How to Apply CodeQL to Your Projects

This repository contains template workflows for CodeQL security scanning. Follow these steps to enable CodeQL on your actual project repositories.

Quick Start - Single Repository

Option 1: Manual Copy (Recommended)

1. Navigate to your project:

   cd /path/to/your/project

2. Create the workflow directory:

   mkdir -p .github/workflows

3. Copy the workflow file:

   cp /Users/dafesmithofoh/codeql/.github/workflows/codeql-org-security.yml .github/workflows/

4. Customize for your languages (edit .github/workflows/codeql-org-security.yml):

   # Change this line to match your project's languages:
   language: [ 'javascript', 'python' ]  # Only your languages

5. Commit and push:

   git add .github/
   git commit -m "Enable CodeQL security scanning"
   git push

6. Done! Check results at:

   • Actions: https://github.com/dafesmith/YOUR-REPO/actions
   • Security: https://github.com/dafesmith/YOUR-REPO/security/code-scanning

Option 2: Using GitHub CLI

# Clone your project
gh repo clone dafesmith/YOUR-PROJECT
cd YOUR-PROJECT

# Copy workflow
mkdir -p .github/workflows
cp /Users/dafesmithofoh/codeql/.github/workflows/codeql-org-security.yml .github/workflows/

# Commit and push
git add .github/
git commit -m "Enable CodeQL security scanning"
git push

Apply to Multiple Repositories

Automated Deployment Script

Create a file deploy-codeql.sh:

#!/bin/bash

# List of your repositories (add your actual repo names)
REPOS=(
  "your-web-app"
  "your-api-service"
  "your-mobile-app"
  "your-backend"
)

# Path to the workflow template
WORKFLOW_FILE="/Users/dafesmithofoh/codeql/.github/workflows/codeql-org-security.yml"

for repo in "${REPOS[@]}"; do
  echo "Enabling CodeQL for $repo..."

  # Clone the repository
  gh repo clone dafesmith/$repo temp-$repo
  cd temp-$repo

  # Create workflow directory
  mkdir -p .github/workflows

  # Copy workflow file
  cp "$WORKFLOW_FILE" .github/workflows/

  # Commit and push
  git add .github/
  git commit -m "Enable CodeQL security scanning"
  git push

  # Cleanup
  cd ..
  rm -rf temp-$repo

  echo "✓ CodeQL enabled for $repo"
done

echo "Done! CodeQL enabled for all repositories."

Run it:

chmod +x deploy-codeql.sh
./deploy-codeql.sh

Language-Specific Configuration

JavaScript/TypeScript Projects

language: [ 'javascript' ]
# No build steps needed

Python Projects

language: [ 'python' ]
# No build steps needed

Java Projects

language: [ 'java' ]
# Autobuild usually works, but if not:
- name: Build Java
  if: matrix.language == 'java'
  run: |
    mvn clean install -DskipTests
    # OR for Gradle:
    # ./gradlew build -x test

Node.js + Python (Multiple Languages)

language: [ 'javascript', 'python' ]
# No build steps needed

C# .NET Projects

language: [ 'csharp' ]
# Add build step:
- name: Build C#
  if: matrix.language == 'csharp'
  run: |
    dotnet restore
    dotnet build --no-restore

Go Projects

language: [ 'go' ]
# Autobuild usually works

Ruby Projects

language: [ 'ruby' ]
# No build steps needed

What Happens After Setup?

Automatic Scans

CodeQL will automatically scan your code:

• ✅ On every push to main/master/develop branches
• ✅ On every pull request to these branches
• ✅ Weekly (every Monday at 2 AM)

Viewing Results

1. Security Tab:

   • Go to: https://github.com/dafesmith/YOUR-REPO/security/code-scanning
   • See all detected vulnerabilities
   • Get AI-powered fix suggestions

2. Pull Request Checks:

   • CodeQL status appears on PRs
   • Blocks merge if critical issues found (optional)

3. Email Notifications:

   • You'll receive emails for new security findings
   • Configure in repository settings

Customizing the Workflow

Change Scan Schedule

Edit the cron schedule:

schedule:
  - cron: '0 2 * * 1'  # Monday 2 AM
  # OR
  - cron: '0 9 * * *'  # Every day at 9 AM
  # OR
  - cron: '0 0 * * 0'  # Sunday midnight

Scan Only on Push (Remove PR and Schedule)

on:
  push:
    branches: [ "main" ]

Add More Branches

on:
  push:
    branches: [ "main", "staging", "production" ]
  pull_request:
    branches: [ "main", "staging", "production" ]

Exclude Specific Paths

Add to workflow:

on:
  push:
    branches: [ "main" ]
    paths-ignore:
      - 'docs/**'
      - '*.md'
      - 'tests/**'

Branch Protection (Optional)

Require CodeQL to pass before merging:

1. Go to: Settings → Branches → Add rule
2. Branch name: main
3. Check: Require status checks to pass
4. Select: CodeQL
5. Save

Now PRs with security issues can't be merged!

Troubleshooting

"No languages detected"

Fix: Ensure your repository contains code files (not just configs)

"Build failed"

Fix: Replace autobuild with custom build steps (see language-specific sections above)

"Workflow didn't run"

Fix: Check that you pushed to main/master/develop branches

"Too slow"

Fix: Reduce languages or use the PR-specific workflow for faster scans

Example Repositories

Simple Web App (JavaScript)

# .github/workflows/codeql-org-security.yml
language: [ 'javascript' ]

Full-Stack App (JavaScript + Python)

# .github/workflows/codeql-org-security.yml
language: [ 'javascript', 'python' ]

Microservices (Multiple Languages)

# .github/workflows/codeql-org-security.yml
language: [ 'javascript', 'python', 'java', 'go' ]

FAQ

Q: Do I need GitHub Advanced Security? A: For private repos, yes. Public repos get it free.

Q: How long does scanning take? A: 2-10 minutes for small projects, 15-60 minutes for large ones.

Q: Will it slow down my CI/CD? A: CodeQL runs in parallel with your tests, minimal impact.

Q: Can I customize which vulnerabilities to report? A: Yes, edit .github/codeql/codeql-org-config.yml (copy from this repo first)

Q: Does it scan dependencies? A: No, that's Dependabot. CodeQL scans YOUR code for vulnerabilities.

Q: What if I get too many false positives? A: Dismiss them in the Security tab with justification, or tune the config.

Getting Help

• Documentation: ORGANIZATION_SETUP.md
• CodeQL Docs: https://codeql.github.com/docs/
• GitHub Support: https://support.github.com/

---

Ready to secure your code? Start with one repository, verify it works, then roll out to all projects! 🛡️