Question

Your security team maintains a shared CodeQL query pack published to GitHub Packages that contains organization-specific security queries. You are using advanced setup and want the code scanning workflow for a JavaScript repository to run the built-in security-and-quality suite PLUS your custom query pack, while excluding one noisy built-in query by its query ID. Which approach correctly accomplishes all three requirements?

Accepted Answer

Create a CodeQL configuration file referenced via the `config-file` input, specifying `queries` for the security-and-quality suite, `packs` for the published custom query pack, and a `query-filters` section to exclude the noisy query by ID

Answer

Set the `queries` input on the `github/codeql-action/init` step to `security-and-quality` and add a second workflow that runs only the custom pack, then merge the SARIF files manually

Answer

Switch to default setup and enable the security-and-quality query suite in the repository settings, since default setup automatically discovers and runs any published organization query packs

Answer

Add the custom pack path to the `paths` input and list the excluded query under `paths-ignore`, while setting `queries: security-and-quality` on the analyze step