Code scanning and Ruby: turning source code into a queryable database | The GitHub Blog

We recently added beta support for Ruby to the CodeQL engine that powers GitHub code scanning, as part of our efforts to make it easier for developers to build and ship secure code. Ruby support is particularly exciting for us, since GitHub itself is a Ruby on Rails app. Any improvements we or the community make to CodeQL’s vulnerability detection will help secure our own code, in addition to helping Ruby’s open source ecosystem.CodeQL’s static analysis works by running queries over a database representation of a program. The following diagram gives a high-level overview of the process:.