Skip to main content

About code scanning alerts

Learn about the different types of code scanning alerts and the information that helps you understand the problem each alert highlights.

代码扫描 可用于 GitHub Enterprise Server 中的组织拥有的存储库。 此功能需要 GitHub Advanced Security 的许可证。 更多信息请参阅“GitHub 的产品”。

Note: Your site administrator must enable 代码扫描 for 您的 GitHub Enterprise Server 实例 before you can use this feature. For more information, see "Configuring 代码扫描 for your appliance."

About alerts from 代码扫描

You can set up 代码扫描 to check the code in a repository using the default CodeQL analysis, a third-party analysis, or multiple types of analysis. When the analysis is complete, the resulting alerts are displayed alongside each other in the security view of the repository. Results from third-party tools or from custom queries may not include all of the properties that you see for alerts detected by GitHub's default CodeQL analysis. For more information, see "Setting up 代码扫描 for a repository."

By default, 代码扫描 analyzes your code periodically on the default branch and during pull requests. For information about managing alerts on a pull request, see "Triaging 代码扫描 alerts in pull requests."

About alert details

Each alert highlights a problem with the code and the name of the tool that identified it. You can see the line of code that triggered the alert, as well as properties of the alert, such as the alert severity, security severity, and the nature of the problem. Alerts also tell you when the issue was first introduced. For alerts identified by CodeQL analysis, you will also see information on how to fix the problem.

警报页面上的状态和详细信息仅反映存储库的默认分支上的警报状态,即使警报存在于其他分支中也是如此。 可以在警报页面右侧 Affected branches(受影响的分支)部分中查看非默认分支上警报状态。 如果默认分支中不存在警报,则警报的状态将显示为“在拉取请求中”或“在分支中”,并将显示为灰色。

Example alert from 代码扫描

If you set up 代码扫描 using CodeQL, you can also find data-flow problems in your code. Data-flow analysis finds potential security issues in code, such as: using data insecurely, passing dangerous arguments to functions, and leaking sensitive information.

When 代码扫描 reports data-flow alerts, GitHub shows you how data moves through the code. 代码扫描 allows you to identify the areas of your code that leak sensitive information, and that could be the entry point for attacks by malicious users.

About severity levels

Alert severity levels may be Error, Warning, or Note.

If 代码扫描 is enabled as a pull request check, the check will fail if it detects any results with a severity of error. You can specify which severity level of code scanning alerts causes a check failure. For more information, see "Defining the severities causing pull request check failure."

About security severity levels

代码扫描 displays security severity levels for alerts that are generated by security queries. Security severity levels can be Critical, High, Medium, or Low.

To calculate the security severity of an alert, we use Common Vulnerability Scoring System (CVSS) data. CVSS is an open framework for communicating the characteristics and severity of software vulnerabilities, and is commonly used by other security products to score alerts. For more information about how severity levels are calculated, see this blog post.

By default, any 代码扫描 results with a security severity of Critical or High will cause a check failure. You can specify which security severity level for 代码扫描 results should cause a check failure. For more information, see "Defining the severities causing pull request check failure."

About analysis origins

You can set up multiple configurations of code analysis on a repository, using different tools and targeting different languages or areas of the code. Each configuration of code scanning is the analysis origin for all the alerts it generates. For example, an alert generated using the default CodeQL analysis with GitHub Actions will have a different analysis origin from an alert generated externally and uploaded via the code scanning API.

If you use multiple configurations to analyze a file, any problems detected by the same query are reported as alerts with multiple analysis origins. If an alert has more than one analysis origin, a icon will appear next to any relevant branch in the Affected branches section on the right-hand side of the alert page. You can hover over the icon to see the names of each analysis origin and the status of the alert for that analysis origin. You can also view the history of when alerts appeared in each analysis origin in the timeline on the alert page. If an alert only has one analysis origin, no information about analysis origins is displayed on the alert page.

Code scanning alert with multiple analysis origins

Note: Sometimes a code scanning alert displays as fixed for one analysis origin but is still open for a second analysis origin. You can resolve this by re-running the second code scanning configuration to update the alert status for that analysis origin.

About labels for alerts that are not found in application code

GitHub Enterprise Server assigns a category label to alerts that are not found in application code. The label relates to the location of the alert.

  • Generated: Code generated by the build process
  • Test: Test code
  • Library: Library or third-party code
  • Documentation: Documentation

代码扫描 categorizes files by file path. You cannot manually categorize source files.

Here is an example from the 代码扫描 alert list of an alert marked as occurring in library code.

Code scanning library alert in list

On the alert page, you can see that the filepath is marked as library code (Library label).

Code scanning library alert details