CodeQL documentation

database init


codeql database init --source-root=<dir> [--language=<lang>[,<lang>...]] [--github-auth-stdin] [--github-url=<url>] <options>... -- <database>


[Plumbing] Create an empty CodeQL database.

Create a skeleton structure for a CodeQL database that doesn’t have a raw QL dataset yet, but is ready for running extractor steps. After this command completes, run one or more codeql database trace-command commands followed by codeql database finalize to prepare the database for querying.

(Part of what this does is resolve the location of the appropriate language pack and store it in the database metadata, such that it won’t need to be redone at each extraction command. It is not valid to switch extractors in the middle of an extraction operation anyway.)



[Mandatory] Path to the CodeQL database to create. This directory will be created, and must not already exist (but its parent must).

If the --db-cluster option is given, this will not be a database itself, but a directory that will contain databases for several languages built from the same source root.

It is important that this directory is not in a location that the build process will interfere with. For instance, the target directory of a Maven project would not be a suitable choice.

-s, --source-root=<dir>

[Mandatory] The root source code directory. In many cases, this will be the checkout root. Files within it are considered to be the primary source files for this database. In some output formats, files will be referred to by their relative path from this directory.


[Advanced] If the database already exists, delete it and proceed with this command instead of failing. This option should be used with caution as it may recursively delete the entire database directory.


[Advanced] Read a Code Scanning configuration file specifying options on how to create the CodeQL databases and what queries to run in later steps. For more details on the format of this configuration file, refer to To run queries from this file in a later step, invoke codeql database analyze without any other queries specified.


Instead of creating a single database, create a “cluster” of databases for different languages, each of which is a subdirectory of the directory given on the command line.

-l, --language=<lang>[,<lang>...]

The language that the new database will be used to analyze.

Use codeql resolve languages to get a list of the pluggable language extractors found on the search path.

When the --db-cluster option is given, this can appear multiple times, or the value can be a comma-separated list of languages.

If this option is omitted, and the source root being analysed is a checkout of a GitHub repository, the CodeQL CLI will make a call to the GitHub API to attempt to automatically determine what languages to analyse. Note that to be able to do this, a GitHub PAT token must be supplied either in the environment variable GITHUB_TOKEN or via standard input using the --github-auth-stdin option.


[Advanced] Count lines of code. By default, this is enabled unless the source root is the root of a filesystem. This flag can be used to either disable, or force the behavior to be enabled even in the root of the filesystem.


[Advanced] Proceed even if the specified source root does not exist.


[Advanced] Create some scripts that can be used to set up “indirect build tracing,” which allows integration into existing build workflows when an explicit build command is not available. For information about when and how to use this feature, please refer to our documentation at

Extractor selection options


A list of directories under which extractor packs may be found. The directories can either be the extractor packs themselves or directories that contain extractors as immediate subdirectories.

If the path contains multiple directory trees, their order defines precedence between them: if the target language is matched in more than one of the directory trees, the one given first wins.

The extractors bundled with the CodeQL toolchain itself will always be found, but if you need to use separately distributed extractors you need to give this option (or, better yet, set up --search-path in a per-user configuration file).

(Note: On Windows the path separator is ;).

Options to configure how to call the GitHub API to auto-detect languages.

-a, --github-auth-stdin

Accept a GitHub Apps token or personal access token via standard input.

This overrides the GITHUB_TOKEN environment variable.

-g, --github-url=<url>

URL of the GitHub instance to use. If omitted, the CLI will attempt to autodetect this from the checkout path and if this is not possible default to

Options to configure Windows tracing


[Windows only] When initializing tracing, inject the tracer into a parent process of the CodeQL CLI whose name matches this argument. If more than one parent process has this name, the one lowest in the process tree will be selected. This option overrides --trace-process-level, so if both are used passed only this option will be used.


[Windows only] When initializing tracing, inject the tracer this many parents above the current process, with 0 corresponding to the process that is invoking the CodeQL CLI. The CLI’s default behaviour if no arguments are passed is to inject into the parent of the calling process.

Options to configure indirect build tracing


[Advanced] Do not trace the specified command, instead rely on it to produce all necessary data directly.


[Advanced] The path to a tracer configuration file. It may be used to modify the behaviour of the build tracer. It may be used to pick out compiler processes that run as part of the build command, and trigger the execution of other tools. The extractors will provide default tracer configuration files that should work in most situations.

Common options

-h, --help

Show this help text.


[Advanced] Give option to the JVM running the command.

(Beware that options containing spaces will not be handled correctly.)

-v, --verbose

Incrementally increase the number of progress messages printed.

-q, --quiet

Incrementally decrease the number of progress messages printed.


[Advanced] Explicitly set the verbosity level to one of errors, warnings, progress, progress+, progress++, progress+++. Overrides -v and -q.


[Advanced] Write detailed logs to one or more files in the given directory, with generated names that include timestamps and the name of the running subcommand.

(To write a log file with a name you have full control over, instead give --log-to-stderr and redirect stderr as desired.)

  • © GitHub, Inc.
  • Terms
  • Privacy