skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

implementing-github-advanced-security-for-code-scanning

Configure GitHub Advanced Security with CodeQL for automated static analysis across repositories.

954|172|Updated Mar 13, 2026
Search Tags:#devsecops#SAST#branch protection#CodeQL#code scanning#secret scanning#github advanced security
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill implementing-github-advanced-security-for-code-scanning
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: implementing-github-advanced-security-for-code-scanning
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/devsecops/implementing-github-advanced-security-for-code-scanning
Command: npx skills add https://github.com/xalgord/xalgorix --skill implementing-github-advanced-security-for-code-scanning

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Teams often enable code scanning superficially, leaving merged code unscanned, alerts unenforced, and secrets unblocked. This Skill guides the correct deployment of GitHub Advanced Security with CodeQL so static analysis actually gates merges and detects vulnerabilities like SQL injection and XSS across repositories.

Core Features & Use Cases

  • CodeQL Workflow Configuration: Set up default or advanced code scanning with custom .github/workflows/codeql-analysis.yml files, language matrices, query suites, and scheduled scans.
  • Enforcement and Gating: Configure branch protection rules requiring code scanning results with severity thresholds so High/Critical alerts block merges.
  • Enterprise Rollout: Enable GHAS organization-wide, add secret scanning with push protection, Dependabot, dependency review, and custom query packs.
  • Use Case: A security engineer rolling out SAST across 200 repositories uses this Skill to enable CodeQL at scale, verify that a test PR with an obvious SQL injection sink is blocked by branch protection, and monitor remediation via the security overview dashboard.

Quick Start

Set up a CodeQL advanced workflow for my repository with push, pull request, and weekly scheduled triggers, then configure branch protection to block merges on High severity alerts.

Frequently Asked Questions about implementing-github-advanced-security-for-code-scanning

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I set up CodeQL code scanning in GitHub Actions?▼

Create a .github/workflows/codeql-analysis.yml file using github/codeql-action/init, autobuild, and analyze steps with a language matrix. Trigger it on push, pull_request, and a weekly schedule so merged code and newly disclosed CVEs are also scanned.

What is the difference between CodeQL default setup and advanced setup?▼

Default setup enables scanning with one click and auto-detects languages without a workflow file. Advanced setup generates a customizable workflow supporting build commands, monorepos, custom query packs, and scheduling control.

Which languages does CodeQL code scanning support?▼

CodeQL supports C/C++, C#, Go, Java/Kotlin, JavaScript/TypeScript, Python, Ruby, and Swift. Compiled languages require a successful build via autobuild or custom build commands, otherwise analysis produces little or no results.

Why is CodeQL running but not blocking pull requests?▼

SARIF results in the Security tab are not a merge gate. Enable branch protection with 'Require code scanning results' and a severity threshold, and ensure the workflow has security-events: write permission so alerts are recorded.

Does GitHub Advanced Security include secret scanning?▼

Yes, GHAS includes secret scanning with push protection to block commits containing detected secrets, plus custom patterns for organization-specific tokens. It also covers dependency review and Dependabot alerts alongside code scanning.

Related Skills

Explore More Software Engineering Skills→
okatech-orgokatech-org

dependency-management-deps-audit

Scan project dependencies for vulnerabilities, license conflicts, and supply-chain risks.

Community
Advanced
fitlab-aifitlab-ai
84

import-codescan

Import Code Scanning alerts and create remediation task skeletons.

Official
Intermediate
ayehiaaayehiaa

semgrep

Run Semgrep static analysis scans and merge SARIF results.

Community
Advanced
EngineerWithAIEngineerWithAI
4

sast-configuration

Configure Semgrep, SonarQube, and CodeQL for automated vulnerability detection.

Official
Intermediate