GitHub CodeQL vs Updatecli
GitHub CodeQL
codeql.github.com
Updatecli
updatecli.ioSide by side
| Figure | GitHub CodeQL | Updatecli |
|---|---|---|
| Price from | $30/mo | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | — |
| Web | Yes | — |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 5 | 1 |
| Spec score · Dependency Management Software | 8.6 (#4) | 7.7 (#17) |
| Purpose | CodeQL is a language and toolchain for code analysis that treats code as data. | Updatecli uses YAML manifests to fetch values, check conditions, update files, and open pull or merge requests. |
Plans
GitHub CodeQL
- Free for research and open sourceFree
- GitHub Code Security$30 a month
- CodeQL for open source and researchFree
- GitHub Code Security$30 a month
- GitHub Free with CodeQL code scanningPrice not published
In their own words
GitHub CodeQL
GitHub CodeQL has no write-up on Specifiction yet; its figures are above.
Updatecli
Updatecli uses YAML manifests to retrieve values, check conditions, update files, and create pull or merge requests. Pipelines run source, condition, and target stages in that order; a target is skipped when its condition is not met. The tool runs as a single statically linked binary without a runtime dependency, server, or database, and releases are available for Linux, macOS, and Windows as well as in container images. Autodiscovery can scan repositories and create manifests for ecosystems including Dockerfiles, Helm, Terraform, npm, and Go. Plugins cover sources, conditions, targets, source-control systems, and actions, with integrations for GitHub, GitLab, Gitea, Azure DevOps, Bitbucket, Jenkins, Docker, Maven, and HTTP APIs. The GitHub SCM plugin can clone a repository and push changes to a working branch; opening a pull request requires a separate action. Manifests can be packaged as OCI artifacts for reuse. Updatecli is free and Apache-2.0 licensed. Udash reporting is experimental, requires the `--experimental` flag, and may change without the usual deprecation cycle.