CodeQL now supports Rust

[coadaflorin]

Hello Rustaceans and Security Enthusiasts! 👋

As you may have seen in the recent GitHub announcement, CodeQL support for Rust is now available in public preview!

What This Means

• Your Rust files will now be included in CodeQL security scans
• Enhanced security posture for projects using Rust

We Want Your Feedback!

As we're still in the public preview phase, your experiences and insights are invaluable:

1. Have you tried the Rust CodeQL support yet? If so, what was your experience?
2. What types of vulnerabilities are you most concerned about in your Rust code?
3. Any false positives or missed vulnerabilities you've noticed?

How to Get Started

If you haven't tried it yet, you can enable CodeQL scanning for your Rust repositories by setting up code scanning.

Let's work together to make Rust code even safer! Your feedback will help shape the future of CodeQL support for Rust as it moves toward general availability.

[Marcono1234]

Might be good to link to the changelog post also in these issues / discussions where users had asked for Rust support in the past:

• Add support for Rust github/codeql#12017
• Rust plugin available github/codeql#8485
• Rust Support via `tree-sitter`'s parser github/codeql#10489
• Instructions for trying out experimental Rust support github/codeql#17781

I can do that if you want, but maybe you (or the other CodeQL maintainers) prefer to do this, to proudly announce what they have been working on.

[coadaflorin]

Thanks for bringing those up, @Marcono1234! I posted some comments on those discussions.

[kristof-mattei]

A fatal error occurred: Rust does not support the manual build mode. Please try using one of the following build modes instead: none.

when using

      - name: Initialize CodeQL
        uses: github/codeql-action/init@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
        with:
          languages: rust
          build-mode: manual
          queries: security-extended,security-and-quality

Which contradicts https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages#codeql-build-modes

The CodeQL action supports three different build modes for compiled languages:

• none - the CodeQL database is created directly from the codebase without building the codebase (supported for all interpreted languages, and additionally supported for C/C++, C# and Java).
• autobuild - CodeQL detects the most likely build method and uses this to attempt to build the codebase and create a database for analysis (supported for all compiled languages).
• manual - you define the build steps to use for the codebase in the workflow (supported for all compiled languages).

Emphasis mine.

[coadaflorin]

Hi @kristof-mattei thanks for raising this! I will update the documentation for CodeQL as Rust does not actually support a manual build mode.

[wmmc88]

There's still another reference to rust in the manual section:

Then uncomment the run step and manually specify the build process to use. For C/C++, C#, Go, Java, Kotlin, Rust (public preview), and Swift, CodeQL will analyze whatever source code is built by your specified build steps.

https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages#about-specifying-build-steps-manually

[wmmc88]

It's also pretty unclear in that doc page that Rust is only supported with build-mode = none. The following implied that Rust would be supported with autobuild:

autobuild - CodeQL detects the most likely build method and uses this to attempt to build the codebase and create a database for analysis (supported for all compiled languages).

[AryanSinghh07]

Just wanted to share some quick thoughts and feedback after trying out the new CodeQL support for Rust that GitHub recently released in public preview.

A Few Things I Noticed

• I ran into a couple of false positives, especially in places where I used unsafe carefully with proper guards.
• Some of my async/await logic and macro-heavy code didn't seem to be fully understood by the scanner — possibly a limitation of how macros are handled right now.

Suggestions

• Add queries that flag risky patterns like unchecked unwraps, or dangerous default settings in common crates
• Improve macro expansion so tools can see through libraries like serde or tokio more clearly
• Highlight lifetime/ownership mistakes that could lead to logic bugs (if possible — I know that’s a tough one!)

[marcostolosa]

I’ve noticed the same thing on my side, especially when using unsafe blocks that are properly guarded. In some cases, the scanner still raises findings that feel more like noise than signal.

It’s encouraging to see Rust support moving forward, though, and I think with improvements around unsafe handling and macro expansion (as you mentioned, with things like tokio and serde ), the results will get much more precise.

[kristof-mattei]

I am having a warning on all of my repos, looking like this:

Low Rust analysis quality

Scanning Rust code completed successfully, but the scan encountered issues. This may be caused by problems identifying dependencies or use of generated source code, among other reasons -- see other CodeQL diagnostics reported on the CodeQL status page for more details of possible causes. Addressing these warnings is advisable to avoid false-positive or missing results.

Example codeql file in affected repo (stock, as Rust doesn't support manual mode): https://github.com/kristof-mattei/docker-dns-rs/blob/4d437f2b58198c36ae9927408bbd91936562768f/.github/workflows/codeql.yml

Link to affected run: https://github.com/kristof-mattei/rust-seed/actions/runs/16090269755/job/45406360742

I don't see anything in the logs that could be the origin of that warning.

[TimTinkers]

I am also encountering this annoyance regarding "Low Code Quality" from CodeQL on Rust and it's all due to the cfg macros for platform-specific code. While waiting for a solution, is there some way to suppress or configure CodeQL not attempt to scan certain files? Or just outright ignore them? Or otherwise prevent that banner from somehow showing up in this specific case? 😄

[TimTinkers]

It can work for Windows and macOS and Linux specific code, but not all at the same time. The easiest way to analyze windows specific things is to run CodeQL analysis on Windows.

This isn't possible with UI-based configuration without custom YAML workflows, right?

Yes reporting to Rust-analyzer is a good idea. Make sure to check it hasn't already been reported yet.

I couldn't find any similar issues, so I reported it in rust-lang/rust-analyzer#20309.

Mostly returning here to make this a CodeQL problem again given that it seems Rust Analyzer will not fix this.

[geoffw0]

Thanks for the updates, this is on our radar in CodeQL.

[gilescope]

Maybe I've been unlucky but on 3/3 rust repos I get this. Looking forward to an update.

[geoffw0]

It turned out the threshold for this warning was set rather high for a newly supported language. github/codeql#20312 addresses this and should silence the majority of warnings (excepting the worst cases). Work on improving the underlying analysis is ongoing...

[queenofcorgis]

@alireza-iranpour85:
We’ve clarified our stance on using generative AI tools like ChatGPT within our Community via this announcement. Please review the guidelines to ensure your post meets them as failure to adhere to those rules can result in action taken by our moderator team.  You can read our updated Code of Conduct and the announcement for more details. Thank you for helping us maintain an authentic and beneficial space for everyone.