我们经常发布文档更新,此页面的翻译可能仍在进行中。有关最新信息,请访问英文文档。如果此页面上的翻译有问题,请告诉我们

About code scanning

You can use 代码扫描 to find security vulnerabilities and errors in the code for your project on GitHub.

代码扫描 is available in public repositories, and in public and private repositories owned by organizations with a license for Advanced Security. For more information, see "GitHub's products."

本文内容

此文档对您有帮助吗?

帮助我们创建出色的文档!

所有 GitHub 文档都是开源的。看到错误或不清楚的内容了吗?提交拉取请求。

做出贡献

或, 了解如何参与。

About 代码扫描

代码扫描 is a feature that you use to analyze the code in a GitHub repository to find security vulnerabilities and coding errors. Any problems identified by the analysis are shown in GitHub.

You can use 代码扫描 to find, triage, and prioritize fixes for existing problems in your code. 代码扫描 also prevents developers from introducing new problems. You can schedule scans for specific days and times, or trigger scans when a specific event occurs in the repository, such as a push.

If 代码扫描 finds a potential vulnerability or error in your code, GitHub displays an alert in the repository. After you fix the code that triggered the alert, GitHub closes the alert. For more information, see "Managing 代码扫描 alerts for your repository."

To monitor results from 代码扫描 across your repositories or your organization, you can use the 代码扫描 API. For more information about API endpoints, see "代码扫描."

To get started with 代码扫描, see "Enabling 代码扫描 for a repository."

About CodeQL

You can use 代码扫描 with CodeQL, a semantic code analysis engine. CodeQL treats code as data, allowing you to find potential vulnerabilities in your code with greater confidence than traditional static analyzers.

QL is the query language that powers CodeQL. QL is an object-oriented logic programming language. GitHub, language experts, and security researchers create the queries used for 代码扫描, and the queries are open source. The community maintains and updates the queries to improve analysis and reduce false positives. For more information, see CodeQL on the GitHub Security Lab website.

代码扫描 with CodeQL supports both compiled and interpreted languages, and can find vulnerabilities and errors in code that's written in the supported languages.

  • C/C++
  • C#
  • Go
  • Java
  • JavaScript/TypeScript
  • Python

You can view and contribute to the queries for 代码扫描 in the github/codeql repository. For more information, see CodeQL queries in the CodeQL documentation.

About billing for 代码扫描

代码扫描 uses GitHub Actions, and each run of a 代码扫描 workflow consumes minutes for GitHub Actions. For more information, see "About billing for GitHub Actions."

About third-party code scanning tools

您可以将 SARIF 文件从第三方静态分析工具上传到 GitHub,并且在仓库中看到 代码扫描 来自这些工具的警报。

代码扫描 可与输出静态分析结果交换格式 (SARIF) 数据的第三方代码扫描工具互操作。 SARIF 是一个开放的标准。 更多信息请参阅“代码扫描 的 SARIF 输出。”

要开始,请参阅“将 SARIF 文件上传到 GitHub”。

Further reading

此文档对您有帮助吗?

帮助我们创建出色的文档!

所有 GitHub 文档都是开源的。看到错误或不清楚的内容了吗?提交拉取请求。

做出贡献

或, 了解如何参与。