Bound.qll - Replace utility for range analysis duplicate across java and cs with shared file

[BazookaMusic]

We have this doc of identical files across languages: https://github.com/github/codeql/blob/main/config/identical-files.json

As an exercise, I created a shared library and removed the duplication between CS and Java.

[Copilot]

Pull request overview

This PR reduces Java/C# duplication in range analysis by introducing a shared Bound library under codeql/rangeanalysis and switching the language-specific libraries to instantiate it via per-language definition modules.

Changes:

• Added shared/rangeanalysis/codeql/rangeanalysis/Bound.qll as the shared implementation.
• Updated Java and C# bound libraries to use the shared implementation via BoundSpecific::BoundDefs.
• Updated packaging/config to support the new shared dependency and removed the now-obsolete “identical files” entry.

Show a summary per file

File	Description
shared/rangeanalysis/codeql/rangeanalysis/Bound.qll	Introduces shared bound abstractions and a parameterized Bound module.
java/ql/lib/semmle/code/java/dataflow/internal/rangeanalysis/BoundSpecific.qll	Defines Java bindings (BoundDefs) implementing the shared bound signature.
java/ql/lib/semmle/code/java/dataflow/Bound.qll	Replaces the Java-specific bound implementation with an instantiation of the shared module.
csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/BoundSpecific.qll	Defines C# bindings (BoundDefs) implementing the shared bound signature.
csharp/ql/lib/semmle/code/csharp/dataflow/Bound.qll	Replaces the C#-specific bound implementation with an instantiation of the shared module.
csharp/ql/lib/qlpack.yml	Adds the codeql/rangeanalysis dependency required by the new shared import.
config/identical-files.json	Removes the Java/C# “Bound” identical-files entry since the code is now shared.

Copilot's findings

• Files reviewed: 7/7 changed files
• Comments generated: 2

[jacobatkinsonoperations-a11y]

Take me off email list

…

On Mon, Jun 1, 2026 at 11:19 AM Sotiris Dragonas ***@***.***> wrote: ***@***.**** commented on this pull request. ------------------------------ In csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/BoundSpecific.qll <#21900 (comment)>: > -class SsaVariable = SU::SsaVariable; +/** Holds if `e` is a bound expression and it is not an SSA variable read. */ Fixed — Reply to this email directly, view it on GitHub <#21900?email_source=notifications&email_token=CD7EBJYVFTZGQ3RH6SWPCB345WUJLA5CNFSNUABKM5UWIORPF5TWS5BNNB2WEL2QOVWGYUTFOF2WK43UKJSXM2LFO4XTINBQGI4DIOBWG4YKM4TFMFZW63VKON2WE43DOJUWEZLEUVSXMZLOOSWGM33PORSXEX3DNRUWG2Y#discussion_r3335599427>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/CD7EBJ4QDELB33GR3JKVD3D45WUJLAVCNFSM6AAAAACZPNRKZCVHI2DSMVQWIX3LMV43YUDVNRWFEZLROVSXG5CSMV3GSZLXHM2DIMBSHA2DQNRXGA> . Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS <https://github.com/notifications/mobile/ios/CD7EBJZQ7QJ2KYH5GY2SQOD45WUJLA5CNFSNUABKM5UWIORPF5TWS5BNNB2WEL2QOVWGYUTFOF2WK43UKJSXM2LFO4XTINBQGI4DIOBWG4YKM4TFMFZW63VKON2WE43DOJUWEZLEUVSXMZLOOSVGM33PORSXEX3JN5ZQ> and Android <https://github.com/notifications/mobile/android/CD7EBJ2X2OSE2CRWEZ664RT45WUJLA5CNFSNUABKM5UWIORPF5TWS5BNNB2WEL2QOVWGYUTFOF2WK43UKJSXM2LFO4XTINBQGI4DIOBWG4YKM4TFMFZW63VKON2WE43DOJUWEZLEUVSXMZLOOSXGM33PORSXEX3BNZSHE33JMQ>. Download it today! You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>