codeql-onboarding-helperlisted

# codeql-onboarding-helper A Category 3 ops tool. CodeQL setup has more decision points than people realize: setup type, query suite, custom packs, triage routing, exception process. Getting them wrong on a regulated-data repo means false negatives (real findings missed) or false-positive saturation (real findings buried). This skill makes the decision tree explicit. ## When to use - Onboarding a new repo to GHAS code scanning. - Refactoring an existing CodeQL setup that's been ignored or under-tuned. - Org-wide consistency audit: are repos using the right query suite for their language + risk? - Planning a custom pack rollout (org-specific patterns). ## When NOT to use - Specific alert triage / dismissal → out of scope. - Building a custom CodeQL query → `codeql-pattern-finder`. - Workflow-level Actions security → `actions-workflow-hardener`. - Org-wide GHAS posture → `ghas-config-reviewer`. ## Decision matrix ### Default setup vs advanced setup | Use default setup if | Use advanced setup if | |----------------------|----------------------| | Standard build (no custom JDK pin, no proprietary build system) | Custom build command, monorepo with non-standard layout | | GitHub-hosted runners are acceptable | Build requires private-network access (internal Maven, internal pip) | | No custom packs needed | Custom CodeQL packs (community or org-internal) needed | | Standard query suite is sufficient | Need to combine multiple suites or modify per-language | | Repo's languag