github/codeql-action

Run GitHub CodeQL static analysis to find security vulnerabilities in your code.

Official actionCategory: Security & Supply ChainLatest v3View on GitHub

What it does

github/codeql-action is the engine behind GitHub Code Scanning. You run codeql-action/init to set up a language, build if needed, then codeql-action/analyze to run the queries and upload results.

Findings appear in the repository Security tab and can annotate pull requests.

Usage

workflow (.yml)

permissions:
  security-events: write
  contents: read
steps:
  - uses: actions/checkout@v4
  - uses: github/codeql-action/init@v3
    with:
      languages: javascript
  - uses: github/codeql-action/analyze@v3

Inputs

Input	Description	Default	Required
`languages`	Languages to analyze (on init), e.g. javascript, python.	-	No
`queries`	Extra query suites to run.	`default`	No
`config-file`	Path to a CodeQL config file.	-	No

Notes

The job needs permissions: security-events: write to upload results.

Compiled languages need a build between init and analyze (autobuild or your own build step).

Common errors

Resource not accessible by integration means the job lacks security-events: write.
For compiled languages, "no code found" usually means the build did not run between init and analyze.

Security and pinning

This is a first-party GitHub action, but still pin the @v3 reference to a SHA for consistency with your other pins.

Alternatives and related

step-security/harden-runnerMonitor and restrict a runner's network egress to detect and block CI supply-chain attacks.

Frequently asked questions

How do I enable CodeQL in Actions?

Add a workflow that runs codeql-action/init with your languages, then codeql-action/analyze, with security-events: write permission.

References

GitHub Actions documentation