[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ADAZ780MTPJDEMYKEHWTPD":3,"skill-same:01M6ADAZ780MTPJDEMYKEHWTPD":109},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":31,"publishedAt":54,"linkOnly":55,"markdownContent":56,"markdownBody":57,"frontMatter":58,"refName":59,"commitSha":60,"skillDirectory":61,"forksCount":62,"repositoryHtmlUrl":63,"repositoryHomepageUrl":64,"ownerHtmlUrl":65,"ownerBlogUrl":66,"ownerDescription":67,"updatedAt":68,"install":69,"resources":82},"01M6ADAZ780MTPJDEMYKEHWTPD","codeql",null,"Comprehensive guide for setting up and configuring CodeQL code scanning via GitHub Actions workflows and the CodeQL CLI. This skill should be used when users need help with code scanning configuration, CodeQL workflow files, CodeQL CLI commands, SARIF output, security analysis setup, or troubleshooting CodeQL analysis.","github\u002Fawesome-copilot","github","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F9919?v=4","01M6AC83DS133TPXFSP1DHNCC6","GitHub","01M6AD3PBDYPK7NVFJNJ66Y8RS",41046,"MIT","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fcodeql\u002FSKILL.md",[18,23,26],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":27,"categoryName":28,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[5,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,9],"when","cli","for","sarif","output","users","commands","files","up","scanning","guide","analysis","github actions","actions","code scanning","help","code","security analysis","setup","workflows","workflow","security","2026-11-10 10:12:30",false,"---\nname: codeql\ndescription: Comprehensive guide for setting up and configuring CodeQL code scanning via GitHub Actions workflows and the CodeQL CLI. This skill should be used when users need help with code scanning configuration, CodeQL workflow files, CodeQL CLI commands, SARIF output, security analysis setup, or troubleshooting CodeQL analysis.\n---\n\n# CodeQL Code Scanning\n\nThis skill provides procedural guidance for configuring and running CodeQL code scanning — both through GitHub Actions workflows and the standalone CodeQL CLI.\n\n## When to Use This Skill\n\nUse this skill when the request involves:\n\n- Creating or customizing a `codeql.yml` GitHub Actions workflow\n- Choosing between default setup and advanced setup for code scanning\n- Configuring CodeQL language matrix, build modes, or query suites\n- Running CodeQL CLI locally (`codeql database create`, `database analyze`, `github upload-results`)\n- Understanding or interpreting SARIF output from CodeQL\n- Troubleshooting CodeQL analysis failures (build modes, compiled languages, runner requirements)\n- Setting up CodeQL for monorepos with per-component scanning\n- Configuring dependency caching, custom query packs, or model packs\n\n## Supported Languages\n\nCodeQL supports the following language identifiers:\n\n| Language | Identifier | Alternatives |\n|---|---|---|\n| C\u002FC++ | `c-cpp` | `c`, `cpp` |\n| C# | `csharp` | — |\n| Go | `go` | — |\n| Java\u002FKotlin | `java-kotlin` | `java`, `kotlin` |\n| JavaScript\u002FTypeScript | `javascript-typescript` | `javascript`, `typescript` |\n| Python | `python` | — |\n| Ruby | `ruby` | — |\n| Rust | `rust` | — |\n| Swift | `swift` | — |\n| GitHub Actions | `actions` | — |\n\n> Alternative identifiers are equivalent to the standard identifier (e.g., `javascript` does not exclude TypeScript analysis).\n\n## Core Workflow — GitHub Actions\n\n### Step 1: Choose Setup Type\n\n- **Default setup** — Enable from repository Settings → Advanced Security → CodeQL analysis. Best for getting started quickly. Uses `none` build mode for most languages.\n- **Advanced setup** — Create a `.github\u002Fworkflows\u002Fcodeql.yml` file for full control over triggers, build modes, query suites, and matrix strategies.\n\nTo switch from default to advanced: disable default setup first, then commit the workflow file.\n\n### Step 2: Configure Workflow Triggers\n\nDefine when scanning runs:\n\n```yaml\non:\n  push:\n    branches: [main, protected]\n  pull_request:\n    branches: [main]\n  schedule:\n    - cron: '30 6 * * 1'  # Weekly Monday 6:30 UTC\n```\n\n- `push` — scans on every push to specified branches; results appear in Security tab\n- `pull_request` — scans PR merge commits; results appear as PR check annotations\n- `schedule` — periodic scans of the default branch (cron must exist on default branch)\n- `merge_group` — add if repository uses merge queues\n\nTo skip scans for documentation-only PRs:\n\n```yaml\non:\n  pull_request:\n    paths-ignore:\n      - '**\u002F*.md'\n      - '**\u002F*.txt'\n```\n\n> `paths-ignore` controls whether the workflow runs, not which files are analyzed.\n\n### Step 3: Configure Permissions\n\nSet least-privilege permissions:\n\n```yaml\npermissions:\n  security-events: write   # Required to upload SARIF results\n  contents: read            # Required to checkout code\n  actions: read             # Required for private repos using codeql-action\n```\n\n### Step 4: Configure Language Matrix\n\nUse a matrix strategy to analyze each language in parallel:\n\n```yaml\njobs:\n  analyze:\n    name: Analyze (${{ matrix.language }})\n    runs-on: ubuntu-latest\n    strategy:\n      fail-fast: false\n      matrix:\n        include:\n          - language: javascript-typescript\n            build-mode: none\n          - language: python\n            build-mode: none\n```\n\nFor compiled languages, set the appropriate `build-mode`:\n- `none` — no build required (supported for C\u002FC++, C#, Java, Rust)\n- `autobuild` — automatic build detection\n- `manual` — custom build commands (advanced setup only)\n\n> For detailed per-language autobuild behavior and runner requirements, search `references\u002Fcompiled-languages.md`.\n\n### Step 5: Configure CodeQL Init and Analysis\n\n```yaml\nsteps:\n  - name: Checkout repository\n    uses: actions\u002Fcheckout@v4\n\n  - name: Initialize CodeQL\n    uses: github\u002Fcodeql-action\u002Finit@v4\n    with:\n      languages: ${{ matrix.language }}\n      build-mode: ${{ matrix.build-mode }}\n      queries: security-extended\n      dependency-caching: true\n\n  - name: Perform CodeQL Analysis\n    uses: github\u002Fcodeql-action\u002Fanalyze@v4\n    with:\n      category: \"\u002Flanguage:${{ matrix.language }}\"\n```\n\n**Query suite options:**\n- `security-extended` — default security queries plus additional coverage\n- `security-and-quality` — security plus code quality queries\n- Custom query packs via `packs:` input (e.g., `codeql\u002Fjavascript-queries:AlertSuppression.ql`)\n\n**Dependency caching:** Set `dependency-caching: true` on the `init` action to cache restored dependencies across runs.\n\n**Analysis category:** Use `category` to distinguish SARIF results in monorepos (e.g., per-language, per-component).\n\n### Step 6: Monorepo Configuration\n\nFor monorepos with multiple components, use the `category` parameter to separate SARIF results:\n\n```yaml\ncategory: \"\u002Flanguage:${{ matrix.language }}\u002Fcomponent:frontend\"\n```\n\nTo restrict analysis to specific directories, use a CodeQL configuration file (`.github\u002Fcodeql\u002Fcodeql-config.yml`):\n\n```yaml\npaths:\n  - apps\u002F\n  - services\u002F\npaths-ignore:\n  - node_modules\u002F\n  - '**\u002Ftest\u002F**'\n```\n\nReference it in the workflow:\n\n```yaml\n- uses: github\u002Fcodeql-action\u002Finit@v4\n  with:\n    config-file: .github\u002Fcodeql\u002Fcodeql-config.yml\n```\n\n### Step 7: Manual Build Steps (Compiled Languages)\n\nIf `autobuild` fails or custom build commands are needed:\n\n```yaml\n- language: c-cpp\n  build-mode: manual\n```\n\nThen add explicit build steps between `init` and `analyze`:\n\n```yaml\n- if: matrix.build-mode == 'manual'\n  name: Build\n  run: |\n    make bootstrap\n    make release\n```\n\n## Core Workflow — CodeQL CLI\n\n### Step 1: Install the CodeQL CLI\n\nDownload the CodeQL bundle (includes CLI + precompiled queries):\n\n```bash\n# Download from https:\u002F\u002Fgithub.com\u002Fgithub\u002Fcodeql-action\u002Freleases\n# Extract and add to PATH\nexport PATH=\"$HOME\u002Fcodeql:$PATH\"\n\n# Verify installation\ncodeql resolve packs\ncodeql resolve languages\n```\n\n> Always use the CodeQL bundle, not a standalone CLI download. The bundle ensures query compatibility and provides precompiled queries for better performance.\n\n### Step 2: Create a CodeQL Database\n\n```bash\n# Single language\ncodeql database create codeql-db \\\n  --language=javascript-typescript \\\n  --source-root=src\n\n# Multiple languages (cluster mode)\ncodeql database create codeql-dbs \\\n  --db-cluster \\\n  --language=java,python \\\n  --command=.\u002Fbuild.sh \\\n  --source-root=src\n```\n\nFor compiled languages, provide the build command via `--command`.\n\n### Step 3: Analyze the Database\n\n```bash\ncodeql database analyze codeql-db \\\n  javascript-code-scanning.qls \\\n  --format=sarif-latest \\\n  --sarif-category=javascript \\\n  --output=results.sarif\n```\n\nCommon query suites: `\u003Clanguage>-code-scanning.qls`, `\u003Clanguage>-security-extended.qls`, `\u003Clanguage>-security-and-quality.qls`.\n\n### Step 4: Upload Results to GitHub\n\n```bash\ncodeql github upload-results \\\n  --repository=owner\u002Frepo \\\n  --ref=refs\u002Fheads\u002Fmain \\\n  --commit=\u003Ccommit-sha> \\\n  --sarif=results.sarif\n```\n\nRequires `GITHUB_TOKEN` environment variable with `security-events: write` permission.\n\n### CLI Server Mode\n\nTo avoid repeated JVM initialization when running multiple commands:\n\n```bash\ncodeql execute cli-server\n```\n\n> For detailed CLI command reference, search `references\u002Fcli-commands.md`.\n\n## Alert Management\n\n### Severity Levels\n\nAlerts have two severity dimensions:\n- **Standard severity:** `Error`, `Warning`, `Note`\n- **Security severity:** `Critical`, `High`, `Medium`, `Low` (derived from CVSS scores; takes display precedence)\n\n### Copilot Autofix\n\nGitHub Copilot Autofix generates fix suggestions for CodeQL alerts in pull requests automatically — no Copilot subscription required. Review suggestions carefully before committing.\n\n### Alert Triage in PRs\n\n- Alerts appear as check annotations on changed lines\n- Check fails by default for `error`\u002F`critical`\u002F`high` severity alerts\n- Configure merge protection rulesets to customize the threshold\n- Dismiss false positives with a documented reason for audit trail\n\n> For detailed alert management guidance, search `references\u002Falert-management.md`.\n\n## Custom Queries and Packs\n\n### Using Custom Query Packs\n\n```yaml\n- uses: github\u002Fcodeql-action\u002Finit@v4\n  with:\n    packs: |\n      my-org\u002Fmy-security-queries@1.0.0\n      codeql\u002Fjavascript-queries:AlertSuppression.ql\n```\n\n### Creating Custom Query Packs\n\nUse the CodeQL CLI to create and publish packs:\n\n```bash\n# Initialize a new pack\ncodeql pack init my-org\u002Fmy-queries\n\n# Install dependencies\ncodeql pack install\n\n# Publish to GitHub Container Registry\ncodeql pack publish\n```\n\n### CodeQL Configuration File\n\nFor advanced query and path configuration, create `.github\u002Fcodeql\u002Fcodeql-config.yml`:\n\n```yaml\npaths:\n  - apps\u002F\n  - services\u002F\npaths-ignore:\n  - '**\u002Ftest\u002F**'\n  - node_modules\u002F\nqueries:\n  - uses: security-extended\npacks:\n  javascript-typescript:\n    - my-org\u002Fmy-custom-queries\n```\n\n## Code Scanning Logs\n\n### Summary Metrics\n\nWorkflow logs include key metrics:\n- **Lines of code in codebase** — baseline before extraction\n- **Lines extracted** — including external libraries and auto-generated files\n- **Extraction errors\u002Fwarnings** — files that failed or produced warnings during extraction\n\n### Debug Logging\n\nTo enable detailed diagnostics:\n- **GitHub Actions:** re-run the workflow with \"Enable debug logging\" checked\n- **CodeQL CLI:** use `--verbosity=progress++` and `--logdir=codeql-logs`\n\n## Troubleshooting\n\n### Common Issues\n\n| Problem | Solution |\n|---|---|\n| Workflow not triggering | Verify `on:` triggers match event; check `paths`\u002F`branches` filters; ensure workflow exists on target branch |\n| `Resource not accessible` error | Add `security-events: write` and `contents: read` permissions |\n| Autobuild failure | Switch to `build-mode: manual` and add explicit build commands |\n| No source code seen | Verify `--source-root`, build command, and language identifier |\n| C# compiler failure | Check for `\u002Fp:EmitCompilerGeneratedFiles=true` conflicts with `.sqlproj` or legacy projects |\n| Fewer lines scanned than expected | Switch from `none` to `autobuild`\u002F`manual`; verify build compiles all source |\n| Kotlin in no-build mode | Disable and re-enable default setup to switch to `autobuild` |\n| Cache miss every run | Verify `dependency-caching: true` on `init` action |\n| Out of disk\u002Fmemory | Use larger runners; reduce analysis scope via `paths` config; use `build-mode: none` |\n| SARIF upload fails | Ensure token has `security-events: write`; check 10 MB file size limit |\n| SARIF results exceed limits | Split across multiple uploads with different `--sarif-category`; reduce query scope |\n| Two CodeQL workflows | Disable default setup if using advanced setup, or remove old workflow file |\n| Slow analysis | Enable dependency caching; use `--threads=0`; reduce query suite scope |\n\n> For comprehensive troubleshooting with detailed solutions, search `references\u002Ftroubleshooting.md`.\n\n### Hardware Requirements (Self-Hosted Runners)\n\n| Codebase Size | RAM | CPU |\n|---|---|---|\n| Small (\u003C100K LOC) | 8 GB+ | 2 cores |\n| Medium (100K–1M LOC) | 16 GB+ | 4–8 cores |\n| Large (>1M LOC) | 64 GB+ | 8 cores |\n\nAll sizes: SSD with ≥14 GB free disk space.\n\n### Action Versioning\n\nPin CodeQL actions to a specific major version:\n\n```yaml\nuses: github\u002Fcodeql-action\u002Finit@v4      # Recommended\nuses: github\u002Fcodeql-action\u002Fautobuild@v4\nuses: github\u002Fcodeql-action\u002Fanalyze@v4\n```\n\nFor maximum security, pin to a full commit SHA instead of a version tag.\n\n## Reference Files\n\nFor detailed documentation, load the following reference files as needed:\n\n- `references\u002Fworkflow-configuration.md` — Full workflow trigger, runner, and configuration options\n  - Search patterns: `trigger`, `schedule`, `paths-ignore`, `db-location`, `model packs`, `alert severity`, `merge protection`, `concurrency`, `config file`\n- `references\u002Fcli-commands.md` — Complete CodeQL CLI command reference\n  - Search patterns: `database create`, `database analyze`, `upload-results`, `resolve packs`, `cli-server`, `installation`, `CI integration`\n- `references\u002Fsarif-output.md` — SARIF v2.1.0 object model, upload limits, and third-party support\n  - Search patterns: `sarifLog`, `result`, `location`, `region`, `codeFlow`, `fingerprint`, `suppression`, `upload limits`, `third-party`, `precision`, `security-severity`\n- `references\u002Fcompiled-languages.md` — Build modes and autobuild behavior per language\n  - Search patterns: `C\u002FC++`, `C#`, `Java`, `Go`, `Rust`, `Swift`, `autobuild`, `build-mode`, `hardware`, `dependency caching`\n- `references\u002Ftroubleshooting.md` — Comprehensive error diagnosis and resolution\n  - Search patterns: `no source code`, `out of disk`, `out of memory`, `403`, `C# compiler`, `analysis too long`, `fewer lines`, `Kotlin`, `extraction errors`, `debug logging`, `SARIF upload`, `SARIF limits`\n- `references\u002Falert-management.md` — Alert severity, triage, Copilot Autofix, and dismissal\n  - Search patterns: `severity`, `security severity`, `CVSS`, `Copilot Autofix`, `dismiss`, `triage`, `PR alerts`, `data flow`, `merge protection`, `REST API`\n","# CodeQL Code Scanning\n\nThis skill provides procedural guidance for configuring and running CodeQL code scanning — both through GitHub Actions workflows and the standalone CodeQL CLI.\n\n## When to Use This Skill\n\nUse this skill when the request involves:\n\n- Creating or customizing a `codeql.yml` GitHub Actions workflow\n- Choosing between default setup and advanced setup for code scanning\n- Configuring CodeQL language matrix, build modes, or query suites\n- Running CodeQL CLI locally (`codeql database create`, `database analyze`, `github upload-results`)\n- Understanding or interpreting SARIF output from CodeQL\n- Troubleshooting CodeQL analysis failures (build modes, compiled languages, runner requirements)\n- Setting up CodeQL for monorepos with per-component scanning\n- Configuring dependency caching, custom query packs, or model packs\n\n## Supported Languages\n\nCodeQL supports the following language identifiers:\n\n| Language | Identifier | Alternatives |\n|---|---|---|\n| C\u002FC++ | `c-cpp` | `c`, `cpp` |\n| C# | `csharp` | — |\n| Go | `go` | — |\n| Java\u002FKotlin | `java-kotlin` | `java`, `kotlin` |\n| JavaScript\u002FTypeScript | `javascript-typescript` | `javascript`, `typescript` |\n| Python | `python` | — |\n| Ruby | `ruby` | — |\n| Rust | `rust` | — |\n| Swift | `swift` | — |\n| GitHub Actions | `actions` | — |\n\n> Alternative identifiers are equivalent to the standard identifier (e.g., `javascript` does not exclude TypeScript analysis).\n\n## Core Workflow — GitHub Actions\n\n### Step 1: Choose Setup Type\n\n- **Default setup** — Enable from repository Settings → Advanced Security → CodeQL analysis. Best for getting started quickly. Uses `none` build mode for most languages.\n- **Advanced setup** — Create a `.github\u002Fworkflows\u002Fcodeql.yml` file for full control over triggers, build modes, query suites, and matrix strategies.\n\nTo switch from default to advanced: disable default setup first, then commit the workflow file.\n\n### Step 2: Configure Workflow Triggers\n\nDefine when scanning runs:\n\n```yaml\non:\n  push:\n    branches: [main, protected]\n  pull_request:\n    branches: [main]\n  schedule:\n    - cron: '30 6 * * 1'  # Weekly Monday 6:30 UTC\n```\n\n- `push` — scans on every push to specified branches; results appear in Security tab\n- `pull_request` — scans PR merge commits; results appear as PR check annotations\n- `schedule` — periodic scans of the default branch (cron must exist on default branch)\n- `merge_group` — add if repository uses merge queues\n\nTo skip scans for documentation-only PRs:\n\n```yaml\non:\n  pull_request:\n    paths-ignore:\n      - '**\u002F*.md'\n      - '**\u002F*.txt'\n```\n\n> `paths-ignore` controls whether the workflow runs, not which files are analyzed.\n\n### Step 3: Configure Permissions\n\nSet least-privilege permissions:\n\n```yaml\npermissions:\n  security-events: write   # Required to upload SARIF results\n  contents: read            # Required to checkout code\n  actions: read             # Required for private repos using codeql-action\n```\n\n### Step 4: Configure Language Matrix\n\nUse a matrix strategy to analyze each language in parallel:\n\n```yaml\njobs:\n  analyze:\n    name: Analyze (${{ matrix.language }})\n    runs-on: ubuntu-latest\n    strategy:\n      fail-fast: false\n      matrix:\n        include:\n          - language: javascript-typescript\n            build-mode: none\n          - language: python\n            build-mode: none\n```\n\nFor compiled languages, set the appropriate `build-mode`:\n- `none` — no build required (supported for C\u002FC++, C#, Java, Rust)\n- `autobuild` — automatic build detection\n- `manual` — custom build commands (advanced setup only)\n\n> For detailed per-language autobuild behavior and runner requirements, search `references\u002Fcompiled-languages.md`.\n\n### Step 5: Configure CodeQL Init and Analysis\n\n```yaml\nsteps:\n  - name: Checkout repository\n    uses: actions\u002Fcheckout@v4\n\n  - name: Initialize CodeQL\n    uses: github\u002Fcodeql-action\u002Finit@v4\n    with:\n      languages: ${{ matrix.language }}\n      build-mode: ${{ matrix.build-mode }}\n      queries: security-extended\n      dependency-caching: true\n\n  - name: Perform CodeQL Analysis\n    uses: github\u002Fcodeql-action\u002Fanalyze@v4\n    with:\n      category: \"\u002Flanguage:${{ matrix.language }}\"\n```\n\n**Query suite options:**\n- `security-extended` — default security queries plus additional coverage\n- `security-and-quality` — security plus code quality queries\n- Custom query packs via `packs:` input (e.g., `codeql\u002Fjavascript-queries:AlertSuppression.ql`)\n\n**Dependency caching:** Set `dependency-caching: true` on the `init` action to cache restored dependencies across runs.\n\n**Analysis category:** Use `category` to distinguish SARIF results in monorepos (e.g., per-language, per-component).\n\n### Step 6: Monorepo Configuration\n\nFor monorepos with multiple components, use the `category` parameter to separate SARIF results:\n\n```yaml\ncategory: \"\u002Flanguage:${{ matrix.language }}\u002Fcomponent:frontend\"\n```\n\nTo restrict analysis to specific directories, use a CodeQL configuration file (`.github\u002Fcodeql\u002Fcodeql-config.yml`):\n\n```yaml\npaths:\n  - apps\u002F\n  - services\u002F\npaths-ignore:\n  - node_modules\u002F\n  - '**\u002Ftest\u002F**'\n```\n\nReference it in the workflow:\n\n```yaml\n- uses: github\u002Fcodeql-action\u002Finit@v4\n  with:\n    config-file: .github\u002Fcodeql\u002Fcodeql-config.yml\n```\n\n### Step 7: Manual Build Steps (Compiled Languages)\n\nIf `autobuild` fails or custom build commands are needed:\n\n```yaml\n- language: c-cpp\n  build-mode: manual\n```\n\nThen add explicit build steps between `init` and `analyze`:\n\n```yaml\n- if: matrix.build-mode == 'manual'\n  name: Build\n  run: |\n    make bootstrap\n    make release\n```\n\n## Core Workflow — CodeQL CLI\n\n### Step 1: Install the CodeQL CLI\n\nDownload the CodeQL bundle (includes CLI + precompiled queries):\n\n```bash\n# Download from https:\u002F\u002Fgithub.com\u002Fgithub\u002Fcodeql-action\u002Freleases\n# Extract and add to PATH\nexport PATH=\"$HOME\u002Fcodeql:$PATH\"\n\n# Verify installation\ncodeql resolve packs\ncodeql resolve languages\n```\n\n> Always use the CodeQL bundle, not a standalone CLI download. The bundle ensures query compatibility and provides precompiled queries for better performance.\n\n### Step 2: Create a CodeQL Database\n\n```bash\n# Single language\ncodeql database create codeql-db \\\n  --language=javascript-typescript \\\n  --source-root=src\n\n# Multiple languages (cluster mode)\ncodeql database create codeql-dbs \\\n  --db-cluster \\\n  --language=java,python \\\n  --command=.\u002Fbuild.sh \\\n  --source-root=src\n```\n\nFor compiled languages, provide the build command via `--command`.\n\n### Step 3: Analyze the Database\n\n```bash\ncodeql database analyze codeql-db \\\n  javascript-code-scanning.qls \\\n  --format=sarif-latest \\\n  --sarif-category=javascript \\\n  --output=results.sarif\n```\n\nCommon query suites: `\u003Clanguage>-code-scanning.qls`, `\u003Clanguage>-security-extended.qls`, `\u003Clanguage>-security-and-quality.qls`.\n\n### Step 4: Upload Results to GitHub\n\n```bash\ncodeql github upload-results \\\n  --repository=owner\u002Frepo \\\n  --ref=refs\u002Fheads\u002Fmain \\\n  --commit=\u003Ccommit-sha> \\\n  --sarif=results.sarif\n```\n\nRequires `GITHUB_TOKEN` environment variable with `security-events: write` permission.\n\n### CLI Server Mode\n\nTo avoid repeated JVM initialization when running multiple commands:\n\n```bash\ncodeql execute cli-server\n```\n\n> For detailed CLI command reference, search `references\u002Fcli-commands.md`.\n\n## Alert Management\n\n### Severity Levels\n\nAlerts have two severity dimensions:\n- **Standard severity:** `Error`, `Warning`, `Note`\n- **Security severity:** `Critical`, `High`, `Medium`, `Low` (derived from CVSS scores; takes display precedence)\n\n### Copilot Autofix\n\nGitHub Copilot Autofix generates fix suggestions for CodeQL alerts in pull requests automatically — no Copilot subscription required. Review suggestions carefully before committing.\n\n### Alert Triage in PRs\n\n- Alerts appear as check annotations on changed lines\n- Check fails by default for `error`\u002F`critical`\u002F`high` severity alerts\n- Configure merge protection rulesets to customize the threshold\n- Dismiss false positives with a documented reason for audit trail\n\n> For detailed alert management guidance, search `references\u002Falert-management.md`.\n\n## Custom Queries and Packs\n\n### Using Custom Query Packs\n\n```yaml\n- uses: github\u002Fcodeql-action\u002Finit@v4\n  with:\n    packs: |\n      my-org\u002Fmy-security-queries@1.0.0\n      codeql\u002Fjavascript-queries:AlertSuppression.ql\n```\n\n### Creating Custom Query Packs\n\nUse the CodeQL CLI to create and publish packs:\n\n```bash\n# Initialize a new pack\ncodeql pack init my-org\u002Fmy-queries\n\n# Install dependencies\ncodeql pack install\n\n# Publish to GitHub Container Registry\ncodeql pack publish\n```\n\n### CodeQL Configuration File\n\nFor advanced query and path configuration, create `.github\u002Fcodeql\u002Fcodeql-config.yml`:\n\n```yaml\npaths:\n  - apps\u002F\n  - services\u002F\npaths-ignore:\n  - '**\u002Ftest\u002F**'\n  - node_modules\u002F\nqueries:\n  - uses: security-extended\npacks:\n  javascript-typescript:\n    - my-org\u002Fmy-custom-queries\n```\n\n## Code Scanning Logs\n\n### Summary Metrics\n\nWorkflow logs include key metrics:\n- **Lines of code in codebase** — baseline before extraction\n- **Lines extracted** — including external libraries and auto-generated files\n- **Extraction errors\u002Fwarnings** — files that failed or produced warnings during extraction\n\n### Debug Logging\n\nTo enable detailed diagnostics:\n- **GitHub Actions:** re-run the workflow with \"Enable debug logging\" checked\n- **CodeQL CLI:** use `--verbosity=progress++` and `--logdir=codeql-logs`\n\n## Troubleshooting\n\n### Common Issues\n\n| Problem | Solution |\n|---|---|\n| Workflow not triggering | Verify `on:` triggers match event; check `paths`\u002F`branches` filters; ensure workflow exists on target branch |\n| `Resource not accessible` error | Add `security-events: write` and `contents: read` permissions |\n| Autobuild failure | Switch to `build-mode: manual` and add explicit build commands |\n| No source code seen | Verify `--source-root`, build command, and language identifier |\n| C# compiler failure | Check for `\u002Fp:EmitCompilerGeneratedFiles=true` conflicts with `.sqlproj` or legacy projects |\n| Fewer lines scanned than expected | Switch from `none` to `autobuild`\u002F`manual`; verify build compiles all source |\n| Kotlin in no-build mode | Disable and re-enable default setup to switch to `autobuild` |\n| Cache miss every run | Verify `dependency-caching: true` on `init` action |\n| Out of disk\u002Fmemory | Use larger runners; reduce analysis scope via `paths` config; use `build-mode: none` |\n| SARIF upload fails | Ensure token has `security-events: write`; check 10 MB file size limit |\n| SARIF results exceed limits | Split across multiple uploads with different `--sarif-category`; reduce query scope |\n| Two CodeQL workflows | Disable default setup if using advanced setup, or remove old workflow file |\n| Slow analysis | Enable dependency caching; use `--threads=0`; reduce query suite scope |\n\n> For comprehensive troubleshooting with detailed solutions, search `references\u002Ftroubleshooting.md`.\n\n### Hardware Requirements (Self-Hosted Runners)\n\n| Codebase Size | RAM | CPU |\n|---|---|---|\n| Small (\u003C100K LOC) | 8 GB+ | 2 cores |\n| Medium (100K–1M LOC) | 16 GB+ | 4–8 cores |\n| Large (>1M LOC) | 64 GB+ | 8 cores |\n\nAll sizes: SSD with ≥14 GB free disk space.\n\n### Action Versioning\n\nPin CodeQL actions to a specific major version:\n\n```yaml\nuses: github\u002Fcodeql-action\u002Finit@v4      # Recommended\nuses: github\u002Fcodeql-action\u002Fautobuild@v4\nuses: github\u002Fcodeql-action\u002Fanalyze@v4\n```\n\nFor maximum security, pin to a full commit SHA instead of a version tag.\n\n## Reference Files\n\nFor detailed documentation, load the following reference files as needed:\n\n- `references\u002Fworkflow-configuration.md` — Full workflow trigger, runner, and configuration options\n  - Search patterns: `trigger`, `schedule`, `paths-ignore`, `db-location`, `model packs`, `alert severity`, `merge protection`, `concurrency`, `config file`\n- `references\u002Fcli-commands.md` — Complete CodeQL CLI command reference\n  - Search patterns: `database create`, `database analyze`, `upload-results`, `resolve packs`, `cli-server`, `installation`, `CI integration`\n- `references\u002Fsarif-output.md` — SARIF v2.1.0 object model, upload limits, and third-party support\n  - Search patterns: `sarifLog`, `result`, `location`, `region`, `codeFlow`, `fingerprint`, `suppression`, `upload limits`, `third-party`, `precision`, `security-severity`\n- `references\u002Fcompiled-languages.md` — Build modes and autobuild behavior per language\n  - Search patterns: `C\u002FC++`, `C#`, `Java`, `Go`, `Rust`, `Swift`, `autobuild`, `build-mode`, `hardware`, `dependency caching`\n- `references\u002Ftroubleshooting.md` — Comprehensive error diagnosis and resolution\n  - Search patterns: `no source code`, `out of disk`, `out of memory`, `403`, `C# compiler`, `analysis too long`, `fewer lines`, `Kotlin`, `extraction errors`, `debug logging`, `SARIF upload`, `SARIF limits`\n- `references\u002Falert-management.md` — Alert severity, triage, Copilot Autofix, and dismissal\n  - Search patterns: `severity`, `security severity`, `CVSS`, `Copilot Autofix`, `dismiss`, `triage`, `PR alerts`, `data flow`, `merge protection`, `REST API`\n",{"name":5,"description":7},"main","5269f7ea2d6c3a9bfda5ed878b6726cf509121fd","skills\u002Fcodeql",5340,"https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot","https:\u002F\u002Fawesome-copilot.github.com\u002F","https:\u002F\u002Fgithub.com\u002Fgithub","https:\u002F\u002Fgithub.com\u002Fabout","How people build software.","2026-11-11 13:41:32",{"source":8,"skillName":5,"commands":70,"prompt":80,"zipAvailable":81},[71,74,77],{"tool":72,"command":73},"npx","npx skills add github\u002Fawesome-copilot --skill codeql",{"tool":75,"command":76},"bunx","bunx skills add github\u002Fawesome-copilot --skill codeql",{"tool":78,"command":79},"pnpm","pnpm dlx skills add github\u002Fawesome-copilot --skill codeql","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fcodeql\u002FSKILL.md",true,[83,89,93,97,101,105],{"path":84,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":87,"sourceHtmlUrl":88},"references\u002Falert-management.md","REFERENCE","参考文档",6462,"https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fcodeql\u002Freferences\u002Falert-management.md",{"path":90,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":91,"sourceHtmlUrl":92},"references\u002Fcli-commands.md",8340,"https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fcodeql\u002Freferences\u002Fcli-commands.md",{"path":94,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":95,"sourceHtmlUrl":96},"references\u002Fcompiled-languages.md",9363,"https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fcodeql\u002Freferences\u002Fcompiled-languages.md",{"path":98,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":99,"sourceHtmlUrl":100},"references\u002Fsarif-output.md",9957,"https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fcodeql\u002Freferences\u002Fsarif-output.md",{"path":102,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":103,"sourceHtmlUrl":104},"references\u002Ftroubleshooting.md",9161,"https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fcodeql\u002Freferences\u002Ftroubleshooting.md",{"path":106,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":107,"sourceHtmlUrl":108},"references\u002Fworkflow-configuration.md",8714,"https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fcodeql\u002Freferences\u002Fworkflow-configuration.md",[110,138,164,188,222,239],{"skillNo":111,"name":112,"nameZh":6,"description":113,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":114,"categories":115,"keywords":120,"publishedAt":54},"01M70KXZNX9ES38N2A8M58ZZMZ","supabase-rls-policies","Write, review, and test Supabase Row Level Security (RLS) policies so that one user cannot read or change another user's rows. Use when creating or changing tables, policies, views, or security definer functions in a Supabase project, when reviewing a migration that touches RLS, or when asked to prove user isolation with pgTAP tests that sign in as two users.","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fsupabase-rls-policies\u002FSKILL.md",[116,119],{"categoryNo":117,"categoryName":118,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[121,122,123,124,125,32,126,127,128,129,53,130,131,132,133,134,135,37,136,137],"supabase","rls","supabase rls","supabase rls policies","project","review","change","read","write","isolation","tables","as","tests","prove","use","functions","with",{"skillNo":139,"name":140,"nameZh":6,"description":141,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":142,"categories":143,"keywords":145,"publishedAt":54},"01M70KWA5YWXDV6V8DZ19E3T2Y","skill-distribution-audit","Audit a skill collection before release or investigate installer omissions, archived\u002Ftemplate leakage, duplicate identities, and manifest drift. Reconcile the intended public source set, distribution manifest, and actual discovery output for a specified consumer version. Includes a deterministic set-comparison helper.","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fskill-distribution-audit\u002FSKILL.md",[144],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[146,147,148,149,150,151,34,152,153,154,155,156,157,158,36,159,160,161,162,163],"distribution","skill distribution audit","audit","SET","deterministic","installer","discovery","comparison","helper","manifest","version","collection","drift","investigate","duplicate","template","release","reconcile",{"skillNo":165,"name":166,"nameZh":6,"description":167,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":168,"sourceHtmlUrl":169,"categories":170,"keywords":172,"publishedAt":54},"01M70KCJPFVW7PPQ49CC5R8JGK","logicapps-custom-code-net10-migration","Migrate Azure Logic Apps Standard local-function custom-code projects from .NET 8 to .NET 10. Use for legacy Logic Apps custom-code workspace upgrades, project\u002Fpackage configuration, custom-worker settings, publication, and integrated VS Code debugging. Not for ordinary .NET applications, standalone Azure Functions, Consumption workflows, or cloud deployment.","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Flogicapps-custom-code-net10-migration\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Flogicapps-custom-code-net10-migration\u002FSKILL.md",[171],{"categoryNo":27,"categoryName":28,"taxonomyType":29,"taxonomyTypeDesc":30},[173,48,174,175,176,177,34,125,178,179,180,181,182,183,184,135,185,186,187,51],"custom","logicapps custom code net10 migration","migration","projects","standalone","deployment","applications","local","azure","worker","upgrades","package","apps","Legacy","debugging",{"skillNo":189,"name":190,"nameZh":6,"description":191,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":192,"sourceHtmlUrl":193,"categories":194,"keywords":199,"publishedAt":54},"01M6AEBN37RQMXJ3298PEY7PG1","winmd-api-search","Find and explore Windows desktop APIs. Use when building features that need platform capabilities — camera, file access, notifications, UI controls, AI\u002FML, sensors, networking, etc. Discovers the right API for a task and retrieves full type details (methods, properties, events, enumeration values).","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fwinmd-api-search\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fwinmd-api-search\u002FSKILL.md",[195,198],{"categoryNo":196,"categoryName":197,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":27,"categoryName":28,"taxonomyType":29,"taxonomyTypeDesc":30},[200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,32,215,216,217,218,219,34,220,221],"winmd api search","search","api","windows","desktop","file access","enumeration","ui","ml","file","networking","capabilities","notifications","explore","access","features","full","camera","events","platform","methods","controls",{"skillNo":223,"name":224,"nameZh":6,"description":225,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":226,"licenseFileUrl":227,"sourceHtmlUrl":228,"categories":229,"keywords":235,"publishedAt":54},"01M6AE571R3SC1ZGE202B3NB5S","resemble-detect","Deepfake detection and media safety — detect AI-generated audio, images, video, and text, trace synthesis sources, apply watermarks, verify speaker identity, and analyze media intelligence using Resemble AI","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fresemble-detect\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fresemble-detect\u002FSKILL.md",[230,231,234],{"categoryNo":196,"categoryName":197,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":232,"categoryName":233,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000016","图像与多媒体",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[236,149,209,237,238],"resemble detect","https","identity",{"skillNo":240,"name":241,"nameZh":6,"description":242,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":226,"licenseFileUrl":243,"sourceHtmlUrl":244,"categories":245,"keywords":250,"publishedAt":54},"01M6AE30BSK2HCY4TQQ22Z8JRD","quality-playbook","Run a complete quality engineering audit on any codebase. Derives behavioral requirements from the code, generates spec-traced functional tests, runs a three-pass code review with regression tests, executes a multi-model spec audit (Council of Three), and produces a consolidated bug report with TDD-verified patches. Finds the 35% of real defects that structural code review alone cannot catch. Works with any language. Trigger on 'quality playbook', 'spec audit', 'Council of Three', 'fitness-to-purpose', or 'coverage theater'.","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fquality-playbook\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fquality-playbook\u002FSKILL.md",[246,249],{"categoryNo":247,"categoryName":248,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000007","代码审查",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[251,252,253,254,48,126,9,148,255,256,237,257,258,259,260,261,262,263,264,265,266,267,133,268,269,270,271],"playbook","quality playbook","quality","code review","tdd","run","report","spec","bug report","council","engineering","functional","spec audit","bug","verified","multi-model","three","coverage","model","regression","structural"]