How GitHub uses CodeQL to secure GitHub

This post details how GitHub Product Security Engineering uses CodeQL for security analysis. It explains the strategy of publishing custom CodeQL query packs to GitHub Container Registry (GCR) for improved deployment and iteration speed compared to embedding queries directly in repositories. The post also covers dependency management for CodeQL query packs, specifically pinning versions of libraries like `ruby-all` to ensure stability, and outlines the release flow for new queries. Finally, it discusses strategies for granting access to these private query packs across multiple repositories within an enterprise.