CtrlK
BlogDocsLog inGet started
Tessl Logo

testland/codeql-queries

Configures and runs GitHub CodeQL - semantic-database SAST with queries written in the CodeQL declarative query language; supports `codeql database create` (per-language) + `codeql database analyze` with --format=sarif; ships query packs (`codeql/javascript-queries`, `codeql/python-queries`, `codeql/java-queries`, `codeql/go-queries`, etc.); integrates with GitHub Code Scanning via SARIF upload; suppression via inline comment + sarif-filter + Security-tab dismissal. Use when the team uses GitHub-hosted repos and needs deep semantic SAST beyond pattern matching (cross-file taint flows, dataflow analysis).

70

Quality

88%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Low

Low-risk findings worth noting

Overview
Quality
Evals
Security
Files

codeql-reference.mdreferences/

CodeQL query packs, custom queries, and CI

Reference detail for codeql-queries. The SKILL.md spine keeps the core create/analyze/triage path; this file holds the full pack list, the custom .ql example, and the GitHub Actions integration. Per docs.github.com/code-security/codeql-cli.

Query packs

PackCoverage
codeql/javascript-queriesJS/TS standard checks
codeql/python-queriesPython checks
codeql/java-queriesJava + Kotlin checks
codeql/go-queriesGo checks
codeql/cpp-queriesC/C++ checks
codeql/csharp-queriesC# checks
codeql/ruby-queriesRuby checks
codeql/swift-queriesSwift checks

Each pack ships query suites: code-scanning (default for GitHub Code Scanning), security-and-quality (broader), security-extended (more rules, more false positives).

codeql database analyze my-db \
  codeql/javascript-queries:codeql-suites/javascript-security-extended.qls \
  --format=sarif-latest \
  --output=results.sarif

Custom query authoring

/**
 * @name Hardcoded JWT secret in jwt.sign call
 * @description Detects jwt.sign() calls with literal-string secret
 * @kind problem
 * @problem.severity error
 * @id js/hardcoded-jwt-secret
 * @tags security
 *       external/cwe/cwe-798
 */

import javascript

from CallExpr call, StringLiteral secret
where
  call.getCalleeName() = "sign" and
  call.getReceiver().(VarRef).getName() = "jwt" and
  call.getArgument(1) = secret
select call, "Hardcoded JWT secret detected: " + secret.getValue()

Custom queries register in a query suite (.qls) for selective execution. Validate them with codeql test against expected-results files.

CI integration (GitHub Actions)

Most teams use the GitHub-hosted action for any GitHub-hosted repo:

jobs:
  codeql:
    runs-on: ubuntu-latest
    permissions:
      security-events: write   # for SARIF upload to Security tab
    steps:
      - uses: actions/checkout@v5
      - uses: github/codeql-action/init@v3
        with:
          languages: javascript, python
          queries: security-extended
      - run: ./gradlew build   # or whatever build step is needed
      - uses: github/codeql-action/analyze@v3
        with:
          category: "/language:javascript"

For non-GitHub CI (GitLab / Jenkins), use the CodeQL CLI directly (create + analyze) and upload SARIF to GitHub Code Scanning via the API or a SARIF-compatible viewer.

references

codeql-reference.md

SKILL.md

tile.json