Repositories list

• codeql-sap-js

  Public
  CodeQL models for SAP JavaScript frameworks CAP, UI5 and XSJS

  TypeScript

  •

  MIT License

  •4•6•10•2•Updated Mar 31, 2026Mar 31, 2026

• ghas-to-csv

  Public
  Play with GHAS API to provide posture data over time

  csvgithub-actionsgithub-advanced-security

  csvgithub-actionsgithub-advanced-security

  Python

  •

  MIT License

  •17•42•1•1•Updated Mar 30, 2026Mar 30, 2026

• github-sbom-toolkit

  Public
  Gather SBOMs from the GitHub Dependency Graph and report matches with packages, such as malware advisories from the GitHub Advisory Database or PURLs of your ch…

  malwaredependency-graphdependencies+ 5

  malwaredependency-graphdependenciessupplychainpurlsbomadvanced-securityghas

  TypeScript

  •

  MIT License

  •5•16•0•7•Updated Mar 30, 2026Mar 30, 2026

• codeql-development-mcp-server

  Public
  LLM <-- MCP --> CodeQL( AST | CFG | CLI | LSP )

  mcpstatic-analysisast+ 6

  mcpstatic-analysisastcode-qualitycfglspcode-securitycodeqlcopilot-enabled

  TypeScript

  •

  Other

  •2•14•6•1•Updated Mar 30, 2026Mar 30, 2026

• advanced-security-material

  Public
  securitycode-scanningcodeql+ 2

  securitycode-scanningcodeqladvanced-securityadvanced-security-training

  Shell

  •26•77•2•3•Updated Mar 30, 2026Mar 30, 2026

• spdx-dependency-submission-action

  Public
  upload an SPDX 2.2 formatted SBOM to GitHub's dependency submission API

  JavaScript

  •

  MIT License

  •6•24•4•2•Updated Mar 30, 2026Mar 30, 2026

• awesome-secret-scanning

  Public
  A curated list of awesome GitHub Advanced Security secret scanning resources.

  awesome-listsecret-scanninggithub-advanced-security

  awesome-listsecret-scanninggithub-advanced-security

  MIT License

  •4•16•0•4•Updated Mar 30, 2026Mar 30, 2026

• reusable-workflows

  Public
  Advanced Security Reusable GitHub Actions Workflows

  MIT License

  •6•3•4•6•Updated Mar 30, 2026Mar 30, 2026

• codeql-sarif-security-standard-annotator

  Public
  Compare a CodeQL SARIF results file to a security standard CWE list and annotate the SARIF rules with a tag to highlight results applicable to the security stan…

  TypeScript

  •

  MIT License

  •1•10•1•4•Updated Mar 30, 2026Mar 30, 2026

• codeql-scanner-vscode

  Public
  CodeQL Plugin for VSCode to help scan and view alerts in code

  TypeScript

  •

  MIT License

  •2•5•1•6•Updated Mar 30, 2026Mar 30, 2026

• cocoapods-dependency-submission-action

  Public
  CocoaPods Lockfile Dependency Submission Action

  Python

  •

  MIT License

  •3•5•2•5•Updated Mar 30, 2026Mar 30, 2026

• gradle-lock-dependency-submission-action

  Public
  Gradle Lockfile Dependency Submission Action

  Python

  •

  MIT License

  •1•2•0•4•Updated Mar 30, 2026Mar 30, 2026

• ghas-reviewer-app

  Public
  GitHub Advanced Security Pull Request Security Team required review GitHub App

  github-appadvanced-security

  github-appadvanced-security

  Python

  •

  MIT License

  •11•36•6•4•Updated Mar 30, 2026Mar 30, 2026

• SARIF-viewer

  Public
  JetBrains IDE plugin for displaying SARIF from GHAS or from a local file

  Kotlin

  •

  MIT License

  •5•9•3•5•Updated Mar 27, 2026Mar 27, 2026

• component-detection-dependency-submission-action

  Public
  This GitHub Action runs the microsoft/component-detection library to automate dependency extraction at build time.

  github-actions

  github-actions

  TypeScript

  •

  MIT License

  •29•20•4•8•Updated Mar 27, 2026Mar 27, 2026

• sample-javascript-monorepo

  Public
  Detached fork of babel/babel to use as a TypeScript monorepo sample with 150+ packages using the monorepo-code-scanning-action https://github.com/advanced-secu…

  TypeScript

  •

  MIT License

  •1•0•0•6•Updated Mar 27, 2026Mar 27, 2026

• ghe-cross-instance-committers

  Public
  A script which will return the total number of unique de-deuped active committers across multiple GHES instances

  ghas

  ghas

  TypeScript

  •

  MIT License

  •5•6•2•9•Updated Mar 27, 2026Mar 27, 2026

• dismiss-alerts

  Public
  Dismiss GitHub Code Scanning alerts from SARIF suppression data

  sarifcode-scanningsast+ 3

  sarifcode-scanningsastcode-securityghasgithub-advanced-security

  Java

  •

  MIT License

  •4•19•1•10•Updated Mar 26, 2026Mar 26, 2026

• secret-validator-grunt

  Public
  Agentic validation of GitHub Secret Scanning alerts.

  Python

  •

  MIT License

  •0•0•0•1•Updated Mar 26, 2026Mar 26, 2026

• sarif-toolkit

  Public
  All things SARIF, as an Action

  Python

  •

  MIT License

  •3•4•4•4•Updated Mar 26, 2026Mar 26, 2026

• flake8-sarif-formatter

  Public
  Format Flake8 results as SARIF for input to SAST tools such as GitHub Code Scanning

  Python

  •

  MIT License

  •2•2•1•1•Updated Mar 26, 2026Mar 26, 2026

• secret-scanning-review-action

  Public
  Action to detect if a secret is initially detected in a pull request

  PowerShell

  •

  MIT License

  •7•20•4•5•Updated Mar 26, 2026Mar 26, 2026

• secret-scanning-tools

  Public
  Testing Suite for GitHub Secret Scanning Custom Patterns

  secret-scanninggithub-advanced-security

  secret-scanninggithub-advanced-security

  Python

  •

  MIT License

  •2•8•0•7•Updated Mar 26, 2026Mar 26, 2026

• brew-dependency-submission-action

  Public
  Brew Lockfile Dependency Submission Action

  homebrewbrewactions

  homebrewbrewactions

  Python

  •

  MIT License

  •4•3•1•7•Updated Mar 26, 2026Mar 26, 2026

• monorepo-code-scanning-action

  Public
  Focus SAST scans (with CodeQL) on just the changed parts of your monorepo, split up as you define

  actionsmonoreposast+ 3

  actionsmonoreposastcodeqladvanced-securitycode-scanning-ready

  JavaScript

  •

  MIT License

  •4•12•11•2•Updated Mar 26, 2026Mar 26, 2026

• grab_ql

  Public
  Grab some/all of CodeQL CLI binary, QL library, VSCode starter workspace, VSCode and VSCode QL extension

  Python

  •

  MIT License

  •5•11•9•1•Updated Mar 26, 2026Mar 26, 2026

• enterprise-security-team

  Public
  Manage a uniform team of security managers for every organization in your enterprise

  enterpriseghas

  enterpriseghas

  Python

  •

  MIT License

  •6•24•0•2•Updated Mar 26, 2026Mar 26, 2026

• security-report-action

  Public
  GitHub Action that can generate reports from GitHub Advanced Security and dependency vulnerability findings

  HTML

  •

  MIT License

  •0•3•2•2•Updated Mar 25, 2026Mar 25, 2026

• codeql-development-template

  Public template
  Copilot-native repository template for CodeQL query development

  CodeQL

  •

  MIT License

  •0•9•1•1•Updated Mar 25, 2026Mar 25, 2026

• codeql-qtil

  Public
  A library with a wide variety of handy CodeQL utilities, from simple to complex.

  CodeQL

  •

  MIT License

  •0•4•3•8•Updated Mar 21, 2026Mar 21, 2026