Skill UI

Automates CodeQL database builds, suite selection, and taint-aware scans to surface security and quality issues across supported languages, handling output directories, SARIF results, and extensions in one workflow.

Parses SARIF files from scanners like CodeQL or Semgrep, offering filtering, deduplication, format conversion, and CI/CD integration without running scans itself.

This skill guides developers through integrating Static Application Security Testing (SAST) tools like CodeQL and Semgrep into GitHub Actions CI/CD pipelines. It covers automating code scanning on pull requests and pushes, tuning rules to reduce false positives, uploading SARIF results, and establishing quality gates to prevent vulnerable code from merging into production.

This comprehensive guide provides detailed procedural steps for configuring and executing CodeQL code scanning. It covers both implementing automated workflows using GitHub Actions (`codeql.yml`) and running scans via the CodeQL CLI. Users will learn how to manage language matrices, set build modes, interpret SARIF outputs, handle monorepo structures, and troubleshoot complex security analysis setups across multiple languages (e.g., Python, Java, C++).