Your repository is critical to the security of the Open Source Software (OSS) ecosystem, and as part of our mission to make OSS safer, we are contributing aCodeQL configuration for code scanning to your repository. By enabling code scanning with CodeQL, you will be able to continuously analyze your code and surface potential vulnerabilitiesbefore they can even reach your codebase.
We’ve tested the configuration manually before opening this pull request and adjusted it to the needs of your particular repository, but feel free to tweak it further! Check this page for detailed documentation.
Click here to expand the FAQ section
How often will the code scanning analysis run?
By default, code scanning will trigger a scan with the CodeQL engine on the following events:
- On every pull request — to flag up potential security problems for you to investigate before merging a PR.
- On every push to your default branch and other protected branches — this keeps the analysis results on your repository’sSecurity tab up to date.
- Once a week at a fixed time — to make sure you benefit from the latest updated security analysis even when no code was committed or PRs were opened.
What will this cost?
Nothing! The CodeQL engine will run inside GitHub Actions, making use of yourunlimited free compute minutes for public repositories.
Where can I see the results of the analysis?
The results of the analysis will be available on theSecurity tab of your repository. You can find more information about the resultshere.
For Pull Requests, you can find the results of the analysis in theChecks tab. You can find more information about the Pull Request resultshere.
What types of problems does CodeQL find?
CodeQL queries are hosted in thegithub/codeql repository.
By default, code scanning runs thedefault query suite. The queries in thedefault query suite are highly precise and return few false positive code scanning results.
If you are looking for a more comprehensive analysis, which could return a greater number of false positives, you can enable thesecurity-extended query suite in thequeries option ofgithub/codeql-action/init.
In the event of finding a false positive, please create afalse positive Issue ingithub/codeql so we can investigate and improve the query in question. You can also contribute to the query by opening a pull request againstgithub/codeql.
How do I customize the analysis?
You can customize the analysis by using a CodeQL configuration file. This way, you can specify which queries should [not] be run, and/or which files should be excluded from the analysis. You can find more information about the configuration filehere.
How do I upgrade my CodeQL engine?
No need! New versions of the CodeQL analysis are constantly deployed on GitHub.com; your repository will automatically benefit from the most recently released version.
The analysis doesn’t seem to be working
If you get an error in GitHub Actions that indicates that CodeQL wasn’t able to analyze your code, pleasefollow the instructions here to debug the analysis.
Which source code hosting platforms does code scanning support?
GitHub code scanning is deeply integrated within GitHub itself. If you’d like to scan source code that is hosted elsewhere, we suggest that you create a mirror of that code on GitHub.
Hello fromGitHub Security Lab!
Your repository is critical to the security of the Open Source Software (OSS) ecosystem, and as part of our mission to make OSS safer, we are contributing aCodeQL configuration for code scanning to your repository. By enabling code scanning with CodeQL, you will be able to continuously analyze your code and surface potential vulnerabilitiesbefore they can even reach your codebase.
We’ve tested the configuration manually before opening this pull request and adjusted it to the needs of your particular repository, but feel free to tweak it further! Check this page for detailed documentation.
Questions? Check out the FAQ below!
FAQ
Click here to expand the FAQ section
How often will the code scanning analysis run?
By default, code scanning will trigger a scan with the CodeQL engine on the following events:
What will this cost?
Nothing! The CodeQL engine will run inside GitHub Actions, making use of yourunlimited free compute minutes for public repositories.
Where can I see the results of the analysis?
The results of the analysis will be available on theSecurity tab of your repository. You can find more information about the resultshere.
For Pull Requests, you can find the results of the analysis in theChecks tab. You can find more information about the Pull Request resultshere.
What types of problems does CodeQL find?
CodeQL queries are hosted in the
github/codeqlrepository.By default, code scanning runs the
defaultquery suite. The queries in thedefaultquery suite are highly precise and return few false positive code scanning results.If you are looking for a more comprehensive analysis, which could return a greater number of false positives, you can enable the
security-extendedquery suite in thequeriesoption ofgithub/codeql-action/init.In the event of finding a false positive, please create afalse positive Issue in
github/codeqlso we can investigate and improve the query in question. You can also contribute to the query by opening a pull request againstgithub/codeql.How do I customize the analysis?
You can customize the analysis by using a CodeQL configuration file. This way, you can specify which queries should [not] be run, and/or which files should be excluded from the analysis. You can find more information about the configuration filehere.
How do I upgrade my CodeQL engine?
No need! New versions of the CodeQL analysis are constantly deployed on GitHub.com; your repository will automatically benefit from the most recently released version.
The analysis doesn’t seem to be working
If you get an error in GitHub Actions that indicates that CodeQL wasn’t able to analyze your code, pleasefollow the instructions here to debug the analysis.
Which source code hosting platforms does code scanning support?
GitHub code scanning is deeply integrated within GitHub itself. If you’d like to scan source code that is hosted elsewhere, we suggest that you create a mirror of that code on GitHub.