Skip to content

Commit 53eea82

Browse files
committed
Add instructions to install and use the tool
1 parent 44d765a commit 53eea82

File tree

1 file changed

+55
-1
lines changed

1 file changed

+55
-1
lines changed

README.md

Lines changed: 55 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,57 @@
11
# CodeQL bundle
22

3-
CodeQL bundle is a CLI application for building a custom CodeQL bundle.
3+
A CLI application for building a custom CodeQL bundle.
4+
5+
## Introduction
6+
7+
A CodeQL bundle is an archive containing a CodeQL CLI and compatible [standard library packs](https://github.com/github/codeql) that provides a single deployable artifact for using CodeQL locally or in a CI/CD environment.
8+
9+
A custom CodeQL bundle contains additional CodeQL query packs, library packs, or customization packs.
10+
CodeQL customization packs are special CodeQL library packs that provide unofficial support to extend the CodeQL standard library packs with *sources*, *sinks*, *data-flow steps*, *barriers*, *sanitizer*, and models that describe frameworks
11+
aimed to increase the coverage and/or precision of the CodeQL queries.
12+
13+
Customizations are used to add, or extend, support for open-source frameworks or proprietary frameworks.
14+
For more details on CodeQL customization packs see the section [CodeQL customization packs](#codeql-customization-packs).
15+
16+
## Installation
17+
18+
The CodeQL bundle application can be installed using `pip` with the command:
19+
20+
```bash
21+
python 3.11 -m pip install https://github.com/rvermeulen/codeql-bundle/releases/download/v0.1.2/codeql_bundle-0.1.2-py3-none-any.whl
22+
```
23+
24+
## Usage
25+
26+
Before you can use the CodeQL bundle application you must download a bundle you want to customize from the CodeQL Action [releases](https://github.com/github/codeql-action/releases) page.
27+
28+
The CodeQL bundle application requires a [CodeQL workspace](https://codeql.github.com/docs/codeql-cli/about-codeql-workspaces/) to locate the packs you want to include in a custom bundle.
29+
You can see the packs available in your workspace by running `codeql pack ls -- <dir>` where `<dir>` is the root directory of your CodeQL workspace.
30+
31+
With both a CodeQL bundle and a CodeQL workspace you can create a bundle with the command:
32+
33+
```bash
34+
codeql-bundle --bundle <path-to-bundle> --output codeql-custom-bundle.tar.gz --workspace <path-to-workspace> --log INFO
35+
```
36+
37+
## CodeQL customization packs
38+
39+
The CodeQL bundle CLI application provides a development experience for customization packs that mimics the development experience for official CodeQL packs.
40+
41+
A customization pack is a library pack with the following properties:
42+
43+
1. Has a module `Customizations.qll` located in the subdirectory `<scope>/<package_name>` where any character `-` in the `scope` or `package_name` is replaced with `_`.
44+
For example, a library pack with the name `foo/cpp-customizations` must have a `Customizations.qll` at `foo/cpp_customizations/Customizations.qll`.
45+
1. Has a dependency on the standard library pack it wants to customize. For example, `codeql/cpp-all`.
46+
47+
If both properties hold, then the CodeQL bundle application will import the customizations pack `Customizations.qll` module in the standard library pack and recompile all
48+
the CodeQL query packs in CodeQL bundle that have a dependency on that standard library pack to ensure the customizations are available to the queries.
49+
50+
### Steps to create a customization pack
51+
52+
This example targets the C/C++ language, but you can use this for any supported language.
53+
54+
1. Create a new pack `codeql pack init foo/cpp-customizations`.
55+
2. Turn the pack into a library pack `sed -i '' -e 's/library: false/library: true/' cpp-customizations/qlpack.yml`.
56+
3. Add a dependency on `codeql/cpp-all` with `codeql pack add --dir=cpp-customizations codeql/cpp-all`
57+
4. Implement the customizations module with `mkdir -p cpp-customizations/foo/cpp_customizations && echo "import cpp" > cpp-customizations/foo/cpp_customizations/Customizations.qll`

0 commit comments

Comments
 (0)