skills.rest
soham2008xyz
soham2008xyzCOMMUNITY
Explore all skills by this author →
Website𝕏@nonconformismGitHub

codeql

Configure CodeQL GitHub Actions workflows and run the CLI to generate and upload SARIF results.

Updated Jan 8, 2026
Search Tags:#static analysis#cli#github actions#monorepo#security scanning#codeql#sarif
One-click install
npx skills add https://github.com/soham2008xyz/trade-tycoon --skill codeql-soham2008xyz
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: codeql
Source: https://github.com/soham2008xyz/trade-tycoon/tree/main/.agents/skills/codeql
Command: npx skills add https://github.com/soham2008xyz/trade-tycoon --skill codeql-soham2008xyz

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

CodeQL configuration can be hard to set up correctly for a real repository, especially when choosing workflow triggers, build modes, language matrices, monorepo scope, and when using the CodeQL CLI to generate and upload SARIF results.

Core Features & Use Cases

  • GitHub Actions setup for CodeQL scanning: create or tune a codeql.yml workflow with correct triggers, permissions, language/build-mode matrix, query suites, and result categorization.
  • CLI-based CodeQL execution: run codeql database create, codeql database analyze, and codeql github upload-results to generate SARIF locally or in non-GitHub CI.
  • Monorepo and scope control: apply CodeQL configuration to limit analysis paths and separate SARIF results using category for cleaner security reporting.
  • Troubleshooting and alert handling: diagnose common failures (autobuild issues, missing source, build/extraction problems, SARIF upload limits) and manage alerts/severity expectations.

Quick Start

Use the codeql skill to generate CodeQL SARIF for your repository and upload it to GitHub code scanning.

Frequently Asked Questions about codeql

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I configure CodeQL scanning for a monorepo with multiple languages?▼

CodeQL scanning for a monorepo uses a language matrix and scoped path configuration to limit analysis paths. You can separate SARIF results by category to ensure cleaner security reporting across different parts of the repository.

Can I run CodeQL analysis locally using the CLI and upload SARIF results to GitHub?▼

Yes, you can run CodeQL CLI commands like database create, database analyze, and github upload-results to generate SARIF locally. This allows you to execute code scanning outside of GitHub Actions and upload results directly.

What is the best way to set up a CodeQL workflow in GitHub Actions?▼

Setting up a CodeQL workflow involves configuring a codeql.yml file with correct triggers, permissions, and a language and build-mode matrix. You need accurate CodeQL language identifiers and proper permissions for successful SARIF uploads.

Why does CodeQL autobuild fail during extraction and how do I fix it?▼

CodeQL autobuild failures during extraction often stem from missing source files or incorrect build modes. You can troubleshoot these issues by diagnosing build and extraction problems, or selecting a specific build mode in your workflow matrix.

Does CodeQL code scanning work with both compiled and interpreted codebases?▼

CodeQL code scanning supports both compiled and interpreted codebases by utilizing accurate CodeQL language identifiers. You must select the correct build mode for compiled languages while interpreted languages generally require less build configuration.

Related Skills

Explore More Software Engineering Skills→
iliasjennaneiliasjennane

codeql

Configure and run CodeQL code scanning with GitHub Actions and CodeQL CLI.

Community
Advanced
lidge-junlidge-jun
5

sarif-parsing

Parse, analyze, and aggregate SARIF files from security tools.

Community
Intermediate
vanstinatorvanstinator

golang-continuous-integration

Configure GitHub Actions CI/CD pipelines for Go repositories with testing, security scanning, and releases.

Community
Advanced
balic-AI-ML-R-D-Resourcesbalic-AI-ML-R-D-Resources

variant-analysis

Identify variants of known vulnerabilities across codebases using Semgrep, CodeQL, and ripgrep.

Official
Advanced