Configuring default setup for code scanning

About default setup

Default setup for code scanning is the quickest, easiest, most low-maintenance way to enable code scanning for your repository. Based on the code in your repository, default setup will automatically create a custom code scanning configuration. After enabling default setup, the code written in CodeQL-supported languages in your repository will be scanned:

• On each push to the repository's default branch, or any protected branch. For more information on protected branches, see 保護されたブランチについて.
• When creating or committing to a pull request based against the repository's default branch, or any protected branch, excluding pull requests from forks.
• On a weekly schedule.

You can also enable default setup for multiple or all repositories in an organization at the same time. For information on bulk enablement, see 大規模なコード スキャンの既定のセットアップを構成する.

If you need more granular control over your code scanning configuration, you should instead configure advanced setup. For more information, see Configuring advanced setup for code scanning.

Requirements for using default setup

Your repository is eligible for default setup for code scanning if:

• GitHub Actions が有効になっています。
• 一般公開されているか、GitHub Code Security が有効になっている。

将来、リポジトリに少なくとも 1 つの CodeQL でサポートされる言語が含まれる可能性がある場合は、対象となるリポジトリの既定のセットアップを有効にすることがおすすめです。 CodeQL でサポートされている言語が含まれていないリポジトリで既定のセットアップを有効にした場合、既定のセットアップではスキャンが実行されず、GitHub Actions 分も使用されません。 CodeQL でサポートされている言語がリポジトリの既定のブランチに追加された場合、既定のセットアップでは、CodeQL でサポートされている言語のスキャンが自動的に開始され、GitHub Actions 分が使われます。 CodeQL でサポートされている言語の詳細については、「CodeQL によるコード スキャンについて」を参照してください。

You can use default setup for all CodeQL-supported languages for self-hosted runners or GitHub-hosted runners. See Assigning labels to runners, later in this article.

Default setup uses the none build mode for C/C++、 C#、 Java および Rust and uses the autobuild build mode for other compiled languages. You should configure your self-hosted runners to make sure they can run all the necessary commands for C/C++, C#, and Swift analysis. Analysis of JavaScript/TypeScript, Go, Ruby, Python, and Kotlin code does not currently require special configuration.

Customizing default setup

We recommend that you start using code scanning with default setup. After you've initially configured default setup, you can evaluate code scanning to see how it's working for you. If you find that something isn't working as you expect, you can customize default setup to better meet your needs. For more information, see コード スキャンの既定のセットアップの評価.

About adding new languages to your default setup

If the code in a repository changes to include any CodeQL-supported languages, GitHub will automatically update the code scanning configuration to include the new language. If code scanning fails with the new configuration, GitHub will resume the previous configuration automatically so the repository does not lose code scanning coverage.

Configuring default setup for a repository

1. GitHub で、リポジトリのメイン ページに移動します。

   メモ

   If you are configuring default setup on a fork, you must first enable GitHub Actions. To enable GitHub Actions, under your repository name, click Actions, then click I understand my workflows, go ahead and enable them. Be aware that this will enable all existing workflows on your fork.

2. リポジトリ名の下にある [Settings] をクリックします。 [設定] タブが表示されない場合は、 [] ドロップダウン メニューを選び、 [設定] をクリックします。

   

3. サイドバーの [Security] セクションで、[ Advanced Security] をクリックします。

4. [Code Security] の下の [CodeQL analysis] の右側で、[Set up ] を選んでから、[Default] をクリックします。

   

   You will then see a "CodeQL default configuration" dialog summarizing the code scanning configuration automatically created by default setup.

5. Optionally, to customize your code scanning setup, click Edit.

   • To add or remove a language from the analysis performed by default setup, select or deselect that language in the "Languages" section.
   • To specify the CodeQL query suite you would like to use, select your preferred query suite in the "Query suites" section.

6. Review the settings for default setup on your repository, then click Enable CodeQL. This will trigger a workflow that tests the new, automatically generated configuration.

   メモ

   If you are switching to default setup from advanced setup, you will see a warning informing you that default setup will override existing code scanning configurations. This warning means default setup will disable the existing workflow file and block any CodeQL analysis API uploads.

7. Optionally, to view your default setup configuration after enablement, select , then click View CodeQL configuration.

Assigning labels to runners

You can also assign self-hosted runners with the default code-scanning label, or you can optionally give them custom labels so that individual repositories can use different runners. For information about assigning labels to self-hosted runners, see セルフホストランナーとのラベルの利用.

Specifying custom labels for self-hosted runners is optional. Unless you have a specific use case, we recommend that you only assign runners with the default code-scanning label. For example, you may want to:

• Assign more powerful self-hosted runners to critical repositories for faster code scanning analysis.
• Run your code scanning analyses on a particular platform (for example, macOS).
• Have granular control over the workload for your GitHub-hosted runners and self-hosted runners.

Once you've assigned custom labels to self-hosted runners, your repositories can use those runners for code scanning default setup. For more information, see Configuring default setup for a repository, earlier in this article.

You can also use security configurations to assign labels to self-hosted runners for code scanning. See カスタム セキュリティ構成の作成.

Assigning より大きなランナー (larger runner)

To assign a より大きなランナー, name the runner code-scanning. This will automatically add the code-scanning label to the より大きなランナー. An organization can only have one より大きなランナー with the code-scanning label, and that runner will handle all code scanning jobs from repositories within your organization with access to the runner's group. See Configuring larger runners for default setup.

Next steps

After your configuration runs successfully at least once, you can start examining and resolving code scanning alerts. For more information on code scanning alerts, see Code scanningアラートについて and リポジトリのコード スキャンのアラートの評価.

After you've configured default setup for code scanning, you can read about evaluating how it's working for you and the next steps you can take to customize it. For more information, see コード スキャンの既定のセットアップの評価.

You can find detailed information about your code scanning configuration, including timestamps for each scan and the percentage of files scanned, on the tool status page. For more information, see About the tool status page for code scanning.

When you configure default setup, you may encounter an error. For information on troubleshooting specific errors, see Troubleshooting analysis errors.