CodeQL IaC Extractor, Libraries, and Queries

Note

This is not an official GitHub project and is not supported by the CodeQL team. This is a community project.

⚠️ Important: As of September 2025, this project no longer supports Bicep or GitHub Actions scanning. Please refer to the documentation for supported languages and frameworks.

🚀 Overview

CodeQL Extractor, Library, and Queries for Infrastructure as Code.

🛠️ Usage

- name: Initialize and Analyze IaC
  uses: advanced-security/[email protected]

Note: See full documentation on Workflows.

📚 Documentation

The documentation for CodeQL IaC extractor can be found here.

Other Useful Links:

• Q&A ❓
• Languages and Frameworks 🌐
• Coverage 📊
• Example Workflows 📝

📄 License

This project is licensed under the terms of the MIT open source license. Please refer to MIT for the full terms.

To use this project for Infrastructure as Code, you will need to use CodeQL and follow all terms and conditions of the CodeQL License.

For use in private repositories and code, you will need to purchase a GitHub Advanced Security license.

👥 Contributors

Mathew Payne 💻 🔬 🚧 🛡️ 🤔

Arthur Baars 💻 🤔 🧑‍🏫

Edward Minnix III 💻 🎨 🤔

Joe Farebrother 💻 🎨 🤔

Viktor Lindström 💻

💬 Support

Support is via GitHub Issues or GitHub Discussions.