Skip to main content
ドキュメントには頻繁に更新が加えられ、その都度公開されています。本ページの翻訳はまだ未完成な部分があることをご了承ください。最新の情報については、英語のドキュメンテーションをご参照ください。本ページの翻訳に問題がある場合はこちらまでご連絡ください。

このバージョンの GitHub Enterprise はこの日付をもって終了となりました: 2022-06-03. 重大なセキュリティの問題に対してであっても、パッチリリースは作成されません。 パフォーマンスの向上、セキュリティの改善、新機能のためには、最新バージョンのGitHub Enterpriseにアップグレードしてください。 アップグレードに関する支援については、GitHub Enterprise supportに連絡してください。

About code scanning alerts

Learn about the different types of code scanning alerts and the information that helps you understand the problem each alert highlights.

Code scanning is available for organization-owned repositories where GitHub Advanced Security is enabled. 詳しい情報については、「GitHub Advanced Security について」を参照してください。

Note: Your site administrator must enable code scanning for GitHub Enterprise Serverインスタンス before you can use this feature. For more information, see "Configuring code scanning for your appliance."

About alerts from code scanning

You can set up code scanning to check the code in a repository using the default CodeQL analysis, a third-party analysis, or multiple types of analysis. When the analysis is complete, the resulting alerts are displayed alongside each other in the security view of the repository. Results from third-party tools or from custom queries may not include all of the properties that you see for alerts detected by GitHub's default CodeQL analysis. For more information, see "Setting up code scanning for a repository."

By default, code scanning analyzes your code periodically on the default branch and during pull requests. For information about managing alerts on a pull request, see "Triaging code scanning alerts in pull requests."

About alert details

Each alert highlights a problem with the code and the name of the tool that identified it. You can see the line of code that triggered the alert, as well as properties of the alert, such as the alert severity and the nature of the problem. Alerts also tell you when the issue was first introduced. For alerts identified by CodeQL analysis, you will also see information on how to fix the problem.

Example alert from code scanning

If you set up code scanning using CodeQL, you can also find data-flow problems in your code. Data-flow analysis finds potential security issues in code, such as: using data insecurely, passing dangerous arguments to functions, and leaking sensitive information.

When code scanning reports data-flow alerts, GitHub shows you how data moves through the code. Code scanning allows you to identify the areas of your code that leak sensitive information, and that could be the entry point for attacks by malicious users.

About severity levels

Alert severity levels may be Error, Warning, or Note.

If code scanning is enabled as a pull request check, the check will fail if it detects any results with a severity of error.

About labels for alerts that are not found in application code

GitHub Enterprise Server assigns a category label to alerts that are not found in application code. The label relates to the location of the alert.

  • Generated: Code generated by the build process
  • Test: Test code
  • Library: Library or third-party code
  • Documentation: Documentation

Code scanning categorizes files by file path. You cannot manually categorize source files.

Here is an example from the code scanning alert list of an alert marked as occurring in library code.

Code scanning library alert in list

On the alert page, you can see that the filepath is marked as library code (Library label).

Code scanning library alert details