Skip to content

Commit 616a57d

Browse files
committed
Update article with code scanning example
1 parent 5bcf810 commit 616a57d

File tree

1 file changed

+21
-16
lines changed

1 file changed

+21
-16
lines changed

docs/codeql/codeql-cli/analyzing-databases-with-the-codeql-cli.rst

Lines changed: 21 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -101,39 +101,44 @@ You can also run your own custom queries with the ``database analyze`` command.
101101
For more information about preparing your queries to use with the CodeQL CLI,
102102
see ":doc:`Using custom queries with the CodeQL CLI <using-custom-queries-with-the-codeql-cli>`."
103103

104-
105-
Running LGTM.com query suites
106-
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
104+
Running GitHub code scanning suites
105+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
107106

108107
The CodeQL repository also includes query suites, which can be run over your
109108
code as part of a broader code review. CodeQL query suites are ``.qls`` files
110109
that use directives to select queries to run based on certain metadata
111110
properties.
112111

113-
The query suites included in the CodeQL repository select the same set of
114-
queries that are run by default on `LGTM.com <https://lgtm.com>`__. The queries
115-
are selected to highlight the most relevant and useful results for each
116-
language.
117-
118-
The language-specific LGTM query suites are located at the following paths in
112+
The CodeQL repository includes query suites that are used by the CodeQL action on
113+
`GitHub.com <https://github.com>`__. The query suites are located at the following paths in
119114
the CodeQL repository::
120115

121-
ql/<language>/ql/src/codeql-suites/<language>-lgtm.qls
116+
ql/<language>/ql/src/codeql-suites/<language>-code-scanning.qls
122117

123118
and at the following path in the CodeQL for Go repository::
124119

125-
ql/src/codeql-suites/go-lgtm.qls
120+
ql/src/codeql-suites/go-code-scanning.qls
126121

127122
These locations are specified in the metadata included in the standard QL packs.
128-
This means that CodeQL knows where to find the suite files automatically, and
123+
This means that the CodeQL CLI knows where to find the suite files automatically, and
129124
you don't have to specify the full path on the command line when running an
130125
analysis. For more information, see ":ref:`About QL packs <standard-ql-packs>`."
131126

132-
For example, to run the LGTM.com query suite on a C++ codebase (generating
133-
results in the latest SARIF format), you would run::
127+
.. pull-quote::
128+
129+
Important
130+
131+
If you plan to upload the results to GitHub, you must generate SARIF results.
132+
For more information, see `Analyzing a CodeQL database <https://docs.github.com/en/code-security/secure-coding/running-codeql-cli-in-your-ci-system#analyzing-a-codeql-database>`__ in the GitHub documentation.
133+
134+
For example, to run the code scanning query suite on a C++ codebase and generate
135+
results in the v2.1 SARIF format supported by all versions of GitHub, you would run::
136+
137+
codeql database analyze <cpp-database> cpp-code-scanning.qls --format=sarifv2.1.0 --output=cpp-analysis/cpp-results.sarif
138+
139+
The repository also includes the query suites used by `LGTM.com <https://lgtm.com>`__.
140+
These are stored alongside the code scanning suites with names of the form: ``<language>-lgtm.qls``.
134141

135-
codeql database analyze <cpp-database> cpp-lgtm.qls --format=sarif-latest --output=cpp-analysis/cpp-results.sarif
136-
137142
For information about creating custom query suites, see ":doc:`Creating
138143
CodeQL query suites <creating-codeql-query-suites>`."
139144

0 commit comments

Comments
 (0)