Description
codeql is an agent skill from the github/awesome-copilot collection, a procedural guide for setting up and running CodeQL code scanning, both through GitHub Actions workflows and with the standalone CodeQL CLI. CodeQL finds security vulnerabilities by querying code as data. The skill covers creating or customizing a codeql.yml workflow, choosing between the default setup and the advanced setup for code scanning, and configuring the language matrix, the build modes and the query suites. It explains running the CLI locally, creating a database, analyzing it and uploading results, and it helps interpret SARIF output, the standard format CodeQL results come in. It also covers troubleshooting analysis failures, especially build modes and compiled languages, along with runner requirements, setting up CodeQL for monorepos with per-component scanning, and configuring dependency caching, custom query packs and model packs. The skill is useful for teams who want code scanning in their pipeline and need the right configuration for their languages. Compiled languages often need a working build during analysis, so the build step must be set up correctly. Scanning results should be triaged by people who understand the code, since some findings are false positives. The skill is installed with the skills CLI from the github/awesome-copilot repository. Its skills.sh page showed about 2.0K installs and passing results from three security audits at the time of the scan.…
Highlights
- codeql.yml GitHub Actions workflows
- Default and advanced setup choice
- Language matrix, build modes and query suites
- CodeQL CLI database and analysis steps
- SARIF output and troubleshooting
- Installs with the skills CLI
Ratings & Reviews
No ratings yet
Be the first to rate codeql.
People also visit
codeql FAQ
What is CodeQL?
A code analysis engine that queries code as data to find security vulnerabilities.
Can it run without GitHub Actions?
Yes. The skill also covers running the standalone CodeQL CLI locally.
What are the setup choices?
Default setup or advanced setup, with a configurable language matrix, build modes and query suites.
Does it cover monorepos?
Yes, including per-component scanning.
How do I install it?
Run npx skills add https://github.com/github/awesome-copilot --skill codeql.
What security audits does it have?
skills.sh lists three audits: Gen Agent Trust Hub Pass, Socket Pass and Snyk Pass.
What are the best codeql alternatives?
Popular alternatives to codeql include github-actions-hardening, attack-tree-construction and mtls-configuration. See all codeql alternatives