skills.rest
iliasjennane
iliasjennaneCOMMUNITY
Explore all skills by this author →
GitHub

codeql

Configure and run CodeQL code scanning with GitHub Actions and CodeQL CLI.

Updated Apr 22, 2026
Search Tags:#security#static-analysis#github-actions#codeql#code-scanning#sarif
One-click install
npx skills add https://github.com/iliasjennane/LearningAgent --skill codeql-iliasjennane
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: codeql
Source: https://github.com/iliasjennane/LearningAgent/tree/main/.agents/skills/codeql
Command: npx skills add https://github.com/iliasjennane/LearningAgent --skill codeql-iliasjennane

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Configure and run CodeQL code scanning across GitHub Actions workflows and the CodeQL CLI to identify security vulnerabilities and quality issues in codebases.

Core Features & Use Cases

  • Procedural guidance for configuring and running CodeQL code scanning via GitHub Actions workflows (codeql.yml) and the standalone CodeQL CLI.
  • Guidance on selecting CodeQL language matrices, build modes, and query suites; interpreting SARIF output; and troubleshooting common failures.
  • Support for monorepos, per-component scanning, dependency caching, and integration with CodeQL packs and model packs.

Quick Start

Create or update a GitHub Actions workflow for CodeQL and run the CodeQL CLI to generate SARIF results.

Frequently Asked Questions about codeql

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I configure CodeQL code scanning in a GitHub Actions workflow?▼

Configure CodeQL code scanning by creating or updating a codeql.yml workflow file that defines your language matrix, build modes, and query suites. Select between default and advanced setups to start identifying security vulnerabilities in your codebase.

Can I run CodeQL CLI commands locally and interpret the SARIF output?▼

Run CodeQL CLI commands locally to generate SARIF output files containing security analysis results. Interpret these SARIF files to identify vulnerabilities and code quality issues across your codebase without relying solely on GitHub Actions.

Does CodeQL code scanning support monorepos and per-component scanning?▼

CodeQL code scanning supports monorepos and per-component scanning, allowing targeted security analysis of specific codebase sections. Configure dependency caching and integrate CodeQL packs or model packs to optimize scanning workflows across large repositories.

What is the best way to troubleshoot common CodeQL workflow failures?▼

Troubleshoot common CodeQL workflow failures by reviewing procedural references for GitHub Actions and CodeQL CLI configurations. Address issues related to language matrices, build modes, dependency caching, and SARIF output generation to resolve scanning errors.

How do I select CodeQL language matrices and query suites for my project?▼

Select CodeQL language matrices and query suites by customizing your codeql.yml workflow file to match your project's programming languages and security requirements. Choose between default and advanced setups to optimize code scanning coverage and performance.

Related Skills

Explore More Software Engineering Skills→
safzanpiranisafzanpirani
1

install-qa

Automate Pi skill setup for functional QA with GitHub Actions workflow creation.

Community
Advanced
sbknanasbknana
10

sarif-parsing

Parse SARIF files to deduplicate findings and generate structured reports.

Community
Advanced
reggiechan74reggiechan74
5

ci-cd

Integrate Claude Code with GitHub Actions and GitLab CI/CD pipelines.

Community
Advanced
ofelixdevofelixdev

codeql

Automate CodeQL static analysis to identify security vulnerabilities across programming languages.

Community
Advanced