You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
- ``...<query-specifications>``: a list of queries to run over your database. This
56
-
is a list of arguments. Where each argument can be:
57
+
- ``<query-specifiers>...``: a space-separated list of queries to run over your database. This
58
+
is a list of arguments, where each argument can be:
57
59
58
60
- a path to a query file
59
61
- a path to a directory containing query files
@@ -62,7 +64,7 @@ You can also specify:
62
64
- with an optional version range
63
65
- with an optional path to a query, directory, or query suite inside the pack
64
66
65
-
If omitted, the default query suite for the language of the database being analyzed will be used. For more information, see the :ref:`examples <database-analyze-examples>` below.
67
+
If omitted, the default query suite for the language of the analyzed database will be used. For the complete syntax of query specifiers, see :ref:`"Specifying which queries to run in a CodeQL pack"<specifying-which-queries>`.
66
68
67
69
- ``--sarif-category``: an identifying category for the results. Used when
68
70
you want to upload more than one set of results for a commit.
@@ -95,55 +97,100 @@ You can also specify:
95
97
For full details of all the options you can use when analyzing databases, see
96
98
the `database analyze reference documentation <../manual/database-analyze>`__.
97
99
98
-
.. _database-analyze-examples:
99
100
100
-
Examples
101
-
--------
101
+
.. _specifying-which-queries:
102
102
103
-
The following examples assume your CodeQL databases have been created in a
104
-
directory that is a sibling of your local copies of the CodeQL and CodeQL for Go
105
-
repositories.
103
+
Specifying which queries to run in a CodeQL pack
104
+
------------------------------------------------
106
105
107
-
Running a single query
108
-
~~~~~~~~~~~~~~~~~~~~~~
106
+
Query specifiers are used by ``codeql database analyze`` and other commands that operate on a set of queries.
107
+
The complete form of a query specifier is``scope/name@range:path``, where:
109
108
110
-
To run a single query over a CodeQL database for a JavaScript codebase,
111
-
you could use the following command from the directory containing your database::
109
+
- ``scope/name`` is the qualified name of a CodeQL pack.
110
+
- ``range`` is a `semver range <https://docs.npmjs.com/cli/v6/using-npm/semver#ranges>`_.
111
+
- ``path`` is a file system path to a single query, a directory containing queries, or a query suite file.
When you specify a ``scope/name``, the ``range`` and ``path`` are
114
+
optional. If you omit a ``range`` then the latest version of the
115
+
specified pack is used. If you omit a ``path`` then the default query suite
116
+
of the specified pack is used.
114
117
115
-
This command runs a simple query that finds potential bugs related to unused
116
-
variables, imports, functions, or classes---it is one of the JavaScript
117
-
queries included in the CodeQL repository. You could run more than one query by
118
-
specifying a space-separated list of similar paths.
118
+
The ``path`` can be one of: a ``.ql`` query file, a directory
119
+
containing one or more queries, or a ``.qls`` query suite file. If
120
+
you omit a pack name, then you must provide a ``path``,
121
+
which will be interpreted relative to the working directory
122
+
of the current process. Glob patterns are not supported.
119
123
120
-
The analysis generates a CSV file (``js-results.csv``) in a new directory
121
-
(``js-analysis``).
124
+
If you specify both a ``scope/name`` and ``path``, then the ``path`` cannot
125
+
be absolute. It is considered relative to the root of the CodeQL
126
+
pack.
122
127
123
-
You can also run your own custom queries with the ``database analyze`` command.
124
-
For more information about preparing your queries to use with the CodeQL CLI,
125
-
see ":doc:`Using custom queries with the CodeQL CLI <using-custom-queries-with-the-codeql-cli>`."
128
+
Example query specifiers
129
+
~~~~~~~~~~~~~~~~~~~~~~~~
126
130
127
-
If you do not have the CodeQL repository checked out, you can execute the same queries by specifying the query pack name and the path to the queries::
131
+
* ``codeql/python-queries`` - All the queries in the default query suite of the latest version of the ``codeql/python-queries`` pack.
132
+
* ``codeql/[email protected]`` - All the queries in the default query suite of version ``1.2.3`` of the ``codeql/python-queries`` pack.
133
+
* ``codeql/python-queries@~1.2.3`` - All the queries in the default query suite of the latest version of the ``codeql/python-queries`` pack that is >= ``1.2.3`` and < ``1.3.0``.
134
+
* ``codeql/python-queries:Functions`` - All queries in the ``Functions`` directory in the latest version of the ``codeql/python-queries`` pack.
135
+
* ``codeql/[email protected]:Functions`` - All queries in the ``Functions`` directory in version 1.2.3 of the ``codeql/python-queries`` pack.
136
+
* ``codeql/[email protected]:codeql-suites/python-code-scanning.qls`` - All queries in the ``codeql-suites/python-code-scanning.qls`` directory in version 1.2.3 of the ``codeql/python-queries`` pack.
137
+
* ``suites/my-suite.qls`` - All queries in the ``suites/my-suite.qls`` file relative to the current working directory.
The default query suite of the standard CodeQL query packs are ``codeql-suites/<lang>-code-scanning.qls``. Several other useful query suites can also be found in the ``codeql-suites`` directory of each pack. For example, the ``codeql/cpp-queries`` pack contains the following query suites:
144
+
145
+
* ``cpp-code-scanning.qls`` - Standard Code Scanning queries for C++. The default query suite for this pack.
146
+
* ``cpp-security-extended.qls`` - Queries from the default ``cpp-code-scanning.qls`` suite for C++, plus lower severity and precision queries.
147
+
* ``cpp-security-and-quality.qls`` - Queries from ``cpp-security-extended.qls``, plus maintainability and reliability queries.
130
148
131
-
Use the ``--download`` flag to download the query pack if it isn't yet available locally.
149
+
You can see the sources for these query suites in the `CodeQL repository <https://github.com/github/codeql/tree/main/cpp/ql/src/codeql-suites>`__. Query suites for other languages are similar.
150
+
151
+
Examples of running database analyses
152
+
---------------------------------------------
153
+
154
+
The following examples show how to run ``database analyze`` using CodeQL packs, and how to use a local checkout of the CodeQL repository. These examples assume your CodeQL databases have been created in a directory that is a sibling of your local copies of the CodeQL repository.
The ``analyze`` command above runs the default suite from ``microsoft/coding-standards v1.0.0`` and the latest version of ``github/security-queries`` on the specified database.
146
-
For further information about default suites, see ":ref:`Publishing and using CodeQL packs <publishing-and-using-codeql-packs>`".
168
+
This command runs the default query suite of two CodeQL query packs: ``microsoft/coding-standards`` version 1.0.0 and the latest version of ``github/security-queries`` on the specified database. For further information about default suites, see ":ref:`Publishing and using CodeQL packs <publishing-and-using-codeql-packs>`".
169
+
170
+
The ``--download`` flag is optional. Using it will ensure the query pack is downloaded if it isn't yet available locally.
171
+
172
+
Running a single query
173
+
~~~~~~~~~~~~~~~~~~~~~~
174
+
175
+
To run a single query over a CodeQL database for a JavaScript codebase,
176
+
you could use the following command from the directory containing your database::
The analysis generates a file in the v2.1.0 SARIF format that is supported by all versions of GitHub.
233
-
This file can be uploaded to GitHub by executing ``codeql github upload-results`` or the code scanning API.
283
+
This command downloads the ``codeql/cpp-queries`` CodeQL query pack, runs the analysis, and generates a file in the SARIF version 2.1.0 format that is supported by all versions of GitHub. This file can be uploaded to GitHub by executing ``codeql github upload-results`` or the code scanning API.
234
284
For more information, see `Analyzing a CodeQL database <https://docs.github.com/en/code-security/code-scanning/using-codeql-code-scanning-with-your-existing-ci-system/configuring-codeql-cli-in-your-ci-system#analyzing-a-codeql-database>`__
235
285
or `Code scanning API <https://docs.github.com/en/rest/reference/code-scanning>`__ in the GitHub documentation.
236
286
237
287
CodeQL query suites are ``.qls`` files that use directives to select queries to run
238
288
based on certain metadata properties. The standard CodeQL packs have metadata that specify
239
289
the location of the query suites used by code scanning, so the CodeQL CLI knows where to find these
240
290
suite files automatically, and you don't have to specify the full path on the command line.
241
-
For more information, see ":ref:`About CodeQL packs <standard-codeql-packs>`."
291
+
For more information, see ":ref:`Creating CodeQL query suites <creating-codeql-query-suites>`."
242
292
243
-
The standard query suites are stored at the following paths in
You can use CodeQL query packs in your code scanning setup. This allows you to select query packs published by various sources and use them to analyze your code.
271
308
For more information, see "`Using CodeQL query packs in the CodeQL action <https://docs.github.com/en/code-security/secure-coding/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-codeql-query-packs/>`_" or "`Downloading and using CodeQL query packs in your CI system <https://docs.github.com/en/code-security/secure-coding/using-codeql-code-scanning-with-your-existing-ci-system/configuring-codeql-cli-in-your-ci-system#downloading-and-using-codeql-query-packs>`_."
0 commit comments