CodeQL Wrapper

A universal Python CLI wrapper for running CodeQL analysis seamlessly across any project architecture and CI/CD platform.

CodeQL Wrapper simplifies security analysis by providing a unified interface for CodeQL across monorepos, single repositories, and diverse CI/CD environments including Jenkins, GitHub Actions, Harness, Azure DevOps, and more.

Features

Universal Support
Works with both monorepos and single repositories

CI/CD Agnostic
Seamless integration across all major CI/CD platforms

Smart Language Detection
Automatically detects and analyzes multiple programming languages

SARIF Integration
Built-in support for SARIF upload to GitHub Advanced Security

Performance Optimized
Parallel processing and intelligent resource management

Auto-Installation
Automatically downloads and manages CodeQL CLI

Flexible Configuration
JSON-based configuration for complex project structures

Prerequisites

Requirement	Version/Details
Python	3.9 or higher
Git	For repository analysis
GitHub Token	Required for SARIF upload functionality

Quick Start

Installation

Install CodeQL Wrapper from PyPI:

pip install codeql-wrapper

Basic Usage

Single Repository Analysis

Analyze a single repository with automatic language detection:

codeql-wrapper analyze /path/to/repository

Monorepo Analysis

Analyze all projects in a monorepo "using build-mode none" and upload results to GitHub Advanced Security:

codeql-wrapper analyze /path/to/monorepo --monorepo --upload-sarif

Targeted Analysis

Analyze only projects with changes (perfect for CI/CD):

codeql-wrapper analyze /path/to/repo --monorepo --only-changed-files --upload-sarif

Note: Ensure your GITHUB_TOKEN environment variable is set for SARIF upload functionality.

Advanced Configuration

For complex monorepo setups, create a .codeql.json configuration file in your repository root:

Click to view example configuration

{
  "projects": [
    {
      "path": "./monorepo/project-java-1",
      "build-mode": "manual",
      "build-script": "./build/project-java-1.sh",
      "queries": ["java-security-extended"],
      "language": "java"
    },
    {
      "path": "./monorepo/project-java-1", 
      "language": "javascript"
    },
    {
      "path": "./monorepo/project-python-1",
      "build-mode": "none"
    },
    {
      "path": "./monorepo/project-python-javascript-cpp",
      "build-mode": "none",
      "language": "javascript"
    }
  ]
}

Configuration Options

Option	Description	Values
`path`	Relative path to the project	Any valid path
`build-mode`	How to build the project (default=none)	`none`, `manual`, `autobuild`
`build-script`	Custom build script path	Path to executable script
`queries`	CodeQL query suites to run	Array of query suite names
`language`	Target language (default=auto-detect)	Any supported language

CI/CD Integration

Platform	Status
GitHub Actions	✅ Supported
Harness	✅ Supported
Circle CI	✅ Supported
Azure Pipelines	✅ Supported
Jenkins	✅ Supported

Examples and implementation guides available at:
https://github.com/ModusCreate-fernandomatsuo-GHAS/poc-codeql-wrapper

Documentation

Complete documentation is available at:
https://moduscreate-perdigao-ghas-playground.github.io/codeql-wrapper

Contributing

We welcome contributions! Please see the contributing guidelines for more information.

License

This project is licensed under the MIT License - see the LICENSE file for details.

Made with ❤️ by the Modus Create team

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

codeql_wrapper-0.1.13.tar.gz (36.0 kB view details)

Uploaded Jul 28, 2025 Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

The dropdown lists show the available interpreters, ABIs, and platforms. Enable javascript to be able to filter the list of wheel files.

codeql_wrapper-0.1.13-py3-none-any.whl (43.2 kB view details)

Uploaded Jul 28, 2025 Python 3

File details

Details for the file codeql_wrapper-0.1.13.tar.gz.

File metadata

Download URL: codeql_wrapper-0.1.13.tar.gz
Upload date: Jul 28, 2025
Size: 36.0 kB
Tags: Source
Uploaded using Trusted Publishing? Yes
Uploaded via: twine/6.1.0 CPython/3.12.9

File hashes

Hashes for codeql_wrapper-0.1.13.tar.gz
Algorithm	Hash digest
SHA256	`c3b50d4186a761d1f0ca5902d3de02d6fb980f82fe0549885e2e30de3fea107c`
MD5	`e39b7d820d0e5d329240095563be6764`
BLAKE2b-256	`fbe65e2b94214217d8632f27d5a5af3d8479c1e99a1fe87dfd41ff3719a3d248`

See more details on using hashes here.

Provenance

The following attestation bundles were made for codeql_wrapper-0.1.13.tar.gz:

Publisher: release-publish.yml on ModusCreate-Perdigao-GHAS-Playground/codeql-wrapper

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Statement:
- Statement type: https://in-toto.io/Statement/v1
- Predicate type: https://docs.pypi.org/attestations/publish/v1
- Subject name: codeql_wrapper-0.1.13.tar.gz
- Subject digest: c3b50d4186a761d1f0ca5902d3de02d6fb980f82fe0549885e2e30de3fea107c
- Sigstore transparency entry: 322115453
- Sigstore integration time: Jul 28, 2025
Source repository:
- Permalink: ModusCreate-Perdigao-GHAS-Playground/codeql-wrapper@bb6571e6213584c04b504922ebb69dc0eb570976
- Branch / Tag: refs/heads/main
- Owner: https://github.com/ModusCreate-Perdigao-GHAS-Playground
- Access: private
Publication detail:
- Token Issuer: https://token.actions.githubusercontent.com
- Runner Environment: github-hosted
- Publication workflow: release-publish.yml@bb6571e6213584c04b504922ebb69dc0eb570976
- Trigger Event: push