This introduces a lot of duplicate codeql code that can be avoided using imports and query predicates.

I think each query could look something like this:

import semmle.javascript.security.dataflow.CodeInjectionQuery
import CountThings

Where CountThings.qll looks something like:

import javascript
import evaluation.EndToEndEvaluation

query predicate countThings(int numAlerts, int numSinks) { 
  numAlerts =
    count(DataFlow::Node source, DataFlow::Node sink |
      cfg.hasFlow(source, sink) and not isFlowExcluded(source, sink)
    ) and
  numSinks = count(DataFlow::Node sink |
    exists(DataFlow::Configuration cfg | cfg.isSink(sink) or cfg.isSink(sink, _))
  )

Could you consider if such a refactoring is possible / worth it?

Yes, good point @esbena and I definitely think it's worth it.

Basic QL question: what would the individual queries look like? I.e. how would they actually use the CountThings import? I've checked the documentation and it's not clear how to import and use a predicate

The trick is that query predicate contributes to the results of the query file when imported. You can view it as an importable from/where/select

Ah, there was a critical typo: I have updated the example file name to end with qll now!

I've just attempted the suggestion refactor @esbena - would you mind giving it another look when you have time?

@github/codeql-ml-powered-queries-reviewers if anyone has a spare moment, could someone provide a quick review?

Thanks for the review @esbena - I've now removed the as in the imports.

I accidentally dismissed your approval, would you mind approving again sorry?