- Home
- Git GUI Clients
- GitHub CodeQL
GitHub CodeQL
What it is
GitHub CodeQL is a language and toolchain for analyzing code as data. Its core workflow builds a database from a codebase, runs queries against that database, and presents results for review and triage. Queries can identify security, correctness, maintainability, and readability issues, while users can also write custom queries and package them in CodeQL packs for code scanning or CLI analysis. GitHub provides a command-line interface and an extension for Visual Studio Code. For GitHub-hosted repositories, the standard approach is to enable code scanning with GitHub Actions; external CI systems can use the CodeQL bundle to produce scanning results and upload them to GitHub. Supported languages and workflows include C/C++, C#, Go, Java, Kotlin, JavaScript, TypeScript, Python, Ruby, Rust, Swift, and GitHub Actions. CodeQL 2.26.2's Default suite contains 497 security queries covering 170 CWEs; Extended adds 131 queries covering 32 more CWEs. Code scanning is available for public repositories and eligible organization repositories with GitHub Code Security enabled. GitHub Code Security costs $30 a month, billed per active committer/month.
For and against
For
- Supports custom queries and CodeQL packs.
- Integrates with GitHub Actions and external CI.
- Provides a Visual Studio Code extension.
- Covers security, correctness, maintainability, and readability.
- Has free options for research and open source.
Against
- Does not support PHP or Scala.
- Organization code scanning requires an eligible plan and Code Security.
- Latest release requires supported operating system versions.
The verdict
CodeQL provides a query-based workflow for code analysis, with options for custom checks and CI integration. Confirm that the codebase language and repository meet its support and eligibility requirements.
Who it suits
CodeQL suits developers and security researchers who need to analyze code for security and other quality issues. It supports GitHub Actions and external CI workflows, subject to repository eligibility.
Plans and prices
Free for research and open source
Research use · Open-source codebases
Read 21 Sep 2026 · codeql.github.com
CodeQL for open source and research
OSI-approved open source · academic research · specified automated analysis, CI, or CD
Read 28 Sep 2026 · codeql.github.com
GitHub Code Security
Team or Enterprise plan required · private repositories
Read 28 Sep 2026 · github.com
GitHub Free with CodeQL code scanning
CodeQL available for public repositories
Read 28 Sep 2026 · github.com
On the record
- CI integration
- The CodeQL bundle can be downloaded for an external CI system to generate code-scanning results and upload them to GitHub.codeql.github.com · read 28 Sep 2026
- CodeQL tools
- GitHub provides the CodeQL CLI and a CodeQL extension for Visual Studio Code.codeql.github.com · read 28 Sep 2026
- Core workflow
- CodeQL analysis creates a database, runs queries against it, and interprets the results for review and triage.codeql.github.com · read 28 Sep 2026
- Custom queries
- Users can write custom queries and package them in CodeQL packs for code scanning or CLI analysis.codeql.github.com · read 28 Sep 2026
- GitHub Actions
- The standard way to run CodeQL queries on a GitHub-hosted repository is to enable code scanning with GitHub Actions.codeql.github.com · read 28 Sep 2026
- Language limitation
- CodeQL does not support languages outside its listed supported languages, including PHP and Scala.docs.github.com · read 28 Sep 2026
- Platform requirements
- The latest CodeQL release supports Linux Ubuntu 22.04/24.04, Windows 10 or Windows Server 2019 and Windows 11 or Windows Server 2022/2025, and macOS 14/15/26.codeql.github.com · read 28 Sep 2026
- Purpose
- CodeQL is a language and toolchain for code analysis that treats code as data.codeql.github.com · read 28 Sep 2026
- Query types
- CodeQL queries analyze code for security, correctness, maintainability, and readability issues.codeql.github.com · read 28 Sep 2026
- Repository eligibility
- Code scanning is available for public repositories and for organization-owned repositories on GitHub Team, GitHub Enterprise Cloud, or GitHub Enterprise Server with GitHub Code Security enabled.docs.github.com · read 28 Sep 2026
- Security analysis
- CodeQL is designed to automate security checks and help security researchers perform variant analysis.codeql.github.com · read 28 Sep 2026
- Security coverage
- CodeQL 2.26.2's Default suite contains 497 security queries covering 170 CWEs, while Extended adds 131 queries covering 32 more CWEs.codeql.github.com · read 28 Sep 2026
- Paid from
- 30github.com · read 21 Sep 2026
- Supported languages
- CodeQL supports C/C++, C#, Go, Java, Kotlin, JavaScript, TypeScript, Python, Ruby, Rust, Swift, and GitHub Actions workflows.codeql.github.com · read 28 Sep 2026
