Concepts for CodeQL

Understand the core concepts behind CodeQL and how it helps you find vulnerabilities and errors in your code.

Links

• Code scanning with CodeQL

  You can use CodeQL to identify vulnerabilities and errors in your code. The results are shown as code scanning alerts in GitHub.

• CodeQL code scanning for compiled languages

  Understand how CodeQL analyzes compiled languages, the build options available, and learn how you can customize the database generation process if you need to.

• CodeQL query suites

  You can choose from different built-in CodeQL query suites to use in your CodeQL code scanning setup.

• Custom CodeQL queries

  Custom queries extend CodeQL's built-in security analysis to detect vulnerabilities and enforce coding standards specific to your codebase.

• CodeQL CLI

  You can use the CodeQL CLI to run CodeQL processes locally on software projects or to generate code scanning results for upload to GitHub.

• CodeQL for VS Code

  You can write, run, and test CodeQL queries inside Visual Studio Code with the CodeQL extension.

• CodeQL workspaces

  CodeQL workspaces let you develop and maintain multiple related CodeQL packs together, resolving dependencies between them directly from source.

• Query reference files

  You can use query reference files to define the location of a query you want to run in tests.

• CodeQL query packs

  You can choose from different built-in CodeQL query suites to use in your CodeQL code scanning setup.