|
| 1 | +.. _about-ql-packs: |
| 2 | + |
| 3 | +About QL packs |
| 4 | +============== |
| 5 | + |
| 6 | +QL packs are used to organize the files used in CodeQL analysis. They |
| 7 | +contain queries, library files, query suites, and important metadata. |
| 8 | + |
| 9 | +The `CodeQL repository <https://github.com/github/codeql>`__ contains QL packs for |
| 10 | +C/C++, C#, Java, JavaScript, and Python. The `CodeQL for Go |
| 11 | +<https://github.com/github/codeql-go/>`__ repository contains a QL pack for Go |
| 12 | +analysis. You can also make custom QL packs to contain your own queries and |
| 13 | +libraries. |
| 14 | + |
| 15 | +QL pack structure |
| 16 | +----------------- |
| 17 | + |
| 18 | +A QL pack must contain a file called ``qlpack.yml`` in its root directory. The other |
| 19 | +files and directories within the pack should be logically organized. For example, typically: |
| 20 | + |
| 21 | +- Queries are organized into directories for specific categories. |
| 22 | +- Queries for specific products, libraries, and frameworks are organized into |
| 23 | + their own top-level directories. |
| 24 | +- There is a top-level directory named ``<owner>/<ql-language-specification>`` for query library |
| 25 | + (``.qll``) files. Within this directory, ``.qll`` files should be organized into |
| 26 | + subdirectories for specific categories. |
| 27 | + |
| 28 | +About ``qlpack.yml`` files |
| 29 | +-------------------------- |
| 30 | + |
| 31 | +When executing commands, CodeQL scans siblings of the installation directory (and |
| 32 | +their subdirectories) for ``qlpack.yml`` files. The metadata in the file tells |
| 33 | +CodeQL how to compile queries, what libraries the pack depends on, and where to |
| 34 | +find query suite definitions. |
| 35 | + |
| 36 | +The content of the QL pack (queries and libraries used in CodeQL analysis) is |
| 37 | +included in the same directory as ``qlpack.yml``, or its subdirectories. |
| 38 | + |
| 39 | +The location of ``qlpack.yml`` defines the library path for the content |
| 40 | +of the QL pack. That is, for all ``.ql`` and ``.qll`` files in the QL pack, |
| 41 | +CodeQL will resolve all import statements relative to the ``qlpack.yml`` at the |
| 42 | +pack's root. |
| 43 | + |
| 44 | +For example, in a QL pack with the following contents, you can import ``CustomSinks.qll`` |
| 45 | +from any location in the pack by declaring ``import mycompany.java.CustomSinks``. |
| 46 | + |
| 47 | +.. code-block:: none |
| 48 | +
|
| 49 | + qlpack.yml |
| 50 | + mycompany/ |
| 51 | + java/ |
| 52 | + security/ |
| 53 | + CustomSinks.qll |
| 54 | + Security/ |
| 55 | + CustomQuery.ql |
| 56 | +
|
| 57 | +For more information, see ":ref:`Importing modules <importing-modules>`" |
| 58 | +in the QL language reference. |
| 59 | + |
| 60 | +``qlpack.yml`` properties |
| 61 | +~~~~~~~~~~~~~~~~~~~~~~~~~ |
| 62 | + |
| 63 | +The following properties are supported in ``qlpack.yml`` files. |
| 64 | + |
| 65 | +.. list-table:: |
| 66 | + :header-rows: 1 |
| 67 | + :widths: auto |
| 68 | + |
| 69 | + * - Property |
| 70 | + - Example |
| 71 | + - Required |
| 72 | + - Purpose |
| 73 | + * - ``name`` |
| 74 | + - ``org-queries`` |
| 75 | + - All packs |
| 76 | + - The name of the QL pack defined using alphanumeric characters, hyphens, and periods. It must be unique as CodeQL cannot differentiate between QL packs with identical names. If you intend to distribute the pack, prefix the name with your (or your organization's) name followed by a hyphen. Use the pack name to specify queries to run using ``database analyze`` and to define dependencies between QL packs (see examples below).- ' |
| 77 | + * - ``version`` |
| 78 | + - ``0.0.0`` |
| 79 | + - All packs |
| 80 | + - A version number for this QL pack. This field is not currently used by any commands, but may be required by future releases of CodeQL. |
| 81 | + * - ``libraryPathDependencies`` |
| 82 | + - ``codeql-javascript`` |
| 83 | + - Optional |
| 84 | + - The names of any QL packs that this QL pack depends on, as a sequence. This gives the pack access to any libraries, database schema, and query suites defined in the dependency. |
| 85 | + * - ``suites`` |
| 86 | + - ``suites`` |
| 87 | + - Optional |
| 88 | + - The path to a directory that contains the "well-known" query suites in the pack, defined relative to the pack directory. You can run "well-known" suites stored in this directory by specifying the pack name, without providing their full path. To use query suites stored in other directories in the pack, you must provide their full path. For more information about query suites, see ":doc:`Creating CodeQL query suites <../using-the-codeql-cli/creating-codeql-query-suites>`." |
| 89 | + * - ``extractor`` |
| 90 | + - ``javascript`` |
| 91 | + - All test packs |
| 92 | + - The CodeQL language extractor to use when the CLI creates a database from test files in the pack. For more information about testing queries, see ":doc:`Testing custom queries <../using-the-codeql-cli/testing-custom-queries>`." |
| 93 | + * - ``tests`` |
| 94 | + - ``.`` |
| 95 | + - Optional for test packs |
| 96 | + - Supported from release 2.1.0 onwards. The path to a directory within the pack that contains tests, defined relative to the pack directory. Use ``.`` to specify the whole pack. Any queries in this directory are run as tests when ``test run`` is run with the ``--strict-test-discovery`` option. These queries are ignored by query suite definitions that use ``queries`` or ``qlpack`` instructions to ask for all queries in a particular pack. |
| 97 | + * - ``dbscheme`` |
| 98 | + - ``semmlecode.python.dbscheme`` |
| 99 | + - Core language pack only |
| 100 | + - The path to the :ref:`database schema <codeql-database-schema>` for all libraries and queries written for this CodeQL language (see example below). |
| 101 | + * - ``upgrades`` |
| 102 | + - ``.`` |
| 103 | + - Packs with upgrades |
| 104 | + - The path to a directory within the pack that contains upgrade scripts, defined relative to the pack directory. The ``database upgrade`` action uses these scripts to update databases that were created by an older version of an extractor so they're compatible with the current extractor (see `Upgrade scripts for a language <upgrade-scripts-for-a-language>`__ below.) |
| 105 | + |
| 106 | + |
| 107 | +.. _custom-ql-packs: |
| 108 | + |
| 109 | +Examples of custom QL packs |
| 110 | +--------------------------- |
| 111 | + |
| 112 | +When you write custom queries or tests, you should save them in |
| 113 | +custom QL packs. For simplicity, try to organize each pack logically. For more |
| 114 | +information, see `QL pack structure <#ql-pack-structure>`__. Save files for queries |
| 115 | +and tests in separate packs and, where possible, organize custom packs into specific |
| 116 | +folders for each target language. |
| 117 | + |
| 118 | +QL packs for custom queries |
| 119 | +~~~~~~~~~~~~~~~~~~~~~~~~~~~ |
| 120 | + |
| 121 | +A custom QL pack for queries must include a ``qlpack.yml`` file at |
| 122 | +the pack root, containing ``name``, ``version``, |
| 123 | +and ``libraryPathDependencies`` properties. If the pack contains query suites, you can |
| 124 | +use the ``suites`` property to define their location. Query suites defined |
| 125 | +here are called "well-known" suites, and can be used on the command line by referring to |
| 126 | +their name only, rather than their full path. |
| 127 | +For more information about query suites, see ":doc:`Creating CodeQL query suites <../using-the-codeql-cli/creating-codeql-query-suites>`." |
| 128 | + |
| 129 | +For example, a ``qlpack.yml`` file for a QL pack featuring custom C++ queries |
| 130 | +and libraries may contain: |
| 131 | + |
| 132 | +.. code-block:: yaml |
| 133 | +
|
| 134 | + name: my-custom-queries |
| 135 | + version: 0.0.0 |
| 136 | + libraryPathDependencies: codeql-cpp |
| 137 | + suites: my-custom-suites |
| 138 | +
|
| 139 | +where ``codeql-cpp`` is the name of the QL pack for C/C++ analysis included in |
| 140 | +the CodeQL repository. |
| 141 | + |
| 142 | +.. pull-quote:: |
| 143 | + |
| 144 | + Note |
| 145 | + |
| 146 | + When you create a custom QL pack, it's usually a good idea to add it to the search path in your CodeQL configuration. |
| 147 | + This will ensure that any libraries the pack contains are available to the CodeQL CLI. |
| 148 | + For more information, see ":ref:`Specifying command options in a CodeQL configuration file <specifying-command-options-in-a-codeql-configuration-file>`." |
| 149 | + |
| 150 | +QL packs for custom test files |
| 151 | +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ |
| 152 | + |
| 153 | +For custom QL packs containing test files, you also need to include an |
| 154 | +``extractor`` property so that the ``test run`` command knows how to create test |
| 155 | +databases. You may also wish to specify the ``tests`` property. |
| 156 | + |
| 157 | +.. include:: ../../reusables/test-qlpack.rst |
| 158 | + |
| 159 | +For more information about running tests, see ":doc:`Testing custom queries |
| 160 | +<../using-the-codeql-cli/testing-custom-queries>`." |
| 161 | + |
| 162 | +.. _standard-ql-packs: |
| 163 | + |
| 164 | +Examples of QL packs in the CodeQL repository |
| 165 | +--------------------------------------------- |
| 166 | + |
| 167 | +Each of the languages in the CodeQL repository has three main QL packs: |
| 168 | + |
| 169 | +- Core QL pack for the language, with the :ref:`database schema <codeql-database-schema>` |
| 170 | + used by the language, CodeQL libraries, and queries at ``ql/<language>/ql/src`` |
| 171 | +- Tests for the core language libraries and queries pack at ``ql/<language>/ql/test`` |
| 172 | +- Upgrade scripts for the language at ``ql/<language>/upgrades`` |
| 173 | + |
| 174 | +Core QL pack |
| 175 | +~~~~~~~~~~~~ |
| 176 | + |
| 177 | +The ``qlpack.yml`` file for a core QL pack uses the following properties: |
| 178 | +``name``, ``version``, ``dbscheme``, and ``suites``. |
| 179 | +The ``dbscheme`` property should only be defined in the core QL |
| 180 | +pack for a language. |
| 181 | + |
| 182 | +For example, the ``qlpack.yml`` file for `C/C++ analysis |
| 183 | +<https://github.com/github/codeql/blob/main/cpp/ql/src/qlpack.yml>`__ |
| 184 | +contains: |
| 185 | + |
| 186 | +.. code-block:: yaml |
| 187 | +
|
| 188 | + name: codeql-cpp |
| 189 | + version: 0.0.0 |
| 190 | + dbscheme: semmlecode.cpp.dbscheme |
| 191 | + suites: codeql-suites |
| 192 | +
|
| 193 | +Tests for the core QL pack |
| 194 | +~~~~~~~~~~~~~~~~~~~~~~~~~~ |
| 195 | + |
| 196 | +The ``qlpack.yml`` file for the tests for the core QL packs use the following |
| 197 | +properties: ``name``, ``version``, and ``libraryPathDependencies``. |
| 198 | +The ``libraryPathDependencies`` always specifies the core QL pack. |
| 199 | + |
| 200 | +For example, the ``qlpack.yml`` file for `C/C++ analysis tests |
| 201 | +<https://github.com/github/codeql/blob/main/cpp/ql/test/qlpack.yml>`__ |
| 202 | +contains: |
| 203 | + |
| 204 | +.. code-block:: yaml |
| 205 | +
|
| 206 | + name: codeql-cpp-tests |
| 207 | + version: 0.0.0 |
| 208 | + libraryPathDependencies: codeql-cpp |
| 209 | +
|
| 210 | +Notice that, unlike the example QL pack for custom tests, this file does not define |
| 211 | +an ``extractor`` or ``tests`` property. These properties have been added to |
| 212 | +the QL pack file since the release of CodeQL CLI 2.0.1. |
| 213 | +They haven't been added yet to ensure compatibility for LGTM Enterprise users. |
| 214 | +After the next release of LGTM Enterprise, these files can be updated. |
| 215 | + |
| 216 | +.. _upgrade-ql-packs: |
| 217 | + |
| 218 | +Upgrade scripts for a language |
| 219 | +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ |
| 220 | + |
| 221 | +The ``qlpack.yml`` file for a QL pack that contains only upgrade scripts |
| 222 | +uses the following properties: ``name`` and ``upgrades``. |
| 223 | + |
| 224 | +For example, the ``qlpack.yml`` file for `C/C++ upgrades |
| 225 | +<https://github.com/github/codeql/blob/main/cpp/upgrades/qlpack.yml>`__ |
| 226 | +contains: |
| 227 | + |
| 228 | +.. code-block:: yaml |
| 229 | +
|
| 230 | + name: codeql-cpp-upgrades |
| 231 | + upgrades: . |
0 commit comments