Build: Enable CodeQL in GitHub Actions

0/4 steps

✓📚 Read

✓👁 See

✓🎞 Animate

✓🎯 Test

5⚙️ Build

Build Steps

Progress

0/4

◆ Before you start

Prerequisites

GitHub repositoryRequired
Actions must be enabled
DockerOptional
For running OWASP ZAP locally
Snyk accountOptional
Free tier available — get SNYK_TOKEN
Get it ↗

🔍

Step 1 of 4

Enable CodeQL in GitHub Actions

Add CodeQL to your repository. It will automatically scan on every push and PR, reporting findings in the GitHub Security tab.

Tasks

Create `.github/workflows/codeql.yml` with the provided configuration

Push to a feature branch and create a PR

Check the Security → Code Scanning tab for results

🎯 What You'll Learn

▸Configure CodeQL for your language
▸Understand security-extended vs default queries
▸Read findings in GitHub Security tab (SARIF)

Code

YAML.github/workflows/codeql.yml
1 name: CodeQL SAST
2  
3 on:
4   push:
5     branches: [main]
6   pull_request:
7   schedule:
8     - cron: '0 5 * * 1'  # Weekly Monday 5am
9  
10 jobs:
11   analyze:
12     name: Analyze
13     runs-on: ubuntu-latest
14     permissions:
15       security-events: write
16       contents: read
17     steps:
18       - uses: actions/checkout@v4
19  
20       - name: Initialize CodeQL
21         uses: github/codeql-action/init@v3
22         with:
23           languages: typescript
24           queries: security-extended
25  
26       - name: Build
27         run: npm ci
28  
29       - name: Perform CodeQL Analysis
30         uses: github/codeql-action/analyze@v3
31         with:
32           upload: true
33

💡 Pro Tips

▸The `security-extended` query pack finds more vulnerabilities but takes longer — suitable for main branch; use `security-and-quality` for PRs

Expected Output

Code scanning workflow runs; results visible in GitHub Security tab

Discussion

1 name: CodeQL SAST 2 3 on: 4 push: 5 branches: [main] 6 pull_request: 7 schedule: 8 - cron: '0 5 * * 1' # Weekly Monday 5am 9 10 jobs: 11 analyze: 12 name: Analyze 13 runs-on: ubuntu-latest 14 permissions: 15 security-events: write 16 contents: read 17 steps: 18 - uses: actions/checkout@v4 19 20 - name: Initialize CodeQL 21 uses: github/codeql-action/init@v3 22 with: 23 languages: typescript 24 queries: security-extended 25 26 - name: Build 27 run: npm ci 28 29 - name: Perform CodeQL Analysis 30 uses: github/codeql-action/analyze@v3 31 with: 32 upload: true 33

1	name: CodeQL SAST
2
3	on:
4	push:
5	branches: [main]
6	pull_request:
7	schedule:
8	- cron: '0 5 * * 1' # Weekly Monday 5am
9
10	jobs:
11	analyze:
12	name: Analyze
13	runs-on: ubuntu-latest
14	permissions:
15	security-events: write
16	contents: read
17	steps:
18	- uses: actions/checkout@v4
19
20	- name: Initialize CodeQL
21	uses: github/codeql-action/init@v3
22	with:
23	languages: typescript
24	queries: security-extended
25
26	- name: Build
27	run: npm ci
28
29	- name: Perform CodeQL Analysis
30	uses: github/codeql-action/analyze@v3
31	with:
32	upload: true
33