FlowSummaryImpl: Model more source/sink steps as jump steps

[anurag6569201]

Modeling more source/sink steps as jump steps instead of local steps means that we avoid skipping over nodes that we would like to see in the path graph. For example, in

let callback = |x| sink(x);
//              ^ A
//                      ^ B
pass_source_into_callback(callback)
//                        ^^^^^^^^ C

we would previously get a direct edge C -> B, but now we instead get two edges C -> A and A -> B.

Source merge-base: b0fa3e770386f18fd4d63225301ea4c41e7a5721
Source head: d64ad79e15e56a516d91ab488c5eb01a1f2edbc8

[shipwright-agent]

✅ Shipwright · Approve

Recommendation: approve PR #14 · Tier T2
Checks: 0 total · 0 needing attention

Next step: ready to merge.

Findings (4)

• HIGH The new '--allow-escape-sequences' flag is added to the 'gh api' log fetch with no comment explaining why it is required or what failure mode it fixes. · misc/scripts/accept-expected-changes-from-ci.py:211
  • Fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.
• HIGH The boolean condition in accept-expected-changes-from-ci.py mixes 'and' and 'or' without parentheses. · misc/scripts/accept-expected-changes-from-ci.py:278
  • Fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.
• HIGH The FlowSummaryImpl.qll change adds 'summaryStoreStep(_, _, nodeFrom)' and 'summaryReadStep(nodeTo, _, _)' guards to locality classification. · shared/dataflow/codeql/dataflow/internal/FlowSummaryImpl.qll:2295
  • Fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.
• HIGH 'subprocess.check_output' invokes 'gh api' with a URL built by string interpolation from 'status.nwo' and 'job_id'. · misc/scripts/accept-expected-changes-from-ci.py:210
  • Fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.

Fireworks usage: 49,298 input · 494 output · 49,792 total tokens · $0.0112 · 13s · 0 fix iteration(s)

Open the Shipwright check for full evidence and the audit bundle. Use /shipwright rerun to verify again.

[shipwright-agent]

Shipwright · HIGH

The new '--allow-escape-sequences' flag is added to the 'gh api' log fetch with no comment explaining why it is required or what failure mode it fixes.

Impact: The new '--allow-escape-sequences' flag is added to the 'gh api' log fetch with no comment explaining why it is required or what failure mode it fixes. A future maintainer cannot tell whether removing it is safe, and the flag's behavior may vary across gh versions.

Suggested fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.

[shipwright-agent]

Shipwright · HIGH

The boolean condition in accept-expected-changes-from-ci.py mixes 'and' and 'or' without parentheses.

Impact: The boolean condition in accept-expected-changes-from-ci.py mixes 'and' and 'or' without parentheses. Python precedence makes this '(A and not B) or C', so any status whose context is in supported_internal_status_language_test_names is treated as a language test regardless of state or Windows exclusion. This can silently include unintended statuses in lang_test_failures and alter which expected changes are accepted.

Suggested fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.

[shipwright-agent]

Shipwright · HIGH

The FlowSummaryImpl.qll change adds 'summaryStoreStep(_, _, nodeFrom)' and 'summaryReadStep(nodeTo, _, _)' guards to locality classification.

Impact: The FlowSummaryImpl.qll change adds 'summaryStoreStep(_, _, nodeFrom)' and 'summaryReadStep(nodeTo, _, _)' guards to locality classification. If these predicates are recursive or depend on the steps being compiled, this can introduce non-monotonic recursion or change step locality in ways not covered by the updated expected files, potentially causing missing or spurious dataflow paths in production queries.

Suggested fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.