How to set up/scan C & C++ project via command line?

[davewichers]

I started with the following:

• codeql database create path/to/DBNAME --language=cpp --command="MYBUILDCOMMAND"
• codeql database analyze path/to/DBNAME codeql/cpp-queries --format=sarifv2.1.0 --output=FILENAME.sarif

And when the analyze completes, it says: "CodeQL scanned 2 out of 1562 C/C++ files in this invocation. Typically CodeQL is configured to analyze a single CodeQL language per invocation, so check other invocations to determine overall coverage information."

I looked at the documentation, and apparently you can set the language to multiple languages, e.g., --language=cpp,c

But when I do that, it returned an error during database create that I had to also specify --db-cluster. So, I added that, so now my first command is:

• codeql database create path/to/DBNAME --language=cpp,c --db-cluster --command="MYBUILDCOMMAND"

But then, when I run the database analyze step, I now get this error:

"A fatal error has occurred: path\to\DBNAME is not a recognized CodeQL database."

How do I fix that?

[jketema]

c and cpp are just aliases, so there's no reason to specify both of them, and your initial

codeql database create path/to/DBNAME --language=cpp --command="MYBUILDCOMMAND"

was correct.

If only 2 files were scanned, then we detected only 2 C/C++ compiler invocations during database creation. The most common reason for this is that build artifacts were not cleaned before creating the database, and subsequently build steps were skipped. Another common reason is the use of caching, e.g., with ccache, which is not supported. It is hard to tell though what is going on without further details.

[davewichers]

That didn't help. I deleted all the .obj files in the directory where the compile command is run, and I can see the compilation of every file happening. For each source file I'm seeing: [DATE/TIME] [build-stdout] FILENAME.c

The parameters to the cl invocation are: cl /I "path\to\supportclasses" /W3 /MT /GS /RTC1 /bigobj /EHsc /nologo /MP /c main.cpp STANDARD_PREFIX*.c STANDARD_PREFIX*.cpp (Note: /I is slash capital I, not L)

An .obj file is created for each source file during this process.

I'm using 'cl' as the compiler if that makes any difference. A single invocation of cl with wildcards for all the files to compile is used. i.e., STANDARD_PREFIX*.c STANDARD_PREFIX*.cpp along with paths to the supporting classes in other paths.