Skip to main content

このバージョンの GitHub Enterprise サーバーはこの日付をもって終了となりました: 2024-07-09. 重大なセキュリティの問題に対してであっても、パッチリリースは作成されません。 パフォーマンスの向上、セキュリティの向上、新機能の向上を図るために、最新バージョンの GitHub Enterprise サーバーにアップグレードしてください。 アップグレードに関するヘルプについては、GitHub Enterprise サポートにお問い合わせください

大規模なコード スキャンの既定のセットアップを構成する

既定のセットアップを使用して、Organization 全体のリポジトリに対して code scanning をすばやく構成できます。

この機能を使用できるユーザーについて

Code scanning は、GitHub Enterprise Server の Organization 所有のリポジトリで利用できます。 この機能には、GitHub Advanced Security のライセンスが必要です。 詳しくは、「GitHub Advanced Security について」を参照してください。

About configuring default setup at scale

With default setup for code scanning, you can quickly secure code in repositories across your organization.

You can use the organization settings page labeled "Code security and analysis" to enable code scanning for all repositories in your organization that are eligible for default setup. After enabling default setup, the code written in CodeQL-supported languages in repositories in the organization will be scanned:

  • On each push to the repository's default branch, or any protected branch. For more information on protected branches, see "About protected branches."
  • When creating or committing to a pull request based against the repository's default branch, or any protected branch, excluding pull requests from forks.

For more information, see "Configuring default setup for all eligible repositories in an organization."

You can also create different default setup configurations for individual repositories. For more information on configuring default setup at the repository level, see "Configuring default setup for code scanning."

For repositories that are not eligible for default setup, you can configure advanced setup at the repository level, or at the organization level using a script. For more information, see "Configuring advanced setup for code scanning with CodeQL at scale."

Eligible repositories for CodeQL default setup at scale

Note: The ability to enable and disable default setup for code scanning for eligible repositories in an organization is currently in beta and subject to change.

A repository must meet all the following criteria to be eligible for default setup, otherwise you need to use advanced setup.

  • Advanced setup for code scanning is not already enabled.
  • GitHub Actions are enabled.
  • Uses JavaScript/TypeScript, Python, or Ruby.
  • GitHub Advanced Security is enabled.

Configuring default setup for all eligible repositories in an organization

Through the "Code security and analysis" page of your organization's settings, you can enable default setup for all eligible repositories in your organization. For more information on repository eligibility, see "Eligible repositories for CodeQL default setup at scale."

Note: The ability to enable and disable default setup for code scanning for eligible repositories in an organization is currently in beta and subject to change.

  1. In the upper-right corner of GitHub, select your profile photo, then click Your organizations.

  2. Next to the organization, click Settings.

  3. In the "Security" section of the sidebar, click Code security and analysis.

  4. Click Enable all next to "Code scanning".

  5. In the "Enable code scanning for eligible repositories" dialog box displayed, click Enable for eligible repositories to enable your configuration of default setup.

Notes:

  • If you disable CodeQL code scanning for all repositories this change is not reflected in the coverage information shown in security overview for the organization. The repositories will still appear to have code scanning enabled in the "Security Coverage" view.
  • Enabling code scanning for all eligible repositories in an organization will not override existing code scanning configurations. For information on configuring default setup with different settings for specific repositories, see "Configuring default setup for code scanning."