What it does. Configures GitHub Advanced Security (code scanning with CodeQL, secret scanning, dependency review, and Dependabot alerts) to perform automated static analysis and vulnerability detection across repositories at enterprise scale, including custom CodeQL queries and CI workflow integration. Use when setting up or tuning code scanning, rolling out CodeQL across an organization, or shifting SAST left into pull request workflows. Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Upstream	mukul975/Anthropic-Cybersecurity-Skills
Skill file	skills/implementing-github-advanced-security-for-code-scanning/SKILL.md
License	Apache-2.0 (skill folder LICENSE)
Author	mukul975
Fetched	2026-09-10

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-github-advanced-security-for-code-scanning, or copy the skill folder into ~/.claude/skills/implementing-github-advanced-security-for-code-scanning/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-github-advanced-security-for-code-scanning/SKILL.md

SKILL.md (verbatim)

name: implementing-github-advanced-security-for-code-scanning
description: Configures GitHub Advanced Security (code scanning with CodeQL, secret scanning, dependency review, and Dependabot alerts) to perform automated static analysis and vulnerability detection across repositories at enterprise scale, including custom CodeQL queries and CI workflow integration. Use when setting up or tuning code scanning, rolling out CodeQL across an organization, or shifting SAST left into pull request workflows.
domain: cybersecurity
subdomain: devsecops
tags:
- github-advanced-security
- codeql
- sast
- code-scanning
- supply-chain-security
- devops-security
- shift-left
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- PR.PS-01
- GV.SC-07
- ID.IM-04
- PR.PS-04
mitre_attack:
- T1195
- T1554
- T1059.004

Implementing GitHub Advanced Security for Code Scanning

Overview

GitHub Advanced Security (GHAS) integrates CodeQL-powered static application security testing directly into the GitHub development workflow. CodeQL treats code as data, enabling semantic analysis that identifies security vulnerabilities such as SQL injection, cross-site scripting, buffer overflows, and authentication flaws with significantly fewer false positives than traditional pattern-matching scanners. GHAS encompasses code scanning, secret scanning, dependency review, and Dependabot alerts to provide a comprehensive security posture for repositories.

When to Use

• When deploying or configuring implementing github advanced security for code scanning capabilities in your environment
• When establishing security controls aligned to compliance requirements
• When building or improving security architecture for this domain
• When conducting security assessments that require this implementation

Prerequisites

• GitHub Enterprise Cloud or GitHub Enterprise Server 3.0+ with GHAS license
• Repository admin or organization owner permissions
• Familiarity with GitHub Actions workflow syntax (YAML)
• Supported languages: C/C++, C#, Go, Java/Kotlin, JavaScript/TypeScript, Python, Ruby, Swift

Core Concepts

CodeQL Analysis Engine

CodeQL compiles source code into a queryable database, then executes security-focused queries against that database. The query suites ship with hundreds of checks mapped to CWE identifiers and cover OWASP Top 10, SANS Top 25, and language-specific vulnerability patterns. Custom queries can be authored using the CodeQL query language (QL) to detect organization-specific anti-patterns.

Default Setup vs. Advanced Setup

Default Setup enables code scanning with a single click from the repository's Code Security settings. GitHub automatically determines the languages present, selects appropriate query suites, and configures scanning triggers. This approach requires no workflow file and is ideal for rapid onboarding.

Advanced Setup generates a .github/workflows/codeql.yml workflow file that can be customized. Teams control scheduling, language matrices, build commands for compiled languages, additional query packs, and integration with third-party SARIF producers. Advanced setup is required when custom build steps, monorepo configurations, or private query packs are needed.

Organization-Wide Rollout

For enterprises managing hundreds of repositories, GHAS supports configuring code scanning at scale using the organization-level security overview. Administrators can enable default setup across all eligible repositories, define custom security configurations, and monitor adoption through the security coverage dashboard.

Workflow

Step 1 --- Enable GHAS on the Organization

1. Navigate to Organization Settings > Code security and analysis
2. Enable GitHub Advanced Security for all repositories or selected repositories
3. Confirm license seat allocation (GHAS is billed per active committer)

Step 2 --- Configure Default Setup for Quick Wins

1. Go to Repository Settings > Code security > Code scanning
2. Click "Set up" in the CodeQL analysis row and select "Default"
3. Review the auto-detected languages and query suite (default or extended)
4. Click "Enable CodeQL" to activate scanning on push and pull request events

Step 3 --- Advanced Setup with Custom Workflow

Create .github/workflows/codeql-analysis.yml:

name: "CodeQL Analysis"

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]
  schedule:
    - cron: '30 2 * * 1'  # Weekly Monday 2:30 AM UTC

jobs:
  analyze:
    name: Analyze (${{ matrix.language }})
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      contents: read
      actions: read

    strategy:
      fail-fast: false
      matrix:
        language: ['javascript-typescript', 'python', 'java-kotlin']

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v3
        with:
          languages: ${{ matrix.language }}
          queries: +security-extended,security-and-quality
          # For compiled languages, add build commands below

      - name: Autobuild
        uses: github/codeql-action/autobuild@v3

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v3
        with:
          category: "/language:${{ matrix.language }}"

Step 4 --- Custom Query Packs

Install organization-specific query packs by referencing them in the workflow:

- name: Initialize CodeQL
  uses: github/codeql-action/init@v3
  with:
    languages: java-kotlin
    packs: |
      my-org/java-custom-queries@1.0.0
      codeql/java-queries:cwe/cwe-089

Step 5 --- Configure Branch Protection Rules

1. Navigate to Repository Settings > Branches > Branch protection rules
2. Enable "Require status checks to pass" and add the CodeQL analysis check
3. Enable "Require code scanning results" and set severity thresholds (e.g., block on High/Critical)

Step 6 --- Secret Scanning and Push Protection

1. Enable secret scanning from Code security settings
2. Activate push protection to block commits containing detected secrets
3. Configure custom patterns for organization-specific secrets (API keys, internal tokens)

Step 7 --- Dependency Review and Dependabot

1. Enable Dependabot alerts and security updates
2. Configure .github/dependabot.yml for automated dependency version updates
3. Enable dependency review enforcement on pull requests to block PRs that introduce known vulnerable dependencies

Query Suite Reference

Suite	Description	Use Case
default	High-confidence security queries	Production scanning with minimal false positives
security-extended	Broader security queries including lower-severity findings	Comprehensive security coverage
security-and-quality	Security plus code quality queries	Teams wanting both security and maintainability checks
Custom packs	Organization-authored queries	Detecting internal anti-patterns and compliance violations

Integration with Security Workflows

SARIF Upload from Third-Party Tools

GHAS accepts SARIF (Static Analysis Results Interchange Format) uploads from external tools:

- name: Upload SARIF
  uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: results.sarif
    category: "semgrep"

Security Overview Dashboard

The organization-level security overview provides:

• Risk view showing repositories with open alerts by severity
• Coverage view showing GHAS feature enablement across repositories
• Alert trends over time for tracking remediation progress
• Filter by team, language, and alert type for targeted review

Monitoring and Metrics

• Track mean time to remediate (MTTR) for code scanning alerts
• Monitor false positive rates and tune query configurations accordingly
• Review alert dismissal reasons to identify areas for developer training
• Use the API (/repos/{owner}/{repo}/code-scanning/alerts) for custom reporting dashboards

Common Pitfalls

1. Compiled language build failures --- CodeQL requires successful compilation for C/C++, Java, C#, Go, and Swift; ensure build dependencies are available in the Actions runner
2. Ignoring scheduled scans --- Push/PR scanning misses vulnerabilities in dependencies; weekly scheduled scans catch newly disclosed CVEs in existing code
3. Over-alerting with security-and-quality --- Start with default suite and expand gradually to avoid developer alert fatigue
4. Missing GHAS license seats --- Only active committers to GHAS-enabled repositories consume license seats; plan capacity accordingly

References

• GitHub Code Scanning Documentation
• CodeQL Documentation
• CodeQL Query Repository
• SARIF Specification
• GitHub Security Overview

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

GHAS Code Scanning Implementation Template

Organization Security Configuration

Setting	Value	Notes
Organization	_______________
GHAS License Seats	_______________	Active committers
Default Query Suite	[ ] default [ ] security-extended [ ] security-and-quality
Branch Protection Enabled	[ ] Yes [ ] No
Secret Scanning Enabled	[ ] Yes [ ] No
Push Protection Enabled	[ ] Yes [ ] No
Dependabot Enabled	[ ] Yes [ ] No

Repository Enablement Tracker

Repository	Languages	Setup Type	Scanning Active	Open Alerts	Date Enabled
		[ ] Default [ ] Advanced	[ ] Yes [ ] No
		[ ] Default [ ] Advanced	[ ] Yes [ ] No
		[ ] Default [ ] Advanced	[ ] Yes [ ] No

Custom Query Pack Registry

Pack Name	Version	Description	Target Languages

Alert Severity Gate Configuration

Environment	Block on Critical	Block on High	Block on Medium	Block on Low
Production (main)	[x] Yes	[x] Yes	[ ] Yes	[ ] No
Staging (develop)	[x] Yes	[ ] Yes	[ ] No	[ ] No
Feature branches	[x] Yes	[ ] Yes	[ ] No	[ ] No

Secret Scanning Custom Patterns

Pattern Name	Regex	Description	Alert Enabled	Push Protection
			[ ] Yes [ ] No	[ ] Yes [ ] No

Weekly Security Review Checklist

• Review new critical and high severity alerts
• Check alert dismissal reasons for quality
• Verify new repositories have scanning enabled
• Review Dependabot alerts and merge security updates
• Check secret scanning alerts for exposed credentials
• Update security overview dashboard metrics
• Review MTTR trends and identify bottlenecks

Escalation Matrix

Alert Severity	Response SLA	Escalation Contact	Action Required
Critical	24 hours	Security Lead	Immediate remediation, potential incident
High	72 hours	Team Lead	Prioritize in current sprint
Medium	2 weeks	Developer	Schedule for next sprint
Low	30 days	Developer	Add to backlog

references/api-reference.md (verbatim)

API Reference: Implementing GitHub Advanced Security for Code Scanning

GitHub Code Scanning API

# List code scanning alerts
gh api /repos/OWNER/REPO/code-scanning/alerts?state=open

# Get specific alert
gh api /repos/OWNER/REPO/code-scanning/alerts/ALERT_NUMBER

# List analyses
gh api /repos/OWNER/REPO/code-scanning/analyses

# Upload SARIF
gh api /repos/OWNER/REPO/code-scanning/sarifs -X POST \
  -f commit_sha=SHA -f ref=refs/heads/main -f sarif=@results.sarif.gz

Secret Scanning API

# List secret alerts
gh api /repos/OWNER/REPO/secret-scanning/alerts?state=open

# Update alert state
gh api /repos/OWNER/REPO/secret-scanning/alerts/ALERT_NUMBER -X PATCH \
  -f state=resolved -f resolution=revoked

CodeQL Query Suites

Suite	Description	False Positive Rate
default	High-confidence security	Low
security-extended	Broader security coverage	Medium
security-and-quality	Security + code quality	Higher

CodeQL Workflow (GitHub Actions)

- uses: github/codeql-action/init@v3
  with:
    languages: ${{ matrix.language }}
    queries: +security-extended
- uses: github/codeql-action/autobuild@v3
- uses: github/codeql-action/analyze@v3

Supported Languages

Language	Build Required	Query Pack
Python	No	codeql/python-queries
JavaScript/TypeScript	No	codeql/javascript-queries
Java/Kotlin	Yes	codeql/java-queries
C/C++	Yes	codeql/cpp-queries
C#	Yes	codeql/csharp-queries
Go	Yes	codeql/go-queries
Ruby	No	codeql/ruby-queries
Swift	Yes	codeql/swift-queries

References

• GHAS Docs: https://docs.github.com/en/code-security/code-scanning
• CodeQL: https://codeql.github.com/docs/
• CodeQL Queries: https://github.com/github/codeql
• SARIF Spec: https://sarifweb.azurewebsites.net/

references/standards.md (verbatim)

Standards and Frameworks Reference

OWASP Top 10 (2021) Coverage by CodeQL

OWASP Category	CodeQL CWE Coverage	Query Suite
A01 Broken Access Control	CWE-22, CWE-284, CWE-639	security-extended
A02 Cryptographic Failures	CWE-259, CWE-327, CWE-328	security-extended
A03 Injection	CWE-77, CWE-78, CWE-79, CWE-89	default
A04 Insecure Design	CWE-209, CWE-256, CWE-501	security-and-quality
A05 Security Misconfiguration	CWE-16, CWE-611	security-extended
A06 Vulnerable Components	Dependency Review / Dependabot	N/A (separate feature)
A07 Auth Failures	CWE-287, CWE-798	default
A08 Data Integrity Failures	CWE-502, CWE-829	security-extended
A09 Logging Failures	CWE-117, CWE-778	security-and-quality
A10 SSRF	CWE-918	default

NIST SP 800-218 (SSDF) Alignment

• PO.3: Define security requirements --- CodeQL enforces security policies through query suites
• PW.4: Reuse existing, well-secured software --- Dependabot ensures dependencies are patched
• PW.7: Review and test code for vulnerabilities --- Automated code scanning on every PR
• PW.8: Test executable code --- SARIF integration enables combining SAST with DAST results
• RV.1: Identify and confirm vulnerabilities --- Security overview tracks alerts across the organization

CIS Software Supply Chain Security Guide

• SCS-1: Source code management security --- Branch protection rules, required reviewers
• SCS-2: Build pipelines --- CodeQL runs in GitHub Actions with pinned action versions
• SCS-5: Artifact management --- Dependency review prevents vulnerable packages from merging

ISO 27001 Control Mapping

ISO 27001 Control	GHAS Feature
A.8.25 Secure development lifecycle	CodeQL in CI/CD pipeline
A.8.26 Application security requirements	Custom query packs for org standards
A.8.28 Secure coding	Real-time scanning on pull requests
A.8.29 Security testing in dev and acceptance	Required status checks with severity gates
A.8.31 Separation of environments	Branch protection and deployment rules

references/workflows.md (verbatim)

GHAS Implementation Workflows

Workflow 1: Organization-Wide Enablement

1. Audit current repository inventory
   - List all repositories in the organization
   - Identify languages and build systems in use
   - Estimate active committer count for licensing
   |
2. Pilot phase (2-4 weeks)
   - Enable GHAS on 5-10 representative repositories
   - Use default setup for initial scanning
   - Collect baseline alert counts and false positive rates
   |
3. Triage pilot results
   - Review alerts by severity (Critical, High, Medium, Low)
   - Dismiss confirmed false positives with documented reasons
   - Create remediation issues for confirmed vulnerabilities
   |
4. Tune configuration
   - Adjust query suites based on false positive feedback
   - Write custom queries for organization-specific patterns
   - Configure alert dismissal policies
   |
5. Broad rollout
   - Enable default setup across remaining repositories
   - Configure organization-level security configurations
   - Set branch protection rules requiring code scanning checks
   |
6. Continuous monitoring
   - Review security overview dashboard weekly
   - Track MTTR for code scanning alerts
   - Report metrics to security leadership monthly

Workflow 2: Pull Request Security Gate

Developer pushes code to feature branch
           |
   PR is created targeting main
           |
   CodeQL analysis triggers automatically
           |
   Dependency review checks for vulnerable dependencies
           |
   Secret scanning checks for hardcoded credentials
           |
   Results posted as PR check and inline annotations
           |
   [Pass] All checks pass --> PR is eligible for merge
   [Fail] Critical/High findings --> PR is blocked
           |
   Developer reviews findings and applies fixes
           |
   Re-push triggers re-analysis
           |
   Merge after all checks pass and reviewer approval

Workflow 3: Custom CodeQL Query Development

1. Identify recurring vulnerability pattern not caught by default queries
   |
2. Set up CodeQL development environment
   - Install CodeQL CLI
   - Clone CodeQL standard library repository
   - Create workspace with target codebase database
   |
3. Author the query in QL language
   - Define source, sink, and taint-tracking configuration
   - Add metadata (@name, @description, @kind, @problem.severity, @security-severity, @precision, @id, @tags)
   |
4. Test the query
   - Create test cases with expected results
   - Run `codeql test run` against test database
   - Validate precision and recall
   |
5. Package the query
   - Create qlpack.yml with version and dependencies
   - Publish to GitHub Container Registry or internal package registry
   |
6. Deploy to scanning workflow
   - Reference the query pack in codeql-action/init step
   - Monitor results for the new query across repositories

Workflow 4: SARIF Integration with External Tools

External SAST/DAST tool runs scan
           |
   Tool outputs results in SARIF 2.1.0 format
           |
   GitHub Actions uploads SARIF via codeql-action/upload-sarif
           |
   Results appear in Security tab alongside CodeQL findings
           |
   Unified triage workflow across all scanning tools
           |
   Alert deduplication based on location and rule ID

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.