About the problem
When you apply a security configuration and code scanning is defined as "Enabled with advanced setup allowed", each repository is checked to see if there is an existing, active, advanced setup.
- No change to code scanning if an active advanced setup configuration is detected.
- Default setup is enabled for repositories where advanced setup is inactive or absent.
Inactive or absent advanced setup
A configuração avançada é considerada inativa para um repositório quando este atende a qualquer um dos seguintes critérios:
- A análise mais recente do CodeQL tem mais de 90 dias.
- Todas as configurações do CodeQL foram excluídas.
- O arquivo de fluxo de trabalho foi excluído ou desabilitado (exclusivamente para a configuração avançada executada usando ações).
Solving the problem
This solution has two parts:
-
Any repositories where default setup for code scanning was unexpectedly applied need to run CodeQL analysis at intervals of less than 90 days, for example, once a month.
Even if the repository is not under active development, new vulnerabilities may be identified by updates to CodeQL analysis.
-
Once the affected repositories all have CodeQL analysis running, you can reapply the security configuration.