[lestarch-autobot]

Related Issue(s)
Has Unit Tests (y/n)	n
Documentation Included (y/n)	n
Generative AI was used in this contribution (y/n)	AI

---

Change Description

The upstream CodeQL JPL_C pack's Rule 16 ("Use assertions") queries rely on semmle.code.cpp.commons.Assertions, which only recognizes macros matching assert(, Assert(x, y), or c_assert( — so FW_ASSERT is invisible to them. This caused cpp/jpl-c/use-of-assertions-density ("Long function without assertion") to flag every long F´ function even when it contains FW_ASSERTs, and made the other three Rule 16 queries silently skip FW_ASSERT entirely.

This PR adds a small in-repo query pack, .github/codeql/fprime-queries/:

• FprimeAssertions.qll — extends the standard Assertion class with an FwAssert class matching FW_ASSERT macro invocations. (FW_ASSERT expands to (cond ? (void)0 : Fw::SwAssert(...)), so the asserted expression is the conditional's condition.)
• FW_ASSERT-aware copies of the four upstream Rule 16 queries (density, constant, non-boolean, side-effect) under new IDs cpp/fprime/jpl-c/use-of-assertions-*. Per review feedback, the non-boolean query flags any asserted expression whose unspecified type is not bool (stricter than the upstream pointer-only check, appropriate since F´ is C++).

The CodeQL configs are updated to swap them in:

• jpl-standard-pack-1.yml: adds the custom pack via queries: and excludes the three upstream warning-severity assertion queries (constant / non-boolean / side-effect).
• jpl-standard-pack-2.yml: adds the custom pack and excludes upstream cpp/jpl-c/use-of-assertions-density.

The existing severity filters in each config automatically route the recommendation-severity density query to pack 2 and the warning-severity queries to pack 1.

Rationale

Eliminates persistent false positives from "Long function without assertion" on F´ code (FW_ASSERT was not recognized as an assertion), and enables the constant/non-boolean/side-effect assertion checks to actually analyze FW_ASSERT conditions (previously false negatives).

Testing/Review Recommendations

• All four queries compile with codeql query compile (CodeQL CLI 2.25.6).
• Verified against a test database built from a file replicating the FW_ASSERT macro from Fw/Types/Assert.hpp:
  • a >10-line function containing FW_ASSERT is no longer flagged by the density query, while one without any assertion still is;
  • FW_ASSERT(x > 0) passes the non-boolean check, while FW_ASSERT(x) (int), FW_ASSERT(p) (pointer), and FW_ASSERT(1) are flagged;
  • FW_ASSERT(1) and FW_ASSERT(i++ < 5) are correctly flagged by the constant and side-effect queries respectively.
• All three "Code Scan: JPL Coding Standard" analyze jobs passed on the staging PR (Recognize FW_ASSERT in JPL CodeQL Rule 16 assertion queries JPL-Devin/fprime#200).

Future Work

• Consider upstreaming FW_ASSERT support (or an extensibility mechanism) to github/codeql's Assertions.qll.

AI Usage (see policy)

AI (Devin) authored the CodeQL queries, config changes, and testing.

IAMAI

[github-actions]

Coverage report — base devel

Overall (line): 81.41% → 81.40% (-0.01)
Regression threshold: 0.50% (line).

Regressions

(none over threshold)

Modules changed

Module	Line	Δ	Function	Δ	Branch	Δ
Svc/DpCatalog	77.11	-0.45	100.00	+0.00	65.08	-0.72

Modules without UTs

CFDP/Checksum/GTest, Drv/ByteStreamDriverModel, Drv/Interfaces, Drv/LinuxGpioDriver, Drv/LinuxI2cDriver, Drv/LinuxSpiDriver, Drv/LinuxUartDriver, Drv/Ports, Drv/Ports/DataTypes, FppTestProject/FppTest/interfaces, FppTestProject/FppTest/topology/async, FppTestProject/FppTest/topology/components/Comp, FppTestProject/FppTest/topology/components/Framework, FppTestProject/FppTest/topology/components/Receiver, FppTestProject/FppTest/topology/components/Sender, FppTestProject/FppTest/topology/guarded, FppTestProject/FppTest/topology/ports, FppTestProject/FppTest/topology/sync, FppTestProject/FppTest/topology/top_ports, FppTestProject/FppTest/topology/types, Fw/Cmd, Fw/Com, Fw/Comp, Fw/FilePacket/GTest, Fw/Fpy, Fw/Interfaces, Fw/Obj, Fw/Port, Fw/Ports/CompletionStatus, Fw/Ports/Ready, Fw/Ports/Signal, Fw/Ports/SuccessCondition, Fw/Prm, Fw/SerializableFile/test/TestSerializable, Fw/Sm, Fw/Test, Fw/Types/GTest, Os/Models, Svc/Cycle, Svc/DpPorts, Svc/Fatal, Svc/FatalHandler, Svc/FileDownlinkPorts, Svc/FprimeProtocol, Svc/Interfaces, Svc/PassiveConsoleTextLogger, Svc/Ping, Svc/PolyIf, Svc/Ports/CommsPorts, Svc/Ports/FilePorts, Svc/Ports/OsTimeEpoch, Svc/Ports/TlmPacketizerPorts, Svc/Ports/VersionPorts, Svc/Sched, Svc/Seq, Svc/Subtopologies/CdhCore, Svc/Subtopologies/ComCcsds, Svc/Subtopologies/ComFprime, Svc/Subtopologies/ComLoggerTee, Svc/Subtopologies/DataProducts, Svc/Subtopologies/FileHandling, Svc/Types/TlmPacketizerTypes, Svc/WatchDog, TestDeploymentsProject/Ref/PingReceiver, TestDeploymentsProject/Ref/RecvBuffApp, TestDeploymentsProject/Ref/SendBuffApp, TestDeploymentsProject/Ref/Top, TestDeploymentsProject/Ref/TypeDemo, cmake/test/data/TestDeployment/TestBuildAutocoder, cmake/test/data/TestDeployment/TestChainedAutocoder, cmake/test/data/TestDeployment/TestHeaderAutocoder, cmake/test/data/TestDeployment/TestTargetAutocoder, cmake/test/data/test-fprime-library/TestLibrary/TestComponent, cmake/test/data/test-fprime-library2/TestLibrary2/TestComponent