1
0
mirror of synced 2025-12-19 18:10:59 -05:00

[Improvement]: Create "Reference" category for code scanning for CodeQL queries #20670 (#58874)

Co-authored-by: hubwriter <hubwriter@github.com>
This commit is contained in:
Anne-Marie
2025-12-18 16:08:41 +00:00
committed by GitHub
parent a10899f1f1
commit 12b1c7aec0
20 changed files with 138 additions and 75 deletions

View File

@@ -25,4 +25,5 @@ children:
- /integrating-with-code-scanning
- /troubleshooting-code-scanning
- /troubleshooting-sarif-uploads
- /reference
---

View File

@@ -127,7 +127,7 @@ Anyone with push access to a pull request can fix a {% data variables.product.pr
When {% data variables.copilot.copilot_autofix_short %} is enabled for a repository, alerts are displayed in pull requests as normal and information from any alerts found by {% data variables.product.prodname_code_scanning %} is automatically sent to the LLM for processing. When LLM analysis is complete, any results are published as comments on relevant alerts. For more information, see [AUTOTITLE](/code-security/code-scanning/managing-code-scanning-alerts/responsible-use-autofix-code-scanning).
> [!NOTE]
> * {% data variables.copilot.copilot_autofix_short %} supports a subset of {% data variables.product.prodname_codeql %} queries. For information about the availability of {% data variables.copilot.copilot_autofix_short %}, see the query tables linked from [AUTOTITLE](/code-security/code-scanning/managing-your-code-scanning-configuration/codeql-query-suites#query-lists-for-the-default-query-suites).
> * {% data variables.copilot.copilot_autofix_short %} supports a subset of {% data variables.product.prodname_codeql %} queries. For information about the availability of {% data variables.copilot.copilot_autofix_short %}, see the query tables linked from [AUTOTITLE](/code-security/code-scanning/reference/code-ql-built-in-queries).
> * When analysis is complete, all relevant results are published to the pull request at once. If at least one alert in your pull request has an {% data variables.copilot.copilot_autofix_short %} suggestion, you should assume that the LLM has finished identifying potential fixes for your code.
> * On alerts generated from queries that are not supported by {% data variables.copilot.copilot_autofix_short %}, you will see a note telling you that the query is not supported. If a suggestion for a supported query fails to generate, you will see a note on the alert prompting you to try pushing another commit or to contact support.
> * {% data variables.copilot.copilot_autofix_short %} for {% data variables.product.prodname_code_scanning %} alerts won't be able to generate a fix for every alert in every situation. The feature operates on a best-effort basis and is not guaranteed to succeed 100% of the time. For information about the limitations of automatically generated fixes, see [Limitations of suggestions](/code-security/code-scanning/managing-code-scanning-alerts/about-autofix-for-codeql-code-scanning#limitations-of-suggestions).

View File

@@ -1,7 +1,7 @@
---
title: CodeQL query suites
shortTitle: CodeQL query suites
intro: 'You can choose from different built-in {% data variables.product.prodname_codeql %} query suites to use in your {% data variables.product.prodname_codeql %} {% data variables.product.prodname_code_scanning %} setup.'
intro: You can choose from different built-in {% data variables.product.prodname_codeql %} query suites to use in your {% data variables.product.prodname_codeql %} {% data variables.product.prodname_code_scanning %} setup.
product: '{% data reusables.gated-features.codeql %}'
versions:
fpt: '*'
@@ -14,6 +14,7 @@ type: reference
topics:
- Code scanning
- CodeQL
contentType: other
---
## About {% data variables.product.prodname_codeql %} query suites
@@ -43,11 +44,7 @@ The built-in {% data variables.product.prodname_codeql %} query suites, `default
* Relative to the `default` query suite, the `security-extended` suite may return a greater number of false positive {% data variables.product.prodname_code_scanning %} results.
* This query suite is available for use with default setup for {% data variables.product.prodname_code_scanning %}, and is referred to as the "Extended" query suite on {% data variables.product.prodname_dotcom %}.
## Query lists for the default query suites
For each language, the following article lists which queries are included in the `default` and the `security-extended` suites. {% ifversion code-scanning-autofix %}Where {% data variables.copilot.copilot_autofix_short %} is available for a language, details of which queries are supported are also included.{% endif %}
{% data reusables.code-scanning.codeql-query-tables.links-to-all-tables %}
For a complete list of queries included in each query suite for every language, see [AUTOTITLE](/code-security/code-scanning/reference).
## Further reading

View File

@@ -1,23 +0,0 @@
---
title: GitHub Actions queries for CodeQL analysis
shortTitle: GitHub Actions queries
intro: 'Explore the queries that {% data variables.product.prodname_codeql %} uses to analyze workflows used by {% data variables.product.prodname_actions %} when you select the `default` or the `security-extended` query suite.'
product: '{% data reusables.gated-features.codeql %}'
allowTitleToDifferFromFilename: true
versions:
fpt: '*'
ghes: '*'
ghec: '*'
type: reference
topics:
- Code scanning
- CodeQL
---
{% data variables.product.prodname_codeql %} includes many queries for analyzing workflows used by {% data variables.product.prodname_actions %}. {% data reusables.code-scanning.codeql-query-tables.query-suite-behavior %}
## Built-in queries for workflow analysis
{% data reusables.code-scanning.codeql-query-tables.codeql-version-info %}
{% data reusables.code-scanning.codeql-query-tables.actions %}

View File

@@ -1,7 +1,7 @@
---
title: Managing your code scanning configuration
shortTitle: Manage code scanning
intro: 'You can manage your existing {% data variables.product.prodname_code_scanning %} configuration with the help of metrics and logging outputs generated by your analysis.'
intro: You can manage your existing {% data variables.product.prodname_code_scanning %} configuration with the help of metrics and logging outputs generated by your analysis.
product: '{% data reusables.gated-features.code-scanning %}'
versions:
fpt: '*'
@@ -14,20 +14,10 @@ topics:
children:
- /about-the-tool-status-page
- /editing-your-configuration-of-default-setup
- /codeql-query-suites
- /set-code-scanning-merge-protection
- /enabling-delegated-alert-dismissal-for-code-scanning
- /codeql-query-suites
- /configuring-larger-runners-for-default-setup
- /viewing-code-scanning-logs
- /actions-built-in-queries
- /c-cpp-built-in-queries
- /csharp-built-in-queries
- /github-actions-built-in-queries
- /go-built-in-queries
- /java-kotlin-built-in-queries
- /javascript-typescript-built-in-queries
- /python-built-in-queries
- /ruby-built-in-queries
- /rust-built-in-queries
- /swift-built-in-queries
---

View File

@@ -0,0 +1,25 @@
---
title: About built-in CodeQL queries
shortTitle: About built-in queries
allowTitleToDifferFromFilename: true
intro: Learn about the CodeQL queries that code scanning uses to analyze code.
product: '{% data reusables.gated-features.code-scanning %}'
versions:
fpt: '*'
ghec: '*'
ghes: '*'
type: overview
topics:
- Code Security
- Code scanning
- CodeQL
contentType: other
---
## About built-in queries for CodeQL analysis
For each language, the following articles list which queries are included in the `default` and the `security-extended` suites. {% ifversion code-scanning-autofix %}Where {% data variables.copilot.copilot_autofix_short %} is available for a language, details of which queries are supported are also included.{% endif %}
{% data reusables.code-scanning.codeql-query-tables.links-to-all-tables %}
For more information about CodeQL query suites, see [AUTOTITLE](/code-security/code-scanning/managing-your-code-scanning-configuration/codeql-query-suites).

View File

@@ -1,7 +1,7 @@
---
title: Actions queries for CodeQL analysis
shortTitle: Actions CodeQL queries
intro: 'Explore the queries that {% data variables.product.prodname_codeql %} uses to analyze code written in {% data variables.product.prodname_actions %} workflow files when you select the `default` or the `security-extended` query suite.'
title: GitHub Actions queries for CodeQL analysis
shortTitle: Actions queries
intro: Explore the queries that {% data variables.product.prodname_codeql %} uses to analyze code written in {% data variables.product.prodname_actions %} workflow files when you select the `default` or the `security-extended` query suite.
product: '{% data reusables.gated-features.codeql %}'
allowTitleToDifferFromFilename: true
versions:
@@ -12,6 +12,10 @@ type: reference
topics:
- Code scanning
- CodeQL
redirect_from:
- /code-security/code-scanning/managing-your-code-scanning-configuration/actions-built-in-queries
- /code-security/code-scanning/managing-your-code-scanning-configuration/github-actions-built-in-queries
contentType: other
---
{% data variables.product.prodname_codeql %} includes many queries for analyzing {% data variables.product.prodname_actions %} workflows. {% data reusables.code-scanning.codeql-query-tables.query-suite-behavior %}

View File

@@ -1,7 +1,7 @@
---
title: C and C++ queries for CodeQL analysis
shortTitle: C and C++ CodeQL queries
intro: 'Explore the queries that {% data variables.product.prodname_codeql %} uses to analyze code written in C or C++ when you select the `default` or the `security-extended` query suite.'
shortTitle: C and C++ queries
intro: Explore the queries that {% data variables.product.prodname_codeql %} uses to analyze code written in C or C++ when you select the `default` or the `security-extended` query suite.
product: '{% data reusables.gated-features.codeql %}'
allowTitleToDifferFromFilename: true
versions:
@@ -12,6 +12,9 @@ type: reference
topics:
- Code scanning
- CodeQL
redirect_from:
- /code-security/code-scanning/managing-your-code-scanning-configuration/c-cpp-built-in-queries
contentType: other
---
{% data variables.product.prodname_codeql %} includes many queries for analyzing C and C++ code. {% data reusables.code-scanning.codeql-query-tables.query-suite-behavior %}

View File

@@ -1,7 +1,7 @@
---
title: C# queries for CodeQL analysis
shortTitle: C# CodeQL queries
intro: 'Explore the queries that {% data variables.product.prodname_codeql %} uses to analyze code written in C# when you select the `default` or the `security-extended` query suite.'
shortTitle: C# queries
intro: Explore the queries that {% data variables.product.prodname_codeql %} uses to analyze code written in C# when you select the `default` or the `security-extended` query suite.
product: '{% data reusables.gated-features.codeql %}'
allowTitleToDifferFromFilename: true
versions:
@@ -12,6 +12,9 @@ type: reference
topics:
- Code scanning
- CodeQL
redirect_from:
- /code-security/code-scanning/managing-your-code-scanning-configuration/csharp-built-in-queries
contentType: other
---
{% data variables.product.prodname_codeql %} includes many queries for analyzing C# code. {% data reusables.code-scanning.codeql-query-tables.query-suite-behavior %}

View File

@@ -1,7 +1,7 @@
---
title: Go queries for CodeQL analysis
shortTitle: Go CodeQL queries
intro: 'Explore the queries that {% data variables.product.prodname_codeql %} uses to analyze code written in Go (Golang) when you select the `default` or the `security-extended` query suite.'
shortTitle: Go queries
intro: Explore the queries that {% data variables.product.prodname_codeql %} uses to analyze code written in Go (Golang) when you select the `default` or the `security-extended` query suite.
product: '{% data reusables.gated-features.codeql %}'
allowTitleToDifferFromFilename: true
versions:
@@ -12,6 +12,9 @@ type: reference
topics:
- Code scanning
- CodeQL
redirect_from:
- /code-security/code-scanning/managing-your-code-scanning-configuration/go-built-in-queries
contentType: other
---
{% data variables.product.prodname_codeql %} includes many queries for analyzing Go code. {% data reusables.code-scanning.codeql-query-tables.query-suite-behavior %}

View File

@@ -0,0 +1,27 @@
---
title: Queries for CodeQL analysis
shortTitle: CodeQL queries
intro: Explore the CodeQL queries that code scanning uses to analyze code.
product: '{% data reusables.gated-features.code-scanning %}'
versions:
fpt: '*'
ghec: '*'
ghes: '*'
topics:
- Code Security
- Code scanning
- CodeQL
children:
- /about-built-in-queries
- /actions-built-in-queries
- /c-cpp-built-in-queries
- /csharp-built-in-queries
- /go-built-in-queries
- /java-kotlin-built-in-queries
- /javascript-typescript-built-in-queries
- /python-built-in-queries
- /ruby-built-in-queries
- /rust-built-in-queries
- /swift-built-in-queries
---

View File

@@ -1,7 +1,7 @@
---
title: Java and Kotlin queries for CodeQL analysis
shortTitle: Java and Kotlin CodeQL queries
intro: 'Explore the queries that {% data variables.product.prodname_codeql %} uses to analyze code written in Java or Kotlin when you select the `default` or the `security-extended` query suite.'
shortTitle: Java and Kotlin queries
intro: Explore the queries that {% data variables.product.prodname_codeql %} uses to analyze code written in Java or Kotlin when you select the `default` or the `security-extended` query suite.
product: '{% data reusables.gated-features.codeql %}'
allowTitleToDifferFromFilename: true
versions:
@@ -12,6 +12,9 @@ type: reference
topics:
- Code scanning
- CodeQL
redirect_from:
- /code-security/code-scanning/managing-your-code-scanning-configuration/java-kotlin-built-in-queries
contentType: other
---
{% data variables.product.prodname_codeql %} includes many queries for analyzing Java and Kotlin code. {% data reusables.code-scanning.codeql-query-tables.query-suite-behavior %}

View File

@@ -1,7 +1,7 @@
---
title: JavaScript and TypeScript queries for CodeQL analysis
shortTitle: JavaScript and TypeScript queries
intro: 'Explore the queries that {% data variables.product.prodname_codeql %} uses to analyze code written in JavaScript or TypeScript when you select the `default` or the `security-extended` query suite.'
intro: Explore the queries that {% data variables.product.prodname_codeql %} uses to analyze code written in JavaScript or TypeScript when you select the `default` or the `security-extended` query suite.
product: '{% data reusables.gated-features.codeql %}'
allowTitleToDifferFromFilename: true
versions:
@@ -12,6 +12,9 @@ type: reference
topics:
- Code scanning
- CodeQL
redirect_from:
- /code-security/code-scanning/managing-your-code-scanning-configuration/javascript-typescript-built-in-queries
contentType: other
---
{% data variables.product.prodname_codeql %} includes many queries for analyzing JavaScript and TypeScript code. {% data reusables.code-scanning.codeql-query-tables.query-suite-behavior %}

View File

@@ -1,7 +1,7 @@
---
title: Python queries for CodeQL analysis
shortTitle: Python CodeQL queries
intro: 'Explore the queries that {% data variables.product.prodname_codeql %} uses to analyze code written in Python when you select the `default` or the `security-extended` query suite.'
shortTitle: Python queries
intro: Explore the queries that {% data variables.product.prodname_codeql %} uses to analyze code written in Python when you select the `default` or the `security-extended` query suite.
product: '{% data reusables.gated-features.codeql %}'
allowTitleToDifferFromFilename: true
versions:
@@ -12,6 +12,9 @@ type: reference
topics:
- Code scanning
- CodeQL
redirect_from:
- /code-security/code-scanning/managing-your-code-scanning-configuration/python-built-in-queries
contentType: other
---
{% data variables.product.prodname_codeql %} includes many queries for analyzing Python code. {% data reusables.code-scanning.codeql-query-tables.query-suite-behavior %}

View File

@@ -1,7 +1,7 @@
---
title: Ruby queries for CodeQL analysis
shortTitle: Ruby CodeQL queries
intro: 'Explore the queries that {% data variables.product.prodname_codeql %} uses to analyze code written in Ruby when you select the `default` or the `security-extended` query suite.'
shortTitle: Ruby queries
intro: Explore the queries that {% data variables.product.prodname_codeql %} uses to analyze code written in Ruby when you select the `default` or the `security-extended` query suite.
product: '{% data reusables.gated-features.codeql %}'
allowTitleToDifferFromFilename: true
versions:
@@ -12,6 +12,9 @@ type: reference
topics:
- Code scanning
- CodeQL
redirect_from:
- /code-security/code-scanning/managing-your-code-scanning-configuration/ruby-built-in-queries
contentType: other
---
{% data variables.product.prodname_codeql %} includes many queries for analyzing Ruby code. {% data reusables.code-scanning.codeql-query-tables.query-suite-behavior %}

View File

@@ -1,7 +1,7 @@
---
title: Rust queries for CodeQL analysis
shortTitle: Rust CodeQL queries
intro: 'Explore the queries that {% data variables.product.prodname_codeql %} uses to analyze code written in Rust when you select the `default` or the `security-extended` query suite.'
shortTitle: Rust queries
intro: Explore the queries that {% data variables.product.prodname_codeql %} uses to analyze code written in Rust when you select the `default` or the `security-extended` query suite.
product: '{% data reusables.gated-features.codeql %}'
allowTitleToDifferFromFilename: true
versions:
@@ -12,6 +12,9 @@ type: reference
topics:
- Code scanning
- CodeQL
redirect_from:
- /code-security/code-scanning/managing-your-code-scanning-configuration/rust-built-in-queries
contentType: other
---
{% data variables.product.prodname_codeql %} includes many queries for analyzing Rust code. {% data reusables.code-scanning.codeql-query-tables.query-suite-behavior %}

View File

@@ -1,7 +1,7 @@
---
title: Swift queries for CodeQL analysis
shortTitle: Swift CodeQL queries
intro: 'Explore the queries that {% data variables.product.prodname_codeql %} uses to analyze code written in Swift when you select the `default` or the `security-extended` query suite.'
shortTitle: Swift queries
intro: Explore the queries that {% data variables.product.prodname_codeql %} uses to analyze code written in Swift when you select the `default` or the `security-extended` query suite.
product: '{% data reusables.gated-features.codeql %}'
allowTitleToDifferFromFilename: true
versions:
@@ -12,6 +12,9 @@ type: reference
topics:
- Code scanning
- CodeQL
redirect_from:
- /code-security/code-scanning/managing-your-code-scanning-configuration/swift-built-in-queries
contentType: other
---
{% data variables.product.prodname_codeql %} includes many queries for analyzing Swift code. {% data reusables.code-scanning.codeql-query-tables.query-suite-behavior %}

View File

@@ -0,0 +1,16 @@
---
title: Reference for code scanning
shortTitle: Reference
intro: Reference documentation for {% data variables.product.prodname_code_scanning %}.
product: '{% data reusables.gated-features.code-scanning %}'
versions:
fpt: '*'
ghec: '*'
ghes: '*'
topics:
- Code Security
- Code scanning
- CodeQL
children:
- /code-ql-built-in-queries
---

View File

@@ -89,7 +89,7 @@ For more information about filtering alerts, see [AUTOTITLE](/code-security/secu
In addition to the core filters, you will usually want to add a filter to limit results to a specific rule name, severity, or tag.
* `is:open autofilter:true {% ifversion security-campaigns-autofix %}autofix:supported {% endif %}rule:java/log-injection` to show only alerts for log injection in Java code. See [Query lists for the default query suites](/code-security/code-scanning/managing-your-code-scanning-configuration/codeql-query-suites#query-lists-for-the-default-query-suites).
* `is:open autofilter:true {% ifversion security-campaigns-autofix %}autofix:supported {% endif %}rule:java/log-injection` to show only alerts for log injection in Java code. See [AUTOTITLE](/code-security/code-scanning/reference/code-ql-built-in-queries).
* `is:open autofilter:true {% ifversion security-campaigns-autofix %}autofix:supported {% endif %}tag:external/cwe/cwe-117` to show only alerts for "CWE 117: Improper Output Neutralization for Logs". This includes log injection in Java and other languages.
* `is:open autofilter:true {% ifversion security-campaigns-autofix %}autofix:supported {% endif %}severity:critical` to show only alerts with a security severity of critical.

View File

@@ -1,13 +1,12 @@
{% ifversion code-scanning-actions-language %}
* [AUTOTITLE](/code-security/code-scanning/managing-your-code-scanning-configuration/actions-built-in-queries)
* [AUTOTITLE](/code-security/code-scanning/reference/code-ql-built-in-queries/actions-built-in-queries)
{% endif %}
* [AUTOTITLE](/code-security/code-scanning/managing-your-code-scanning-configuration/c-cpp-built-in-queries)
* [AUTOTITLE](/code-security/code-scanning/managing-your-code-scanning-configuration/csharp-built-in-queries)
* [AUTOTITLE](/code-security/code-scanning/managing-your-code-scanning-configuration/github-actions-built-in-queries)
* [AUTOTITLE](/code-security/code-scanning/managing-your-code-scanning-configuration/go-built-in-queries)
* [AUTOTITLE](/code-security/code-scanning/managing-your-code-scanning-configuration/java-kotlin-built-in-queries)
* [AUTOTITLE](/code-security/code-scanning/managing-your-code-scanning-configuration/javascript-typescript-built-in-queries)
* [AUTOTITLE](/code-security/code-scanning/managing-your-code-scanning-configuration/python-built-in-queries)
* [AUTOTITLE](/code-security/code-scanning/managing-your-code-scanning-configuration/ruby-built-in-queries)
* [AUTOTITLE](/code-security/code-scanning/managing-your-code-scanning-configuration/rust-built-in-queries)
* [AUTOTITLE](/code-security/code-scanning/managing-your-code-scanning-configuration/swift-built-in-queries)
* [AUTOTITLE](/code-security/code-scanning/reference/code-ql-built-in-queries/c-cpp-built-in-queries)
* [AUTOTITLE](/code-security/code-scanning/reference/code-ql-built-in-queries/csharp-built-in-queries)
* [AUTOTITLE](/code-security/code-scanning/reference/code-ql-built-in-queries/go-built-in-queries)
* [AUTOTITLE](/code-security/code-scanning/reference/code-ql-built-in-queries/java-kotlin-built-in-queries)
* [AUTOTITLE](/code-security/code-scanning/reference/code-ql-built-in-queries/javascript-typescript-built-in-queries)
* [AUTOTITLE](/code-security/code-scanning/reference/code-ql-built-in-queries/python-built-in-queries)
* [AUTOTITLE](/code-security/code-scanning/reference/code-ql-built-in-queries/ruby-built-in-queries)
* [AUTOTITLE](/code-security/code-scanning/reference/code-ql-built-in-queries/rust-built-in-queries)
* [AUTOTITLE](/code-security/code-scanning/reference/code-ql-built-in-queries/swift-built-in-queries)