codeql
Comprehensive guide for setting up and configuring CodeQL code scanning via GitHub Actions workflows and the CodeQL CLI. This skill should be used when users need help with code scanning configuration, CodeQL workflow files, CodeQL CLI commands, SARIF output, security analysis setup, or troubleshooting CodeQL analysis.
Profile →npx skills add github/awesome-copilot --skill codeql --agent copilot
Same command for any agent — swap --agent for claude-code, codex, cursor.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# CodeQL Code Scanning This skill provides procedural guidance for configuring and running CodeQL code scanning — both through GitHub Actions workflows and the standalone CodeQL CLI. ## When to Use This Skill Use this skill when the request involves: - Creating or customizing a `codeql.yml` GitHub Actions workflow - Choosing between default setup and advanced setup for code scanning - Configuring CodeQL language matrix, build modes, or query suites - Running CodeQL CLI locally (`codeql database create`, `database analyze`, `github upload-results`) - Understanding or interpreting SARIF output from CodeQL - Troubleshooting CodeQL analysis failures (build modes, compiled languages, runner requirements) - Setting up CodeQL for monorepos with per-component scanning - Configuring dependency caching, custom query packs, or model packs ## Supported Languages CodeQL supports the following language identifiers: | Language | Identifier | Alternatives | |---|---|---| | C/C++ | `c-cpp` | `c`, `cpp` | | C# | `csharp` | — | | Go | `go` | — | | Java/Kotlin | `java-kotlin` | `java`, `kotlin` | | JavaScript/TypeScript | `javascript-typescript` | `javascript`, `typescript` | | Python | `python` | — |
- When to Use This Skill
- Supported Languages
- Core Workflow — GitHub Actions
- Step 1: Choose Setup Type
- Step 2: Configure Workflow Triggers
- Step 3: Configure Permissions
- Step 4: Configure Language Matrix
- Step 5: Configure CodeQL Init and Analysis
- Step 6: Monorepo Configuration
- Step 7: Manual Build Steps (Compiled Languages)
- Core Workflow — CodeQL CLI
- Step 1: Install the CodeQL CLI
- Step 2: Create a CodeQL Database
- Step 3: Analyze the Database
Download from https://github.com/github/codeql-action/releases Extract and add to PATH export PATH="$HOME/codeql:$PATH" Verify installation codeql resolve packs codeql resolve languages Single language codeql database create codeql-db \ Multiple languages (cluster mode) codeql database create codeql-dbs \
What does the codeql skill do?
Comprehensive guide for setting up and configuring CodeQL code scanning via GitHub Actions workflows and the CodeQL CLI. This skill should be used when users need help with code scanning configuration, CodeQL workflow files, CodeQL CLI commands, SARIF output, security analysis setup, or troubleshooting CodeQL analysis.
How do I install it?
Run `npx skills add github/awesome-copilot --skill codeql --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From github/awesome-copilot, a repository with 37,432 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.