Ada support: a community CodeQL extractor, and using it from code scanning

[peter-villadsen]

I maintain codeql-ada (https://github.com/peter-villadsen/codeql-ada, MIT), a CodeQL
extractor and QL library for Ada:

• Extractor built on AdaCore's Libadalang; build mode none, reads GNAT .gpr
  projects; Linux x86-64 tarball per release, plus a container image
  (ghcr.io/peter-villadsen/codeql-ada).
• Library pack peter-villadsen/ada-all and query pack peter-villadsen/ada-queries on
  GHCR. The library follows the Java library's design (AST, the shared
  ControlFlowGraph and SSA libraries, data flow with taint tracking).
• Tested with CodeQL CLI 2.25.6.

Ada is common in safety- and security-critical code, and there is no CodeQL support for
it today. Two requests:

1. github/codeql-action rejects languages: ada ("Unrecognized language"), so users
   have to run the CLI in shell steps and use only upload-sarif. Could the action
   accept a language provided by an extractor on the search path?
2. Would GitHub consider listing community-maintained extractors (with a clear
   "not supported by GitHub" note) on "Supported languages and frameworks", or
   somewhere linked from it?

I'd welcome feedback on the extractor and library, and I'm open to discussing what it
would take for Ada to become an officially supported language.

Peter Villadsen

[coadaflorin]

Hey @peter-villadsen! Thanks for reaching out with this work.
I work on the product team for CodeQL. We will have an internal discussion about the options related to your asks.

I will start with question 2:

Would GitHub consider listing community-maintained extractors (with a clear
"not supported by GitHub" note) on "Supported languages and frameworks", or
somewhere linked from it?

A list of third party extractors already exists at github.com/advanced-security/awesome-codeql. You can add a PR to that repo.
Regarding inclusion for 3rd party scanners/extractors in the official documentation, there are no plans for it right now.

For question 1:

github/codeql-action rejects languages: ada ("Unrecognized language"), so users
have to run the CLI in shell steps and use only upload-sarif. Could the action
accept a language provided by an extractor on the search path?

We'll need to look into this and better understand the implications of going down such a path.

I'd be happy to chat further on this topic if you have some time.

[peter-villadsen]

Florin, Thanks for the reply. This PR was created: Added peter-villadsen ada extractor by peter-villadsen * Pull Request #25 * advanced-security/awesome-codeql<advanced-security/awesome-codeql#25>. BR Peter From: Florin Coada ***@***.***> Sent: Friday, October 30, 2026 6:43 AM To: github/codeql ***@***.***> Cc: Peter Villadsen ***@***.***>; Mention ***@***.***> Subject: Re: [github/codeql] Ada support: a community CodeQL extractor, and using it from code scanning (Discussion #22885) Hey @peter-villadsen<https://github.com/peter-villadsen>! Thanks for reaching out with this work. I work on the product team for CodeQL. We will have an internal discussion about the options related to your asks. I will start with question 2: Would GitHub consider listing community-maintained extractors (with a clear "not supported by GitHub" note) on "Supported languages and frameworks", or somewhere linked from it? A list of third party extractors already exists<https://github.com/advanced-security/awesome-codeql#codeql-extractors> at github.com/advanced-security/awesome-codeql. You can add a PR to that repo. Regarding inclusion for 3rd party scanners/extractors in the official documentation, there are no plans for it right now. For question 1: github/codeql-action rejects languages: ada ("Unrecognized language"), so users have to run the CLI in shell steps and use only upload-sarif. Could the action accept a language provided by an extractor on the search path? We'll need to look into this and better understand the implications of going down such a path. I'd be happy to chat further on this topic if you have some time. - Reply to this email directly, view it on GitHub<#22885?email_source=notifications&email_token=AS3TOV4N5SP7W4L2GJCWCOL5WSLHNA5CNFSNUABIM5UWIORPF5TWS5BNNB2WEL2ENFZWG5LTONUW63SDN5WW2ZLOOQXTCOJSHE2DMNZSUZZGKYLTN5XKO3LFNZ2GS33OUVSXMZLOOSWGM33PORSXEX3DNRUWG2Y#discussioncomment-19294672>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AS3TOV3JELQ65XI2MWV2J6D5WSLHNAVCNFSNUABIKJSXA33TNF2G64TZHMYTIMZQGQYDIMRYHNCGS43DOVZXG2LPNY5TCMJRGI4DKOBTUF3AE>. You are receiving this because you were mentioned.Message ID: ***@***.******@***.***>>