CodeQL, Code Scanning, SARIF, Custom Queries, Autofix, and Security Gates: Configuration, Design Choices, and Tradeoffs

1. Default setup or advanced setup?

Start with the problem, not the workflow file. Default setup minimizes maintenance and automatically follows supported-language changes. Advanced setup is justified when the repository has an analysis requirement that GitHub-managed defaults cannot satisfy. Creating an advanced workflow “because CI should be YAML” adds an owner, action-version update burden, trigger logic, permissions, and build failure modes without automatically increasing coverage.

For compiled languages, validate the database itself. Current CodeQL may use none for C/C++, C#, Java, and Rust when appropriate, while Kotlin needs a build. If production correctness depends on generated source or unusual build flags, a manual advanced setup can be more representative even though it costs more to operate.

2. Built-in suites versus custom queries

The built-in default suite prioritizes high precision. security-extended adds more security queries with somewhat lower precision, so it can find additional issues at the cost of more triage. Changing suites changes the question you ask of the same code; it does not make the database more complete by itself.

Use a custom query when the organization has a recurring security invariant that standard queries do not encode—for example, a proprietary authorization API that must dominate a sensitive operation. Custom queries belong in a CodeQL pack, need metadata/tests/versioning, and should be reviewed like production code. A query that blocks merges organization-wide is internal platform code with a wide blast radius.

# Conceptual advanced-setup configuration fragment.
# Pin query packs to reviewed versions in production.
queries:
  - uses: security-extended
  - uses: your-org/security-queries@1.4.2

3. Alert-as-information versus merge-blocking policy

Scanning and gating answer different questions. Scanning says “this analysis produced these findings.” A gate says “given this tool, severity, branch, and policy, this change may or may not enter the target ref.” Keeping them separate lets teams collect evidence before they enforce it.

A sensible rollout is often observe → establish baseline/ownership → measure precision and coverage → gate only new/relevant high-confidence findings → tighten policy over time. A rule that fails every PR because of unrelated legacy backlog teaches developers to seek bypasses, not to fix risk.

4. Copilot Autofix versus manual remediation

Copilot Autofix is a proposal generator. Its strongest fit is a localized alert with a well-understood fix pattern and tests that exercise the behavior. Manual design review is still required when remediation changes trust boundaries, authorization, parsing semantics, cryptography, data lifetime, or cross-service behavior.

Agentic autofix is currently public preview and can involve a Copilot cloud agent session and AI-credit billing. It is not required for this course. Even when agentic validation reruns CodeQL, GitHub notes that it cannot guarantee fixes for custom-query or security-extended findings. Production policy should therefore record which analysis was rerun and what independent tests/review were completed.

5. Repository-local versus centralized security platform code

Repository-local configuration keeps ownership near the application, which helps unusual builds. Organization-level security configurations and policies improve consistency but require organization roles and, for private/internal repositories, appropriate product entitlements. External CI scanners may be necessary for regulated networks or existing tooling; SARIF keeps the GitHub alert/triage surface interoperable even when analysis runs elsewhere.

Do not blur external systems into GitHub: a third-party scanner owns its rules/license/runtime; GitHub hosts the repository and code-scanning result objects; Actions may orchestrate execution; rulesets govern merge admission; Git provides revisions. Each component has a separate identity, billing model, and incident boundary.

6. Worked decision: Atlas Relay

Atlas Relay has a public JavaScript SDK, a private Java service, an inherited backlog of medium findings, and one custom authorization framework. The team wants meaningful security gates without stopping all delivery.

Knowledge check

Summary

Configuration is a tradeoff among coverage, precision, maintenance, governance, compatibility, and cost. Default setup is the baseline; advanced setup and custom queries are justified by specific coverage needs. Gates should consume mature evidence, and autofix remains a reviewable patch proposal.

Next you will diagnose the failure modes that make apparently healthy scanning pipelines misleading or operationally harmful.

Official references

• Setup types
• Advanced setup
• CodeQL query suites
• Custom CodeQL queries
• CodeQL query packs
• Autofix
• Merge protection