codeql

Static analysis scans your codebase for security vulnerabilities by building a CodeQL database, applying data extensions, and executing queries to surface risky patterns. It produces machine-readable SARIF outputs and logs artifacts to a defined directory.

Yes, CodeQL taint tracking supports polyglot repositories across Python, JavaScript/TypeScript, Go, Java/Kotlin, C/C++, C#, Ruby, and Swift, enabling interprocedural vulnerability detection across multiple language services.

Integrating CodeQL analysis into a build pipeline involves running the full analysis workflow, which supports run-all and important-only scan modes, processes SARIF output, and stores structured diagnostics and results in a defined output directory.

Yes, you can create and consume custom data extension models for project APIs to catch domain-specific risks during security analysis. The workflow creates these extensions and applies them alongside explicit query suites for targeted findings.

Interprocedural data flow analysis identifies risky code patterns by tracking how untrusted data moves across function boundaries and procedures. This taint tracking mechanism surfaces vulnerabilities that span multiple files and services within the codebase.

Important-only scan modes limit vulnerability detection to a targeted subset of findings using explicit suite references, whereas run-all modes execute the complete query suite. Both modes process SARIF outputs and log diagnostics to a structured workflow directory.