Repositories list

• ghas-to-csv

  Public
  Play with GHAS API to provide posture data over time

  github-advanced-securitycsvgithub-actions

  Python

  •

  MIT License

  •16•38•4•3•Updated Jul 18, 2025Jul 18, 2025

• crypto-bill-of-materials-data

  Public
  Generate a Crypto Bill of Materials using CodeQL

  TypeScript

  •

  MIT License

  •3•1•0•1•Updated Jul 18, 2025Jul 18, 2025

• codeql-sap-js

  Public
  CodeQL models for SAP JavaScript frameworks CAP, UI5 and XSJS

  TypeScript

  •

  MIT License

  •2•6•4•3•Updated Jul 18, 2025Jul 18, 2025

• sample-javascript-monorepo

  Public
  TypeScript

  •

  MIT License

  •0•0•0•6•Updated Jul 18, 2025Jul 18, 2025

• dismiss-alerts

  Public
  Java

  •

  MIT License

  •3•17•2•5•Updated Jul 15, 2025Jul 15, 2025

• secret-scanning-notifications

  Public
  A GitHub Action that sends email notifications to security manager team for any new or resolved secret scanning alerts based on a set frequency

  TypeScript

  •

  MIT License

  •3•1•0•7•Updated Jul 15, 2025Jul 15, 2025

• sample-codeql-pipeline-config

  Public
  Integrate CodeQL into CI/CD pipelines, using the CodeQL CLI Bundle for Automated Code Scanning

  MIT License

  •11•21•0•0•Updated Jul 15, 2025Jul 15, 2025

• generate-sbom-action

  Public
  An Action to wrap creating an SBOM via REST API

  TypeScript

  •

  MIT License

  •4•18•1•7•Updated Jul 15, 2025Jul 15, 2025

• codeql-summarize

  Public
  CodeQL Summary Generator

  Python

  •

  MIT License

  •2•7•2•1•Updated Jul 14, 2025Jul 14, 2025

• conda-dependency-submission-action

  Public
  TypeScript

  •

  MIT License

  •3•0•0•5•Updated Jul 14, 2025Jul 14, 2025

• codeql-extractor-iac

  Public
  CodeQL Extractor, Library, and Queries for Infrastructure as Code

  CodeQL

  •

  MIT License

  •6•50•16•4•Updated Jul 14, 2025Jul 14, 2025

• component-detection-dependency-submission-action

  Public
  TypeScript

  •

  MIT License

  •13•18•2•2•Updated Jul 9, 2025Jul 9, 2025

• codeql-extractor-action

  Public
  CodeQL Extractor Action

  Rust

  •

  MIT License

  •0•2•0•0•Updated Jul 9, 2025Jul 9, 2025

• monorepo-code-scanning-action

  Public
  Focus SAST scans (with CodeQL) on just the changed parts of your monorepo, split up as you define

  actionsmonoreposast+ 3codeqladvanced-securitycode-scanning-ready

  JavaScript

  •

  MIT License

  •3•7•11•0•Updated Jul 8, 2025Jul 8, 2025

• ghas-reviewer-app

  Public
  GitHub Advanced Security Pull Request Security Team required review GitHub App

  github-appadvanced-security

  Python

  •

  MIT License

  •10•36•5•1•Updated Jul 4, 2025Jul 4, 2025

• set-codeql-language-matrix

  Public
  Automatically set the CodeQL matrix job using the languages in your repository.

  codeql

  Python

  •

  MIT License

  •7•15•3•1•Updated Jul 3, 2025Jul 3, 2025

• codeql-workshops-staging

  Public
  Original workshops and staging area for new ones

  CodeQL

  •

  MIT License

  •8•16•2•1•Updated Jul 3, 2025Jul 3, 2025

• SARIF-viewer

  Public
  JetBrains IDE plugin for displaying SARIF from GHAS or from a local file

  Kotlin

  •

  MIT License

  •4•8•3•5•Updated Jul 3, 2025Jul 3, 2025

• ghe-cross-instance-committers

  Public
  A script which will return the total number of unique de-deuped active committers across multiple GHES instances

  ghas

  TypeScript

  •

  MIT License

  •4•6•2•1•Updated Jul 1, 2025Jul 1, 2025

• codeql-scanner-vscode

  Public
  CodeQL Plugin for VSCode to help scan and view alerts in code

  TypeScript

  •

  MIT License

  •3•0•0•0•Updated Jun 30, 2025Jun 30, 2025

• reusable-workflows

  Public
  Advanced Security Reusable GitHub Actions Workflows

  MIT License

  •5•3•4•4•Updated Jun 30, 2025Jun 30, 2025

• policy-as-code

  Public
  GitHub Advanced Security Policy as Code

  Python

  •

  MIT License

  •21•84•12•2•Updated Jun 30, 2025Jun 30, 2025

• conan-dependency-submission

  Public
  Conan Dependency Submission to GitHub

  Python

  •

  MIT License

  •1•0•3•0•Updated Jun 27, 2025Jun 27, 2025

• codeql-sarif-security-standard-annotator

  Public
  Compare a CodeQL SARIF results file to a security standard CWE list and annotate the SARIF rules with a tag to highlight results applicable to the security standard

  TypeScript

  •

  MIT License

  •1•9•1•11•Updated Jun 23, 2025Jun 23, 2025

• awesome-codeql

  Public
  A curated list of awesome CodeQL resources.

  awesomeawesome-list

  MIT License

  •4•45•0•1•Updated Jun 20, 2025Jun 20, 2025

• brew-dependency-submission-action

  Public
  Brew Lockfile Dependency Submission Action

  homebrewbrewactions

  Python

  •

  MIT License

  •4•3•1•1•Updated Jun 19, 2025Jun 19, 2025

• cocoapods-dependency-submission-action

  Public
  CocoaPods Lockfile Dependency Submission Action

  Python

  •

  MIT License

  •3•5•2•0•Updated Jun 19, 2025Jun 19, 2025

• sarif-toolkit

  Public
  All things SARIF, as an Action

  Python

  •

  MIT License

  •3•4•3•1•Updated Jun 19, 2025Jun 19, 2025

• secret-scanning-review-action

  Public
  Action to detect if a secret is initially detected in a pull request

  Python

  •

  MIT License

  •7•17•7•4•Updated Jun 18, 2025Jun 18, 2025

• validate-secrets

  Public
  Extensible secret validation tool for GitHub Secret Scanning and beyond.

  Python

  •

  MIT License

  •0•1•1•0•Updated Jun 17, 2025Jun 17, 2025