You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/codeql/codeql-cli/analyzing-databases-with-the-codeql-cli.rst
+12-17Lines changed: 12 additions & 17 deletions
Original file line number
Diff line number
Diff line change
@@ -19,7 +19,7 @@ Before starting an analysis you must:
19
19
- :doc:`Create a CodeQL database <creating-codeql-databases>` for the source
20
20
code you want to analyze.
21
21
22
-
It is simplest to run ``database analyze`` using CodeQL packs. You can also
22
+
The simplest way to run ``codeql database analyze`` is using CodeQL packs. You can also
23
23
run the command using queries from a local checkout of the CodeQL repository,
24
24
which you may want to do if you want to customize the CodeQL core queries.
25
25
@@ -64,7 +64,7 @@ You can also specify:
64
64
- with an optional version range
65
65
- with an optional path to a query, directory, or query suite inside the pack
66
66
67
-
If omitted, the default query suite for the language of the database being analyzed will be used. For the complete syntax of query specifiers, see the :ref:`examples <specifying-which-queries>` below.
67
+
If omitted, the default query suite for the language of the analyzed database will be used. For the complete syntax of query specifiers, see :ref:`"Specifying which queries to run in a CodeQL pack"<specifying-which-queries>`.
68
68
69
69
- ``--sarif-category``: an identifying category for the results. Used when
70
70
you want to upload more than one set of results for a commit.
@@ -104,7 +104,7 @@ Specifying which queries to run in a CodeQL pack
104
104
------------------------------------------------
105
105
106
106
Query specifiers are used by ``codeql database analyze`` and other commands that operate on a set of queries.
107
-
The complete way to specify a set of queries is in the form ``scope/name@range:path``, where:
107
+
The complete form of a query specifier is``scope/name@range:path``, where:
108
108
109
109
- ``scope/name`` is the qualified name of a CodeQL pack.
110
110
- ``range`` is a `semver range <https://docs.npmjs.com/cli/v6/using-npm/semver#ranges>`_.
@@ -115,13 +115,13 @@ optional. If you omit a ``range`` then the latest version of the
115
115
specified pack is used. If you omit a ``path`` then the default query suite
116
116
of the specified pack is used.
117
117
118
-
The ``path`` can be one of a ``.ql`` query file, a directory
118
+
The ``path`` can be one of: a ``.ql`` query file, a directory
119
119
containing one or more queries, or a ``.qls`` query suite file. If
120
120
you omit a pack name, then you must provide a ``path``,
121
121
which will be interpreted relative to the working directory
122
122
of the current process. Glob patterns are not supported.
123
123
124
-
If you specify a ``scope/name`` and ``path``, then the ``path`` cannot
124
+
If you specify both a ``scope/name`` and ``path``, then the ``path`` cannot
125
125
be absolute. It is considered relative to the root of the CodeQL
126
126
pack.
127
127
@@ -143,18 +143,15 @@ Example query specifiers
143
143
The default query suite of the standard CodeQL query packs are ``codeql-suites/<lang>-code-scanning.qls``. Several other useful query suites can also be found in the ``codeql-suites`` directory of each pack. For example, the ``codeql/cpp-queries`` pack contains the following query suites:
144
144
145
145
* ``cpp-code-scanning.qls`` - Standard Code Scanning queries for C++. The default query suite for this pack.
146
-
* ``cpp-security-extended.qls`` - Security-extended queries for C++. This suite contains queries that are less precise than the standard security queries, and may find more false-positives. This query suite includes all queries from ``cpp-code-scanning.qls``.
147
-
* ``cpp-security-and-quality.qls`` - Security-and-quality queries for C++. This query suite includes all queries from ``cpp-security-extended.qls``.
146
+
* ``cpp-security-extended.qls`` - Queries from the default ``cpp-code-scanning.qls`` suite for C++, plus lower severity and precision queries.
147
+
* ``cpp-security-and-quality.qls`` - Queries from ``cpp-security-extended.qls``, plus maintainability and reliability queries.
148
148
149
149
You can see the sources for these query suites in the `CodeQL repository <https://github.com/github/codeql/tree/main/cpp/ql/src/codeql-suites>`__. Query suites for other languages are similar.
150
150
151
-
Examples of using ``codeql database analyze``
151
+
Examples of running database analyses
152
152
---------------------------------------------
153
153
154
-
The following examples show how to run ``database analyze`` using CodeQL packs as
155
-
well as using a local checkout of the CodeQL repository. These examples assume your
156
-
CodeQL databases have been created in a directory that is a sibling of your local
157
-
copies of the CodeQL repository.
154
+
The following examples show how to run ``database analyze`` using CodeQL packs, and how to use a local checkout of the CodeQL repository. These examples assume your CodeQL databases have been created in a directory that is a sibling of your local copies of the CodeQL repository.
The ``analyze`` command above runs the default query suite of two CodeQL query packs: ``microsoft/coding-standards`` version 1.0.0 and the latest version of ``github/security-queries`` on the
172
-
specified database. For further information about default suites, see
173
-
":ref:`Publishing and using CodeQL packs <publishing-and-using-codeql-packs>`".
168
+
This command runs the default query suite of two CodeQL query packs: ``microsoft/coding-standards`` version 1.0.0 and the latest version of ``github/security-queries`` on the specified database. For further information about default suites, see ":ref:`Publishing and using CodeQL packs <publishing-and-using-codeql-packs>`".
174
169
175
170
The ``--download`` flag is optional. Using it will ensure the query pack is downloaded if it isn't yet available locally.
176
171
@@ -189,7 +184,7 @@ specifying a space-separated list of similar paths.
189
184
190
185
The analysis generates a CSV file (``js-results.csv``) in a new directory (``js-analysis``).
191
186
192
-
If you have the CodeQL repository checked out, you can execute the same queries by specifying the path to the query directly::
187
+
Alternatively, if you have the CodeQL repository checked out, you can execute the same queries by specifying the path to the query directly::
This command downloads the ``codeql/cpp-queries`` CodeQL query pack, runs the analysis, and generates a file in the v2.1.0 SARIF format that is supported by all versions of GitHub. This file can be uploaded to GitHub by executing ``codeql github upload-results`` or the code scanning API.
283
+
This command downloads the ``codeql/cpp-queries`` CodeQL query pack, runs the analysis, and generates a file in the SARIF version 2.1.0 format that is supported by all versions of GitHub. This file can be uploaded to GitHub by executing ``codeql github upload-results`` or the code scanning API.
289
284
For more information, see `Analyzing a CodeQL database <https://docs.github.com/en/code-security/code-scanning/using-codeql-code-scanning-with-your-existing-ci-system/configuring-codeql-cli-in-your-ci-system#analyzing-a-codeql-database>`__
290
285
or `Code scanning API <https://docs.github.com/en/rest/reference/code-scanning>`__ in the GitHub documentation.
0 commit comments