Skip to content

Commit d89c41b

Browse files
committed
QL: update the readme
1 parent dc91877 commit d89c41b

File tree

1 file changed

+10
-26
lines changed

1 file changed

+10
-26
lines changed

ql/README.md

Lines changed: 10 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,10 @@
1-
# QL analysis support for CodeQL
1+
# CodeQL for CodeQL
22

3-
- *Part of the May 2021 [code scanning hackathon](https://github.com/github/code-scanning-hackathon/issues/3).*
4-
- *Part of the October 2021 [code scanning hackathon](https://github.com/github/code-scanning-hackathon/issues/61).*
3+
CodeQL for CodeQL analyses QL code to find some common bug patterns.
4+
This analysis is mostly used as a PR check in [`github/codeql`](https://github.com/github/codeql).
5+
CodeQL for CodeQL is experimental technology and not a supported product
56

6-
Under development.
7-
8-
## Viewing the alerts from github/codeql and github/codeql-go
9-
10-
**TLDR: View https://github.com/github/codeql-ql/security/code-scanning?query=branch%3Anightly-changes-alerts periodically.**
11-
12-
The [`nightly-changes-alerts` branch](https://github.com/github/codeql-ql/tree/nightly-changes-alerts) contains nightly snapshots of QL related code from [github/codeql](https://github.com/github/codeql) and [github/codeql-go](https://github.com/github/codeql-go). The corresponding [code-scanning alerts](https://github.com/github/codeql-ql/security/code-scanning?query=branch%3Anightly-changes-alerts) are from the [default query suite](https://github.com/github/codeql-ql/blob/main/ql/src/codeql-suites/ql-code-scanning.qls).
13-
14-
The branch and alerts are updated every night by the [`nightly-changes.yml` workflow](https://github.com/github/codeql-ql/actions/workflows/nightly-changes.yml).
15-
16-
Ideally, the scans would happen automatically as part of the PRs. That requires more coordination, and is tracked here: https://github.com/github/codeql-coreql-team/issues/1669.
7+
Some setup is required to use CodeQL for CodeQL (see the below sections).
178

189
## Building the tools from source
1910

@@ -43,22 +34,15 @@ Then run
4334
codeql database create <database-path> -l ql -s <project-source-path> --search-path <extractor-pack-path>
4435
```
4536

37+
CodeQL can be configured to remember the extractor by setting the config file `~/.config/codeql/config` to:
38+
```bash
39+
--search-path /full/path/to/extractor-pack
40+
```
41+
4642
## Running qltests
4743

4844
Run
4945

5046
```bash
5147
codeql test run <test-path> --search-path <repository-root-path>
5248
```
53-
54-
## GitHub Actions
55-
56-
In addition to the above nightly scans of the known CodeQL repositories, the following Actions are of particular interest:
57-
58-
- [`bleeding-codeql-analysis.yml`](https://github.com/github/codeql-ql/actions/workflows/bleeding-codeql-analysis.yml)
59-
- runs on all PRs, displays how alerts for the known CodeQL repositories change as consequence of the PR
60-
- the code from the known CodeQL repositories should be updated occasionally by running [`repo-tests/import-repositories.sh`](https://github.com/github/codeql-ql/blob/main/repo-tests/import-repositories.sh) locally, and creating a PR.
61-
- produces an artifact built `ql` database in
62-
- [`build.yml`](https://github.com/github/codeql-ql/actions/workflows/build.yml)
63-
- produces an artifact with the `ql` extractor and the `ql` query pack in
64-

0 commit comments

Comments
 (0)