Configure GitHub Advanced Security with CodeQL to perform automated static analysis and vulnerability detection across repositories at enterprise scale.
Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.
Configure GitHub Advanced Security with CodeQL to perform automated static analysis and vulnerability detection across repositories at enterprise scale.
Implementing GitHub Advanced Security for Code Scanning
Overview
GitHub Advanced Security (GHAS) integrates CodeQL-powered static application security testing directly into the GitHub development workflow. CodeQL treats code as data, enabling semantic analysis that identifies security vulnerabilities such as SQL injection, cross-site scripting, buffer overflows, and authentication flaws with significantly fewer false positives than traditional pattern-matching scanners. GHAS encompasses code scanning, secret scanning, dependency review, and Dependabot alerts to provide a comprehensive security posture for repositories.
When to Use
When deploying or configuring implementing github advanced security for code scanning capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation
Common Misconfigurations & Verification
CodeQL can be enabled and still gate nothing:
Scanning PRs only, never the default branch. A codeql.yml with only on: pull_request (no push to main/develop and no schedule:) leaves already-merged code and newly disclosed CVEs unscanned. Include push to the default branch and a weekly schedule: cron.
Results uploaded but not required. SARIF in the Security tab is not a gate. Enable branch protection "Require code scanning results" with a severity threshold (block on High/Critical); otherwise PRs merge with open alerts.
security-events: write permission missing so upload-sarif/analyze silently fails to record results.
Compiled languages with a broken autobuild. If C/C++, Java, C#, Go, or Swift don't actually compile, CodeQL analyzes little or nothing while still reporting success — verify the build step succeeds and the DB is populated.
Default suite only. Using just default (not security-extended) plus a narrow language matrix misses categories — confirm every language in the repo is listed in the matrix.
Push protection / secret scanning left off, so secrets aren't blocked at commit time.
Concrete verification: Open a PR introducing an obvious sink (e.g. a SQL string built from input, or ) on a protected branch. Confirm CodeQL raises a High alert branch protection blocks the merge until it's resolved — not just shows an annotation.
request
eval(userInput)
and
Prerequisites
GitHub Enterprise Cloud or GitHub Enterprise Server 3.0+ with GHAS license
Repository admin or organization owner permissions
Familiarity with GitHub Actions workflow syntax (YAML)
Supported languages: C/C++, C#, Go, Java/Kotlin, JavaScript/TypeScript, Python, Ruby, Swift
Core Concepts
CodeQL Analysis Engine
CodeQL compiles source code into a queryable database, then executes security-focused queries against that database. The query suites ship with hundreds of checks mapped to CWE identifiers and cover OWASP Top 10, SANS Top 25, and language-specific vulnerability patterns. Custom queries can be authored using the CodeQL query language (QL) to detect organization-specific anti-patterns.
Default Setup vs. Advanced Setup
Default Setup enables code scanning with a single click from the repository's Code Security settings. GitHub automatically determines the languages present, selects appropriate query suites, and configures scanning triggers. This approach requires no workflow file and is ideal for rapid onboarding.
Advanced Setup generates a .github/workflows/codeql.yml workflow file that can be customized. Teams control scheduling, language matrices, build commands for compiled languages, additional query packs, and integration with third-party SARIF producers. Advanced setup is required when custom build steps, monorepo configurations, or private query packs are needed.
Organization-Wide Rollout
For enterprises managing hundreds of repositories, GHAS supports configuring code scanning at scale using the organization-level security overview. Administrators can enable default setup across all eligible repositories, define custom security configurations, and monitor adoption through the security coverage dashboard.
Workflow
Step 1 --- Enable GHAS on the Organization
Navigate to Organization Settings > Code security and analysis
Enable GitHub Advanced Security for all repositories or selected repositories
Confirm license seat allocation (GHAS is billed per active committer)
Step 2 --- Configure Default Setup for Quick Wins
Go to Repository Settings > Code security > Code scanning
Click "Set up" in the CodeQL analysis row and select "Default"
Review the auto-detected languages and query suite (default or extended)
Click "Enable CodeQL" to activate scanning on push and pull request events
The organization-level security overview provides:
Risk view showing repositories with open alerts by severity
Coverage view showing GHAS feature enablement across repositories
Alert trends over time for tracking remediation progress
Filter by team, language, and alert type for targeted review
Monitoring and Metrics
Track mean time to remediate (MTTR) for code scanning alerts
Monitor false positive rates and tune query configurations accordingly
Review alert dismissal reasons to identify areas for developer training
Use the API (/repos/{owner}/{repo}/code-scanning/alerts) for custom reporting dashboards
Common Pitfalls
Compiled language build failures --- CodeQL requires successful compilation for C/C++, Java, C#, Go, and Swift; ensure build dependencies are available in the Actions runner
Ignoring scheduled scans --- Push/PR scanning misses vulnerabilities in dependencies; weekly scheduled scans catch newly disclosed CVEs in existing code
Over-alerting with security-and-quality --- Start with default suite and expand gradually to avoid developer alert fatigue
Missing GHAS license seats --- Only active committers to GHAS-enabled repositories consume license seats; plan capacity accordingly
