Repository files navigation

This action runs GitHub's industry-leading semantic code analysis engine,CodeQL, against a repository's source code to find security vulnerabilities. It then automatically uploads the results to GitHub so they can be displayed on pull requests and in the repository's security tab. CodeQL runs an extensible set ofqueries, which have been developed by the community and theGitHub Security Lab to find common vulnerabilities in your code.

For a list of recent changes, see the CodeQL Action'schangelog.

This project is released under theMIT License.

The underlying CodeQL CLI, used in this action, is licensed under theGitHub CodeQL Terms and Conditions. As such, this action may be used on open source projects hosted on GitHub, and on private repositories that are owned by an organisation with GitHub Advanced Security enabled.

We recommend using default setup to configure CodeQL analysis for your repository. For more information, see "Configuring default setup for code scanning."

You can also configure advanced setup for a repository to find security vulnerabilities in your code using a highly customizable code scanning configuration. For more information, see "Configuring advanced setup for code scanning" and "Customizing your advanced setup for code scanning."

This repository contains several actions that enable you to analyze code in your repository using CodeQL and upload the analysis to GitHub Code Scanning. Actions in this repository also allow you to upload to GitHub analyses generated by any SARIF-producing SAST tool.

Actions for CodeQL analyses:

• init: Sets up CodeQL for analysis. For information about input parameters, see theinit action definition.
• analyze: Finalizes the CodeQL database, runs the analysis, and uploads the results to Code Scanning. For information about input parameters, see theanalyze action definition.

Actions for uploading analyses generated by third-party tools:

• upload-sarif: Uploads a SARIF file to Code Scanning. If you are using theanalyze action, there is no reason to use this action as well. For information about input parameters, see theupload-sarif action definition.

Actions with special purposes and unlikely to be used directly:

• autobuild: Attempts to automatically build the code. Only used for analyzing languages that require a build. Use thebuild-mode: autobuild input in theinit action instead. For information about input parameters, see theautobuild action definition.
• resolve-environment: [Experimental] Attempts to infer a build environment suitable for automatic builds. For information about input parameters, see theresolve-environment action definition.
• start-proxy: [Experimental] Start the HTTP proxy server. Internal use only and will change without notice. For information about input parameters, see thestart-proxy action definition.

All advanced setup code scanning workflows must have thesecurity-events: write permission. Workflows in private repositories must additionally have thecontents: read permission. For more information, see "Assigning permissions to jobs."

The CodeQL Action supports different build modes for analyzing the source code. The available build modes are:

• none: The database will be created without building the source code. Available for all interpreted languages and some compiled languages.
• autobuild: The database will be created by attempting to automatically build the source code. Available for all compiled languages.
• manual: The database will be created by building the source code using a manually specified build command. To use this build mode, specify manual build steps in your workflow between theinit andanalyze steps. Available for all compiled languages.

Interpreted languages must usenone for the build mode.

For compiled languages:

• manual build mode will typically produce the most precise results, but it is more difficult to set up and will cause the analysis to take slightly more time to run.
• autobuild build mode is simpler to set up, but will only work for projects with generic build steps that can be guessed by the heuristics of the autobuild scripts. Ifautobuild fails, then you must switch tomanual ornone. Ifautobuild succeeds, then the results and run time will be the same asmanual mode.
• none build mode is also simpler to set up and is slightly faster to run, but there is a possibility that some alerts will be missed. This may happen if your repository does any code generation during compilation or if there are any dependencies downloaded from registries that the workflow does not have access to.none is not yet supported by C/C++, Swift, Go, or Kotlin.

The following versions of the CodeQL Action are currently supported:

• v3 (latest)

We typically release new minor versions of the CodeQL Action and Bundle when a new minor version of GitHub Enterprise Server (GHES) is released. When a version of GHES is deprecated, the CodeQL Action and Bundle releases that shipped with it are deprecated as well.

See the full list of GHES release and deprecation dates atGitHub Enterprise Server releases.

Read abouttroubleshooting code scanning.

This project welcomes contributions. SeeCONTRIBUTING.md for details on how to build, install, and contribute.