Skip to main content
Frecuentemente publicamos actualizaciones de nuestra documentación. Es posible que la traducción de esta página esté en curso. Para conocer la información más actual, visita la documentación en inglés. Si existe un problema con las traducciones en esta página, por favor infórmanos.

Esta versión de GitHub Enterprise se discontinuó el 2022-06-03. No se realizarán lanzamientos de patch, ni siquiera para problemas de seguridad críticos. Para obtener un mejor desempeño, más seguridad y nuevas características, actualiza a la última versión de GitHub Enterprise. Para obtener ayuda con la actualización, contacta al soporte de GitHub Enterprise.

Triaging code scanning alerts in pull requests

When escaneo de código identifies a problem in a pull request, you can review the highlighted code and resolve the alert.

If you have read permission for a repository, you can see annotations on pull requests. With write permission, you can see detailed information and resolve escaneo de código alerts for that repository.

El Escaneo de código se encuentra disponible para los repositorios que pertenecen a organizaciones donde se habilitó el GitHub Advanced Security. Para obtener más información, consulta la sección "Acerca de GitHub Advanced Security".

About escaneo de código results on pull requests

In repositories where escaneo de código is configured as a pull request check, escaneo de código checks the code in the pull request. By default, this is limited to pull requests that target the default branch, but you can change this configuration within GitHub Actions or in a third-party CI/CD system. If merging the changes would introduce new escaneo de código alerts to the target branch, the alerts are reported in multiple places.

  • Check results in the pull request
  • The Files changed tab of the pull request

If you have write permission for the repository, you can see any existing escaneo de código alerts on the Security tab. For information about repository alerts, see "Managing escaneo de código alerts for your repository."

If your pull request targets a protected branch that uses escaneo de código, and the repository owner has configured required status checks, then the "Escaneo de código results" check must pass before you can merge the pull request. For more information, see "About protected branches."

About escaneo de código as a pull request check

There are many options for configuring escaneo de código as a pull request check, so the exact setup of each repository will vary and some will have more than one check.

Escaneo de código results check

For all configurations of escaneo de código, the check that contains the results of escaneo de código is: Escaneo de código results. The results for each analysis tool used are shown separately. Any new alerts caused by changes in the pull request are shown as annotations.

Escaneo de código results check failures

If the escaneo de código results check finds any problems with a severity of error the check fails and the error is reported in the check results. If all the results found by escaneo de código have lower severities, the alerts are treated as warnings or notes and the check succeeds.

Failed escaneo de código check on a pull request

Other escaneo de código checks

Depending on your configuration, you may see additional checks running on pull requests with escaneo de código configured. These are usually workflows that analyze the code or that upload escaneo de código results. These checks are useful for troubleshooting when there are problems with the analysis.

For example, if the repository uses the Flujo de trabajo de análisis de CodeQL a CodeQL / Analyze (LANGUAGE) check is run for each language before the results check runs. The analysis check may fail if there are configuration problems, or if the pull request breaks the build for a language that the analysis needs to compile (for example, C/C++, C#, or Java).

As with other pull request checks, you can see full details of the check failure on the Checks tab. For more information about configuring and troubleshooting, see "Configuring escaneo de código" or "Troubleshooting the CodeQL workflow."

Viewing an alert on your pull request

You can see any escaneo de código alerts introduced in a pull request by displaying the Files changed tab. Each alert is shown as an annotation on the lines of code that triggered the alert. The severity of the alert is displayed in the annotation.

Alert annotation within a pull request diff

If you have write permission for the repository, some annotations contain links with extra context for the alert. In the example above, from CodeQL analysis, you can click user-provided value to see where the untrusted data enters the data flow (this is referred to as the source). In this case you can also view the full path from the source to the code that uses the data (the sink) by clicking Show paths. This makes it easy to check whether the data is untrusted or if the analysis failed to recognize a data sanitization step between the source and the sink. For information about analyzing data flow using CodeQL, see "About data flow analysis."

To see more information about an alert, users with write permission can click the Show more details link shown in the annotation. This allows you to see all of the context and metadata provided by the tool in an alert view. In the example below, you can see tags showing the severity, type, and relevant common weakness enumerations (CWEs) for the problem. The view also shows which commit introduced the problem.

In the detailed view for an alert, some escaneo de código tools, like CodeQL analysis, also include a description of the problem and a Show more link for guidance on how to fix your code.

Alert description and link to show more information

Fixing an alert on your pull request

Anyone with push access to a pull request can fix a escaneo de código alert that's identified on that pull request. If you commit changes to the pull request this triggers a new run of the pull request checks. If your changes fix the problem, the alert is closed and the annotation removed.

Dismissing an alert on your pull request

An alternative way of closing an alert is to dismiss it. You can dismiss an alert if you don't think it needs to be fixed. Por ejemplo, un error en el código que se utiliza únicamente para hacer pruebas, o cuando el esfuerzo de areglar el error es mayor que el beneficio potencial de mejorar el código. If you have write permission for the repository, the Dismiss button is available in code annotations and in the alerts summary. When you click Dismiss you will be prompted to choose a reason for closing the alert.

Choosing a reason for dismissing an alert

Es importante elegir la razón adecuada del menú desplegable, ya que esto puede afectar si la consulta continuará incluyéndose en los análisis futuros.

Si descartas una alerta de CodeQL como consecuencia de un resultado de falso positivo, por ejemplo, porque el código utiliza una biblioteca de sanitización que no es compatible, considera contribuir con el repositorio de CodeQL y mejorar el análisis. Para obtener más información acerca de CodeQL, consulta la sección "Contribuir con CodeQL".

For more information about dismissing alerts, see "Managing escaneo de código alerts for your repository."