“codeql”的搜索结果

Set up CodeQL security scanning in GitHub Actions or with the local CLI. Get guidance on language settings, build steps, analysis rules, result uploads, and troubleshooting so you can configure scans and interpret their findings.

中文简介正在准备中。当前显示英语简介。

• Adding security scans to GitHub Actions
• Running local scans with the CodeQL CLI
• Investigating failed builds or result uploads

Edit and validate Bazel build settings using conventions specific to CodeQL development. Follow established helpers for packaging and operating system differences, add dependencies with checksums, and check changed targets while respecting the standalone build setup.

中文简介正在准备中。当前显示英语简介。

• Edit CodeQL Bazel build files
• Configure packaging for different operating systems
• Add external build dependencies

Scans code for security vulnerabilities with CodeQL by tracing data across functions. Builds and checks analysis databases, models project-specific APIs, and saves findings in SARIF, a structured results format, with broad or focused scan options.

中文简介正在准备中。当前显示英语简介。

• Scanning a codebase for security vulnerabilities
• Tracing untrusted input through custom APIs
• Choosing broad or high-precision security scans

Comprehensive guide for setting up and configuring CodeQL code scanning via GitHub Actions workflows and the CodeQL CLI. This skill should be used when users need help with code scanning configuration, CodeQL workflow files, CodeQL CLI commands, SARIF output, security analysis setup, or troubleshooting CodeQL analysis.

中文简介正在准备中。当前显示原文说明。

Comprehensive guide for setting up and configuring CodeQL code scanning via GitHub Actions workflows and the CodeQL CLI. This skill should be used when users need help with code scanning configuration, CodeQL workflow files, CodeQL CLI commands, SARIF output, security analysis setup, or troubleshooting CodeQL analysis.

中文简介正在准备中。当前显示原文说明。

Comprehensive guide for setting up and configuring CodeQL code scanning via GitHub Actions workflows and the CodeQL CLI. This skill should be used when users need help with code scanning configuration, CodeQL workflow files, CodeQL CLI commands, SARIF output, security analysis setup, or troubleshooting CodeQL analysis.

中文简介正在准备中。当前显示原文说明。

Find other occurrences of a known bug across a codebase by tracing its root cause. Gradually broaden search patterns, assess matching candidates, assign severity, and document findings with rules to help prevent recurrence.

中文简介正在准备中。当前显示英语简介。

• Finding similar issues after discovering a vulnerability
• Building CodeQL or Semgrep queries from a known bug
• Checking whether similar code shares the same root cause

Connect static analysis results and human audit notes to a Trailmark code graph. Group findings by severity and compare them with input flow, impact, and privilege boundaries to prioritize investigation and understand findings in their code context.

中文简介正在准备中。当前显示英语简介。

• Connecting Semgrep or CodeQL results to code structure
• Combining human audit notes with automated findings
• Prioritizing findings using input flow and impact

Run CodeQL static analysis for security vulnerability detection, taint tracking, and data flow analysis. Use when asked to analyze code with CodeQL, create CodeQL databases, write custom QL queries, perform security audits, or set up CodeQL in CI/CD pipelines.

中文简介正在准备中。当前显示原文说明。

Process SARIF files, a standard format for static analysis results, to filter alerts, remove duplicates, combine findings from multiple tools, and produce reports. It also supports comparing runs and integrating result checks into CI/CD pipelines.

中文简介正在准备中。当前显示英语简介。

• Combine findings from multiple security scanners
• Filter alerts by severity and remove duplicates
• Compare earlier and current results for new issues

Run CodeQL database creation and security queries, add data-extension models, or process CodeQL SARIF. Use when CodeQL is explicitly requested; use security-review for a broader manual security review.

中文简介正在准备中。当前显示原文说明。

Use the open-source CodeQL ecosystem for .NET security analysis. Use when a repo needs CodeQL query packs, CLI-based analysis on open source codebases, or GitHub Action setup with explicit licensing caveats. USE FOR: the repo uses or wants CodeQL for .NET security analysis; GitHub code scanning is part of the CI plan. DO NOT USE FOR: teams that need a tool with no private-repo licensing caveat. INVOKES: inspect the repository context, edit targeted files, and run relevant build, test, lint, or validation commands when changes are made.

中文简介正在准备中。当前显示原文说明。

Review authorized source code or pull request changes for security flaws. Combine automated static analysis, which checks code without running it, with manual validation to document affected locations, data flows, reproduction examples, and suggested fixes.

中文简介正在准备中。当前显示英语简介。

• Reviewing pull request changes for security issues
• Checking scanner findings for false positives
• Investigating authorization and injection flaws

Set up automated security checks that inspect source code without running the application. Configure Semgrep, SonarQube, or CodeQL, add project-specific rules, reduce false alarms, and define criteria for blocking problematic changes.

中文简介正在准备中。当前显示英语简介。

• Adding automated security scans to CI/CD
• Creating security rules for project-specific code patterns
• Reducing false alarms and scan time

Uses a known or suspected vulnerability to find related code through Trailmark's graph of calls, types, and implementations. Produces ranked review targets with reasons and limitations for follow-up security analysis.

中文简介正在准备中。当前显示英语简介。

• Finding variants of a known vulnerability
• Prioritizing code that shares sensitive operations
• Preparing candidates for Semgrep or CodeQL review

Parses and processes SARIF files from static analysis tools like CodeQL, Semgrep, or other scanners. Triggers on "parse sarif", "read scan results", "aggregate findings", "deduplicate alerts", or "process sarif output". Handles filtering, deduplication, format conversion, and CI/CD integration of SARIF data. Does NOT run scans — use the Semgrep or CodeQL skills for that.

中文简介正在准备中。当前显示原文说明。

bu skill covers integrating Static Application Security Testing (SAST) tools—CodeQL and Semgrep—into GitHub Actions CI/CD pipelines. It addresses configuring automated code scanning on pull requests and pushes, tuning rules to reduce false positives, uploading SARIF results to GitHub Advanced Security, and establishing quality gates that block merges when high-severity vulnerabilities are Detected.

中文简介正在准备中。当前显示原文说明。

Configure GitHub Advanced Security with CodeQL to perform automated static analysis and vulnerability Tespit across repositories at enterprise scale.

中文简介正在准备中。当前显示原文说明。

Triage and fix Dependabot alerts and CodeQL findings in the ai repository. Use when the user asks to address security vulnerabilities, fix Dependabot alerts, resolve CodeQL issues, or do security maintenance.

中文简介正在准备中。当前显示原文说明。

调查OpenClaw CI的排队和运行环境不足问题，根据测量结果调整运行器注册预算、并行数量、测试分组、运行器规格及任务分配位置。

• 调查OpenClaw CI排队原因
• 估算高峰期运行器注册数量
• 调整并行数量和测试拆分

Compare multiple NemoClaw pull requests addressing the same issue. It checks merge eligibility, correctness, quality, and attribution, then produces an evidence-based recommendation for merging or choosing a candidate for further repair.

中文简介正在准备中。当前显示英语简介。

• Comparing competing pull requests for one issue
• Checking merge eligibility before ranking proposals
• Choosing a candidate to repair when none is ready

Helps review application code, authentication, access controls, and dependencies for security flaws. Uses OWASP guidance and CVE reports, records of known vulnerabilities, to assess impact and recommend practical fixes.

中文简介正在准备中。当前显示英语简介。

• Reviewing application code for security flaws
• Assessing known vulnerabilities in dependencies
• Checking authentication and data access controls

Prepare a codebase for an external security review by defining goals, running static checks, improving test coverage, and removing unused code. Assemble the review scope, verified build instructions, diagrams, and documentation into a package for auditors.

中文简介正在准备中。当前显示英语简介。

• Preparing a codebase for an external security audit
• Organizing fixes and missing tests before review
• Defining the review scope and a stable code version

Perform static application security testing with tools like Semgrep, CodeQL, and SonarQube. Identify security vulnerabilities in source code before deployment. Use when implementing secure SDLC, code review automation, or security gates in CI/CD pipelines.

中文简介正在准备中。当前显示原文说明。