Writing your own CodeQL queries

CodeQL comes with a lot of out-of-the-box queries – especially if you use the security-and-quality suite. But the full power of CodeQL comes if you start to write your own queries. Of course, this is not trivial. CodeQL is a complex query language, and if you look at some of the queries at https://github.com/github/codeql, you'll see that they can get quite complex. But if you know your coding language, it should be quite easy to create some simple queries.

To write CodeQL queries, you need Visual Studio Code (VS Code) and the GitHub CodeQL extension (https://marketplace.visualstudio.com/items?itemName=GitHub.vscode-codeql).

If you have both installed, clone the starter workspace:

$ git clone --recursive https://github.com/github/vscode-codeql-starter.git

Note the --recursive parameter! If you forget it, you have to load the submodules manually:

$ git submodule update --remote

In VSCode, select File | Open Workspace from...