How github/codeql works
This repository contains CodeQL’s standard libraries and security queries, plus language-specific extractors that represent source code for analysis. The user-facing workflow is to analyze a codebase, extract it into a database, run queries, and inspect findings; the CLI and engine that orchestrate this workflow are maintained elsewhere. The README documents the libraries and queries’ role in GitHub security products and points users to the CLI, but the sampled source does not show the end-to-end runtime wiring, so those internal links are marked unverified.
Main entry points: ql/src C/C++ queries · extractor Language extractors · Semmle.Extraction.CSharp C# extractor · ql/src C# queries
Components 15
Language extraction
- Language extractors
javascript/extractor - C# extractor
csharp/extractor/Semmle.Extraction.CSharp - C# dependencies
csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching - Python extractor
python/extractor - Go extractor
go/extractor
Libraries and queries
- C/C++ queries
cpp/ql/src - C# queries
csharp/ql/src - Java queries
java/ql/src - Python queries
python/ql/src - Standard libraries
cpp/ql/src
Analysis results
- Security findings
Security products
- GitHub security products
Other components
- Code analyst
- Target codebase
- CodeQL CLI
Connections 15
- Code analyst → CodeQL CLI: runs queries
- Target codebase → CodeQL CLI: provides source
- CodeQL CLI → Language extractors: dispatches extraction
- Language extractors → C# extractor: includes language support
- C# extractor → C# dependencies: resolves dependencies
csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/DependencyManager.cs - CodeQL CLI → C/C++ queries: runs checks
- CodeQL CLI → C# queries: runs checks
- CodeQL CLI → Java queries: runs checks
- CodeQL CLI → Python queries: runs checks
- Standard libraries → C/C++ queries: supports queries
- CodeQL CLI → Security findings: reports results
- C/C++ queries → GitHub security products: powers products
- C# queries → GitHub security products: powers products
- Java queries → GitHub security products: powers products
- Python queries → GitHub security products: powers products