codeql

Run an end-to-end CodeQL security scan by building or reusing a CodeQL database, generating data extensions, and executing an explicit query suite with quality gates to prevent misleading zero findings. Quality guardrails verify extraction metrics like baseline LoC and extractor errors.

Filter SARIF security scan results by processing raw outputs through severity thresholds that target medium findings filtered by security-severity, preserving raw results while writing a filtered final SARIF file to a controlled output directory for precise vulnerability triage.

Fix CodeQL database extraction issues by assessing extraction quality through baseline LoC, file counts, and extractor errors, applying quality-first guardrails to detect and prevent false confidence from cached builds during end-to-end security analysis.

CodeQL security scanning works on macOS Apple Silicon by handling arm64e/arm64 build tracing issues with safer routing and last-resort fallbacks, ensuring reliable dataflow analysis and database extraction during end-to-end security audits.

Use data extensions to improve model coverage in CodeQL dataflow analysis by generating and validating extensions during the end-to-end pipeline, ensuring comprehensive security scanning and accurate vulnerability hunting across supported languages.

Use the important-only query suite for security-focused precision with severity thresholding, and run-all for maximum coverage during CodeQL security scanning, avoiding silent pack default-suite filtering by explicitly selecting the suite during end-to-end analysis.