How can you run CodeQL analysis locally to test queries before pushing to GitHub?

How can you run CodeQL analysis locally to test queries before pushing to GitHub?

• A. Run GitHub Actions
• B. Use the Visual Studio plugin
• C. Use the CodeQL CLI to create a database for your project and run your queries locally, then review results before committing
• D. It can't be run locally

Answer: (C)

Testing CodeQL queries locally relies on the CodeQL CLI to build a database for your project and run your queries against it. Start by installing the CodeQL CLI, then create a database that reflects your project’s codebase, specifying the appropriate language and pointing to the source root. Once the database is ready, run your .ql query files against that database using the CLI and inspect the results locally, often exporting them as SARIF for easy viewing or further analysis. This workflow lets you iterate on your queries, verify findings, and refine them without waiting for GitHub Actions or any CI environment. It gives you immediate feedback on how your queries behave with your actual codebase, which is essential before pushing changes.

Testing CodeQL queries locally relies on the CodeQL CLI to build a database for your project and run your queries against it. Start by installing the CodeQL CLI, then create a database that reflects your project’s codebase, specifying the appropriate language and pointing to the source root. Once the database is ready, run your .ql query files against that database using the CLI and inspect the results locally, often exporting them as SARIF for easy viewing or further analysis. This workflow lets you iterate on your queries, verify findings, and refine them without waiting for GitHub Actions or any CI environment. It gives you immediate feedback on how your queries behave with your actual codebase, which is essential before pushing changes.