使用 Homebrew Cask 安装 codeql

项目链接

• 主页

命令和别名

• codeql

项目历史

CodeQL originated at Semmle, whose semantic analysis technology was acquired by GitHub in 2019. GitHub subsequently made CodeQL central to GitHub Advanced Security and to code scanning workflows, with the CLI distributed from GitHub-controlled release repositories.

采用历史

Adoption moved from security research and Semmle users into GitHub's hosted code scanning product, GitHub Actions workflows, and enterprise security programs. The CLI remains important for users who need local analysis, custom queries, alternative CI systems, or prebuilt CodeQL databases.

使用方式

The CLI creates CodeQL databases, runs queries, analyzes code, produces SARIF results, manages CodeQL packs, and uploads results to GitHub code scanning. GitHub recommends the CodeQL bundle because it includes the CLI plus compatible queries and libraries.

为什么软件包爱好者会关心

Package nerds care because the Homebrew cask wraps a large, versioned security-analysis toolchain that is otherwise commonly installed from GitHub release bundles. Its formula/cask packaging makes CodeQL feel like a normal terminal tool despite its bundled queries, extractors, and platform-specific binaries.

时间线

• 2019: GitHub creates the codeql-cli-binaries repository for CLI binaries.
• 2019: GitHub acquires Semmle, bringing CodeQL into GitHub.
• 2020: CodeQL becomes a core part of GitHub code scanning and Advanced Security workflows.
• 2026: Homebrew cask distributes CodeQL CLI 2.25.6.

Related projects

• Related projects include github/codeql for queries and libraries, github/codeql-action for GitHub Actions integration, GitHub code scanning, SARIF tooling, and CodeQL for Visual Studio Code.

来源

• https://github.com/github/codeql-cli-binaries
• https://docs.github.com/en/code-security/codeql-cli
• https://docs.github.com/api/article/body?pathname=/en/code-security/how-tos/find-and-fix-code-vulnerabilities/scan-from-the-command-line/set-up-codeql-cli
• https://formulae.brew.sh/api/cask/codeql.json