Configures and runs GitHub CodeQL - semantic-database SAST with queries written in the CodeQL declarative query language; supports `codeql database create` (per-language) + `codeql database analyze` with --format=sarif; ships query packs (`codeql/javascript-queries`, `codeql/python-queries`, `codeql/java-queries`, `codeql/go-queries`, etc.); integrates with GitHub Code Scanning via SARIF upload; suppression via inline comment + sarif-filter + Security-tab dismissal. Use when the team uses GitHub-hosted repos and needs deep semantic SAST beyond pattern matching (cross-file taint flows, dataflow analysis).
日本語の概要は準備中です。原文の説明を表示しています。
実行スコア 未検証
インストール方法を見るインストールする前に、エージェントに与えられる指示の中身を確認できます。
Per docs.github.com/code-security/codeql-cli:
CodeQL is GitHub's semantic-analysis SAST: build a database of the
codebase (control flow, data flow, type info), run .ql queries
against it, emit SARIF for GitHub Code Scanning. This
database-then-query model catches cross-file taint flows (user input
reaching a SQL sink unsanitized) that pattern matchers cannot express.
For multi-platform CI without GitHub, use semgrep-rules
or sonarqube-rules.
CodeQL CLI download from github.com/github/codeql-cli-binaries/releases. Per cql-docs the CLI is bundled separately from the queries - install both:
# Download CodeQL CLI (per platform)
curl -L https://github.com/github/codeql-cli-binaries/releases/latest/download/codeql-linux64.zip -o codeql.zip
unzip codeql.zip
export PATH="$PATH:$PWD/codeql"
# Verify
codeql --version
Query packs (the .ql files) are pulled per-scan via
--download flag or pre-installed via codeql pack download.
# For interpreted languages (JS, Python, Ruby): no build needed
codeql database create my-db --language=javascript --source-root=.
# For compiled languages (Java, C#, Go): wrap the build
codeql database create my-db --language=java --command="./gradlew build" --source-root=.
codeql database create my-db --language=cpp --command="make all"
The --language flag accepts: cpp / csharp / go / java /
javascript / python / ruby / swift / kotlin (verify
support against cql-docs for the current CodeQL release).
For JS/TS + Python, the --build-mode none extraction works
without a build step. For Java/C#/C++, you MUST wrap the project's
build via --command so CodeQL can observe compilation.
codeql database analyze my-db \
--format=sarif-latest \
--output=results.sarif \
codeql/javascript-queries
The full per-language pack list, the query suites (code-scanning,
security-and-quality, security-extended), a custom .ql query
example, and the GitHub Actions CI integration are in
references/codeql-reference.md.
Three layers:
| Mechanism | Example | When to use |
|---|---|---|
Inline // codeql[<rule-id>] | // codeql[js/sql-injection] - Reason: input pre-sanitized via library X | Single-line exception with documented rationale |
| SARIF post-processing filter | cat results.sarif | jq 'del(.runs[].results[] | select(.ruleId == "js/path-injection" and .locations[].physicalLocation.artifactLocation.uri | startswith("vendor/")))' | Bulk exclusion of vendored / generated code |
| GitHub Security tab dismissal | UI: "Dismiss alert" → False positive / Won't fix / Used in tests | Persistent, auditable, requires reviewer comment |
Justification template (mandatory in code):
// codeql[js/sql-injection]
// Reason: parameter pre-validated via Joi schema (line 42); literal interpolation safe
// Reviewer: alice@example.com (2026-05-15)
// Expires: 2026-12-15
const result = await db.query(`SELECT * FROM users WHERE id = ${userId}`);
GitHub Security tab dismissals are persistent + auditable + show in the audit log; prefer them over inline comments for production suppressions.
Cadence: every quarter, review GitHub Security → "Dismissed alerts" filter; expired ones reopened for re-review.
CodeQL databases can be GBs for large codebases. Performance flags:
codeql database create my-db --language=java \
--command="./gradlew build" \
--threads=8 \
--ram=8192 # MB
For incremental scanning (changed-files-only), GitHub's hosted
runner uses caching across runs. Self-hosted CI must implement
caching manually (the codeql-action/init action handles it on
GitHub).
| Anti-pattern | Why it fails | Fix |
|---|---|---|
Skip --command for compiled languages | Database empty; analysis returns no findings silently | Always wrap the build (Step 2) |
Use security-extended without baseline | Flood of pre-existing findings overwhelms the team | Start with code-scanning; ratchet up |
| Inline comment without GitHub dismissal | No audit trail | Use Security-tab dismissal for persistent FPs (Step 4) |
| Run CodeQL on every PR for large codebase | Database creation is slow (10 - 30 min); PR cycle slow | Schedule full scan nightly; PR-only delta scanning via Code Scanning |
| Custom queries without test suite | Bugs in custom queries miss real findings | Use codeql test to validate against expected-results files |
semgrep-rules,
sonarqube-rules,
language-native-sast - sister scannersまだレビューはありません。使ってみた感想をお寄せください。
ログインなしで書き込めます。使ってみた感想、質問、動かなかった環境などを気軽にどうぞ。
まだコメントはありません。最初のコメントを書いてみませんか。
Builds a CI gate that fails the build on **new** WCAG / a11y violations introduced by a PR while grandfathering pre-existing violations on a per-rule / per-page baseline. Aggregates verdicts from axe-core / pa11y / Lighthouse a11y / WAVE / IBM Equal Access scans. Use when a project has accumulated a11y debt and a strict "zero violations" gate would block every PR - the ratchet pattern lets the team ship while preventing regressions.
日本語の概要は準備中です。原文の説明を表示しています。
Workflow skill that builds an A/B-test validity checklist from an experiment proposal, walking the canonical design-correctness gates - pre-registered OEC/power/guardrails, randomization unit + SRM check, assignment integrity, telemetry, peeking discipline, novelty/primacy, post-experiment SRM re-check - into a per-experiment checklist + sign-off form. Use when launching, auditing, or governing an experiment. For pitfall mechanics (guardrails, peeking) see experiment-results-interpreter's references; to read an already-valid result use experiment-results-interpreter; for per-SDK harness tests use experiment-sdk-testing - this gates DESIGN, not SDK code.
日本語の概要は準備中です。原文の説明を表示しています。
The single install-flow skill: the reference contract for the PWA install flow (installability gate fields, `beforeinstallprompt` handshake, per-platform paths - Android WebAPK / iOS Share menu / Firefox no-op - and the `display-mode` post-install signal, in references/install-flow-reference.md) plus the build-an-X workflow that emits the Add-to-Home-Screen suite. Walks the four-stage timeline, emitting one test per gate cell per [web.dev/articles/install-criteria][install-criteria], the deferred-prompt → `prompt()` → `userChoice` chain per [web.dev/articles/customize-install][customize-install], the iOS Safari manual-metadata branch (`apple-touch-icon`) per [web.dev/learn/pwa/installation][learn-pwa], and the post-install `(display-mode: standalone)` MQ assertion. Output: a Playwright spec with per-stage cells plus a coverage matrix. Use when a PWA's manifest, icons, or install handler change, when install conversion drops at an unknown stage, or when triaging a flaky install assertion.
日本語の概要は準備中です。原文の説明を表示しています。
Build-an-X workflow that uses an LLM to map existing tests to spec sections - given a spec doc + the test suite, the LLM identifies which tests cover which sections, surfaces uncovered sections (gap), and recommends specific tests to add. Output is a coverage matrix per spec ID. Scope is mapping tests that already exist and naming the gaps, not authoring tests for new acceptance criteria. Use when a spec doc and a test suite both exist but nobody can say which requirements are actually covered - before a release sign-off, an audit, or a decision about where to spend the next round of test effort.
日本語の概要は準備中です。原文の説明を表示しています。
Generates tests from natural-language specs (acceptance criteria, user stories, requirements) using an LLM, with confidence scoring per test case (LLM self-assessment plus heuristics: assertion quality, naming, completeness), batching uncertain cases for human review, and integration with the team's existing test framework. Use when the user asks to generate unit tests from acceptance criteria, convert user stories to test cases, automate test creation from requirements, or augment a spec-driven test suite with AI-generated stubs that are then curated before merge.
日本語の概要は準備中です。原文の説明を表示しています。
Configures Allure Report (test-runner adapter install, `allure-results` directory wiring, `categories.json` for failure classification, `history-trend.json` retention via the copy-history-between-runs pattern), runs the Allure CLI to convert `allure-results` to a static HTML site, and uploads the report as a CI artifact. Use when the team needs richer test reporting than JUnit XML - step-level attachments, per-test history, retry tracking, and severity / epic / feature labeling across framework-agnostic adapters (pytest, Jest, JUnit, TestNG, NUnit, Mocha). As a rich static HTML report generator, it is the open-source alternative to the sunset ExtentReports (JVM/.NET per-test HTML narrative); for hosted cross-run flakiness analytics rather than a static per-run report use currents-integration.
日本語の概要は準備中です。原文の説明を表示しています。