Use when configuring GitHub Advanced Security with CodeQL to perform automated static analysis and vulnerability detection across repositories at enterprise scale.
Use when configuring GitHub Advanced Security with CodeQL to perform automated static analysis and vulnerability detection across repositories at enterprise scale.
Implementing GitHub Advanced Security for Code Scanning
Overview
GitHub Advanced Security (GHAS) integrates CodeQL-powered static application security testing directly into the GitHub development workflow. CodeQL treats code as data, enabling semantic analysis that identifies security vulnerabilities such as SQL injection, cross-site scripting, buffer overflows, and authentication flaws with significantly fewer false positives than traditional pattern-matching scanners. GHAS encompasses code scanning, secret scanning, dependency review, and Dependabot alerts to provide a comprehensive security posture for repositories.
Anti-Rationalization Table
Rationalization
Reality
"I'll figure it out as I go"
A structured approach saves time and reduces errors. Follow the workflow in this skill rather than improvising.
"I already know this topic"
Familiarity breeds shortcuts. Use the checklist to verify you haven't missed critical steps.
"This doesn't apply to my situation"
The patterns here generalize across contexts. Adapt, don't skip — the underlying principles hold.
"One more tool will fix it"
Adding complexity rarely solves process gaps. Master the core workflow first.
When to Use
Trigger phrases:
"implementing github advanced security for code scanning"
"Use when working with implementing github advanced security for code scanning"
When deploying or configuring implementing github advanced security for code scanning capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation
Prerequisites
GitHub Enterprise Cloud or GitHub Enterprise Server 3.0+ with GHAS license
Repository admin or organization owner permissions
Familiarity with GitHub Actions workflow syntax (YAML)
Supported languages: C/C++, C#, Go, Java/Kotlin, JavaScript/TypeScript, Python, Ruby, Swift
Core Concepts
This section covers core concepts for implementing github advanced security for code scanning.
Ensure all prerequisites are met before proceeding
Follow the documented workflow steps in sequence
Record results and any anomalies encountered during this phase
CodeQL Analysis Engine
CodeQL compiles source code into a queryable database, then executes security-focused queries against that database. The query suites ship with hundreds of checks mapped to CWE identifiers and cover OWASP Top 10, SANS Top 25, and language-specific vulnerability patterns. Custom queries can be authored using the CodeQL query language (QL) to detect organization-specific anti-patterns.
Default Setup vs. Advanced Setup
Default Setup enables code scanning with a single click from the repository's Code Security settings. GitHub automatically determines the languages present, selects appropriate query suites, and configures scanning triggers. This approach requires no workflow file and is ideal for rapid onboarding.
Advanced Setup generates a .github/workflows/codeql.yml workflow file that can be customized. Teams control scheduling, language matrices, build commands for compiled languages, additional query packs, and integration with third-party SARIF producers. Advanced setup is required when custom build steps, monorepo configurations, or private query packs are needed.
Organization-Wide Rollout
For enterprises managing hundreds of repositories, GHAS supports configuring code scanning at scale using the organization-level security overview. Administrators can enable default setup across all eligible repositories, define custom security configurations, and monitor adoption through the security coverage dashboard.
Workflow
Scope the task — define objectives, boundaries, and success criteria
Gather information — collect all necessary data and context before proceeding
Execute the core workflow — follow the domain-specific steps methodically
Validate results — verify outputs against expected outcomes or baselines
Document findings — record results, anomalies, and recommendations
Step 1 --- Enable GHAS on the Organization
Navigate to Organization Settings > Code security and analysis
Enable GitHub Advanced Security for all repositories or selected repositories
Confirm license seat allocation (GHAS is billed per active committer)
Step 2 --- Configure Default Setup for Quick Wins
Go to Repository Settings > Code security > Code scanning
Click "Set up" in the CodeQL analysis row and select "Default"
Review the auto-detected languages and query suite (default or extended)
Click "Enable CodeQL" to activate scanning on push and pull request events
The organization-level security overview provides:
Risk view showing repositories with open alerts by severity
Coverage view showing GHAS feature enablement across repositories
Alert trends over time for tracking remediation progress
Filter by team, language, and alert type for targeted review
Monitoring and Metrics
Track mean time to remediate (MTTR) for code scanning alerts
Monitor false positive rates and tune query configurations accordingly
Review alert dismissal reasons to identify areas for developer training
Use the API (/repos/{owner}/{repo}/code-scanning/alerts) for custom reporting dashboards
Common Pitfalls
Compiled language build failures --- CodeQL requires successful compilation for C/C++, Java, C#, Go, and Swift; ensure build dependencies are available in the Actions runner
Ignoring scheduled scans --- Push/PR scanning misses vulnerabilities in dependencies; weekly scheduled scans catch newly disclosed CVEs in existing code
Over-alerting with security-and-quality --- Start with default suite and expand gradually to avoid developer alert fatigue
Missing GHAS license seats --- Only active committers to GHAS-enabled repositories consume license seats; plan capacity accordingly
When NOT to Use
You need to test the implementation (use performing-* skills)
Task is about configuring existing tools (use configuring-* skills)
You need to analyze security events (use analyzing-* skills)
Task is about building detection rules (use building-* skills)
