codeql

# CodeQL Code Scanning This skill provides procedural guidance for configuring and running CodeQL code scanning — both through GitHub Actions workflows and the standalone CodeQL CLI. ## When to Use This Skill Use this skill when the request involves: - Creating or customizing a `codeql.yml` GitHub Actions workflow - Choosing between default setup and advanced setup for code scanning - Configuring CodeQL language matrix, build modes, or query suites - Running CodeQL CLI locally (`codeql database create`, `database analyze`, `github upload-results`) - Understanding or interpreting SARIF output from CodeQL - Troubleshooting CodeQL analysis failures (build modes, compiled languages, runner requirements) - Setting up CodeQL for monorepos with per-component scanning - Configuring dependency caching, custom query packs, or model packs ## Supported Languages CodeQL supports the following language identifiers: | Language | Identifier | Alternatives | |---|---|---| | C/C++ | `c-cpp` | `c`, `cpp` | | C# | `csharp` | — | | Go | `go` | — | | Java/Kotlin | `java-kotlin` | `java`, `kotlin` | | JavaScript/TypeScript | `javascript-typescript` | `javascript`, `typescript` | | Python | `python` | — | | Ruby | `ruby` | — | | Rust | `rust` | — | | Swift | `swift` | — | | GitHub Actions | `actions` | — | > Alternative identifiers are equivalent to the standard identifier (e.g., `javascript` does not exclude TypeScript analysis). ## Core Workflow — GitHub Actions ### Step 1: Choose Setup ...