CodeQL

CodeQL is GitHub's semantic code-analysis system. This package installs the CodeQL command-line interface, which creates analysis databases from code, resolves and runs queries and produces results for review or code-scanning workflows. It is aimed at security researchers, developers and teams integrating static analysis into development or CI.

Analysis workflow

Build a CodeQL database for a supported language, select compatible query packs or query suites and analyze the resulting database. Queries can describe data flow and relationships in code rather than only matching source text. Results can be exported in formats such as SARIF for compatible viewers or GitHub code scanning. The separate CodeQL extension for VS Code provides an interactive query-development interface; it is not the graphical application installed by this cask.

Coverage depends on the language, extraction configuration, build mode and query selection. A successful command is not proof that every source file was extracted or every vulnerability detected. Review warnings and database coverage, and investigate findings before treating them as confirmed defects.

Installation and prerequisites

Use the official codeql-osx64.zip archive or brew install --cask codeql. The Homebrew cask exposes the codeql executable from the extracted distribution. Despite its osx64 filename, the official release text explicitly includes Apple Silicon in macOS support. The checked sources do not establish a precise numeric minimum macOS release or independently verify the archive's complete binary architectures, so no additional numeric requirement or Universal claim is invented.

The CLI includes a Java runtime; version 2.27.1 updates the bundled Eclipse Temurin OpenJDK to 25.0.4.1. An alternative JDK can be selected with CODEQL_JAVA_HOME when required. Language compilers, build tools, project dependencies and compatible CodeQL language/query packs are separate workflow prerequisites, depending on what you analyze. The cask itself declares no separate formula dependency or named conflict. The CLI-only platform ZIP should not be confused with a CodeQL bundle containing compatible query resources.

Normal analysis needs filesystem access to source, build outputs and analysis databases. The checked documentation does not establish a blanket Accessibility or Full Disk Access requirement. Database creation for compiled languages may run a project's build; use source and build scripts you trust and allocate enough CPU, memory and disk space for the repository.

License, accounts and network

The CodeQL CLI is governed by GitHub CodeQL Terms and Conditions, distinct from the MIT-licensed query source repository. Downloading a binary does not grant unrestricted commercial use for every private codebase. GitHub documents access for public repositories and eligible private repositories with the appropriate GitHub Code Security licensing. Review the current terms for your intended codebase and deployment.

Local database analysis and query execution are separate from authenticated GitHub integration. Downloading packs, accessing private registries and uploading SARIF results can require network access and credentials. Do not describe every workflow as requiring an account, or every workflow as entirely offline. Protect tokens and check organization permissions before enabling uploads.

Data and practical risks

Analysis databases and exported findings can contain source-derived information, paths and security-sensitive details. Store them according to your repository's confidentiality requirements and review destinations before uploading. Queries, pack dependencies and build scripts can influence what is executed; verify their provenance. Static analysis complements testing and review and does not guarantee that a codebase is secure.

The official v2.27.2 release lists codeql-osx64.zip as 981,956,830 bytes. This is the Mac CLI archive, not the generic multi-platform ZIP or an installed database size. Version 2.27.0 deprecates the generic combined distribution in favor of per-platform downloads.

Sources: Official product, CLI concepts and licensing, Official binary releases, CLI terms.