CodeQL Queries in LGTM #24711
-
I am wanting to place JPL queries from CodeQL to LGTM. What queries does LGTM have? Where do I find a list of these queries? Is there a way to use certain CodeQL queries in LGTM besides downloading the queries and placing them in a .lgtm folder as custom queries? Can LGTM take in a SARIF file and upload its results? |
Beta Was this translation helpful? Give feedback.
Replies: 4 comments
-
Hi ArielSAdamsNASA,
By default, LGTM will run all queries that satisfy the following criteria:
And the queries that satisfy the following criteria are being displayed:
A quick-and-dirty way of getting a list of the queries on LGTM is to search for queries with an
You can configure which queries should be run by using a custom lgtm.yml configuration file. You can download a comprehensive template lgtm.yml file from here that explains this. Specifically, you should look at the
Unfortunately, no. You can’t upload a SARIF file and display the results in LGTM. I hope these answers are helpful. If not, I’ll be happy to expand on any of them! |
Beta Was this translation helpful? Give feedback.
-
Would it be possible to create the lgtm/cpp-queries in .lgtm.yml like so instead of creating a permanent folder in github?
|
Beta Was this translation helpful? Give feedback.
-
I’m afraid that this is not possible. LGTM looks for these custom queries when polling the repository for new commits. This is mentioned in passing at LGTM
|
Beta Was this translation helpful? Give feedback.
-
I should add that this is possible using Code Scanning: Configuring code scanning - GitHub Docs. CodeQL is normally run using Actions, in which case it is easy to arrange the order of operations such that you put the queries in place before performing the analysis. Alternatively if you use another CI system it is typical to invoke the CodeQL CLI yourself and the same applies. |
Beta Was this translation helpful? Give feedback.
Hi ArielSAdamsNASA,
By default, LGTM will run all queries that satisfy the following criteria:
@problem.severity
isError
orWarning
, and the@precision
is at leastMedium
@problem.severity
isRecommendation
and the@precision
is at leastHigh
And the queries that satisfy the following criteria are being displayed:
@problem.severity
isError
orWarning
, and the@precision
is at leastHigh
@problem.severity
isRecommendation
and the@precision
is at leastVery high
A quick-and-dirty way of getting a list of the queries on LGTM is to search for queries with an
@id
that starts withcpp/
(to get a …