skills.rest
tamago0224
tamago0224COMMUNITY
Explore all skills by this author →
GitHub

codeql

Generate CodeQL GitHub Actions workflows and CLI commands for security scanning.

Updated Mar 8, 2026
Search Tags:#security#cli#github actions#codeql#sarif#code scanning
One-click install
npx skills add https://github.com/tamago0224/kuroshio-mta --skill codeql-tamago0224
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: codeql
Source: https://github.com/tamago0224/kuroshio-mta/tree/main/.agents/skills/codeql
Command: npx skills add https://github.com/tamago0224/kuroshio-mta --skill codeql-tamago0224

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Many developers struggle to set up CodeQL code scanning, create correct GitHub Actions workflows, select appropriate build modes, and interpret SARF​I results, which can lead to missed vulnerabilities and insecure code.

Core Features & Use Cases

  • Workflow Generation: Step‑by‑step instructions to create or modify codeql.yml for GitHub Actions, covering triggers, permissions, and language matrix builds.
  • CLI Guidance: Detailed commands for installing the CodeQL bundle, creating databases, analyzing code, and uploading SARIF results.
  • Troubleshooting & Optimization: References for build‑mode selection, dependency caching, SARIF limits, and common error resolutions.

Quick Start

Ask the skill to generate a complete CodeQL GitHub Actions workflow for scanning a Go project with default settings.

Frequently Asked Questions about codeql

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I set up CodeQL code scanning with GitHub Actions?▼

To set up CodeQL code scanning with GitHub Actions, you need to create a codeql.yml workflow file defining triggers, permissions, and language matrix builds. This skill provides step-by-step workflow generation templates for automated source code analysis.

How do I run CodeQL analysis from the CLI and upload SARIF results?▼

Running CodeQL analysis from the CLI involves installing the CodeQL bundle, creating databases, analyzing code, and uploading SARIF results. This skill provides detailed CLI commands and installation steps for completing the process.

Can I use CodeQL to scan source code across multiple programming languages?▼

Yes, you can scan source code across multiple languages using CodeQL. This skill supports configuring language matrix builds in GitHub Actions workflows and CLI commands for comprehensive code analysis.

Why does my CodeQL build fail and how do I select the correct build mode?▼

CodeQL build failures often stem from incorrect build-mode selection or missing dependencies. This skill provides troubleshooting references for build-mode configuration, dependency caching, and resolving common errors.

Do I need external security tools to configure CodeQL scanning?▼

No, you do not need external security tools to configure CodeQL scanning. This skill provides workflow templates, CLI installation steps, and troubleshooting guidance without requiring external dependencies.

Related Skills

Explore More Software Engineering Skills→
managedcodemanagedcode
466

dotnet-codeql

Integrate CodeQL security analysis into .NET repositories via CLI or GitHub Actions.

Official
Advanced
igbuendigbuend
8

sarif-issue-reporter

Analyze SARIF 2.1.0 files to generate vulnerability reports with CVSS scoring.

Community
Advanced
Cogni-AI-OUCogni-AI-OU
3

codeql

Configure CodeQL workflows and CLI runs to generate and upload SARIF findings.

Official
Intermediate
macaughmacaugh
5

Static Vulnerability Analysis

Detects injection, memory safety and authorization flaws in multiple languages.

Community
Advanced