您可以使用 code scanning 在 GitHub 上查找项目中的安全漏洞和代码错误。
Learn about the different types of code scanning alerts and the information that helps you understand the problem each alert highlights.
When code scanning identifies a problem in a pull request, you can review the highlighted code and resolve the alert.
You can set up code scanning by adding a workflow to your repository.
From the security view, you can view, fix, or dismiss alerts for potential vulnerabilities or errors in your project's code.
You can add code scanning alerts to issues using task lists. This makes it easy to create a plan for development work that includes fixing alerts.
You can configure how GitHub scans the code in your project for vulnerabilities and errors.
You can use CodeQL to identify vulnerabilities and errors in your code. The results are shown as code scanning alerts in GitHub.
根据代码库的大小，推荐在自托管计算机上运行 CodeQL 分析的规范（RAM、CPU 内核和磁盘）。
您可以配置 GitHub 如何使用 CodeQL analysis workflow 扫描用编译语言编写的代码以查找漏洞和错误。
If you're having problems with code scanning, you can troubleshoot by using these tips for resolving issues.
You can run code scanning in a container by ensuring that all processes run in the same container.
您可以在 GitHub.com 中查看 code scanning 分析期间生成的输出。