skills.rest
microsoft
microsoftOFFICIAL
Explore all skills by this author →
Website𝕏@OpenAtMicrosoftGitHub

gh-code-scanning

Retrieves and groups GitHub code scanning alerts by rule and severity using the gh CLI.

1.4k|284|Updated Nov 2, 2025
Search Tags:#static analysis#triage#gh CLI#gitHub#CodeQL#code scanning#security alerts
One-click install
npx skills add https://github.com/microsoft/hve-core --skill gh-code-scanning
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: gh-code-scanning
Source: https://github.com/microsoft/hve-core/tree/main/.github/skills/security/gh-code-scanning
Command: npx skills add https://github.com/microsoft/hve-core --skill gh-code-scanning

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires gh, jq, and includes scripts (resource) components.

What problem does it solve?

GitHub code scanning alerts from tools like CodeQL and Scorecard live in the GitHub Security tab, which is not accessible through the default MCP toolset, making it hard for AI agents and developers to triage a repository's security posture programmatically.

Core Features & Use Cases

  • Grouped Alert Retrieval: Fetches open code scanning alerts via the gh CLI and groups them by rule, sorted by occurrence count, with PowerShell and Bash script twins.
  • Structured JSON Output: Emits rule ID, tool, security severity, affected file paths, alert URL, and finding description per group for programmatic consumption.
  • Backlog Issue Creation: Provides a deduplication pattern using an embedded automation marker to create GitHub issues for each alert rule without duplicates.
  • Use Case: An agent triaging a repository runs the script with JSON output, identifies the highest-frequency CodeQL rules, and files one deduplicated security issue per rule for the team to remediate.

Quick Start

Ask the agent to list and group the open code scanning alerts for your repository as JSON, for example by running the Get-CodeScanningAlerts script with your owner and repo names.

Frequently Asked Questions about gh-code-scanning

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I list GitHub code scanning alerts from the command line?▼

Run the Get-CodeScanningAlerts.ps1 script with your owner and repo names, or use the Bash twin get-code-scanning-alerts.sh. Both call gh api against the code-scanning alerts endpoint and group open alerts by rule, sorted by occurrence count.

How do I get code scanning alerts as JSON for an AI agent?▼

Pass -OutputFormat Json to the PowerShell script, which returns a JSON array of group objects containing RuleId, Tool, SecuritySeverity, Count, AffectedPaths, AlertUrl, and FindingDescription. Always use JSON output for programmatic consumption.

What permissions does the gh CLI need for code scanning alerts?▼

The gh CLI must be authenticated with the security_events scope for private repositories, or public_repo for public-only repositories; the repo scope also satisfies security_events. Run gh auth login or set GH_TOKEN, and refresh with gh auth refresh -s security_events if you get HTTP 403 errors.

Why does the code scanning alert script return empty results?▼

Empty results usually mean the branch ref format is wrong or no alerts exist on that branch. The scripts use refs/heads/main format; omit the branch filter to search all branches or verify the branch name is correct.

Can I filter code scanning alerts by severity?▼

The Bash script supports a -s flag accepting critical, high, medium, or low, which appends a severity filter to the API query. The PowerShell script returns all severities grouped, with SecuritySeverity available per group for filtering after retrieval.

What are the limitations of using gh api for code scanning alerts?▼

The skill is read-only and depends on unpinned gh and jq binaries resolved from PATH, inheriting their patch posture. TLS validation is delegated to gh and the system trust store, and the skill handles no credentials directly.

Related Skills

Explore More Software Engineering Skills→
netdatanetdata
80.1k

graphql-audit

Triage GitHub Code Scanning alerts via REST and GraphQL.

Official
Intermediate
neogenzneogenz
4

product-owner

Automate Product Owner tasks for GitHub issues, user stories, milestones, and sprint planning.

Community
Intermediate
L3DigitalNetL3DigitalNet
6

security

Audit GitHub repository security via Dependabot, code scanning, and branch protection.

Official
Advanced
githubnextgithubnext
4.9k

github-mcp-server

Configures GitHub MCP server with Docker or hosted modes and selectable tool sets.

Official
Intermediate