This action runs GitHub's industry-leading static analysis engine, CodeQL, against a repository's source code to find security vulnerabilities. It then automatically uploads the results to GitHub so they can be displayed in the repository's security tab. CodeQL runs an extensible set of queries, which have been developed by the community and the GitHub Security Lab to find common vulnerabilities in your code.
This project is released under the MIT License.
The underlying CodeQL CLI, used in this action, is licensed under the GitHub CodeQL Terms and Conditions. As such, this action may be used on open source projects hosted on GitHub, and on private repositories that are owned by an organisation with GitHub Advanced Security enabled.
This is a short walkthrough, but for more information read configuring code scanning.
To get code scanning results from CodeQL analysis on your repo you can use the following workflow as a template:
If you prefer to integrate this within an existing CI workflow, it should end up looking something like this:
config-file parameter of the
init action to enable the configuration file. The value of
config-file is the path to the configuration file you want to use. This example loads the configuration file
- uses: github/codeql-action/init@v1 with: config-file: ./.github/codeql/codeql-config.yml
The configuration file must be located within the local repository. For information on how to write a configuration file, see "Using a custom configuration file."
If you only want to customise the queries used, you can specify them in your workflow instead of creating a config file, using the
queries property of the
- uses: github/codeql-action/init@v1 with: queries: <local-or-remote-query>,<another-query>
By default, this will override any queries specified in a config file. If you wish to use both sets of queries, prefix the list of queries in the workflow with
- uses: github/codeql-action/init@v1 with: queries: +<local-or-remote-query>,<another-query>
Read about troubleshooting code scanning.