Configuring CodeQL runner in your CI system

About configuring CodeQL code scanning in your CI system

To integrate code scanning into your CI system, you can use the CodeQL runner. For more information, see "Running CodeQL runner in your CI system."

In general, you invoke the CodeQL runner as follows.

$ /path/to-runner/codeql-runner-OS  

/path/to-runner/ depends on where you've downloaded the CodeQL runner on your CI system. codeql-runner-OS depends on the operating system you use. There are three versions of the CodeQL runner, codeql-runner-linux, codeql-runner-macos, and codeql-runner-win, for Linux, macOS, and Windows systems respectively.

To customize the way the CodeQL runner scans your code, you can use flags, such as --languages and --queries, or you can specify custom settings in a separate configuration file.

Scanning pull requests

Scanning code whenever a pull request is created prevents developers from introducing new vulnerabilities and errors into the code.

To scan a pull request, run the analyze command and use the --ref flag to specify the pull request. The reference is refs/pull/<PR-number>/head or refs/pull/<PR-number>/merge, depending on whether you have checked out the HEAD commit of the pull request branch or a merge commit with the base branch.

$ /path/to-runner/codeql-runner-linux analyze --ref refs/pull/42/merge

Overriding automatic language detection

The CodeQL runner automatically detects and scans code written in the supported languages.

• C/C++
• C#
• Go
• Java
• JavaScript/TypeScript
• Python

サポートされている 1 つ以上の言語のコードがリポジトリに含まれている� �合は、分析する言語を選択できます。 言語が分析されないようにする理由は、いくつかあります。 たとえば、プロジェクトで、コードの本体に対する依存関係が別の言語の中にあり、それらの依存関係のアラートを表示したくない� �合が考えられます。

To override automatic language detection, run the init command with the --languages flag, followed by a comma-separated list of language keywords. The keywords for the supported languages are cpp, csharp, go, java, javascript, and python.

$ /path/to-runner/codeql-runner-linux init --languages cpp,java

Running additional queries

コードをスキャンするためにCodeQLを使う� �合、CodeQL分析エンジンはコードからデータベースを生成し、それに対してクエリを実行します。 CodeQLの分析はデフォルトのクエリセットを使いますが、デフォルトのクエリに� えてもっと多くのクエリを実行するよう指定することもできます。

実行したいクエリが他にあれば、リポジトリ内の QL パックに属していなければなりません。 詳細については、「code scanning と CodeQL について」を参照してく� さい。

1 つの .ql ファイル、複数の .ql ファイルを含むディレクトリ、 .qls クエリ スイート定義ファイル、または任意の組み合わせを指定できます。 クエリ スイート定義の詳細については、「CodeQL クエリ スイートの作成」を参照してく� さい。

以下のクエリスイートはCodeQL code scanningに組み込まれており、利用可能です。

クエリ スイート	説明
security-extended	既定のスイートからのクエリ、および重要度と精度の低いクエリ
security-and-quality	security-extended からのクエリに� え、保守性および信� �性のクエリ。

クエリ スイートを指定すると、CodeQL の分析エンジンでは、既定の一連のクエリと、追� のクエリ スイートで定義されている追� クエリが実行されます。

To add one or more queries, pass a comma-separated list of paths to the --queries flag of the init command. You can also specify additional queries in a configuration file.

If you also are using a configuration file for custom settings, and you are also specifying additional queries with the --queries flag, the CodeQL runner uses the additional queries specified with the --queries flag instead of any in the configuration file. If you want to run the combined set of additional queries specified with the flag and in the configuration file, prefix the value passed to --queries with the + symbol. For more information, see "Using a custom configuration file."

In the following example, the + symbol ensures that the CodeQL runner uses the additional queries together with any queries specified in the referenced configuration file.

$ /path/to-runner/codeql-runner-linux init --config-file .github/codeql/codeql-config.yml 
    --queries +security-and-quality,octo-org/python-qlpack/show_ifs.ql@main

Using a custom configuration file

Instead of passing additional information to the CodeQL runner commands, you can specify custom settings in a separate configuration file.

The configuration file is a YAML file. It uses syntax similar to the workflow syntax for GitHub Actions, as illustrated in the examples below. For more information, see "Workflow syntax for GitHub Actions."

Use the --config-file flag of the init command to specify the configuration file. The value of --config-file is the path to the configuration file that you want to use. This example loads the configuration file .github/codeql/codeql-config.yml.

$ /path/to-runner/codeql-runner-linux init --config-file .github/codeql/codeql-config.yml

構成ファイルは、分析するリポジトリ内、または外部リポジトリ内に� �納できます。 外部リポジトリを使用すると、1 つの� �所の複数のリポジトリに対して構成オプションを指定できます。 外部リポジトリにある構成ファイルを参照する� �合は、 OWNER/REPOSITORY/FILENAME@BRANCH 構文を使用できます。 たとえば、 octo-org/shared/codeql-config.yml@main です。

Example configuration files

この構成ファイルは、コードのスキャン時に CodeQL によって実行されるクエリのリストに security-and-quality クエリ スイートを追� します。 使用できるクエリ スイートの詳細については、「追� のクエリを実行する」を参照してく� さい。

name: "My CodeQL config"

queries:
  - uses: security-and-quality

以下の設定ファイルはデフォルトのクエリを無効化し、その代わりに実行するカスタ� クエリのセットを指定します。 また、CodeQL が、src/node_modules ディレクトリと .test.js で名前が終わるファイルを除く、src ディレクトリ (ルートに対する相対) 内のファイルをスキャンするようにも設定します。 src/node_modules 内のファイルと末尾が .test.js で終わる名前のファイルは、分析から除外されます。

name: "My CodeQL config"

disable-default-queries: true

queries:
  - name: Use an in-repository QL pack (run queries in the my-queries directory)
    uses: ./my-queries
  - name: Use an external JavaScript QL pack (run queries from an external repo)
    uses: octo-org/javascript-qlpack@main
  - name: Use an external query (run a single query from an external QL pack)
    uses: octo-org/python-qlpack/show_ifs.ql@main
  - name: Use a query suite file (run queries from a query suite in this repo)
    uses: ./codeql-qlpacks/complex-python-qlpack/rootAndBar.qls

paths:
  - src 
paths-ignore: 
  - src/node_modules
  - '**/*.test.js'

Configuring code scanning for compiled languages

For the compiled languages C/C++, C#, and Java, CodeQL builds the code before analyzing it. For these three languages, CodeQL analyzes the source files in your repository that are built. CodeQL also runs a build for Go projects to set up the project, but then analyzes all Go files in the repository, not just the files that are built. For any of these languages, including Go, you can disable autobuild and instead use custom build commands in order to analyze only the files that are built by these custom commands.

For many common build systems, the CodeQL runner can build the code automatically. To attempt to build the code automatically, run autobuild between the init and analyze steps. Note that if your repository requires a specific version of a build tool, you may need to install the build tool manually first.

The autobuild process only ever attempts to build one compiled language for a repository. The language automatically selected for analysis is the language with the most files. If you want to choose a language explicitly, use the --language flag of the autobuild command.

$ /path/to-runner/codeql-runner-linux autobuild --language csharp

If the autobuild command can't build your code, you can run the build steps yourself, between the init and analyze steps. For more information, see "Running CodeQL runner in your CI system."

Uploading code scanning data to GitHub

By default, the CodeQL runner uploads results from code scanning when you run the analyze command. You can also upload SARIF files separately, by using the upload command.

Once you've uploaded the data, GitHub displays the alerts in your repository.

• If you uploaded to a pull request, for example --ref refs/pull/42/merge or --ref refs/pull/42/head, then the results appear as alerts in a pull request check. For more information, see "Triaging code scanning alerts in pull requests."
• If you uploaded to a branch, for example --ref refs/heads/my-branch, then the results appear in the Security tab for your repository. For more information, see "Managing code scanning alerts for your repository."

CodeQL runner command reference

The CodeQL runner supports the following commands and flags.

init

Initializes the CodeQL runner and creates a CodeQL database for each language to be analyzed.

Flag	Required	Input value
--repository	✓	Name of the repository to initialize.
--github-url	✓	URL of the GitHub instance where your repository is hosted.
--github-auth-stdin	✓	Read the GitHub Apps token or personal access token from standard input.
--languages		Comma-separated list of languages to analyze. By default, the CodeQL runner detects and analyzes all supported languages in the repository.
--queries		Comma-separated list of additional queries to run, in addition to the default suite of security queries. This overrides the queries setting in the custom configuration file.
--config-file		Path to custom configuration file.
--codeql-path		Path to a copy of the CodeQL CLI executable to use. By default, the CodeQL runner downloads a copy.
--temp-dir		Directory where temporary files are stored. The default is ./codeql-runner.
--tools-dir		Directory where CodeQL tools and other files are stored between runs. The default is a subdirectory of the home directory.
--checkout-path		The path to the checkout of your repository. The default is the current working directory.
--debug		None. Prints more verbose output.
--trace-process-name		Advanced, Windows only. Name of the process where a Windows tracer of this process is injected.
--trace-process-level		Advanced, Windows only. Number of levels up of the parent process where a Windows tracer of this process is injected.
-h, --help		None. Displays help for the command.

autobuild

Attempts to build the code for the compiled languages C/C++, C#, and Java. For those languages, CodeQL builds the code before analyzing it. Run autobuild between the init and analyze steps.

Flag	Required	Input value
--language		The language to build. By default, the CodeQL runner builds the compiled language with the most files.
--temp-dir		Directory where temporary files are stored. The default is ./codeql-runner.
--debug		None. Prints more verbose output.
-h, --help		None. Displays help for the command.

analyze

Analyzes the code in the CodeQL databases and uploads results to GitHub Enterprise Server.

Flag	Required	Input value
--repository	✓	Name of the repository to analyze.
--commit	✓	SHA of the commit to analyze. In Git and in Azure DevOps, this corresponds to the value of git rev-parse HEAD. In Jenkins, this corresponds to $GIT_COMMIT.
--ref	✓	Name of the reference to analyze, for example refs/heads/main or refs/pull/42/merge. In Git or in Jenkins, this corresponds to the value of git symbolic-ref HEAD. In Azure DevOps, this corresponds to $(Build.SourceBranch).
--github-url	✓	URL of the GitHub instance where your repository is hosted.
--github-auth-stdin	✓	Read the GitHub Apps token or personal access token from standard input.
--checkout-path		The path to the checkout of your repository. The default is the current working directory.
--no-upload		None. Stops the CodeQL runner from uploading the results to GitHub Enterprise Server.
--output-dir		Directory where the output SARIF files are stored. The default is in the directory of temporary files.
--ram		Amount of memory to use when running queries. The default is to use all available memory.
--no-add-snippets		None. Excludes code snippets from the SARIF output.
--category		Category to include in the SARIF results file for this analysis. A category can be used to distinguish multiple analyses for the same tool and commit, but performed on different languages or different parts of the code. This value will appear in the <run>.automationDetails.id property in SARIF v2.1.0.
--threads		Number of threads to use when running queries. The default is to use all available cores.
--temp-dir		Directory where temporary files are stored. The default is ./codeql-runner.
--debug		None. Prints more verbose output.
-h, --help		None. Displays help for the command.

upload

Uploads SARIF files to GitHub Enterprise Server.

Flag	Required	Input value
--sarif-file	✓	SARIF file to upload, or a directory containing multiple SARIF files.
--repository	✓	Name of the repository that was analyzed.
--commit	✓	SHA of the commit that was analyzed. In Git and in Azure DevOps, this corresponds to the value of git rev-parse HEAD. In Jenkins, this corresponds to $GIT_COMMIT.
--ref	✓	Name of the reference that was analyzed, for example refs/heads/main or refs/pull/42/merge. In Git or in Jenkins, this corresponds to the value of git symbolic-ref HEAD. In Azure DevOps, this corresponds to $(Build.SourceBranch).
--github-url	✓	URL of the GitHub instance where your repository is hosted.
--github-auth-stdin	✓	Read the GitHub Apps token or personal access token from standard input.
--checkout-path		The path to the checkout of your repository. The default is the current working directory.
--debug		None. Prints more verbose output.
-h, --help		None. Displays help for the command.