Note: Your site administrator must enable 代� �扫描 for your GitHub Enterprise Server instance before you can use this feature. For more information, see "Configuring 代� �扫描 for your appliance."
You can use the CodeQL CLI to run 代� �扫描 on code that you're processing in a third-party continuous integration (CI) system. 代� �扫描 是一项功能，可用于分析 GitHub 仓库中的代� �，以查找安全漏洞和编� �错误。 分析发现的任何问题都显示在 GitHub Enterprise Server 中。 For information, see "About 代� �扫描 with CodeQL." For recommended specifications (RAM, CPU cores, and disk) for running CodeQL analysis, see "Recommended hardware resources for running CodeQL."
Alternatively, you can use GitHub Actions to run 代� �扫描 within GitHub Enterprise Server. For information about 代� �扫描 using actions, see "Setting up 代� �扫描 for a repository." For an overview of the options for CI systems, see "About CodeQL 代� �扫描 in your CI system".
注：CodeQL CLI 可用于拥有 Advanced Security 许可证的客户。
You should download the CodeQL bundle from https://github.com/github/codeql-action/releases. The bundle contains:
- CodeQL CLI product
- A compatible version of the queries and libraries from https://github.com/github/codeql
- Precompiled versions of all the queries included in the bundle
You should always use the CodeQL bundle as this ensures compatibility and also gives much better performance than a separate download of the CodeQL CLI and checkout of the CodeQL queries. If you will only be running the CLI on one specific platform, download the appropriate
codeql-bundle-PLATFORM.tar.gz file. Alternatively, you can download
codeql-bundle.tar.gz, which contains the CLI for all supported platforms.
You need to make the full contents of the CodeQL CLI bundle available to every CI server that you want to run CodeQL 代� �扫描 analysis on. For example, you might configure each server to copy the bundle from a central, internal location and extract it. Alternatively, you could use the REST API to get the bundle directly from GitHub, ensuring that you benefit from the latest improvements to queries. Updates to the CodeQL CLI are released every 2-3 weeks. For example:
$ wget https://HOSTNAME/github/codeql-action/releases/latest/download/codeql-bundle-linux64.tar.gz $ tar -xvzf ../codeql-bundle-linux64.tar.gz
After you extract the CodeQL CLI bundle, you can run the
codeql executable on the server:
- By executing
<extraction-root>is the folder where you extracted the CodeQL CLI bundle.
- By adding
PATH, so that you can run the executable as just
After you extract the CodeQL CLI bundle, you can run the following command to verify that the CLI is correctly set up to create and analyze databases.
codeql resolve qlpacksif
/<extraction-root>/codeqlis on the
/<extraction-root>/codeql/codeql resolve qlpacksotherwise.
Extract from successful output:
You should check that the output contains the expected languages and also that the directory location for the qlpack files is correct. The location should be within the extracted CodeQL CLI bundle, shown above as
<extraction root>, unless you are using a checkout of
github/codeql. If the CodeQL CLI is unable to locate the qlpacks for the expected languages, check that you downloaded the CodeQL bundle and not a standalone copy of the CodeQL CLI.
Each CI server needs a GitHub 应用程序 or personal access token for the CodeQL CLI to use to upload results to GitHub Enterprise Server. You must use an access token or a GitHub 应用程序 with the
security_events write permission. If CI servers already use a token with this scope to checkout repositories from GitHub Enterprise Server, you could potentially allow the CodeQL CLI to use the same token. Otherwise, you should create a new token with the
security_events write permission and add this to the CI system's secret store. For information, see "Building GitHub 应用程序" and "Creating a personal access token."
You're now ready to configure the CI system to run CodeQL analysis, generate results, and upload them to GitHub Enterprise Server where the results will be matched to a branch or pull request and displayed as 代� �扫描 alerts. For detailed information, see "Configuring CodeQL CLI in your CI system."