La API del escaneo de código te permite recuperar y actualizar las alertas del escaneo de código desde un repositorio. Puedes utilizar las terminales para crear reportes automatizados para las alertas del escaneo de código en una organización o cargar resutlados de análisis que se hayan generado utilizando con herramientas fuera de línea del escaneo de código. Para obtener más información, consulta la sección "Encontrar vulnerabilidades de seguridad y errores en tu código".
List code scanning alerts for a repository
Lists all open code scanning alerts for the default branch (usually main
or master
). You must use an access token with the security_events
scope to use
this endpoint. GitHub Apps must have the security_events
read permission to use
this endpoint.
The response includes a most_recent_instance
object.
This provides details of the most recent instance of this alert
for the default branch or for the specified Git reference
(if you used ref
in the request).
get /repos/{owner}/{repo}/code-scanning/alerts
Parámetros
Name | Type | In | Description |
---|---|---|---|
accept |
string | header |
Setting to
|
owner |
string | path | |
repo |
string | path | |
tool_name |
string | query |
The name of a code scanning tool. Only results by this tool will be listed. You can specify the tool by using either |
tool_guid |
string | query |
The GUID of a code scanning tool. Only results by this tool will be listed. Note that some code scanning tools may not include a GUID in their analysis data. You can specify the tool by using either |
page |
integer | query |
Page number of the results to fetch. Default:1 |
per_page |
integer | query |
Results per page (max 100) Default:30 |
ref |
string | query |
The Git reference for the results you want to list. The |
state |
string | query |
Set to |
Ejemplos de código
Shell
curl \
-H "Accept: application/vnd.github.v3+json" \
http(s)://{hostname}/api/v3/repos/octocat/hello-world/code-scanning/alerts
JavaScript (@octokit/core.js)
await octokit.request('GET /repos/{owner}/{repo}/code-scanning/alerts', {
owner: 'octocat',
repo: 'hello-world'
})
Response
Status: 200 OK
[
{
"number": 4,
"created_at": "2020-02-13T12:29:18Z",
"url": "https://api.github.com/repos/octocat/hello-world/code-scanning/alerts/4",
"html_url": "https://github.com/octocat/hello-world/code-scanning/4",
"state": "open",
"dismissed_by": null,
"dismissed_at": null,
"dismissed_reason": null,
"rule": {
"id": "js/zipslip",
"severity": "error",
"description": "Arbitrary file write during zip extraction",
"name": "js/zipslip"
},
"tool": {
"name": "CodeQL",
"guid": null,
"version": "2.4.0"
},
"most_recent_instance": {
"ref": "refs/heads/main",
"analysis_key": ".github/workflows/codeql-analysis.yml:CodeQL-Build",
"environment": "{}",
"state": "open",
"commit_sha": "39406e42cb832f683daa691dd652a8dc36ee8930",
"message": {
"text": "This path depends on a user-provided value."
},
"location": {
"path": "spec-main/api-session-spec.ts",
"start_line": 917,
"end_line": 917,
"start_column": 7,
"end_column": 18
},
"classifications": [
"test"
]
},
"instances_url": "https://api.github.com/repos/octocat/hello-world/code-scanning/alerts/4/instances"
},
{
"number": 3,
"created_at": "2020-02-13T12:29:18Z",
"url": "https://api.github.com/repos/octocat/hello-world/code-scanning/alerts/3",
"html_url": "https://github.com/octocat/hello-world/code-scanning/3",
"state": "dismissed",
"dismissed_by": {
"login": "octocat",
"id": 1,
"node_id": "MDQ6VXNlcjE=",
"avatar_url": "https://github.com/images/error/octocat_happy.gif",
"gravatar_id": "",
"url": "https://api.github.com/users/octocat",
"html_url": "https://github.com/octocat",
"followers_url": "https://api.github.com/users/octocat/followers",
"following_url": "https://api.github.com/users/octocat/following{/other_user}",
"gists_url": "https://api.github.com/users/octocat/gists{/gist_id}",
"starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}",
"subscriptions_url": "https://api.github.com/users/octocat/subscriptions",
"organizations_url": "https://api.github.com/users/octocat/orgs",
"repos_url": "https://api.github.com/users/octocat/repos",
"events_url": "https://api.github.com/users/octocat/events{/privacy}",
"received_events_url": "https://api.github.com/users/octocat/received_events",
"type": "User",
"site_admin": false
},
"dismissed_at": "2020-02-14T12:29:18Z",
"dismissed_reason": "false positive",
"rule": {
"id": "js/zipslip",
"severity": "error",
"description": "Arbitrary file write during zip extraction",
"name": "js/zipslip"
},
"tool": {
"name": "CodeQL",
"guid": null,
"version": "2.4.0"
},
"most_recent_instance": {
"ref": "refs/heads/main",
"analysis_key": ".github/workflows/codeql-analysis.yml:CodeQL-Build",
"environment": "{}",
"state": "open",
"commit_sha": "39406e42cb832f683daa691dd652a8dc36ee8930",
"message": {
"text": "This path depends on a user-provided value."
},
"location": {
"path": "lib/ab12-gen.js",
"start_line": 917,
"end_line": 917,
"start_column": 7,
"end_column": 18
},
"classifications": []
},
"instances_url": "https://api.github.com/repos/octocat/hello-world/code-scanning/alerts/3/instances"
}
]
Response if GitHub Advanced Security is not enabled for this repository
Status: 403 Forbidden
Resource not found
Status: 404 Not Found
Service unavailable
Status: 503 Service Unavailable
Notes
Get a code scanning alert
Gets a single code scanning alert. You must use an access token with the security_events
scope to use this endpoint. GitHub Apps must have the security_events
read permission to use this endpoint.
Deprecation notice:
The instances field is deprecated and will, in future, not be included in the response for this endpoint. The example response reflects this change. The same information can now be retrieved via a GET request to the URL specified by instances_url
.
get /repos/{owner}/{repo}/code-scanning/alerts/{alert_number}
Parámetros
Name | Type | In | Description |
---|---|---|---|
accept |
string | header |
Setting to
|
owner |
string | path | |
repo |
string | path | |
alert_number |
integer | path |
The number that identifies an alert. You can find this at the end of the URL for a code scanning alert within GitHub, and in the |
Ejemplos de código
Shell
curl \
-H "Accept: application/vnd.github.v3+json" \
http(s)://{hostname}/api/v3/repos/octocat/hello-world/code-scanning/alerts/42
JavaScript (@octokit/core.js)
await octokit.request('GET /repos/{owner}/{repo}/code-scanning/alerts/{alert_number}', {
owner: 'octocat',
repo: 'hello-world',
alert_number: 42
})
Response
Status: 200 OK
{
"number": 42,
"created_at": "2020-06-19T11:21:34Z",
"url": "https://api.github.com/repos/octocat/hello-world/code-scanning/alerts/42",
"html_url": "https://github.com/octocat/hello-world/code-scanning/42",
"state": "dismissed",
"dismissed_by": {
"login": "octocat",
"id": 54933897,
"node_id": "MDQ6VXNlcjE=",
"avatar_url": "https://github.com/images/error/octocat_happy.gif",
"gravatar_id": "",
"url": "https://api.github.com/users/octocat",
"html_url": "https://github.com/octocat",
"followers_url": "https://api.github.com/users/octocat/followers",
"following_url": "https://api.github.com/users/octocat/following{/other_user}",
"gists_url": "https://api.github.com/users/octocat/gists{/gist_id}",
"starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}",
"subscriptions_url": "https://api.github.com/users/octocat/subscriptions",
"organizations_url": "https://api.github.com/users/octocat/orgs",
"repos_url": "https://api.github.com/users/octocat/repos",
"events_url": "https://api.github.com/users/octocat/events{/privacy}",
"received_events_url": "https://api.github.com/users/octocat/received_events",
"type": "User",
"site_admin": false
},
"dismissed_at": "2020-02-14T12:29:18Z",
"dismissed_reason": "false positive",
"rule": {
"id": "js/zipslip",
"severity": "error",
"description": "Arbitrary file write during zip extraction (\"Zip Slip\")",
"name": "js/zipslip",
"full_description": "Extracting files from a malicious zip archive without validating that the destination file path is within the destination directory can cause files outside the destination directory to be overwritten.",
"tags": [
"security",
"external/cwe/cwe-022"
],
"help": "# Arbitrary file write during zip extraction (\"Zip Slip\")\\nExtracting files from a malicious zip archive without validating that the destination file path is within the destination directory can cause files outside the destination directory to be overwritten ..."
},
"tool": {
"name": "CodeQL",
"guid": null,
"version": "2.4.0"
},
"most_recent_instance": {
"ref": "refs/heads/main",
"analysis_key": ".github/workflows/codeql-analysis.yml:CodeQL-Build",
"environment": "{}",
"state": "dismissed",
"commit_sha": "39406e42cb832f683daa691dd652a8dc36ee8930",
"message": {
"text": "This path depends on a user-provided value."
},
"location": {
"path": "spec-main/api-session-spec.ts",
"start_line": 917,
"end_line": 917,
"start_column": 7,
"end_column": 18
},
"classifications": [
"test"
]
},
"instances_url": "https://api.github.com/repos/octocat/hello-world/code-scanning/alerts/42/instances"
}
Response if GitHub Advanced Security is not enabled for this repository
Status: 403 Forbidden
Resource not found
Status: 404 Not Found
Service unavailable
Status: 503 Service Unavailable
Notes
Update a code scanning alert
Updates the status of a single code scanning alert. You must use an access token with the security_events
scope to use this endpoint. GitHub Apps must have the security_events
write permission to use this endpoint.
patch /repos/{owner}/{repo}/code-scanning/alerts/{alert_number}
Parámetros
Name | Type | In | Description |
---|---|---|---|
accept |
string | header |
Setting to
|
owner |
string | path | |
repo |
string | path | |
alert_number |
integer | path |
The number that identifies an alert. You can find this at the end of the URL for a code scanning alert within GitHub, and in the |
state |
string | body |
Required. Sets the state of the code scanning alert. Can be one of |
dismissed_reason |
string or nullable | body |
Required when the state is dismissed. The reason for dismissing or closing the alert. Can be one of: |
Ejemplos de código
Shell
curl \
-X PATCH \
-H "Accept: application/vnd.github.v3+json" \
http(s)://{hostname}/api/v3/repos/octocat/hello-world/code-scanning/alerts/42 \
-d '{"state":"state"}'
JavaScript (@octokit/core.js)
await octokit.request('PATCH /repos/{owner}/{repo}/code-scanning/alerts/{alert_number}', {
owner: 'octocat',
repo: 'hello-world',
alert_number: 42,
state: 'state'
})
Response
Status: 200 OK
{
"number": 42,
"created_at": "2020-08-25T21:28:36Z",
"url": "https://api.github.com/repos/octocat/hello-world/code-scanning/alerts/42",
"html_url": "https://github.com/octocat/hello-world/code-scanning/42",
"state": "dismissed",
"dismissed_by": {
"login": "octocat",
"id": 1,
"node_id": "MDQ6VXNlcjE=",
"avatar_url": "https://github.com/images/error/octocat_happy.gif",
"gravatar_id": "",
"url": "https://api.github.com/users/octocat",
"html_url": "https://github.com/octocat",
"followers_url": "https://api.github.com/users/octocat/followers",
"following_url": "https://api.github.com/users/octocat/following{/other_user}",
"gists_url": "https://api.github.com/users/octocat/gists{/gist_id}",
"starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}",
"subscriptions_url": "https://api.github.com/users/octocat/subscriptions",
"organizations_url": "https://api.github.com/users/octocat/orgs",
"repos_url": "https://api.github.com/users/octocat/repos",
"events_url": "https://api.github.com/users/octocat/events{/privacy}",
"received_events_url": "https://api.github.com/users/octocat/received_events",
"type": "User",
"site_admin": false
},
"dismissed_at": "2020-09-02T22:34:56Z",
"dismissed_reason": "false positive",
"rule": {
"id": "js/zipslip",
"severity": "error",
"description": "Arbitrary file write during zip extraction (\"Zip Slip\")",
"name": "js/zipslip",
"full_description": "Extracting files from a malicious zip archive without validating that the destination file path is within the destination directory can cause files outside the destination directory to be overwritten.",
"tags": [
"security",
"external/cwe/cwe-022"
],
"help": "# Arbitrary file write during zip extraction (\"Zip Slip\")\\nExtracting files from a malicious zip archive without validating that the destination file path is within the destination directory can cause files outside the destination directory to be overwritten ..."
},
"tool": {
"name": "CodeQL",
"guid": null,
"version": "2.4.0"
},
"most_recent_instance": {
"ref": "refs/heads/main",
"analysis_key": ".github/workflows/codeql-analysis.yml:CodeQL-Build",
"environment": "{}",
"state": "dismissed",
"commit_sha": "39406e42cb832f683daa691dd652a8dc36ee8930",
"message": {
"text": "This path depends on a user-provided value."
},
"location": {
"path": "spec-main/api-session-spec.ts",
"start_line": 917,
"end_line": 917,
"start_column": 7,
"end_column": 18
},
"classifications": [
"test"
]
},
"instances_url": "https://api.github.com/repos/octocat/hello-world/code-scanning/alerts/42/instances"
}
Response if the repository is archived or if github advanced security is not enabled for this repository
Status: 403 Forbidden
Resource not found
Status: 404 Not Found
Service unavailable
Status: 503 Service Unavailable
Notes
List code scanning analyses for a repository
Lists the details of all code scanning analyses for a repository,
starting with the most recent.
The response is paginated and you can use the page
and per_page
parameters
to list the analyses you're interested in.
By default 30 analyses are listed per page.
The rules_count
field in the response give the number of rules
that were run in the analysis.
For very old analyses this data is not available,
and 0
is returned in this field.
You must use an access token with the security_events
scope to use this endpoint.
GitHub Apps must have the security_events
read permission to use this endpoint.
Deprecation notice:
The tool_name
field is deprecated and will, in future, not be included in the response for this endpoint. The example response reflects this change. The tool name can now be found inside the tool
field.
get /repos/{owner}/{repo}/code-scanning/analyses
Parámetros
Name | Type | In | Description |
---|---|---|---|
accept |
string | header |
Setting to
|
owner |
string | path | |
repo |
string | path | |
tool_name |
string | query |
The name of a code scanning tool. Only results by this tool will be listed. You can specify the tool by using either |
tool_guid |
string | query |
The GUID of a code scanning tool. Only results by this tool will be listed. Note that some code scanning tools may not include a GUID in their analysis data. You can specify the tool by using either |
page |
integer | query |
Page number of the results to fetch. Default:1 |
per_page |
integer | query |
Results per page (max 100) Default:30 |
ref |
string | query |
The Git reference for the analyses you want to list. The |
sarif_id |
string | query |
Filter analyses belonging to the same SARIF upload. |
Ejemplos de código
Shell
curl \
-H "Accept: application/vnd.github.v3+json" \
http(s)://{hostname}/api/v3/repos/octocat/hello-world/code-scanning/analyses
JavaScript (@octokit/core.js)
await octokit.request('GET /repos/{owner}/{repo}/code-scanning/analyses', {
owner: 'octocat',
repo: 'hello-world'
})
Response
Status: 200 OK
[
{
"ref": "refs/heads/main",
"commit_sha": "d99612c3e1f2970085cfbaeadf8f010ef69bad83",
"analysis_key": ".github/workflows/codeql-analysis.yml:analyze",
"environment": "{\"language\":\"python\"}",
"error": "",
"category": ".github/workflows/codeql-analysis.yml:analyze/language:python",
"created_at": "2020-08-27T15:05:21Z",
"results_count": 17,
"rules_count": 49,
"id": 201,
"url": "https://api.github.com/repos/octocat/hello-world/code-scanning/analyses/201",
"sarif_id": "6c81cd8e-b078-4ac3-a3be-1dad7dbd0b53",
"tool": {
"name": "CodeQL",
"guid": null,
"version": "2.4.0"
},
"deletable": true,
"warning": ""
},
{
"ref": "refs/heads/my-branch",
"commit_sha": "c8cff6510d4d084fb1b4aa13b64b97ca12b07321",
"analysis_key": ".github/workflows/shiftleft.yml:build",
"environment": "{}",
"error": "",
"category": ".github/workflows/shiftleft.yml:build/",
"created_at": "2020-08-31T22:46:44Z",
"results_count": 17,
"rules_count": 32,
"id": 200,
"url": "https://api.github.com/repos/octocat/hello-world/code-scanning/analyses/200",
"sarif_id": "8981cd8e-b078-4ac3-a3be-1dad7dbd0b582",
"tool": {
"name": "Python Security Analysis",
"guid": null,
"version": "1.2.0"
},
"deletable": true,
"warning": ""
}
]
Response if GitHub Advanced Security is not enabled for this repository
Status: 403 Forbidden
Resource not found
Status: 404 Not Found
Service unavailable
Status: 503 Service Unavailable
Notes
Upload an analysis as SARIF data
Uploads SARIF data containing the results of a code scanning analysis to make the results available in a repository. You must use an access token with the security_events
scope to use this endpoint. GitHub Apps must have the security_events
write permission to use this endpoint.
There are two places where you can upload code scanning results.
- If you upload to a pull request, for example
--ref refs/pull/42/merge
or--ref refs/pull/42/head
, then the results appear as alerts in a pull request check. For more information, see "Triaging code scanning alerts in pull requests." - If you upload to a branch, for example
--ref refs/heads/my-branch
, then the results appear in the Security tab for your repository. For more information, see "Managing code scanning alerts for your repository."
You must compress the SARIF-formatted analysis data that you want to upload, using gzip
, and then encode it as a Base64 format string. For example:
gzip -c analysis-data.sarif | base64 -w0
SARIF upload supports a maximum of 1000 results per analysis run. Any results over this limit are ignored. Typically, but not necessarily, a SARIF file contains a single run of a single tool. If a code scanning tool generates too many results, you should update the analysis configuration to run only the most important rules or queries.
The 202 Accepted
, response includes an id
value.
You can use this ID to check the status of the upload by using this for the /sarifs/{sarif_id}
endpoint.
For more information, see "Get information about a SARIF upload."
post /repos/{owner}/{repo}/code-scanning/sarifs
Parámetros
Name | Type | In | Description |
---|---|---|---|
accept |
string | header |
Setting to
|
owner |
string | path | |
repo |
string | path | |
commit_sha |
string | body |
Required. The SHA of the commit to which the analysis you are uploading relates. |
ref |
string | body |
Required. The full Git reference, formatted as |
sarif |
string | body |
Required. A Base64 string representing the SARIF file to upload. You must first compress your SARIF file using |
checkout_uri |
string | body |
The base directory used in the analysis, as it appears in the SARIF file. This property is used to convert file paths from absolute to relative, so that alerts can be mapped to their correct location in the repository. |
started_at |
string | body |
The time that the analysis run began. This is a timestamp in ISO 8601 format: |
tool_name |
string | body |
The name of the tool used to generate the code scanning analysis. If this parameter is not used, the tool name defaults to "API". If the uploaded SARIF contains a tool GUID, this will be available for filtering using the |
Ejemplos de código
Shell
curl \
-X POST \
-H "Accept: application/vnd.github.v3+json" \
http(s)://{hostname}/api/v3/repos/octocat/hello-world/code-scanning/sarifs \
-d '{"commit_sha":"commit_sha","ref":"ref","sarif":"sarif"}'
JavaScript (@octokit/core.js)
await octokit.request('POST /repos/{owner}/{repo}/code-scanning/sarifs', {
owner: 'octocat',
repo: 'hello-world',
commit_sha: 'commit_sha',
ref: 'ref',
sarif: 'sarif'
})
Default response
Status: 202 Accepted
{
"id": "47177e22-5596-11eb-80a1-c1e54ef945c6",
"url": "https://api.github.com/repos/octocat/hello-world/code-scanning/sarifs/47177e22-5596-11eb-80a1-c1e54ef945c6"
}
Bad Request if the sarif field is invalid
Status: 400 Bad Request
Response if the repository is archived or if github advanced security is not enabled for this repository
Status: 403 Forbidden
Resource not found
Status: 404 Not Found
Payload Too Large if the sarif field is too large
Status: 413 Payload Too Large
Service unavailable
Status: 503 Service Unavailable