mirror of
https://github.com/github/codeql.git
synced 2025-12-16 16:53:25 +01:00
Make general updates, add framework for new article
This commit is contained in:
Felicity Chapman
@@ -37,7 +37,10 @@ The CodeQL extension for Visual Studio Code adds rich language support for CodeQ
|
||||
CodeQL queries using the Visual Studio Code extension.
|
||||
|
||||
- :doc:`Working with CodeQL packs in Visual Studio Code
|
||||
<working-with-codeql-packs-in-visual-studio-code>`: You can view and edit CodeQL packs in Visual Studio Code.
|
||||
<working-with-codeql-packs-in-visual-studio-code>`: You can view, create, and edit all types of CodeQL pack in Visual Studio Code.
|
||||
|
||||
- :doc:`Using the CodeQL model editor
|
||||
<using-the-codeql-model-editor>`: You can view, create, and edit CodeQL model packs using a dedicated editor.
|
||||
|
||||
- :doc:`Customizing settings
|
||||
<customizing-settings>`: You can edit the settings for the
|
||||
@@ -67,6 +70,7 @@ The CodeQL extension for Visual Studio Code adds rich language support for CodeQ
|
||||
running-codeql-queries-at-scale-with-mrva
|
||||
testing-codeql-queries-in-visual-studio-code
|
||||
working-with-codeql-packs-in-visual-studio-code
|
||||
using-the-codeql-model-editor
|
||||
customizing-settings
|
||||
troubleshooting-codeql-for-visual-studio-code
|
||||
troubleshooting-variant-analysis
|
||||
|
||||
@@ -0,0 +1,12 @@
|
||||
:tocdepth: 1
|
||||
|
||||
.. _using-the-codeql-model-editor:
|
||||
|
||||
Using the CodeQL model editor
|
||||
=============================
|
||||
|
||||
.. include:: ../reusables/beta-note-package-management.rst
|
||||
|
||||
You can view, write, and edit all types of CodeQL packs in Visual Studio Code using the CodeQL extension.
|
||||
|
||||
TODO
|
||||
@@ -7,11 +7,17 @@ Working with CodeQL packs in Visual Studio Code
|
||||
|
||||
.. include:: ../reusables/beta-note-package-management.rst
|
||||
|
||||
You can view CodeQL packs and write and edit queries for them in Visual Studio Code.
|
||||
You can view, write, and edit all types of CodeQL packs in Visual Studio Code using the CodeQL extension.
|
||||
|
||||
About CodeQL packs
|
||||
------------------
|
||||
CodeQL packs are used to create, share, depend on, and run CodeQL queries and libraries. You can publish your own CodeQL packs and download packs created by others. For more information, see "`About CodeQL packs <https://docs.github.com/en/code-security/codeql-cli/codeql-cli-reference/about-codeql-packs>`__."
|
||||
You use CodeQL packs to share your expertise in query writing, CodeQL library development, and modeling dependencies with other users. The CodeQL package management system ensures that when you publish a CodeQL pack it is ready to use, without any compilation. Anything the CodeQL pack depends on is explicitly defined within the pack. You can publish your own CodeQL packs and download packs created by others. For more information, see "`About CodeQL packs <https://docs.github.com/en/code-security/codeql-cli/codeql-cli-reference/about-codeql-packs>`__."
|
||||
|
||||
There are three types of CodeQL pack, each with a specific purpose.
|
||||
|
||||
- Query packs are designed to be run. When a query pack is published, the bundle includes all the transitive dependencies and pre-compiled representations of each query, in addition to the query sources. This ensures consistent and efficient execution of the queries in the pack.
|
||||
- Library packs are designed to be used by query packs (or other library packs) and do not contain queries themselves. The libraries are not compiled separately.
|
||||
- Model packs are used to model dependencies that are not supported by the standard CodeQL libraries. When you add a model pack to your analysis, all extensible queries also explore the sources and sinks of the dependencies defined in the pack.
|
||||
|
||||
Using standard CodeQL packs in Visual Studio Code
|
||||
--------------------------------------------------------------
|
||||
@@ -19,21 +25,33 @@ To install dependencies for a CodeQL pack in your Visual Studio Code workspace,
|
||||
|
||||
You can write and run query packs that depend on the CodeQL standard libraries, without needing to check out the standard libraries in your workspace. Instead, you can install only the dependencies required by the query packs you want to use.
|
||||
|
||||
Creating and editing CodeQL packs in Visual Studio Code
|
||||
Working with CodeQL query packs in Visual Studio Code
|
||||
-------------------------------------------------------
|
||||
To create a new CodeQL pack, you will need to use the CodeQL CLI from a terminal, which you can do within Visual Studio Code or outside of it with the ``codeql pack init`` command. Once you create an empty pack, you can edit the ``qlpack.yml`` file or run the ``codeql pack add`` command to add dependencies or change the name or version. For more information, see "`Creating and working with CodeQL packs <https://docs.github.com/en/code-security/codeql-cli/using-the-codeql-cli/creating-and-working-with-codeql-packs>`__."
|
||||
|
||||
One of the main benefits of working with a CodeQL query pack is that all dependecies are resolved, not just those defined within the query and standard libraries.
|
||||
|
||||
Creating and editing CodeQL query packs
|
||||
---------------------------------------
|
||||
To create a new query pack, you will need to use the CodeQL CLI from a terminal, which you can do within Visual Studio Code or outside of it with the ``codeql pack init`` command. Once you create an empty pack, you can edit the ``qlpack.yml`` file or run the ``codeql pack add`` command to add dependencies or change the name or version. For detailed information, see "`Creating and working with CodeQL packs <https://docs.github.com/en/code-security/codeql-cli/using-the-codeql-cli/creating-and-working-with-codeql-packs>`__."
|
||||
|
||||
You can create or edit queries in a CodeQL pack in Visual Studio Code as you would with any CodeQL query, using the standard code editing features such as autocomplete suggestions to find elements to use from the pack's dependencies.
|
||||
|
||||
You can then use the CodeQL CLI to publish your pack to share with others. For more information, see "`Publishing and using CodeQL packs <https://docs.github.com/en/code-security/codeql-cli/using-the-codeql-cli/publishing-and-using-codeql-packs>`__."
|
||||
You can then use the CodeQL CLI to publish your pack to share with others. For detailed information, see "`Publishing and using CodeQL packs <https://docs.github.com/en/code-security/codeql-cli/using-the-codeql-cli/publishing-and-using-codeql-packs>`__."
|
||||
|
||||
Viewing CodeQL packs and their dependencies in Visual Studio Code
|
||||
-----------------------------------------------------------------
|
||||
To download a CodeQL pack that someone else has created, run the **CodeQL: Download Packs** command from the Command Palette.
|
||||
You can download all the core CodeQL query packs, or enter the full name of a specific pack to download. For example, to download the core queries for analyzing Java or Kotlin, enter ``codeql/java-queries``.
|
||||
Viewing CodeQL query packs and their dependencies in Visual Studio Code
|
||||
-----------------------------------------------------------------------
|
||||
To download a query pack that someone else has created, run the **CodeQL: Download Packs** command from the Command Palette.
|
||||
You can download all the core query packs, or enter the full name of a specific pack to download. For example, to download the core queries for analyzing Java and Kotlin, enter ``codeql/java-queries``.
|
||||
|
||||
Whether you have downloaded a CodeQL pack or created your own, you can open the ``qlpack.yml`` file in the root of a CodeQL pack directory in Visual Studio Code and view the dependencies section to see what libraries the pack depends on.
|
||||
|
||||
If you want to understand a query in a CodeQL pack better, you can open the query file and view the code, using the IntelliSense code editing features of Visual Studio Code. For example, if you hover over an element from a library depended on by the pack, Visual Studio Code will resolve it so you can see documentation about the element.
|
||||
|
||||
To view the full definition of an element of a query, you can right-click and choose **Go to Definition**. If the library pack is present within the same Visual Studio Code workspace, this will take you to the definition within the workspace. Otherwise it will take you to the definition within your package cache, the shared location where downloaded dependencies are stored, which is in your home directory by default.
|
||||
|
||||
Working with CodeQL model packs in Visual Studio Code
|
||||
-------------------------------------------------------
|
||||
|
||||
The CodeQL extension for Visual Studio Code includes a dedicated editor for creating and editing model packs.
|
||||
|
||||
TODO a little more, but mostly about the general use, because editing will be in a new article.
|
||||
|
||||
@@ -2,4 +2,4 @@
|
||||
|
||||
Note
|
||||
|
||||
The CodeQL package management functionality, including CodeQL packs, is currently available as a beta release and is subject to change. During the beta release, CodeQL packs are available only using GitHub Packages - the GitHub Container registry. To use this beta functionality, install the latest version of the CodeQL CLI bundle from: https://github.com/github/codeql-action/releases.
|
||||
The CodeQL package management functionality, including all types of CodeQL pack, is currently available as a beta release and is subject to change. During the beta release, CodeQL packs are available only using GitHub Packages - the GitHub Container registry. To use this beta functionality, install the latest version of the CodeQL CLI bundle from: https://github.com/github/codeql-action/releases.
|
||||
|
||||
Reference in New Issue
Block a user