codeql

The codeql skill provides procedural guidance for setting up and configuring CodeQL code scanning, both through GitHub Actions workflows and the standalone CodeQL CLI. It helps users create or customize scanning configuration, interpret SARIF output, and troubleshoot analysis failures for security analysis.

For GitHub Actions, it walks through choosing default versus advanced setup, configuring triggers, least-privilege permissions, a per-language build matrix with appropriate build modes (none, autobuild, manual), the init and analyze steps, query suite selection (security-extended, security-and-quality, custom packs), dependency caching, and monorepo configuration via categories and config files. For the CLI, it covers installing the CodeQL bundle, creating single- or multi-language databases, analyzing with query suites to SARIF, and uploading results to GitHub. It also explains the two alert severity dimensions and Copilot Autofix.

It is most useful for developers and security engineers configuring code scanning across the supported languages (C/C++, C#, Go, Java/Kotlin, JavaScript/TypeScript, Python, Ruby, Rust, Swift, and GitHub Actions), whether in CI or locally.