Configuring CodeQL runner in your CI system

You can configure how the CodeQL runner scans the code in your project and uploads the results to GitHub.

Code scanning is available for organization-owned repositories where GitHub Advanced Security is enabled. Weitere Informationen findest Du unter „Informationen zu GitHub Advanced Security“.

Note: Your site administrator must enable code scanning for your GitHub Enterprise Server instance before you can use this feature. For more information, see "Configuring code scanning for your appliance."

About configuring CodeQL code scanning in your CI system

To integrate code scanning into your CI system, you can use the CodeQL runner. For more information, see "Running CodeQL runner in your CI system."

In general, you invoke the CodeQL runner as follows.

$ /path/to-runner/codeql-runner-OS  

/path/to-runner/ depends on where you've downloaded the CodeQL runner on your CI system. codeql-runner-OS depends on the operating system you use. There are three versions of the CodeQL runner, codeql-runner-linux, codeql-runner-macos, and codeql-runner-win, for Linux, macOS, and Windows systems respectively.

To customize the way the CodeQL runner scans your code, you can use flags, such as --languages and --queries, or you can specify custom settings in a separate configuration file.

Scanning pull requests

Scanning code whenever a pull request is created prevents developers from introducing new vulnerabilities and errors into the code.

To scan a pull request, run the analyze command and use the --ref flag to specify the pull request. The reference is refs/pull/<PR-number>/head or refs/pull/<PR-number>/merge, depending on whether you have checked out the HEAD commit of the pull request branch or a merge commit with the base branch.

$ /path/to-runner/codeql-runner-linux analyze --ref refs/pull/42/merge

Note: If you analyze code with a third-party tool and want the results to appear as pull request checks, you must run the upload command and use the --ref flag to specify the pull request instead of the branch. The reference is refs/pull/<PR-number>/head or refs/pull/<PR-number>/merge.

Overriding automatic language detection

The CodeQL runner automatically detects and scans code written in the supported languages.

  • C/C++
  • C#
  • Go
  • Java
  • JavaScript/TypeScript
  • Python

Code scanning automatically detects and scans code written in the supported languages.

To override automatic language detection, run the init command with the --languages flag, followed by a comma-separated list of language keywords. The keywords for the supported languages are cpp, csharp, go, java, javascript, and python.

$ /path/to-runner/codeql-runner-linux init --languages cpp,java

Running additional queries

When you use CodeQL to scan code, the CodeQL analysis engine generates a database from the code and runs queries on it. Weitere Informationen findest Du unter „ Über code scanning."

CodeQL analysis uses a default set of queries, but you can specify more queries to run, in addition to the default queries. The queries you want to run must belong to a QL pack in a repository. For more information, see "About QL packs."

Queries must only depend on the standard libraries (that is, the libraries referenced by an import LANGUAGE statement in your query), or libraries in the same QL pack as the query. The standard libraries are located in the github/codeql repository. For more information, see "About CodeQL queries."

You can specify a single .ql file, a directory containing multiple .ql files, a .qls query suite definition file, or any combination. For more information about query suite definitions, see "Creating CodeQL query suites."

The following query suites are built into CodeQL code scanning and are available for use.

Query suiteBeschreibung
security-extendedQueries of lower severity and precision than the default queries
security-and-qualityQueries from security-extended, plus maintainability and reliability queries

When you specify a query suite, the CodeQL analysis engine will run the queries contained within the suite for you, in addition to the default set of queries.

To add one or more queries, pass a comma-separated list of paths to the --queries flag of the init command. You can also specify additional queries in a configuration file.

If you also are using a configuration file for custom settings, and you are also specifying additional queries with the --queries flag, the CodeQL runner uses the additional queries specified with the --queries flag instead of any in the configuration file. If you want to run the combined set of additional queries specified with the flag and in the configuration file, prefix the value passed to --queries with the + symbol. For examples of configuration files, see "Example configuration files."

In the following example, the + symbol ensures that the CodeQL runner uses the additional queries together with any queries specified in the referenced configuration file.

$ /path/to-runner/codeql-runner-linux init --config-file .github/codeql/codeql-config.yml 
    --queries +security-and-quality,octo-org/python-qlpack/show_ifs.ql@main

Using a third-party code scanning tool

Instead of passing additional information to the CodeQL runner commands, you can specify custom settings in a separate configuration file.

The configuration file is a YAML file. It uses syntax similar to the workflow syntax for GitHub Actions, as illustrated in the examples below. Weitere Informationen findest Du unter „Workflow-Syntax für GitHub Actions“.

Use the --config-file flag of the init command to specify the configuration file. The value of --config-file is the path to the configuration file that you want to use. This example loads the configuration file .github/codeql/codeql-config.yml.

$ /path/to-runner/codeql-runner-linux init --config-file .github/codeql/codeql-config.yml

The configuration file can be located within the repository you are analyzing, or in an external repository. Using an external repository allows you to specify configuration options for multiple repositories in a single place. When you reference a configuration file located in an external repository, you can use the OWNER/REPOSITORY/FILENAME@BRANCH syntax. For example, monacorp/shared/codeql-config.yml@main.

Example configuration files

This configuration file adds the security-and-quality query suite to the list of queries run by CodeQL when scanning your code. For more information about the query suites available for use, see "Running additional queries."

name: "My CodeQL config"

queries:
  - uses: security-and-quality

The following configuration file disables the default queries and specifies a set of custom queries to run instead. It also configures CodeQL to scan files in the src directory (relative to the root), except for the src/node_modules directory, and except for files whose name ends in .test.js. Files in src/node_modules and files with names ending .test.js are therefore excluded from analysis.

name: "My CodeQL config"

disable-default-queries: true

queries:
  - name: Use an in-repository QL pack (run queries in the my-queries directory)
    uses: ./my-queries
  - name: Use an external JavaScript QL pack (run queries from an external repo)
    uses: octo-org/javascript-qlpack@main
  - name: Use an external query (run a single query from an external QL pack)
    uses: octo-org/python-qlpack/show_ifs.ql@main
  - name: Use a query suite file (run queries from a query suite in this repo)
    uses: ./codeql-qlpacks/complex-python-qlpack/rootAndBar.qls

paths:
  - src 
paths-ignore: 
  - src/node_modules
  - '**/*.test.js'

Configuring code scanning for compiled languages

For the compiled languages C/C++, C#, and Java, CodeQL builds the code before analyzing it. CodeQL also runs a build for Go projects to set up the project. However, in contrast to the other compiled languages, all Go files in the repository are extracted, not just those that are built. You can use custom build commands to skip extracting Go files that are not touched by the build.

For many common build systems, the CodeQL runner can build the code automatically. To attempt to build the code automatically, run autobuild between the init and analyze steps. Note that if your repository requires a specific version of a build tool, you may need to install the build tool manually first.

The autobuild process only ever attempts to build one compiled language for a repository. The language automatically selected for analysis is the language with the most files. If you want to choose a language explicitly, use the --language flag of the autobuild command.

$ /path/to-runner/codeql-runner-linux autobuild --language csharp

If the autobuild command can't build your code, you can run the build steps yourself, between the init and analyze steps. For more information, see "Running CodeQL runner in your CI system."

Uploading code scanning data to GitHub

By default, the CodeQL runner uploads results from code scanning when you run the analyze command. You can also upload SARIF files separately, by using the upload command.

Once you've uploaded the data, GitHub displays the alerts in your repository.

CodeQL runner command reference

The CodeQL runner supports the following commands and flags.

init

Initializes the CodeQL runner and creates a CodeQL database for each language to be analyzed.

FlagErforderlichInput value
--repositoryName of the repository to initialize.
--github-urlURL of the GitHub instance where your repository is hosted.
--github-auth-stdinRead the GitHub Apps token or personal access token from standard input.

| --languages | | Comma-separated list of languages to analyze. By default, the CodeQL runner detects and analyzes all supported languages in the repository. | | --queries | | Comma-separated list of additional queries to run, in addition to the default suite of security queries. This overrides the queries setting in the custom configuration file. | | --config-file | | Path to custom configuration file. | | --codeql-path | | Path to a copy of the CodeQL CLI executable to use. By default, the CodeQL runner downloads a copy. | | --temp-dir | | Directory where temporary files are stored. The default is ./codeql-runner. | | --tools-dir | | Directory where CodeQL tools and other files are stored between runs. The default is a subdirectory of the home directory. | | --checkout-path | | The path to the checkout of your repository. The default is the current working directory. | | --debug | | None. Prints more verbose output. | | --trace-process-name | | Advanced, Windows only. Name of the process where a Windows tracer of this process is injected. | | --trace-process-level | | Advanced, Windows only. Number of levels up of the parent process where a Windows tracer of this process is injected. | | -h, --help | | None. Displays help for the command. |

autobuild

Attempts to build the code for the compiled languages C/C++, C#, and Java. For those languages, CodeQL builds the code before analyzing it. Run autobuild between the init and analyze steps.

FlagErforderlichInput value
--languageThe language to build. By default, the CodeQL runner builds the compiled language with the most files.
--temp-dirDirectory where temporary files are stored. The default is ./codeql-runner.
--debugNone. Prints more verbose output.
-h, --helpNone. Displays help for the command.

analyze

Analyzes the code in the CodeQL databases and uploads results to GitHub Enterprise Server.

FlagErforderlichInput value
--repositoryName of the repository to analyze.
--commitSHA of the commit to analyze. In Git and in Azure DevOps, this corresponds to the value of git rev-parse HEAD. In Jenkins, this corresponds to $GIT_COMMIT.
--refName of the reference to analyze, for example refs/heads/main or refs/pull/42/merge. In Git or in Jenkins, this corresponds to the value of git symbolic-ref HEAD. In Azure DevOps, this corresponds to $(Build.SourceBranch).
--github-urlURL of the GitHub instance where your repository is hosted.
--github-auth-stdinRead the GitHub Apps token or personal access token from standard input.

| --checkout-path | | The path to the checkout of your repository. The default is the current working directory. | | --no-upload | | None. Stops the CodeQL runner from uploading the results to GitHub Enterprise Server. | | --output-dir | | Directory where the output SARIF files are stored. The default is in the directory of temporary files. | | --ram | | Amount of memory to use when running queries. The default is to use all available memory. | | --no-add-snippets | | None. Excludes code snippets from the SARIF output. | | --threads | | Number of threads to use when running queries. The default is to use all available cores. | | --temp-dir | | Directory where temporary files are stored. The default is ./codeql-runner. | | --debug | | None. Prints more verbose output. | | -h, --help | | None. Displays help for the command. |

hochladen

Uploads SARIF files to GitHub Enterprise Server.

Note: If you analyze code with the CodeQL runner, the analyze command uploads SARIF results by default. You can use the upload command to upload SARIF results that were generated by other tools.

FlagErforderlichInput value
--sarif-fileSARIF file to upload, or a directory containing multiple SARIF files.
--repositoryName of the repository that was analyzed.
--commitSHA of the commit that was analyzed. In Git and in Azure DevOps, this corresponds to the value of git rev-parse HEAD. In Jenkins, this corresponds to $GIT_COMMIT.
--refName of the reference that was analyzed, for example refs/heads/main or refs/pull/42/merge. In Git or in Jenkins, this corresponds to the value of git symbolic-ref HEAD. In Azure DevOps, this corresponds to $(Build.SourceBranch).
--github-urlURL of the GitHub instance where your repository is hosted.
--github-auth-stdinRead the GitHub Apps token or personal access token from standard input.

| --checkout-path | | The path to the checkout of your repository. The default is the current working directory. | | --debug | | None. Prints more verbose output. | | -h, --help | | None. Displays help for the command. |

Did this doc help you?Privacy policy

Help us make these docs great!

All GitHub docs are open source. See something that's wrong or unclear? Submit a pull request.

Make a contribution

Oder, learn how to contribute.