Getting started with Visual Studio CodeQL Extension

[stephenegriffin]

I cannot figure out how to get started with this extension. All I want to do is run the same CodeQL analysis that I get from the Github CodeQL action locally so I can iterate on resolutions to the identified problems. I figured I would install the extension, hit the some sort of "run now" button and be on my way but it looks like it's much more complicated than that.

I'm trying to follow the steps given here:
https://codeql.github.com/docs/codeql-for-visual-studio-code/setting-up-codeql-in-visual-studio-code/

• Installing the extension: Check - I think I got that.

• Configuring access to the CodeQL CLI: Unlcear why this is even a step since it says the extension manages the CLI for me. So I think I got past this?

• Setting up a CodeQL workspace: I'll be honest, I haven't the foggiest idea what this section is asking me to do. I've got clones of all sorts of codeql projects on my harddrive now but no idea how to use them. I think the "Updating an existing workspace for CodeQL" section may be trying to tell me how to set this up but I'm really not making sense of what it's asking me to do.

I then try to work through these steps:
https://codeql.github.com/docs/codeql-for-visual-studio-code/analyzing-your-projects/

• Choosing a database: I think I've added a database from Github. That's not exactly what I want to do as I want to build locally and analyze something from there but for now I'll settle for analyzing anything.
• Running a query: Completely baffled. I have no idea where to get a QL file to run it, and I really don't want to write one, as my goal is to just run what the github action runs. When I look at the logs for the action, I see a bunch of .qlx files referenced - are those somehow the same as ql? I suppose if I ever figure out the "Setting up a CodeQL workspace" this step may make more sense?

I feel like I'm having a major conceptual failure in how CodeQL works. Setting up the github action was so easy and turnkey - I don't understand why running it locally isn't as well.

[mbg]

Hey @stephenegriffin!

Thank you for the question and taking the time to describe your thought process and experience here 🙇🏻 I am sorry that you haven't had a good experience here and haven't been able to get the analysis to work locally.

The VSCode extension is primarily aimed at developing queries and testing them on existing databases (or taking individual, existing queries and testing them). The VSCode extension would be the right choice for you if you were expecting not to make any changes to the code of your project, but rather explore why a particular query produces the results it does.

To create a database from a codebase and run a full analysis on it, you should use the CodeQL CLI directly. You can find the documentation for the CLI at https://docs.github.com/en/code-security/codeql-cli, but let me know if you have any questions about using that. This is the right choice if you are expecting to primarily make changes to the code of your project, and run the full query suite after each iteration.

[stephenegriffin]

Ok - I might have to use the codeql cli. I'm trying to script everything so I don't have to remember how to do it all by hand. Is there a nuget package to install the CLI? The instructions here don't give any hint on how to download/install the CLI in any sort of automated fashion:
https://docs.github.com/en/code-security/code-scanning/using-codeql-code-scanning-with-your-existing-ci-system/installing-codeql-cli-in-your-ci-system

[stephenegriffin]

I ended up writing an installer: https://github.com/microsoft/mfcmapi/blob/u/sgriffin/codeql/scripts/install-codeql.ps1

[mbg]

Hi @stephenegriffin, sorry for not getting back to you here before you wrote a script to install it! For automated installation, you could also look into our gh extension for CodeQL that lets you install and manage CodeQL versions (among other things).

[felickz]

FYI there is also an OSS extension on top of the gh codeql extension: gh-codeql-scan. This aims to make scanning easier - a one liner to support CodeQL database creation, tracing/extraction, query analysis, and results upload.