codeql-scan

CodeQL Scan Skill

Execute CodeQL security scans with automated language detection, database caching, and SARIF output generation.

Quick Start

# Via Claude Code skill system
/codeql-scan

# Full scan with auto-detected languages
python3 "${COPILOT_PLUGIN_ROOT:-${CLAUDE_PLUGIN_ROOT:-.claude}}/skills/codeql-scan/scripts/invoke_codeql_scan.py" --operation full

# Quick scan with cached databases
python3 "${COPILOT_PLUGIN_ROOT:-${CLAUDE_PLUGIN_ROOT:-.claude}}/skills/codeql-scan/scripts/invoke_codeql_scan.py" --operation quick

# Validate configuration only
python3 "${COPILOT_PLUGIN_ROOT:-${CLAUDE_PLUGIN_ROOT:-.claude}}/skills/codeql-scan/scripts/invoke_codeql_scan.py" --operation validate

Triggers

• Run CodeQL scan
• Check for vulnerabilities
• Validate CodeQL configuration
• Quick security scan
• Scan for security issues

Decision Tree

Need CodeQL analysis?
+-- First time setup       --> python3 .codeql/scripts/install_codeql.py
+-- Validate config        --> invoke_codeql_scan.py --operation validate
+-- Full repository scan   --> invoke_codeql_scan.py --operation full
+-- Quick scan (cached)    --> invoke_codeql_scan.py --operation quick
+-- Specific language      --> invoke_codeql_scan.py --operation full --languages python
+-- CI mode                --> invoke_codeql_scan.py --operation full --ci

When to Use Each Operation

Operation	Use When	Performance	Output
full	First scan, major changes, pre-PR validation	30-60s	SARIF + Console
quick	Iterative development, minor changes	10-20s	SARIF + Console
validate	Config changes, troubleshooting	<5s	Console only

Process

flowchart TD
    A[Start CodeQL Scan] --> B{Operation Type}
    B -->|full| C[Check CLI Installed]
    B -->|quick| C
    B -->|validate| D[Run test_codeql_config.py]

    C --> E{CLI Available?}
    E -->|No| F[Error: Install CLI]
    E -->|Yes| G[Detect Languages]

    G --> H[Run invoke_codeql_scan.py]
    H --> I{Scan Successful?}

    I -->|Yes| J[Generate SARIF]
    I -->|No| K[Error: Scan Failed]

    J --> L[Display Summary]
    D --> M{Config Valid?}
    M -->|Yes| N2[Display Config Status]
    M -->|No| O2[Exit 2: Config Invalid]

    L --> N[Exit 0]
    N2 --> N
    F --> O[Exit 3]
    K --> P[Exit 3]