Tool Diagnostics & Metrics v1.0.0

CodeQL for .NET

Use the open-source CodeQL ecosystem for .NET security analysis. Use when a repo needs CodeQL query packs, CLI-based analysis on open source codebases, or GitHub Action setup with explicit licensing caveats. USE FOR: the repo uses or wants CodeQL for .NET security analysis; GitHub code scanning is part of the CI plan. DO NOT USE FOR: teams that need a tool with no private-repo licensing caveat. INVOKES: inspect the repository context, edit targeted files, and run relevant build, test, lint, or validation commands when changes are made.

Trigger On

  • the repo uses or wants CodeQL for .NET security analysis
  • GitHub code scanning is part of the CI plan

Workflow

  1. Treat CodeQL as a security-analysis tool, not as a style checker.
  2. Make the licensing and hosting model explicit before proposing it as the default gate.
  3. Prefer manual build mode for compiled .NET projects when precision matters.

Deliver

  • explicit CodeQL setup or an explicit rejection with caveat documented
  • reproducible CI or local commands for running CodeQL in this repo

Validate

  • the chosen CodeQL path is allowed for the repo type
  • build mode is documented and reproducible

Load References

Related skills

Use the open-source free `Asynkron.Profiler` dotnet tool for CLI-first CPU, allocation, exception, contention, and heap profiling of .NET commands or existing trace artifacts.

Asynkron.Profiler

These are the skills our senior team ships with. Want us to build your system? Book a 15-min call.