codeql cli build tracing and compiled languages

[sam-cha-tfs]

I have a repo that uses a script with parameters to build the project. I can pass the script with codeql database create --command <build script and args> and create the database. After creating the database I am able to analyze. My question is do I need to use the build tracing option since a compiled language is used? This is not clear to me in the documentation.

https://docs.github.com/en/code-security/codeql-cli/getting-started-with-the-codeql-cli/preparing-your-code-for-codeql-analysis#using-indirect-build-tracing

[aeisenberg]

No. In your situation, if you can run codeql database create with no problem, then you do not need to do any tracing.

[sam-cha-tfs]

What if the several steps are in the build script? My understanding is that if I cannot create a database with my build script then I have to use build tracing.

[aeisenberg]

That's correct. If your build process spans several steps, then you must use tracing.

[sam-cha-tfs]

So if my build script has several steps then I must use build tracing even if I can create a database?

[aeisenberg]

Not necessarily. codeql only needs to trace the build artifacts. So, even if your build consists of several steps, but only one of them actually creates build artifacts (ie- runs the compiler), then you can run that command in database create and move all the other steps outside of codeql.

Also, if you are successfully building a database right now, there's no reason to make any changes.

[smowton]

To be clear, create -c "bash build.sh" where that shell script can contain many different compiler invocations is fine.