Skip to content
Get packs

CodeQL Code Scanning Guide

Guides setting up CodeQL code scanning workflows and CLI runs for security analysis

Source Download skill
Repository
github/awesome-copilot
Stars
40,703
Licence
MIT
Files
7 files

What it does

When installed, the agent gets step-by-step guidance for configuring CodeQL, GitHub's static analysis tool that looks for security bugs in source code. It can write or adjust GitHub Actions workflow files, pick languages and build modes, set permissions and triggers, run the CodeQL command-line tool locally, and interpret or troubleshoot the SARIF results. The included reference files add detail on compiled-language builds, alert management, and configuration.

Great for

  • Developers adding CodeQL security scanning to a GitHub repository for the first time
  • Teams with monorepos or compiled languages who need build-mode and category settings
  • Security engineers running CodeQL locally and troubleshooting failed analysis runs

Skip it if

  • Projects not hosted on GitHub or not using GitHub Actions, since the guidance centres on that setup (the CLI parts may still help)
  • Anyone expecting it to run scans itself; it only explains how to configure and run CodeQL, and any scripts it produces would run in the user's own environment

Try asking

  • “Create a codeql.yml advanced setup workflow for my Python and JavaScript repo”
  • “Why is my CodeQL analysis failing for a C++ project with autobuild?”
  • “Help me restrict CodeQL scanning to the apps/ and services/ folders in a monorepo”
  • “Explain the fields in this SARIF file from CodeQL”
Step-by-step guide: how to use CodeQL Code Scanning GuideInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 7 original files, the MIT licence and an attribution note.

    codeql.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip codeql.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip codeql.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Give the agent your language list and whether the project is compiled, so it picks the right build-mode.
  • Paste the failing workflow log or SARIF excerpt so troubleshooting references can be matched to your case.
  • Review generated workflow YAML before committing, especially permissions and trigger settings.

What's inside

  • references/alert-management.md
  • references/cli-commands.md
  • references/compiled-languages.md
  • references/sarif-output.md
  • references/troubleshooting.md
  • references/workflow-configuration.md
  • SKILL.md

Redistributed unmodified from github/awesome-copilot under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.