# github/codeql architecture

> Architecture diagram of the GitHub repository github/codeql, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-02). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/github/codeql
- Repository: https://github.com/github/codeql

## Overview

This repository contains CodeQL’s standard libraries and security queries, plus language-specific extractors that represent source code for analysis. The user-facing workflow is to analyze a codebase, extract it into a database, run queries, and inspect findings; the CLI and engine that orchestrate this workflow are maintained elsewhere. The README documents the libraries and queries’ role in GitHub security products and points users to the CLI, but the sampled source does not show the end-to-end runtime wiring, so those internal links are marked unverified.

Main entry points: [`cpp/ql/src`](https://github.com/github/codeql/tree/main/cpp/ql/src) (C/C++ queries), [`javascript/extractor`](https://github.com/github/codeql/tree/main/javascript/extractor) (Language extractors), [`csharp/extractor/Semmle.Extraction.CSharp`](https://github.com/github/codeql/tree/main/csharp/extractor/Semmle.Extraction.CSharp) (C# extractor), [`csharp/ql/src`](https://github.com/github/codeql/tree/main/csharp/ql/src) (C# queries)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_extraction["Language extraction"]
  node_extractors["Language extractors"]
  node_csharp_extractor["C# extractor"]
  node_csharp_dependencies["C# dependencies"]
  node_python_extractor["Python extractor"]
  node_go_extractor["Go extractor"]
end

subgraph group_query["Libraries and queries"]
  node_cpp_queries["C/C++ queries"]
  node_csharp_queries["C# queries"]
  node_java_queries["Java queries"]
  node_python_queries["Python queries"]
  node_query_libraries["Standard libraries"]
end

subgraph group_analysis["Analysis results"]
  node_findings["Security findings"]
end

subgraph group_products["Security products"]
  node_advanced_security["GitHub security products"]
end

node_engineer(("Code analyst"))
node_codebase["Target codebase"]
node_cli["CodeQL CLI"]

node_engineer -->|"runs queries"| node_cli
node_codebase -.->|"provides source"| node_cli
node_cli -.->|"dispatches extraction"| node_extractors
node_extractors -.->|"includes language support"| node_csharp_extractor
node_csharp_extractor -.->|"resolves dependencies"| node_csharp_dependencies
node_cli -.->|"runs checks"| node_cpp_queries
node_cli -.->|"runs checks"| node_csharp_queries
node_cli -.->|"runs checks"| node_java_queries
node_cli -.->|"runs checks"| node_python_queries
node_query_libraries -.->|"supports queries"| node_cpp_queries
node_cli -.->|"reports results"| node_findings
node_cpp_queries -->|"powers products"| node_advanced_security
node_csharp_queries -->|"powers products"| node_advanced_security
node_java_queries -->|"powers products"| node_advanced_security
node_python_queries -->|"powers products"| node_advanced_security

click node_extractors "https://github.com/github/codeql/tree/main/javascript/extractor"
click node_csharp_extractor "https://github.com/github/codeql/tree/main/csharp/extractor/Semmle.Extraction.CSharp"
click node_csharp_dependencies "https://github.com/github/codeql/tree/main/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching"
click node_python_extractor "https://github.com/github/codeql/tree/main/python/extractor"
click node_go_extractor "https://github.com/github/codeql/tree/main/go/extractor"
click node_cpp_queries "https://github.com/github/codeql/tree/main/cpp/ql/src"
click node_csharp_queries "https://github.com/github/codeql/tree/main/csharp/ql/src"
click node_java_queries "https://github.com/github/codeql/tree/main/java/ql/src"
click node_python_queries "https://github.com/github/codeql/tree/main/python/ql/src"
click node_query_libraries "https://github.com/github/codeql/tree/main/cpp/ql/src"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_extractors,node_csharp_extractor,node_csharp_dependencies,node_python_extractor,node_go_extractor toneBlue
class node_cpp_queries,node_csharp_queries,node_java_queries,node_python_queries,node_query_libraries toneAmber
class node_findings toneMint
class node_advanced_security toneRose
class node_engineer,node_codebase,node_cli toneIndigo
```

## Components

### Language extraction

- [Language extractors](https://github.com/github/codeql/tree/main/javascript/extractor): `javascript/extractor`
- [C# extractor](https://github.com/github/codeql/tree/main/csharp/extractor/Semmle.Extraction.CSharp): `csharp/extractor/Semmle.Extraction.CSharp`
- [C# dependencies](https://github.com/github/codeql/tree/main/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching): `csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching`
- [Python extractor](https://github.com/github/codeql/tree/main/python/extractor): `python/extractor`
- [Go extractor](https://github.com/github/codeql/tree/main/go/extractor): `go/extractor`

### Libraries and queries

- [C/C++ queries](https://github.com/github/codeql/tree/main/cpp/ql/src): `cpp/ql/src`
- [C# queries](https://github.com/github/codeql/tree/main/csharp/ql/src): `csharp/ql/src`
- [Java queries](https://github.com/github/codeql/tree/main/java/ql/src): `java/ql/src`
- [Python queries](https://github.com/github/codeql/tree/main/python/ql/src): `python/ql/src`
- [Standard libraries](https://github.com/github/codeql/tree/main/cpp/ql/src): `cpp/ql/src`

### Analysis results

- **Security findings**

### Security products

- **GitHub security products**

### Other components

- **Code analyst**
- **Target codebase**
- **CodeQL CLI**

## Connections

- Code analyst → CodeQL CLI: runs queries
- Target codebase → CodeQL CLI: provides source
- CodeQL CLI → Language extractors: dispatches extraction
- Language extractors → C# extractor: includes language support
- C# extractor → C# dependencies: resolves dependencies (evidence: `csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/DependencyManager.cs`)
- CodeQL CLI → C/C++ queries: runs checks
- CodeQL CLI → C# queries: runs checks
- CodeQL CLI → Java queries: runs checks
- CodeQL CLI → Python queries: runs checks
- Standard libraries → C/C++ queries: supports queries
- CodeQL CLI → Security findings: reports results
- C/C++ queries → GitHub security products: powers products
- C# queries → GitHub security products: powers products
- Java queries → GitHub security products: powers products
- Python queries → GitHub security products: powers products