About configuring default setup at scale
With default setup for code scanning, you can quickly secure code in repositories across your organization.
You can enable code scanning for all repositories in your organization that are eligible for default setup. After enabling default setup, the code written in CodeQL-supported languages in repositories in the organization will be scanned:
- On each push to the repository's default branch, or any protected branch. For more information on protected branches, see Informationen zu geschützten Branches.
- When creating or committing to a pull request based against the repository's default branch, or any protected branch, excluding pull requests from forks.
- On a weekly schedule.
For more information, see Configuring default setup for all eligible repositories in an organization.
For repositories that are not eligible for default setup, you can configure advanced setup at the repository level, or at the organization level using a script. For more information, see Configuring advanced setup for code scanning with CodeQL at scale.
Eligible repositories for CodeQL default setup at scale
A repository must meet all the following criteria to be eligible for default setup, otherwise you need to use advanced setup.
- Advanced setup for code scanning is not already enabled.
- GitHub Actions sind aktiviert.
- Es ist öffentlich sichtbar, oder GitHub Code Security ist aktiviert.
Es wird empfohlen, das Standardsetup für berechtigte Repositorys zu aktivieren, wenn die Repositorys in Zukunft mindestens eine von CodeQL unterstützte Sprache enthalten. Wenn du das Standardsetup für ein Repository aktivierst, das keine von CodeQL unterstützten Sprachen enthält, führt das Standardsetup keine Scans aus und nutzt keine GitHub Actions-Minuten. Wenn die von CodeQL unterstützten Sprachen zum Standardbranch des Repositorys hinzugefügt werden, beginnt das Standardsetup automatisch mit dem Scannen der von CodeQL unterstützten Sprachen und der Nutzung von GitHub Actions-Minuten. Weitere Informationen zu den von CodeQL unterstützten Sprachen findest du unter Informationen zu Codescans mit CodeQL.
About adding languages to an existing default setup configuration
If the code in a repository changes to include a CodeQL-supported language, GitHub will automatically update the code scanning configuration to include the new language. If code scanning fails with the new configuration, GitHub will resume the previous configuration automatically so the repository does not lose code scanning coverage.
Providing default setup access to private registries
When a repository uses code stored in a private registry, default setup needs access to the registry to work effectively. For more information, see Giving security features access to private registries.
Configuring default setup for all eligible repositories in an organization
You can enable default setup for all eligible repositories in your organization. For more information, see Informationen zum Aktivieren von Sicherheitsfeatures im großen Stil.
Extending CodeQL coverage in default setup
Through your organization's security settings page, you can extend coverage in default setup using model packs for all eligible repositories in your organization. For more information, see Bearbeiten der Konfiguration des Standardsetups.
Configuring default setup for a subset of repositories in an organization
You can filter for specific repositories you would like to configure default setup for. For more information, see Applying a custom security configuration.
Configuring merge protection for all repositories in an organization
You can use rulesets to prevent pull requests from being merged when one of the following conditions is met:
- Ein erforderliches Tool hat eine code scanning-Warnung eines Schweregrads gefunden, der in einem Regelsatz definiert ist.
- Eine erforderliche % data variables.product.prodname_code_scanning %}-Toolanalyse wird noch ausgeführt.
- Für das Repository ist kein erforderliches code scanning-Tool konfiguriert.
For more information, see Festlegen des Zusammenführungsschutzes für Codeüberprüfung. For more general information about rulesets, see Informationen zu Regelsätzen.