From Newsgroup: uk.rec.waterways

<div>If you are setting up the CodeQL CLI in your CI system, you need to make the full contents of the CodeQL CLI bundle available to every CI server that you want to run CodeQL code scanning analysis on. For example, you might configure each server to copy the bundle from a central, internal location and extract it. Alternatively, you could use the REST API to get the bundle directly from GitHub, ensuring that you benefit from the latest improvements to queries. For more information, see "Releases" in the REST API documentation.</div><div></div><div></div><div>You should always use the CodeQL bundle as this ensures compatibility and also gives much better performance than a separate download of the CodeQL CLI and checkout of the CodeQL queries. If you will only be running the CLI on one specific platform, download the appropriate codeql-bundle-PLATFORM.tar.gz file. Alternatively, you can download codeql-bundle.tar.gz, which contains the CLI for all supported platforms.</div><div></div><div></div><div></div><div></div><div></div><div>codeql bundle download</div><div></div><div>Download: https://t.co/8Juuhp0kwk </div><div></div><div></div><div>Note: If you add codeql to your PATH, it can be accessed by CodeQL for Visual Studio Code to compile and run queries.For more information about configuring VS Code to access the CodeQL CLI, see "Setting up CodeQL in Visual Studio Code."</div><div></div><div></div><div>You should check that the output contains the expected languages and also that the directory location for the qlpack files is correct. The location should be within the extracted CodeQL CLI bundle, shown in the earlier example as . If the CodeQL CLI is unable to locate the qlpacks for the expected languages, check that you downloaded the CodeQL bundle and not a standalone copy of the CodeQL CLI.</div><div></div><div></div><div>[Advanced] Controls the location of cached data on disk that willpersist between several runs of the CLI, such as downloaded QL packs andcompiled query plans. If not set explicitly, this defaults to adirectory named .codeql in the user's home directory; it will becreated if it doesn't already exist.</div><div></div><div></div><div>A list of directories under which QL packs may be found. Each directorycan either be a QL pack (or bundle of packs containing a.codeqlmanifest.json file at the root) or the immediate parent of oneor more such directories.</div><div></div><div></div><div>Note: The CodeQL package management functionality, including CodeQL packs, is currently available as a beta release and is subject to change. During the beta release, CodeQL packs are available only using GitHub Packages - the Container registry. To use this beta functionality, install the latest version of the CodeQL CLI bundle from: -action/releases.</div><div></div><div></div><div>Query packs contain a set of pre-compiled queries that can be evaluated on a CodeQL database. Query packs are designed to be run. When a query pack is published, the bundle includes all the transitive dependencies and pre-compiled representations of each query, in addition to the query sources. This ensures consistent and efficient execution of the queries in the pack.</div><div></div><div></div><div>The standard CodeQL packs for all supported languages are published in the Container registry. If you installed the CodeQL CLI in the standard way, using the CodeQL CLI bundle, the core query packs are already downloaded and available to you. They are:</div><div></div><div></div><div></div><div></div><div></div><div></div><div>The CodeQL CLI bundle includes queries that are maintained by GitHub experts, security researchers, and community contributors. If you want to run queries developed by other organizations, CodeQL query packs provide an efficient and reliable way to download and run queries, while model packs (beta) can be used to expand code scanning analysis to recognize libraries and frameworks that are not supported by default. For more information about query packs, see "About code scanning with CodeQL." For information about writing your own model packs, see "Creating and working with CodeQL packs."</div><div></div><div></div><div>Before you can use a CodeQL query pack to analyze a database, you must download any packages you require from the GitHub Container registry. This can be done either by using the --download flag as part of the codeql database analyze command, or running codeql pack download. If a package is not publicly available, you will need to use a GitHub App or personal access token to authenticate. For more information and an example, see "Uploading CodeQL analysis results to GitHub."</div><div></div><div></div><div>If you want to download a CodeQL pack without running it immediately, then you can use the codeql pack download command. This is useful if you want to avoid accessing the internet when running CodeQL queries. When you run the CodeQL analysis, you can specify packs, versions, and paths in the same way as in the previous example:</div><div></div><div></div><div>The default query suite of the standard CodeQL query packs are codeql-suites/-code-scanning.qls. Several other useful query suites can also be found in the codeql-suites directory of each pack. For example, the codeql/cpp-queries pack contains the following query suites:</div><div></div><div></div><div>In this example, the relevant queries in the standard query pack codeql/java-queries will use the dependency information from the model pack, my-repo/my-java-model-pack, to check for vulnerabilities in code that calls those dependencies.</div><div></div><div></div><div>Most of this data is located in a directory named .codeql in the published pack, but precompiled queries are in files with a .qlx suffix next to the .ql source for each query. When analyzing a database with a query from a published pack, CodeQL will load these files instead of the .ql source. If you need to modify the content of a published pack, be sure to remove all of the .qlx files, since they may prevent modifications in the .ql files from taking effect.</div><div></div><div></div><div>The CodeQL package management functionality, including all types of CodeQL pack, is currently available as a beta release and is subject to change. During the beta release, CodeQL packs are available only using GitHub Packages - the GitHub Container registry. To use this beta functionality, install the latest version of the CodeQL CLI bundle from: -action/releases.</div><div></div><div></div><div>To download a query pack that someone else has created, run the CodeQL: Download Packs command from the Command Palette.You can download all the core query packs, or enter the full name of a specific pack to download. For example, to download the core queries for analyzing Java and Kotlin, enter codeql/java-queries.</div><div></div><div></div><div>The CodeQL bundle consists of the CodeQL CLI together with the standard CodeQL query and library packsmaintained by GitHub. The bundle can be downloaded from GitHub releases.Use this when running code scanning with CodeQL on GitHub Actions or in another CI system.</div><div></div><div></div><div>The default workflow that CodeQL will propose links to the github/codeql-action action, of which a static copy is installed with each Enterprise Server update. This organization is hidden by default, but you can navigate to it with the direct link. The issue here is that these action repos (github/dependabot-action and all repos in the actions org) only have the source code linked and updated with each Enterprise Server update. Since the CodeQL bundle is stored as a release asset, it is missing from the appliance. The bundle contains all CodeQL queries, including the security-extended and security-and-quality query types.</div><div></div><div></div><div>After downloading the codeql-action-sync-tool, you need to make sure you have write access to the github organization. By default you do not have it, so you cannot write to the release assets or anything else in this org. That means we need to promote the user that will execute the syncing to an owner of the github org.</div><div></div><div></div><div>Now we can call the codeql-action-sync-tool to download the latest version of the CodeQL bundle and upload it to the github/codeql-action repo. This tool will also update the github/codeql-action repo with the latest version of the action code.</div><div></div><div>You can run it with this command:</div><div></div><div></div><div>That means that we can prep our runners by copying the CodeQL bundle to this location. This will prevent the bundle from being downloaded for each run. The folder is used by including the CodeQL bundle release version and date: /opt/hostedtoolcache/CodeQL/2.12.1-20230120/x64/codeql/codeql.</div><div></div><div></div><div>For each language there is a query pack containing all CodeQL queries for that language (from our open source repository). These packs are named codeql/-queries. For example, the CodeQL pack containing the standard C/C++ queries is called codeql/cpp-queries.</div><div></div><div></div><div>We've also released packs with all CodeQL standard libraries for each language. These packs are named codeql/-all (e.g. codeql/cpp-all). If you're writing your own query pack, you'll likely want to express a dependency on the CodeQL standard libraries for that language.</div><div></div><div> 356178063d</div>
--- Synchronet 3.21d-Linux NewsLink 1.2