Do I understand correctly, that to create new database with codeql for cpp project, it is enough to provide a list of files and build flags?

For C++, it's actually a bit more than that: In the default configuration, CodeQL will look at linker invocations as well, which allows it to distinguish versions of the same function (or an identically-name-mangled function) compiled into different binaries.

Having said that, one can actually get a pretty long way with just the data from a compile_commands.json file. There are still caveats, mainly around generated code or code that's moved around by the build system: If you never run the build, then such code will obviously not exist, and therefore compilations will fail arbitrarily. Perhaps worse, there may be stale generated code that's picked up, and so you may analyze a tree that does not correspond to a real configuration.

If you're willing to take that risk, then indeed it would be possible to drive database creation from just a compile_commands.json file. We have some internal scripts that do it, but they touch non-public APIs. I've raised an issue for us to look at exposing them in a more friendly way, and will update this when there is news.

This feature can save a lot of time during database creation for cpp projects, because generation of this file is fast, as opposed to providing -c flag to codeql binary to actually build the project.

You're right, we'd save the time that a clean build would take. Note that database creation still won't be instantaneous, as we have to do everything the compiler would do during the build (to parse the code and create ASTs) and then some more (to output the database data).