How to use CodeQL Queries in LGTM?

[ArielSAdamsNASA]

Description of the issue

Is there a way to use certain CodeQL queries in LGTM besides downloading the queries and placing them in a .lgtm folder as custom queries? Can LGTM take in a SARIF file and upload its results?

For the security suite queries, Security and Quality and Security Extended, is there a way to easily obtain which queries are included in these suites? I would rather not manually going through each query to see if it satisfies security-extended-selectors.yml, security-and-quality-selectors.yml, and exclude-slow-queries.yml.

[aibaars]

You can use the codeql resolve queries command for that. For example the Java queries in the "security-extended" suite can be obtained by running codeql resolve queries java-security-extended .

LGTM runs the "lgtm-full" query suites. Running codeql resolve queries java-lgtm-full gives the list of Java queries run by LGTM. Note that by default LGTM only shows a subset of the queries it runs. The "java-lgtm" suite gives insight in the list of queries that are shown by default.

It's quite likely that a query you are interested in is actually being run but results are simply hidden. In this case you can add a queries: block to your lgtm.yml configuration and make the queries visible. Making all queries visible is done like this

queries:
  include: '*'

[ArielSAdamsNASA]

I was wanting to use the JPL queries provided by CodeQL in LGTM. These queries are not available in LGTM as far as I know. How would I be able to do so?

[intrigus-lgtm]

As far as I know, there is no other way to add custom queries to lgtm.com but adding them to the special lgtm folder as explained here.

[aibaars]

@ArielSAdamsNASA for LGTM.com the way to achieve this is to copy those queries in the lgtm/cpp-queries or .lgtm/cpp-queries folder in the repository you wish to analyse. See https://lgtm.com/help/lgtm/about-queries#how-do-i-add-custom-queries-to-LGTM

For LGTM enterprise the method above works as well, but in addition you could make a zip file of JPL_C and upload it as a system-wide custom query pack, either using the:

• Admin UI: https://help.semmle.com/lgtm-enterprise/admin/help/adding-queries.html
• Admin CLI: https://help.semmle.com/lgtm-enterprise/admin/help/command-line/upload-querypack.html

If you need assistance with LGTM enterprise, please file a support ticket using the same channels as for GitHub enterprise.

[ArielSAdamsNASA]

I tried using codeql resolve queries for cpp queries, but am having some issues. For example, I ran ./codeql resolve queries cpp-lgtm.qls and got

ERROR: QL Pack 'codeql/cpp-all' is a library and does not contain queries to run. Try using a query pack instead. (/cfs/codeql-home/codeql-repo/cpp/ql/lib:1,1-1)
A fatal error occurred: Error resolving queries.

I also tried ./codeql resolve queries cpp-security-extended.qls and received the same error.

I had no issues with the java queries.

[aibaars]

@ArielSAdamsNASA Your last comment seems unrelated to the original question. It's better to create a new issue. The error message you are seeing is probably due to using the development branch (main) of the codeql repository with an "older" CodeQL CLI. Compatible versions of this repository are the lgtm.com branch or the LGTM enterprise tags, for example LGTM 1.27

If this doesn't answer your question, please file a new issue with details on which versions of the CodeQL CLI and the codeql repository you are using.

[jketema]

Hi @ArielSAdamsNASA . Thanks for your interest in LGTM. I'm closing this issue, as LGTM has been shutdown. Please see the blog post on LGTM's deprecation for further details. More details on LGTM's replacement - Code Scanning - can be found in the GitHub Docs for this feature.