How to Enable CodeQL Analysis in Your GitHub Repository

[Lomanu4]

What is CodeQL?


CodeQL is GitHub's semantic code analysis engine that lets you discover vulnerabilities in your code before they reach production. It treats code as data, allowing you to query your codebase like a database and find security weaknesses automatically.

Why Use CodeQL?


Detect Real Vulnerabilities: Find SQL injections, XSS, path traversals, and more
Integrated Security: Runs directly in your GitHub workflow
Multiple Languages: Supports JavaScript, TypeScript, Python, Java, C#, C++, Go, and Ruby
Free for Public Repositories: Complete security analysis at no cost for open-source projects

Setting Up CodeQL Analysis in few Steps


Enable GitHub Actions in Your Repository

First, make sure GitHub Actions is enabled:

1. Navigate to your repository on GitHub
2. Click on the "Settings" tab
3. Select "Actions" from the sidebar
4. Make sure "Allow all actions and reusable workflows" is selected

First (easier) method

Go to your repository and click in Security Tab.

Пожалуйста Авторизируйтесь или Зарегистрируйтесь для просмотра скрытого текста.

Now click on setup code scanning

Пожалуйста Авторизируйтесь или Зарегистрируйтесь для просмотра скрытого текста.

Now select Default option

Пожалуйста Авторизируйтесь или Зарегистрируйтесь для просмотра скрытого текста.

After select default you'll see the following prompt

Пожалуйста Авторизируйтесь или Зарегистрируйтесь для просмотра скрытого текста.

• It shows languages that you have in your project and workflows if available too. You can click in edit to remove languages, workflows, select branchs to run and so forth.

Now the second way

Create a CodeQL Workflow File
Create a new file at .github/workflows/codeql-analysis.yml with the following content:

name: "CodeQL Analysis"

on:
push:
branches: [ "main" ]
pull_request:
branches: [ "main" ]
schedule:
- cron: '30 1 * * 0' # Runs at 1:30 AM UTC every Sunday

jobs:
analyze:
name: Analyze
runs-on: ubuntu-latest
permissions:
actions: read
contents: read
security-events: write

strategy:
fail-fast: false
matrix:
language: [ 'javascript', 'python' ] # Modify these languages as needed
# Available options: 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby'

steps:
- name: Checkout repository
uses: actions/checkout@v3

- name: Initialize CodeQL
uses: github/codeql-action/init@v2
with:
languages: ${{ matrix.language }}

# Autobuild attempts to build any compiled languages
- name: Autobuild
uses: github/codeql-action/autobuild@v2

- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v2
with:
category: "/language:${{matrix.language}}"
Customize for Your Project


Modify the workflow file based on your needs:

• Branches: Change main to your default branch name if different
• Languages: Update the language matrix to include only languages your project uses
• Schedule: Adjust the cron schedule as needed for regular scanning

Commit and Push Your Changes


git add .github/workflows/codeql-analysis.yml
git commit -m "Add CodeQL security scanning workflow"
git push
View Results in the Security Tab

After the workflow runs:

1. Go to your repository on GitHub
2. Click on the "Security" tab
3. Select "Code scanning alerts" from the left sidebar
4. Review any security vulnerabilities discovered by CodeQL

Code with some security alerts

Пожалуйста Авторизируйтесь или Зарегистрируйтесь для просмотра скрытого текста.

Advanced Configuration

Custom Build Steps
If your project requires custom build steps instead of using the autobuild feature:

# Replace the autobuild step with custom commands
- name: Custom Build Steps
run: |
# Add your custom build commands here
./configure
make bootstrap
make release

- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v2
Adding CodeQL Query Suites
You can use custom query suites for specialized analysis:
yaml- name: Initialize CodeQL
uses: github/codeql-action/init@v2
with:
languages: ${{ matrix.language }}
queries: security-extended,security-and-quality

Available query suites include:

security-extended: Additional queries for security analysis
security-and-quality: Security queries plus quality and correctness

Troubleshooting


Common Issues

• 
  Workflow not running
  
  • Check that GitHub Actions is enabled
  • Verify branch names match your repository
• 
  Builds failing
  
  • Look at workflow logs to identify build issues
  • Consider using custom build steps if autobuild fails
• 
  Memory issues
  
  • For large codebases, you might need to adjust RAM limits:

- name: Initialize CodeQL
uses: github/codeql-action/init@v2
with:
languages: ${{ matrix.language }}
ram: '8192'
Best Practices

1. Run on schedule to catch issues even when code isn't actively being pushed
2. Review alerts promptly and address security issues
3. Use pull request integration to catch issues before they're merged
4. Configure code owners for security alerts to ensure follow-up

Conclusion


Setting up CodeQL is a powerful step toward securing your codebase. By incorporating it into your GitHub workflow, you create an automated security review process that can catch vulnerabilities before they impact your users.
For more information, check GitHub's

Пожалуйста Авторизируйтесь или Зарегистрируйтесь для просмотра скрытого текста.

Have you implemented CodeQL in your projects? Share your experience in the comments below!

Пожалуйста Авторизируйтесь или Зарегистрируйтесь для просмотра скрытого текста.