codeql-security-scanner

name	codeql-security-scanner
description	用于通过 CodeQL 执行语义代码扫描、安全查询、自定义规则、SARIF 报告和 GitHub Code Scanning 集成。
zh_description	用于通过 CodeQL 执行语义代码扫描、安全查询、自定义规则、SARIF 报告和 GitHub Code Scan。
version	1.0.0
author	seaworld008
source	in-house
source_url
tags	[security, sast, codeql, code-scanning, github, sarif, custom-queries, appsec]
created_at	2026-05-20
updated_at	2026-05-20
quality	4
complexity	advanced

CodeQL Security Scanner

Trigger / When to Use

Use this skill when the user wants deep semantic code scanning, GitHub Advanced Security style analysis, custom CodeQL queries, SARIF output, or vulnerability investigation with CodeQL databases.

Good trigger phrases:

• "run CodeQL locally"
• "add CodeQL code scanning"
• "scan JavaScript for security issues"
• "write a CodeQL query"
• "upload SARIF to GitHub"
• "investigate a CodeQL alert"

Core Capabilities

• Build CodeQL databases for supported languages.
• Run default and security-extended query suites.
• Produce SARIF reports for GitHub code scanning.
• Investigate dataflow-based vulnerabilities.
• Author and test custom queries for recurring insecure patterns.
• Integrate scans in GitHub Actions or local CI.

Workflow

1. Identify Languages

Inspect the repository:

rg --files | sed -n '1,160p'

Determine:

• Primary language.
• Build command.
• Whether generated code should be excluded.
• Whether dependencies need to be installed before database creation.
• Whether multiple CodeQL databases are required for a polyglot repo.

2. Verify CodeQL CLI

codeql version

If missing, use official GitHub CodeQL CLI installation guidance. For GitHub-hosted workflows, prefer github/codeql-action.

3. Create a Database

For compiled languages, provide the real build command:

codeql database create codeql-db --language=java --command="mvn -DskipTests package"

For JavaScript or TypeScript:

codeql database create codeql-db --language=javascript-typescript

For Python:

codeql database create codeql-db --language=python

If database creation fails, fix dependency installation or build steps before analyzing.

4. Run Queries

Default query suite:

codeql database analyze codeql-db --format=sarif-latest --output=codeql.sarif

Security extended suite: