CodeQL database

codeql database create <db> --language=<lang>

Creates the CodeQL database of the repository, the previous step to semantic analysis of code vulnerabilities.

Run it in the CI/CD pipeline (or locally) when you want CodeQL semantic analysis: codeql database create builds the code database (the model of data flows and calls) and the subsequent analysis (codeql database analyze) runs the security queries — vulnerabilities by data flow (injection, XSS, path traversal) that syntactic analysis doesn't see. It's GitHub's semantic SAST: detection of vulnerabilities by data flow (from input to sink). In DevSecOps, CodeQL is the deep pipeline analysis (with GitHub Actions code scanning): the database created in CI and queries run on each push.

Don't use it for quick analysis: database creation (the code build) is slow — semgrep/bandit give the quick filter and CodeQL the deep one. Database creation requires the build (for compiled languages) or buildless analysis (for interpreted ones): build configuration in CI is part of the flow. And note: CodeQL detects vulnerabilities from the queries — domain-specific ones require custom queries (QL). Licensing: CodeQL is free for open source code and has GitHub restrictions for private code — check it. Semantic analysis complements syntactic, not replaces it.