Question

A security engineer enabled CodeQL default setup on a repository to get scanning running quickly. Later, the team needs to add a custom CodeQL query pack maintained by their organization and adjust which build steps run before analysis. The engineer opens the repository's code scanning configuration but cannot find a way to specify custom queries or build commands. What is the correct action to enable these customizations?

Accepted Answer

Switch from default setup to advanced setup, which generates an editable codeql.yml workflow file where custom query packs and build steps can be defined

Answer

Edit the default setup configuration in the repository Security settings to paste the custom query pack reference into a queries field

Answer

Upload the custom query results as a SARIF file using the code scanning API, since default setup cannot run any CodeQL analysis

Answer

Disable code scanning entirely and re-enable default setup with the extended query suite, which automatically includes organization query packs