resolve-codeql

Resolve CodeQL

Fix CodeQL alerts in current repository only by analyzing, classifying, and delegating to specialized agents.

Scope Options

Usage	Scope	Batch Size
/resolve-codeql	List all alerts	N/A
/resolve-codeql fix	Fix all alerts	5
/resolve-codeql type:permissions	Permissions alerts only	5
/resolve-codeql type:injection	Expression injection only	5
/resolve-codeql type:other	Other alert types	5
/resolve-codeql file:path/to/workflow.yml	Specific file only	N/A

Related

• codeql-permissions-auditor agent - Fix missing permissions
• codeql-expression-injector agent - Mitigate injection vulnerabilities
• codeql-generic-resolver agent - Handle other alert types
• codeql-permission-classification skill - Permission requirements
• github-workflow-security-patterns skill - Security patterns

Workflow

Phase 1: Alert Discovery & Classification

Replace <OWNER> and <REPO> before running.

This endpoint needs a token carrying security_events: read (App installation) or the security_events scope (classic PAT). Without it the call returns 403 Resource not accessible by integration. That is a credential gap, not an empty alert list — never read it as "no alerts". See the gh-cli-patterns skill for how to tell that 403 apart from the one meaning code scanning is simply disabled.

gh api 'repos/<OWNER>/<REPO>/code-scanning/alerts?state=open&per_page=100' --paginate \
  --jq '.[] | {
    number,
    rule: .rule.id,
    severity: .rule.severity,
    location: .most_recent_instance.location.path,
    message: .most_recent_instance.message.text
  }'

Group results by rule type:

• actions/missing-workflow-permissions -> Permissions category
• actions/expression-injection -> Expression injection category
• Others -> Generic category

Apply scope filter (if provided):

• type:permissions, type:injection, type:other
• file:<path> - only alerts in specific file