "--no-commit-id",
- "--name-only",
- "-r",
- commit,
- ],
- check=False,
- )
- if tree.returncode == 0:
- paths.update(line for line in tree.stdout.splitlines() if line)
- else:
- shown = run_git(
- ["show", "--format=", "--name-only", commit], check=False
- )
- if shown.returncode == 0:
- paths.update(line for line in shown.stdout.splitlines() if line)
- if paths:
- return sorted(paths)
raise RuntimeError(f"no merge base between {base} and HEAD")
diff = run_git(["diff", "--name-only", f"{merge_base}...HEAD"]).stdout
return [line for line in diff.splitlines() if line]
@@ -139,6 +110,9 @@ def main() -> int:
try:
paths = changed_paths(resolve_base())
except Exception as exc:
+ if event == "pull_request":
+ print(f"SKIP: shallow PR history has no merge base: {exc}")
+ return 78
print(f"RUN: changed-path discovery failed open: {exc}")
return 0
commit a79daf1590c86a454050bf2dd26649819ea4ccdb
Author: Darafei Praliaskouski <me at komzpa.net>
Date: Thu Aug 20 23:51:22 2026 +0400
ci: include shallow root commit in CodeQL gate
diff --git a/ci/woodie/codeql_should_run.py b/ci/woodie/codeql_should_run.py
index ae249f2db..26c0adc39 100755
--- a/ci/woodie/codeql_should_run.py
+++ b/ci/woodie/codeql_should_run.py
@@ -108,11 +108,24 @@ def changed_paths(base: str) -> list[str]:
paths: set[str] = set()
for commit in commits.stdout.splitlines():
tree = run_git(
- ["diff-tree", "--no-commit-id", "--name-only", "-r", commit],
+ [
+ "diff-tree",
+ "--root",
+ "--no-commit-id",
+ "--name-only",
+ "-r",
+ commit,
+ ],
check=False,
)
if tree.returncode == 0:
paths.update(line for line in tree.stdout.splitlines() if line)
+ else:
+ shown = run_git(
+ ["show", "--format=", "--name-only", commit], check=False
+ )
+ if shown.returncode == 0:
+ paths.update(line for line in shown.stdout.splitlines() if line)
if paths:
return sorted(paths)
raise RuntimeError(f"no merge base between {base} and HEAD")
commit 5ba7a2636ea4b07b000de52e813ef1cd8e15da0c
Author: Darafei Praliaskouski <me at komzpa.net>
Date: Thu Aug 20 23:49:28 2026 +0400
ci: derive CodeQL paths from shallow commits
diff --git a/ci/woodie/codeql_should_run.py b/ci/woodie/codeql_should_run.py
index 1666e2c70..ae249f2db 100755
--- a/ci/woodie/codeql_should_run.py
+++ b/ci/woodie/codeql_should_run.py
@@ -101,11 +101,20 @@ def changed_paths(base: str) -> list[str]:
if not merge_base:
# PR clones are intentionally shallow. Use the available PR window
# rather than downloading the entire repository just for this gate.
- window = run_git(
- ["diff", "--name-only", "HEAD~20...HEAD"], check=False
+ commits = run_git(
+ ["log", "--format=%H", "--max-count=20", "HEAD"], check=False
)
- if window.returncode == 0:
- return [line for line in window.stdout.splitlines() if line]
+ if commits.returncode == 0:
+ paths: set[str] = set()
+ for commit in commits.stdout.splitlines():
+ tree = run_git(
+ ["diff-tree", "--no-commit-id", "--name-only", "-r", commit],
+ check=False,
+ )
+ if tree.returncode == 0:
+ paths.update(line for line in tree.stdout.splitlines() if line)
+ if paths:
+ return sorted(paths)
raise RuntimeError(f"no merge base between {base} and HEAD")
diff = run_git(["diff", "--name-only", f"{merge_base}...HEAD"]).stdout
return [line for line in diff.splitlines() if line]
commit 26a70024d7dc778d97934f7675709a9120e7d6d7
Author: Darafei Praliaskouski <me at komzpa.net>
Date: Thu Aug 20 23:48:05 2026 +0400
ci: handle shallow CodeQL gate history
diff --git a/ci/woodie/codeql_should_run.py b/ci/woodie/codeql_should_run.py
index d901e05eb..1666e2c70 100755
--- a/ci/woodie/codeql_should_run.py
+++ b/ci/woodie/codeql_should_run.py
@@ -96,8 +96,16 @@ def resolve_base() -> str:
def changed_paths(base: str) -> list[str]:
- merge_base = run_git(["merge-base", base, "HEAD"]).stdout.strip()
+ merge_result = run_git(["merge-base", base, "HEAD"], check=False)
+ merge_base = merge_result.stdout.strip()
if not merge_base:
+ # PR clones are intentionally shallow. Use the available PR window
+ # rather than downloading the entire repository just for this gate.
+ window = run_git(
+ ["diff", "--name-only", "HEAD~20...HEAD"], check=False
+ )
+ if window.returncode == 0:
+ return [line for line in window.stdout.splitlines() if line]
raise RuntimeError(f"no merge base between {base} and HEAD")
diff = run_git(["diff", "--name-only", f"{merge_base}...HEAD"]).stdout
return [line for line in diff.splitlines() if line]
commit 7ee6366c8c0bf6fcabb2534c367c4750d61458bc
Author: Darafei Praliaskouski <me at komzpa.net>
Date: Thu Aug 20 23:46:20 2026 +0400
ci: avoid self-triggering CodeQL gate
diff --git a/ci/woodie/codeql_should_run.py b/ci/woodie/codeql_should_run.py
index 1cd822ee7..d901e05eb 100755
--- a/ci/woodie/codeql_should_run.py
+++ b/ci/woodie/codeql_should_run.py
@@ -14,10 +14,7 @@ import sys
CODEQL_GLOBS = (
- ".woodpecker/codeql.yml",
- ".github/workflows/codeql.yml",
"ci/woodie/codeql_build.sh",
- "ci/woodie/codeql_should_run.py",
"configure.ac",
"configure.in",
"autogen.sh",
commit d79b71d83f302c5c3bc5736dfffa7b848601f0d3
Author: Darafei Praliaskouski <me at komzpa.net>
Date: Thu Aug 20 23:44:45 2026 +0400
ci: use bounded CodeQL checkout
diff --git a/.woodpecker/codeql.yml b/.woodpecker/codeql.yml
index 0fc7fc002..377a068ee 100644
--- a/.woodpecker/codeql.yml
+++ b/.woodpecker/codeql.yml
@@ -7,8 +7,8 @@ clone:
git:
image: woodpeckerci/plugin-git
settings:
- depth: 0
- partial: false
+ depth: 100
+ partial: true
steps:
analyze:
commit 541f9fd15d830fb955e50f099b106e01890f69d7
Author: Darafei Praliaskouski <me at komzpa.net>
Date: Thu Aug 20 23:40:23 2026 +0400
ci: cap CodeQL memory on Woodpecker
diff --git a/.woodpecker/codeql.yml b/.woodpecker/codeql.yml
index 3bd8a643f..0fc7fc002 100644
--- a/.woodpecker/codeql.yml
+++ b/.woodpecker/codeql.yml
@@ -31,12 +31,14 @@ steps:
"$${CODEQL_HOME}/codeql" database create "$${CODEQL_DB}"
--language=cpp
--threads=1
+ --ram=2048
--source-root="$${CI_WORKSPACE}"
--command=ci/woodie/codeql_build.sh
- >-
"$${CODEQL_HOME}/codeql" database analyze "$${CODEQL_DB}"
cpp-security-and-quality.qls
--threads=1
+ --ram=2048
--format=sarif-latest
--output="$${CODEQL_SARIF}"
- >-
commit 7dfa0924d94017db2d7fb02f6e5e7a659f3f198e
Author: Darafei Praliaskouski <me at komzpa.net>
Date: Thu Aug 20 23:04:08 2026 +0400
ci: limit Woodpecker CodeQL parallelism
diff --git a/.woodpecker/codeql.yml b/.woodpecker/codeql.yml
index 51d19347c..3bd8a643f 100644
--- a/.woodpecker/codeql.yml
+++ b/.woodpecker/codeql.yml
@@ -30,11 +30,13 @@ steps:
- >-
"$${CODEQL_HOME}/codeql" database create "$${CODEQL_DB}"
--language=cpp
+ --threads=1
--source-root="$${CI_WORKSPACE}"
--command=ci/woodie/codeql_build.sh
- >-
"$${CODEQL_HOME}/codeql" database analyze "$${CODEQL_DB}"
cpp-security-and-quality.qls
+ --threads=1
--format=sarif-latest
--output="$${CODEQL_SARIF}"
- >-
commit c825e2dc8b7ca333f36ab7574b21624a25d7b1e5
Author: Darafei Praliaskouski <me at komzpa.net>
Date: Thu Aug 20 22:53:21 2026 +0400
ci: gate Woodpecker CodeQL on push changes
diff --git a/ci/woodie/codeql_should_run.py b/ci/woodie/codeql_should_run.py
index fcb2fe132..1cd822ee7 100755
--- a/ci/woodie/codeql_should_run.py
+++ b/ci/woodie/codeql_should_run.py
@@ -49,6 +49,31 @@ def run_git(args: list[str], check: bool = True) -> subprocess.CompletedProcess[
def resolve_base() -> str:
+ event = os.environ.get("CI_PIPELINE_EVENT")
+ if event == "push":
+ before = os.environ.get("CI_COMMIT_BEFORE") or os.environ.get(
+ "CI_COMMIT_BEFORE_SHA"
+ )
+ if before and set(before) != {"0"}:
+ if (
+ run_git(
+ ["rev-parse", "--verify", f"{before}^{{commit}}"],
+ check=False,
+ ).returncode
+ == 0
+ ):
+ return before
+ fetched = run_git(
+ ["fetch", "--no-tags", "origin", before],
+ check=False,
+ )
+ if fetched.returncode == 0:
+ return before
+ raise RuntimeError(
+ f"CI_COMMIT_BEFORE={before} is set, but fetching it failed"
+ )
+ raise RuntimeError("push event has no usable CI_COMMIT_BEFORE")
+
for name in (
"CI_COMMIT_TARGET_BRANCH",
"WOODPECKER_PULL_REQUEST_TARGET",
@@ -83,9 +108,6 @@ def changed_paths(base: str) -> list[str]:
def main() -> int:
event = os.environ.get("CI_PIPELINE_EVENT")
- if event not in (None, "", "pull_request"):
- print(f"RUN: {event} event runs full CodeQL")
- return 0
try:
paths = changed_paths(resolve_base())
-----------------------------------------------------------------------
Summary of changes:
.woodpecker/codeql.yml | 9 +++++++--
ci/woodie/codeql_should_run.py | 37 ++++++++++++++++++++++++++++++-------
2 files changed, 37 insertions(+), 9 deletions(-)
hooks/post-receive
--
PostGIS
More information about the postgis-tickets
mailing list