You can use the Jenkins CodeQL queries as part of the regular CodeQL code scanning workflow. This is the more flexible approach in terms of your ability to configure the build, and additionally only requires one workflow to be set up to use the generic code scanning rules provided by GitHub in addition to the Jenkins-specific rules. Please note the findings will be reported part of the "CodeQL" code scanning tool on the GitHub UI.

Additionally, code-level suppressions documented as part of finding descriptions do not work by default. See advanced-security/dismiss-alerts for a GitHub-provided way to support code-level suppression. The instructions below do not add suppression support, see advanced-security/dismiss-alerts for the necessary configuration changes.

See the Jenkins Security Scan documentation on jenkins.io.

1. Install the CodeQL CLI.

2. Run codeql pack install test/ to install the dependencies.

The file run-tests.sh in this repository is a self-contained script that installs CodeQL, pack dependencies, and then runs the tests. Since it downloads and extracts CodeQL CLI binaries, its use is not recommended for local development.

To update to a newer CodeQL release:

1. Determine which release to update to. See the list of CodeQL releases and the corresponding releases of java-all.

2. Edit all qlpack.yml files in this repository and increase the version of codeql/java-all to the corresponding version in github/codeql (java/ql/src/qlpack.yml at the tagged top-level version in tags).

3. Run codeql pack upgrade <dir> on each of the directories containing a qlpack.yml file.

4. Edit run-tests.sh to download the correct CodeQL release and run it to confirm everything works as expected.

To release this as QL packs here:

1. Update the versions from x.y.z-dev to x.y.z in qlpack.yml files and git commit this (example).

2. Define the environment variable GITHUB_TOKEN or prepare to pass the argument --github-auth-stdin to the next command. Either way, you need a token with write:packages permission.

3. Run codeql pack publish --groups=-test to upload everything but the tests as packs.

4. Update the versions from x.y.z to x.y.(z+1)-dev in qlpack.yml files and git commit this (example).