pixpilot/CodeQL Scanner
Runs CodeQL analysis, filters files, and creates GitHub issues for security findings.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit May 18, 2026
- License
- MIT
Pinned Snippet
uses: pixpilot/codeql-scanner@17be419687e85fab4e07d815bc60f2a91c6c028c # no releases — HEAD as of 2026-07-11tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| languages | A comma-separated list of CodeQL languages to analyze. For example: 'javascript,python,java' | no | javascript |
| source-root | Path of the root source code directory, relative to $GITHUB_WORKSPACE. | no | — |
| ram | The amount of memory in MB that can be used by CodeQL extractors. By default, CodeQL extractors will use most of the memory available in the system. | no | — |
| threads | The number of threads that can be used by CodeQL extractors. By default, CodeQL extractors will use all the hardware threads available in the system. | no | — |
| debug | Enable debugging mode. This will result in more output being produced which may be useful when debugging certain issues. | no | false |
| config | Configuration passed as a YAML string in the same format as the config-file input. This takes precedence over the config-file input. | no | — |
| config-file | Path to CodeQL configuration file (e.g., .github/codeql/codeql-configuration.yml) | no | — |
| qls-profile | Comma-separated list of CodeQL QLS profiles to use (e.g., security-and-quality,security-extended) | no | security-and-quality |
| token | GITHUB_TOKEN for creating issues | yes | — |
Outputs
no outputs