Add new configuration Parameter

CHANGELOG.md

@@ -2,7 +2,7 @@
 
 ## [UNRELEASED]
 
-No user facing changes.
+- You can now configure CodeQL within your code scanning workflow by passing a `config` parameter to the `init` Action. [#1590](https://github.com/github/codeql-action/pull/1590)
 
 ## 2.2.11 - 06 Apr 2023
 

README.md

@@ -135,6 +135,44 @@ By default, this will override any queries specified in a config file. If you wi
     queries: +<local-or-remote-query>,<another-query>
 ```
 
+### Configuration via `config` input
+
+
+You can alternatively configure CodeQL using the `config` input to the `init` Action. The value of this input must be a YAML string that follows the configuration file format documented at "[Using a custom configuration file](https://help.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#using-a-custom-configuration-file)."
+
+
+
+- **Complete Configuration**
+
+    ```yaml
+    - uses: github/codeql-action/init@v2
+      with:
+        languages: ${{ matrix.language }}
+        config: |
+          disable-default-queries: true
+          queries:
+            - uses: security-extended
+            - uses: security-and-quality
+          query-filters:
+            - include:
+          tags: /cwe-020/
+    ```
+
+
+- **Actions Variables**
+
+  You can use actions or environment variables to share configuration across multiple repositories and to modify configuration without needing to edit the workflow file.
+
+  ```yaml
+  - uses: github/codeql-action/init@v2
+    with:
+      languages: ${{ matrix.language }}
+      config: ${{ vars.CODEQL_CONF }}
+  ```
+
+
+  where `vars.CODEQL_CONF` references an [Actions configuration variable](https://docs.github.com/en/actions/learn-github-actions/variables#defining-configuration-variables-for-multiple-workflows).
+
 ## Troubleshooting
 
 Read about [troubleshooting code scanning](https://help.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/troubleshooting-code-scanning).

init/action.yml

@@ -44,6 +44,9 @@ inputs:
   db-location:
     description: Path where CodeQL databases should be created. If not specified, a temporary directory will be used.
     required: false
+  config:    
+    description: Configuration passed as a YAML string in the same format as the config-file input. This takes precedence over the config-file input.
+    required: false
   queries:
     description: Comma-separated list of additional queries to run. By default, this overrides the same setting in a configuration file; prefix with "+" to use both sets of queries.
     required: false