Skip to content

Commit e8a0d07

Browse files
aeisenbergsubatoi
andcommitted
Update docs/codeql/codeql-cli/analyzing-databases-with-the-codeql-cli.rst
Co-authored-by: Ben Ahmady <32935794+subatoi@users.noreply.github.com>
1 parent aefd516 commit e8a0d07

File tree

1 file changed

+12
-17
lines changed

1 file changed

+12
-17
lines changed

docs/codeql/codeql-cli/analyzing-databases-with-the-codeql-cli.rst

Lines changed: 12 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ Before starting an analysis you must:
1919
- :doc:`Create a CodeQL database <creating-codeql-databases>` for the source
2020
code you want to analyze.
2121

22-
It is simplest to run ``database analyze`` using CodeQL packs. You can also
22+
The simplest way to run ``codeql database analyze`` is using CodeQL packs. You can also
2323
run the command using queries from a local checkout of the CodeQL repository,
2424
which you may want to do if you want to customize the CodeQL core queries.
2525

@@ -64,7 +64,7 @@ You can also specify:
6464
- with an optional version range
6565
- with an optional path to a query, directory, or query suite inside the pack
6666

67-
If omitted, the default query suite for the language of the database being analyzed will be used. For the complete syntax of query specifiers, see the :ref:`examples <specifying-which-queries>` below.
67+
If omitted, the default query suite for the language of the analyzed database will be used. For the complete syntax of query specifiers, see :ref:`"Specifying which queries to run in a CodeQL pack"<specifying-which-queries>`.
6868

6969
- ``--sarif-category``: an identifying category for the results. Used when
7070
you want to upload more than one set of results for a commit.
@@ -104,7 +104,7 @@ Specifying which queries to run in a CodeQL pack
104104
------------------------------------------------
105105

106106
Query specifiers are used by ``codeql database analyze`` and other commands that operate on a set of queries.
107-
The complete way to specify a set of queries is in the form ``scope/name@range:path``, where:
107+
The complete form of a query specifier is``scope/name@range:path``, where:
108108

109109
- ``scope/name`` is the qualified name of a CodeQL pack.
110110
- ``range`` is a `semver range <https://docs.npmjs.com/cli/v6/using-npm/semver#ranges>`_.
@@ -115,13 +115,13 @@ optional. If you omit a ``range`` then the latest version of the
115115
specified pack is used. If you omit a ``path`` then the default query suite
116116
of the specified pack is used.
117117

118-
The ``path`` can be one of a ``.ql`` query file, a directory
118+
The ``path`` can be one of: a ``.ql`` query file, a directory
119119
containing one or more queries, or a ``.qls`` query suite file. If
120120
you omit a pack name, then you must provide a ``path``,
121121
which will be interpreted relative to the working directory
122122
of the current process. Glob patterns are not supported.
123123

124-
If you specify a ``scope/name`` and ``path``, then the ``path`` cannot
124+
If you specify both a ``scope/name`` and ``path``, then the ``path`` cannot
125125
be absolute. It is considered relative to the root of the CodeQL
126126
pack.
127127

@@ -143,18 +143,15 @@ Example query specifiers
143143
The default query suite of the standard CodeQL query packs are ``codeql-suites/<lang>-code-scanning.qls``. Several other useful query suites can also be found in the ``codeql-suites`` directory of each pack. For example, the ``codeql/cpp-queries`` pack contains the following query suites:
144144

145145
* ``cpp-code-scanning.qls`` - Standard Code Scanning queries for C++. The default query suite for this pack.
146-
* ``cpp-security-extended.qls`` - Security-extended queries for C++. This suite contains queries that are less precise than the standard security queries, and may find more false-positives. This query suite includes all queries from ``cpp-code-scanning.qls``.
147-
* ``cpp-security-and-quality.qls`` - Security-and-quality queries for C++. This query suite includes all queries from ``cpp-security-extended.qls``.
146+
* ``cpp-security-extended.qls`` - Queries from the default ``cpp-code-scanning.qls`` suite for C++, plus lower severity and precision queries.
147+
* ``cpp-security-and-quality.qls`` - Queries from ``cpp-security-extended.qls``, plus maintainability and reliability queries.
148148

149149
You can see the sources for these query suites in the `CodeQL repository <https://github.com/github/codeql/tree/main/cpp/ql/src/codeql-suites>`__. Query suites for other languages are similar.
150150

151-
Examples of using ``codeql database analyze``
151+
Examples of running database analyses
152152
---------------------------------------------
153153

154-
The following examples show how to run ``database analyze`` using CodeQL packs as
155-
well as using a local checkout of the CodeQL repository. These examples assume your
156-
CodeQL databases have been created in a directory that is a sibling of your local
157-
copies of the CodeQL repository.
154+
The following examples show how to run ``database analyze`` using CodeQL packs, and how to use a local checkout of the CodeQL repository. These examples assume your CodeQL databases have been created in a directory that is a sibling of your local copies of the CodeQL repository.
158155

159156
.. _run-query-pack:
160157

@@ -168,9 +165,7 @@ pack names::
168165

169166
codeql database analyze <database> microsoft/coding-standards@1.0.0 github/security-queries --format=sarifv2.1.0 --output=query-results.sarif --download
170167

171-
The ``analyze`` command above runs the default query suite of two CodeQL query packs: ``microsoft/coding-standards`` version 1.0.0 and the latest version of ``github/security-queries`` on the
172-
specified database. For further information about default suites, see
173-
":ref:`Publishing and using CodeQL packs <publishing-and-using-codeql-packs>`".
168+
This command runs the default query suite of two CodeQL query packs: ``microsoft/coding-standards`` version 1.0.0 and the latest version of ``github/security-queries`` on the specified database. For further information about default suites, see ":ref:`Publishing and using CodeQL packs <publishing-and-using-codeql-packs>`".
174169

175170
The ``--download`` flag is optional. Using it will ensure the query pack is downloaded if it isn't yet available locally.
176171

@@ -189,7 +184,7 @@ specifying a space-separated list of similar paths.
189184

190185
The analysis generates a CSV file (``js-results.csv``) in a new directory (``js-analysis``).
191186

192-
If you have the CodeQL repository checked out, you can execute the same queries by specifying the path to the query directly::
187+
Alternatively, if you have the CodeQL repository checked out, you can execute the same queries by specifying the path to the query directly::
193188

194189
codeql database analyze <javascript-database> ../ql/javascript/ql/src/Declarations/UnusedVariable.ql --format=csv --output=js-analysis/js-results.csv
195190

@@ -285,7 +280,7 @@ you could use the following command from the directory containing your database:
285280

286281
codeql database analyze <cpp-database> codeql/cpp-queries:codeql-suites/cpp-code-scanning.qls --format=sarifv2.1.0 --output=cpp-results.sarif --download
287282

288-
This command downloads the ``codeql/cpp-queries`` CodeQL query pack, runs the analysis, and generates a file in the v2.1.0 SARIF format that is supported by all versions of GitHub. This file can be uploaded to GitHub by executing ``codeql github upload-results`` or the code scanning API.
283+
This command downloads the ``codeql/cpp-queries`` CodeQL query pack, runs the analysis, and generates a file in the SARIF version 2.1.0 format that is supported by all versions of GitHub. This file can be uploaded to GitHub by executing ``codeql github upload-results`` or the code scanning API.
289284
For more information, see `Analyzing a CodeQL database <https://docs.github.com/en/code-security/code-scanning/using-codeql-code-scanning-with-your-existing-ci-system/configuring-codeql-cli-in-your-ci-system#analyzing-a-codeql-database>`__
290285
or `Code scanning API <https://docs.github.com/en/rest/reference/code-scanning>`__ in the GitHub documentation.
291286

0 commit comments

Comments
 (0)