CodeQL Analysis AI Skill Guide

Overview & Engine Architecture

CodeQL models source code as a queryable database. GitHub Actions (or CLI) builds a CodeQL DB per language, runs query suites, and uploads SARIF to code scanning. Agents enable default suites first, fix real issues with root-cause patches, and add path/query exclusions only with documented rationale - not to hide debt permanently.

Source checkout
   -> CodeQL init + autobuild/build
       -> CodeQL analyze (query suite)
           -> SARIF upload -> GitHub code scanning alerts

When to use this skill

• Turning on GitHub code scanning for a repo
• Triaging CodeQL alerts on PRs
• Adding custom queries for org-specific bugs
• Comparing deep semantic findings vs pattern SAST (@semgrep)