# Configure Codeql Scanning > Plan or review CodeQL scanning so security analysis, workflow triggers, language coverage, and SARIF reporting fit the real repository structure. Use when this capability is needed. - Skill: `tomevault-io/configure-codeql-scanning` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds@latest add tomevault-io/configure-codeql-scanning` - Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/configure-codeql-scanning/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Security - Author: tomevault-io (https://skillmd.com/u/tomevault-io) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/tomevault-io/configure-codeql-scanning --- # Configure CodeQL scanning Plan or review CodeQL scanning so security analysis, workflow triggers, language coverage, and SARIF reporting fit the real repository structure. ## When to Use This Skill Use this when a repo needs GitHub code scanning setup, better CodeQL workflow coverage, or troubleshooting around CodeQL analysis and alerts. ## Workflow Overview 1. Decide whether the repo needs default setup, advanced workflow control, or local CLI analysis. 2. Check language coverage, build mode, triggers, and monorepo layout before editing workflow files. 3. Keep permissions minimal while preserving SARIF upload and actionable analysis results. 4. Treat CodeQL as part of the broader security workflow by pairing setup choices with triage and validation expectations. ## Examples - Configure CodeQL scanning for this .NET repository. - Review whether the current codeql.yml has the right languages, triggers, and permissions. - Plan a safer CodeQL setup for a monorepo or mixed-language project. --- > Source: [grey580/Focus-L-AIci](https://github.com/grey580/Focus-L-AIci) — distributed by [TomeVault](https://tomevault.io).