@@ -4,7 +4,7 @@ Getting started with the CodeQL CLI
4
4
===================================
5
5
6
6
To run CodeQL commands, you need to set up the CLI so that it can access
7
- the tools, queries, and libraries required to create and analyze databases.
7
+ the tools, queries, and libraries required to create and analyze databases.
8
8
9
9
.. include :: ../reusables/license-note.rst
10
10
@@ -18,16 +18,16 @@ structures. To get started quickly, we recommend adopting a relatively simple
18
18
setup, as outlined in the steps below.
19
19
20
20
If you use Linux, Windows, or macOS version 10.14 ("Mojave") or earlier, simply
21
- follow the steps below. For macOS version 10.15 ("Catalina") or newer, steps 1
22
- and 4 are slightly different---for further details, see the sections labeled
21
+ follow the steps below. For macOS version 10.15 ("Catalina") or newer, steps 1
22
+ and 4 are slightly different---for further details, see the sections labeled
23
23
**Information for macOS "Catalina" (or newer) users **. If you are using macOS
24
24
on Apple Silicon (e.g. Apple M1), ensure that the `Xcode command-line developer
25
25
tools <https://developer.apple.com/downloads/index.action> `__ and `Rosetta 2
26
26
<https://support.apple.com/en-us/HT211861> `__ are installed.
27
27
28
28
For information about installing the CodeQL CLI in a CI system to create results
29
- to display in GitHub as code scanning alerts, see
30
- `Installing CodeQL CLI in your CI system <https://docs.github.com/en/code-security/secure-coding/using-codeql-code-scanning-with-your-existing-ci-system/installing-codeql-cli-in-your-ci-system >`__
29
+ to display in GitHub as code scanning alerts, see
30
+ `Installing CodeQL CLI in your CI system <https://docs.github.com/en/code-security/secure-coding/using-codeql-code-scanning-with-your-existing-ci-system/installing-codeql-cli-in-your-ci-system >`__
31
31
in the GitHub documentation.
32
32
33
33
1. Download the CodeQL CLI zip package
@@ -42,9 +42,9 @@ Conditions <https://securitylab.github.com/tools/codeql/license>`__.
42
42
43
43
There are several different versions of the CLI available to download, depending
44
44
on your use case:
45
-
45
+
46
46
- If you want to use the most up to date CodeQL tools and features, download the
47
- version tagged ``latest ``.
47
+ version tagged ``latest ``.
48
48
49
49
- If you want to create CodeQL databases to upload to LGTM Enterprise, download
50
50
the version that is compatible with the relevant LGTM Enterprise version
@@ -53,9 +53,9 @@ Conditions <https://securitylab.github.com/tools/codeql/license>`__.
53
53
<https://github.com/github/codeql-cli-binaries/releases> `__ on GitHub. Using the
54
54
correct version of the CLI ensures that your CodeQL databases are
55
55
compatible with your version of LGTM Enterprise. For more information,
56
- see `Preparing CodeQL databases to upload to LGTM
56
+ see `Preparing CodeQL databases to upload to LGTM
57
57
<https://help.semmle.com/lgtm-enterprise/admin/help/prepare-database-upload.html> `__
58
- in the LGTM admin help.
58
+ in the LGTM admin help.
59
59
60
60
If you use Linux, Windows, or macOS version 10.14 ("Mojave") or earlier, simply
61
61
`download the zip archive
@@ -72,97 +72,23 @@ Alternatively, you can download ``codeql.zip``, which contains the CLI for all s
72
72
**Information for macOS "Catalina" (or newer) users **
73
73
74
74
.. pull-quote :: macOS "Catalina" (or newer)
75
-
76
- If you use macOS version 10.15 ("Catalina"), version 11 ("Big Sur"), or the upcoming
77
- version 12 ("Monterey"), you need to ensure that your web browser does not automatically
78
- extract zip files. If you use Safari, complete the following steps before downloading
75
+
76
+ If you use macOS version 10.15 ("Catalina"), version 11 ("Big Sur"), or the upcoming
77
+ version 12 ("Monterey"), you need to ensure that your web browser does not automatically
78
+ extract zip files. If you use Safari, complete the following steps before downloading
79
79
the CodeQL CLI zip archive:
80
-
80
+
81
81
i. Open Safari.
82
82
ii. From the Safari menu, select **Preferences... **.
83
83
iii. Click the **General ** Tab.
84
84
iv. Ensure the check-box labeled **Open "safe" files after downloading **.
85
85
is unchecked.
86
86
87
- 2. Create a new CodeQL directory
88
- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
89
-
90
- Create a new directory where you can place the CLI and any queries and libraries
91
- you want to use. For example, ``$HOME/codeql-home ``.
92
-
93
- The CLI's built-in search operations automatically look in all of its sibling
94
- directories for the files used in database creation and analysis. Keeping these
95
- components in their own directory prevents the CLI searching unrelated sibling
96
- directories while ensuring all files are available without specifying any
97
- further options on the command line.
98
-
99
- .. _local-copy-codeql-queries :
100
-
101
- 3. Obtain a local copy of the CodeQL queries
102
- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
103
-
104
- The `CodeQL repository <https://github.com/github/codeql >`__ contains
105
- the queries and libraries required for CodeQL analysis of C/C++, C#, Java,
106
- JavaScript/TypeScript, Python, and Ruby.
107
- Clone a copy of this repository into ``codeql-home ``.
108
-
109
- By default, the root of the cloned repository will be called ``codeql ``.
110
- Rename this folder ``codeql-repo `` to avoid conflicting with the CodeQL
111
- CLI that you will extract in step 4. If you use git on the command line, you can
112
- clone and rename the repository in a single step by running
113
- ``
git clone [email protected] :github/codeql.git codeql-repo `` in the ``
codeql-home `` folder.
114
-
115
- The CodeQL libraries and queries for Go analysis live in the `CodeQL for Go
116
- repository <https://github.com/github/codeql-go/> `__. Clone a copy of this
117
- repository into ``codeql-home ``.
118
-
119
- The cloned repositories should have a sibling relationship.
120
- For example, if the root of the cloned CodeQL repository is
121
- ``$HOME/codeql-home/codeql-repo ``, then the root of the cloned CodeQL for Go
122
- repository should be ``$HOME/codeql-home/codeql-go ``.
123
-
124
- Within these repositories, the queries and libraries are organized into QL
125
- packs. Along with the queries themselves, QL packs contain important metadata
126
- that tells the CodeQL CLI how to process the query files. For more information,
127
- see ":doc: `About QL packs <about-ql-packs >`."
128
-
129
- .. pull-quote :: Important
130
-
131
- There are different versions of the CodeQL queries available for different
132
- users. Check out the correct version for your use case:
133
-
134
- - For the queries used on `LGTM.com <https://lgtm.com >`__, check out the
135
- ``lgtm.com `` branch. You should use this branch for databases you've built
136
- using the CodeQL CLI, fetched from code scanning on GitHub, or recently downloaded from LGTM.com.
137
- The queries on the ``lgtm.com `` branch are more likely to be compatible
138
- with the ``latest `` CLI, so you'll be less likely to have to upgrade
139
- newly-created databases than if you use the ``main `` branch. Older databases
140
- may need to be upgraded before you can analyze them.
141
-
142
- - For the most up to date CodeQL queries, check out the ``main `` branch.
143
- This branch represents the very latest version of CodeQL's analysis. Even
144
- databases created using the most recent version of the CLI may have to be
145
- upgraded before you can analyze them. For more information, see
146
- ":doc: `Upgrading CodeQL databases <upgrading-codeql-databases >`."
147
-
148
- - For the queries used in a particular LGTM Enterprise release, check out the
149
- branch tagged with the relevant release number. For example, the branch
150
- tagged ``v1.27.0 `` corresponds to LGTM Enterprise 1.27. You must use this
151
- version if you want to upload data to LGTM Enterprise. For further
152
- information, see `Preparing CodeQL databases to upload to LGTM
153
- <https://help.semmle.com/lgtm-enterprise/admin/help/prepare-database-upload.html> `__
154
- in the LGTM admin help.
155
-
156
- 4. Extract the zip archive
87
+ 2. Extract the zip archive
157
88
~~~~~~~~~~~~~~~~~~~~~~~~~~
158
89
159
- For Linux, Windows, and macOS users (version 10.14 "Mojave", and earlier)
160
- simply
161
- extract the zip archive into the directory you created in step 2.
162
-
163
- For example, if the path to your copy of the CodeQL repository is
164
- ``$HOME/codeql-home/codeql-repo ``, then extract the CLI into
165
- ``$HOME/codeql-home/ ``.
90
+ For Linux, Windows, and macOS users (version 10.14 "Mojave", and earlier)
91
+ simply extract the zip archive.
166
92
167
93
.. container :: toggle
168
94
@@ -171,17 +97,17 @@ For example, if the path to your copy of the CodeQL repository is
171
97
**Information for macOS "Catalina" (or newer) users **
172
98
173
99
.. pull-quote :: macOS "Catalina"
174
-
175
- macOS "Catalina", "Big Sur", or "Monterey" users should run the following
176
- commands in the Terminal, where ``${install_loc } `` is the path to the
177
- directory you created in step 2 :
178
-
179
- i. ``mv ~/Downloads/codeql*.zip ${install_loc } ``
180
- ii. ``cd ${install_loc } ``
100
+
101
+ macOS "Catalina", "Big Sur", or "Monterey" users should run the following
102
+ commands in the Terminal, where ``${extraction-root } `` is the path to the
103
+ directory where you will extract the CodeQL CLI zip archive :
104
+
105
+ i. ``mv ~/Downloads/codeql*.zip ${extraction-root } ``
106
+ ii. ``cd ${extraction-root } ``
181
107
iii. ``/usr/bin/xattr -c codeql*.zip ``
182
108
iv. ``unzip codeql*.zip ``
183
-
184
- 5 . Launch ``codeql ``
109
+
110
+ 3 . Launch ``codeql ``
185
111
~~~~~~~~~~~~~~~~~~~~
186
112
187
113
Once extracted, you can run CodeQL processes by running the ``codeql ``
@@ -191,7 +117,7 @@ executable in a couple of ways:
191
117
``<extraction-root> `` is the folder where you extracted the CodeQL CLI
192
118
package.
193
119
- By adding ``<extraction-root>/codeql `` to your ``PATH ``, so that you
194
- can run the executable as just ``codeql ``.
120
+ can run the executable as just ``codeql ``.
195
121
196
122
At this point, you can execute CodeQL commands. For a full list of the CodeQL
197
123
CLI commands, see the "`CodeQL CLI manual <../manual >`__."
@@ -204,25 +130,28 @@ CLI commands, see the "`CodeQL CLI manual <../manual>`__."
204
130
":ref: `Setting up CodeQL in Visual Studio Code <setting-up-codeql-in-visual-studio-code >`."
205
131
206
132
207
- 6 . Verify your CodeQL CLI setup
133
+ 4 . Verify your CodeQL CLI setup
208
134
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
209
135
210
136
CodeQL CLI has subcommands you can execute to verify that you are correctly set
211
137
up to create and analyze databases:
212
138
213
139
- Run ``codeql resolve languages `` to show which languages are
214
140
available for database creation. This will list the languages supported by
215
- default in your CodeQL CLI package.
216
- - Run ``codeql resolve qlpacks `` to show which QL packs the CLI can find. This
217
- will display the names of the QL packs included in the CodeQL repositories:
218
- ``codeql-cpp ``, ``codeql-csharp ``, ``codeql-go ``,
219
- ``codeql-java ``, ``codeql-javascript ``, and ``codeql-python ``. The CodeQL
220
- repositories also contain 'upgrade' packs and 'legacy' packs. Upgrade packs
221
- are used by the CLI when you want to upgrade a database so that it can be
222
- analyzed with a newer version of the CodeQL toolchain than was used to create
223
- it. Legacy packs ensure that custom queries and libraries created using older
224
- products are compatible with your version of CodeQL.
141
+ default in your CodeQL CLI package.
142
+ - (Optional) You can download some ":ref"`CodeQL packs <about-codeql-packs> ` containing pre-compiled queries you would like to run.
143
+ To do this, run ``codeql pack download <pack-name> [...pack-name] ``, where ``pack-name `` is the name of
144
+ the pack you want to download. The core query packs are a good place to start. They are:
145
+
146
+ - ``codeql/cpp-queries ``
147
+ - ``codeql/csharp-queries ``
148
+ - ``codeql/java-queries ``
149
+ - ``codeql/javascript-queries ``
150
+ - ``codeql/python-queries ``
151
+ - ``codeql/ruby-queries ``
225
152
153
+ Alternatively, you can download query packs during the analysis by using the `--download ` flag of the `codeql database analyze `
154
+ command.
226
155
227
156
.. _using-two-versions-of-the-codeql-cli :
228
157
@@ -242,4 +171,4 @@ recommended directory setup depends on which versions you want to install:
242
171
directory. For example, if you unpack version 2.0.2 into
243
172
``$HOME/codeql-home/codeql-cli ``, the older version should be
244
173
unpacked into ``$HOME/codeql-older-version/old-codeql-cli ``. Here, the common
245
- grandparent is the ``$HOME `` directory.
174
+ grandparent is the ``$HOME `` directory.
0 commit comments