Examen del código

Enterprise Cloud

Enterprise Server 3.10

Enterprise Server 3.11

Enterprise Server 3.7

Enterprise Server 3.8

Enterprise Server 3.9

Free, Pro, & Team

GitHub AE

REST API

Toda la documentación de GitHub es de código abierto. ¿Ve algo incorrecto o que no esté claro? Envíe una solicitud de incorporación de cambios.

¡Ayúdanos a hacer geniales estos documentos!

Consulta el vídeo de esta transcripción.

Acciones

Introduzca un término de búsqueda para encontrarlo en la documentación de GitHub.

Examen del código - GitHub AE Docs

Usa la API de REST para recuperar y actualizar alertas de code scanning de un repositorio.

Inicio rápido

Comparación de las API de GitHub

Recursos en la API de REST

Límites de frecuencia

Tipos de medios

Autenticación

Protección de las credenciales de API

Solución de problemas

Libraries

Tipos de eventos de los informes de problemas

Tipos de evento de GitHub

Puntos de conexión para tokens de instalación de aplicaciones de GitHub

Puntos de conexión para tokens de usuario de aplicaciones de GitHub

Permisos para instancias de GitHub App

Información general

Uso de la API

Script con JavaScript

Script con Ruby

Descubrimiento de recursos para un usuario

Entregar despliegues

Representar los datos en gráficas

Trabajar con los comentarios

Paginación

Crear un servidor de IC

procedimientos recomendados

Introducción: base de datos de Git

Introducción: Comprobaciones

Cifrado de secretos

Guías

Artifacts

Permisos

Secretos

Grupos de ejecutores auto-hospedados

Ejecutores autohospedados

Jobs de los flujos de trabajo

Ejecuciones de flujo de trabajo

Workflows

Eventos

Fuentes

Notificaciones

Marcar con una estrella

Observando

Actividad

Aplicaciones de GitHub

Instalaciones

Autorizaciones de OAuth

webhooks

Aplicaciones

Ramas

Ramas protegidas

Ejecuciones de Verificación

Conjuntos de Verificaciones

Comprobaciones

Códigos de conducta

Colaboradores

Invitaciones

Confirmaciones

Comentarios sobre confirmación de cambios

Estados de confirmación

Claves de implementación

Directivas de rama de implementación

Implementaciones

Entornos

Estados de despliegue

Emojis

Estadísticas de los Administradores

Anuncio

Registro de auditoría

Webhooks globales

Licencia

Las organizaciones

Ambientes de pre-recepción

Usuarios

Administración empresarial

Gists

Comentarios

Datos BLOB

Referencias

Etiquetas

Árboles

Base de datos de Git

Gitignore

Incidencias

Asignados

Hitos

Escala de tiempo

Licencias

Markdown

Estadísticas

Métricas

Migraciones

Miembros

Colaboradores externos

Páginas

Boards

Cards

Columnas

Project boards

Extracciones

Revisar comentarios

Solicitudes de revisión

Revisiones

Límite de frecuencia

Reacciones

Versiones

Recursos de versión

Vínculos automáticos

Contenido

Horquillas

Git LFS

Repositorios

Webhooks

Search

Análisis de secretos

Teams

Comentarios de debate

Debates

Grupos externos

Seguidores

Claves GPG

Claves SSH de Git

API DE REST

https://api.github.com/repos/octocat/Hello-World/contents/{+path}

Hello-World

Arbitrary file write during zip extraction

js/zipslip

CodeQL

Lists code scanning alerts for the default branch for all eligible repositories in an organization. Eligible repositories are repositories that are owned by organizations that you own or for which you are a security manager. For more information, see "<a href="https://docs.github.com/github-ae@latest/organizations/managing-peoples-access-to-your-organization-with-roles/managing-security-managers-in-your-organization">Managing security managers in your organization</a>."
To use this endpoint, you must be an owner or security manager for the organization, and you must use an access token with the <code>repo</code> scope or <code>security_events</code> scope.
For public repositories, you may instead use the <code>public_repo</code> scope.

The organization name. The name is not case sensitive.

The name of a code scanning tool. Only results by this tool will be listed. You can specify the tool by using either <code>tool_name</code> or <code>tool_guid</code>, but not both.

tool_name

The name of the tool used to generate the code scanning analysis.

The GUID of a code scanning tool. Only results by this tool will be listed. Note that some code scanning tools may not include a GUID in their analysis data. You can specify the tool by using either <code>tool_guid</code> or <code>tool_name</code>, but not both.

tool_guid

The GUID of the tool used to generate the code scanning analysis, if provided in the uploaded SARIF data.

A cursor, as given in the <a href="https://docs.github.com/github-ae@latest/rest/guides/using-pagination-in-the-rest-api#using-link-headers">Link header</a>. If specified, the query only searches for results before this cursor.

before

A cursor, as given in the <a href="https://docs.github.com/github-ae@latest/rest/guides/using-pagination-in-the-rest-api#using-link-headers">Link header</a>. If specified, the query only searches for results after this cursor.

after

Page number of the results to fetch.

page

The number of results per page (max 100).

per_page

The direction to sort the results by.

direction

If specified, only code scanning alerts with this state will be returned.

state

The property by which to sort the results.

sort

If specified, only code scanning alerts with this severity will be returned.

severity

List code scanning alerts for an organization

Lists code scanning alerts.
To use this endpoint, you must use an access token with the <code>security_events</code> scope or, for alerts from public repositories only, an access token with the <code>public_repo</code> scope.
The response includes a <code>most_recent_instance</code> object.
This provides details of the most recent instance of this alert
for the default branch (or for the specified Git reference if you used <code>ref</code> in the request).

The account owner of the repository. The name is not case sensitive.

owner

The name of the repository without the <code>.git</code> extension. The name is not case sensitive.

repo

The Git reference for the results you want to list. The <code>ref</code> for a branch can be formatted either as <code>refs/heads/&#x3C;branch name></code> or simply <code>&#x3C;branch name></code>. To reference a pull request use <code>refs/pull/&#x3C;number>/merge</code>.

The Git reference, formatted as `refs/pull/<number>/merge`, `refs/pull/<number>/head`,
`refs/heads/<branch name>` or simply `<branch name>`.

Response if GitHub Advanced Security is not enabled for this repository

List code scanning alerts for a repository

This path depends on a user-provided value.

Arbitrary file write during zip extraction ("Zip Slip")

Extracting files from a malicious zip archive without validating that the destination file path is within the destination directory can cause files outside the destination directory to be overwritten.

The time that the alert was created in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.

The time that the alert was dismissed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.

**Required when the state is dismissed.** The reason for dismissing or closing the alert.

The REST API URL for fetching the list of instances for an alert.

Gets a single code scanning alert. You must use an access token with the <code>security_events</code> scope to use this endpoint with private repositories, the <code>public_repo</code> scope also grants permission to read security events on public repositories only.

The number that identifies an alert. You can find this at the end of the URL for a code scanning alert within GitHub, and in the <code>number</code> field in the response from the <code>GET /repos/{owner}/{repo}/code-scanning/alerts</code> operation.

alert_number

Get a code scanning alert

Sets the state of the code scanning alert. You must provide <code>dismissed_reason</code> when you set the state to <code>dismissed</code>.

Required when the state is dismissed. The reason for dismissing or closing the alert.

dismissed_reason

Updates the status of a single code scanning alert. You must use an access token with the <code>security_events</code> scope to use this endpoint. GitHub Apps must have the <code>security_events</code> write permission to use this endpoint.

Response if the repository is archived or if GitHub Advanced Security is not enabled for this repository

Update a code scanning alert

This suffix check is missing a length comparison to correctly handle lastIndexOf returning -1.

Lists all instances of the specified code scanning alert.
You must use an access token with the <code>security_events</code> scope to use this endpoint with private repositories,
the <code>public_repo</code> scope also grants permission to read security events on public repositories only.

List instances of a code scanning alert

Python Security Analysis

Lists the details of all code scanning analyses for a repository,
starting with the most recent.
The response is paginated and you can use the <code>page</code> and <code>per_page</code> parameters
to list the analyses you're interested in.
By default 30 analyses are listed per page.
The <code>rules_count</code> field in the response give the number of rules
that were run in the analysis.
For very old analyses this data is not available,
and <code>0</code> is returned in this field.
You must use an access token with the <code>security_events</code> scope to use this endpoint with private repositories,
the <code>public_repo</code> scope also grants permission to read security events on public repositories only.
Deprecation notice:
The <code>tool_name</code> field is deprecated and will, in future, not be included in the response for this endpoint. The example response reflects this change. The tool name can now be found inside the <code>tool</code> field.