Configuring advanced setup for code scanning with CodeQL at scale

You can use a script to configure advanced setup for code scanning for a specific group of repositories in your organization.

Wer kann dieses Feature verwenden?

Organisationsbesitzerinnen, Sicherheitsmanagerinnen und Organisationsmitglieder mit der Administratorrolle

Code scanning is available for the following repository types:

  • Public repositories on GitHub.com
  • Organization-owned repositories on GitHub Team, GitHub Enterprise Cloud, or GitHub Enterprise Server, with GitHub Code Security enabled.

In diesem Artikel

About enabling advanced setup for code scanning with CodeQL at scale

If you need to configure a highly customizable code scanning setup for many repositories in your organization, or if repositories in your organization are ineligible for default setup, you can enable code scanning at scale with advanced setup.

To enable advanced setup across multiple repositories, you can write a bulk configuration script. To successfully execute the script, GitHub Actions must be enabled for the organization or enterprise.

Alternatively, if you do not need granular control over the code scanning configuration for many repositories in your organization, you can quickly and easily configure code scanning at scale with default setup. For more information, see Configuring default setup for code scanning at scale.

Using a script to enable advanced setup

For repositories that are not eligible for default setup, you can use a bulk configuration script to enable advanced setup across multiple repositories.

  1. Identify a group of repositories that can be analyzed using the same code scanning configuration. For example, all repositories that build Java artifacts using the production environment.
  2. Create and test a GitHub Actions workflow to call the CodeQL action with the appropriate configuration. For more information, see Konfigurieren des erweiterten Setups für das Codescanning.
  3. Use one of the example scripts or create a custom script to add the workflow to each repository in the group.

Extending CodeQL coverage with model packs

Hinweis

CodeQL-Modellpakete liegen derzeit als öffentliche Vorschau vor und können noch geändert werden. Modellpakete werden für die C/C++, C#, Java/Kotlin, Python, Ruby und Rust-Analyse unterstützt.

Der CodeQL-Modell-Editor in der CodeQL-Erweiterung für Visual Studio Code unterstützt Modellierungsabhängigkeiten für C#, Java/Kotlin, Python und Ruby.

If your codebase depends on a library or framework that is not recognized by the standard queries in CodeQL, you can extend the CodeQL coverage in your bulk configuration script by specifying published CodeQL model packs. For more information, see Anpassen des erweiterten Setups für das Codescanning.

Alternatively, if you do not need granular control over the code scanning configuration for many repositories in your organization, you can quickly and easily configure model packs with code scanning at scale with default setup. For more information, see Bearbeiten der Konfiguration des Standardsetups.