CodeQL Database Builder (Multi-Language)

Build and analyze CodeQL databases across multiple languages in a single workflow.

When to Use

• Full security audit of the entire application

• Pre-release security scanning

• CI/CD integration for comprehensive analysis

• Cross-component vulnerability assessment

When NOT to Use

• You only need a quick lint or format run without deep security analysis.

• The codebase is tiny and can be manually audited.

• You are updating documentation unrelated to security.

Prerequisites

• CodeQL CLI installed (brew install codeql or download from GitHub)

• Go 1.24+ installed

• Python 3.10+ installed

• Node.js 18+ installed

• Dependencies installed for each codebase

Quick Start - Build All Databases

1. Setup

DB_NAME=$(basename "$PWD") GO_SRC_ROOT="${GO_SRC_ROOT:-.}" PYTHON_SRC_ROOT="${PYTHON_SRC_ROOT:-.}" JS_SRC_ROOT="${JS_SRC_ROOT:-.}" mkdir -p codeql/packs

2. Build All Databases

Go database:

codeql database create "codeql/${DB_NAME}-go"
--language=go
--source-root="$GO_SRC_ROOT"
--command="go build ./..."
--threads=0
--overwrite

Python database:

codeql database create "codeql/${DB_NAME}-python"
--language=python
--source-root="$PYTHON_SRC_ROOT"
--threads=0
--overwrite

JavaScript/TypeScript database:

codeql database create "codeql/${DB_NAME}-javascript"
--language=javascript
--source-root="$JS_SRC_ROOT"
--threads=0
--overwrite

3. Download All Query Packs

codeql pack download --dir codeql/packs codeql/go-queries codeql pack download --dir codeql/packs codeql/python-queries codeql pack download --dir codeql/packs codeql/javascript-queries

4. Verify All Databases

for lang in go python javascript; do echo "=== ${DB_NAME}-${lang} ===" grep finalised codeql/${DB_NAME}-${lang}/codeql-database.yml done

One-Liner Scripts

Run:

./scripts/codeql-build-all.sh ./scripts/codeql-analyze-all.sh

Run Full Security Analysis

All Components - Code Scanning Suite

DB_NAME=$(basename "$PWD")

codeql database analyze codeql/${DB_NAME}-go
codeql/packs/codeql/go-queries/*/codeql-suites/go-code-scanning.qls
--format=sarif-latest
--output=codeql/${DB_NAME}-go-code-scanning.sarif

codeql database analyze codeql/${DB_NAME}-python
codeql/packs/codeql/python-queries/*/codeql-suites/python-code-scanning.qls
--format=sarif-latest
--output=codeql/${DB_NAME}-python-code-scanning.sarif

codeql database analyze codeql/${DB_NAME}-javascript
codeql/packs/codeql/javascript-queries/*/codeql-suites/javascript-code-scanning.qls
--format=sarif-latest
--output=codeql/${DB_NAME}-javascript-code-scanning.sarif

All Components - Security and Quality Suite

DB_NAME=$(basename "$PWD")

for lang in go python javascript; do codeql database analyze codeql/${DB_NAME}-${lang}
codeql/packs/codeql/${lang}-queries/*/codeql-suites/${lang}-security-and-quality.qls
--format=sarif-latest
--output=codeql/${DB_NAME}-${lang}-security.sarif done

Buildless Fallback (Go)

codeql database create "codeql/${DB_NAME}-go"
--language=go
--source-root="$GO_SRC_ROOT"
--build-mode=none
--threads=0
--overwrite

VS Code Multi-Database Setup

.vscode/settings.json :

{ "codeQL.runningQueries.additionalPacks": [ "${workspaceFolder}/codeql/packs" ] }

Switch between databases using CodeQL: Choose Database from Folder .

Merge SARIF Results

pip install sarif-tools

sarif merge
codeql/${DB_NAME}-go-results.sarif
codeql/${DB_NAME}-python-results.sarif
codeql/${DB_NAME}-javascript-results.sarif
--output codeql/${DB_NAME}-all-results.sarif

Troubleshooting

Check All Databases

for lang in go python javascript; do echo "=== ${lang} ===" codeql database info codeql/${DB_NAME}-${lang} 2>/dev/null || echo "Not found" done

Clean All

rm -rf codeql/${DB_NAME}-*

View Logs

for lang in go python javascript; do echo "=== ${lang} logs ===" tail -20 codeql/${DB_NAME}-${lang}/log/*.log 2>/dev/null || echo "No logs" done

Output Summary

echo "=== CodeQL Analysis Summary ===" echo "" for lang in go python javascript; do sarif="codeql/${DB_NAME}-${lang}-results.sarif" if [ -f "$sarif" ]; then total=$(jq '.runs[0].results | length' "$sarif") high=$(jq '[.runs[0].results[] | select(.level == "error")] | length' "$sarif") echo "${lang}: ${total} total, ${high} high severity" fi done