Skip to main content

대규모 코드 스캔을 위한 기본 설정 구성

기본 설정을 사용하여 조직 전체의 리포지토리에 대한 code scanning을(를) 신속하게 구성할 수 있습니다.

누가 이 기능을 사용할 수 있는 있나요?

Code scanning는 GitHub.com의 모든 퍼블릭 리포지토리에 사용할 수 있습니다. Code scanning는 또한 GitHub Enterprise Cloud를 사용하고 GitHub Advanced Security에 대한 라이선스가 있는 조직이 소유한 프라이빗 리포지토리에서 사용할 수 있습니다. 자세한 내용은 "GitHub Advanced Security 정보.

About configuring default setup at scale

With default setup for code scanning, you can quickly secure code in repositories across your organization.

You can use the organization settings page labeled "Code security and analysis" to enable code scanning for all repositories in your organization that are eligible for default setup. For more information, see "Configuring default setup for all eligible repositories in an organization."

You can also create different default setup configurations for individual repositories. For more information on configuring default setup at the repository level, see "Configuring default setup for code scanning."

For repositories that are not eligible for default setup, you can configure advanced setup at the repository level, or at the organization level using a script. For more information, see "Configuring advanced setup for code scanning with CodeQL at scale."

Eligible repositories for CodeQL default setup at scale

A repository must meet all the following criteria to be eligible for default setup, otherwise you need to use advanced setup.

  • Code scanning is not already enabled.
  • GitHub Actions are enabled.
  • Publicly visible.

We recommend enabling default setup for eligible repositories if there is any chance the repositories will include at least one CodeQL-supported language in the future. If you enable default setup on a repository that does not include any CodeQL-supported languages, default setup will not run any scans or use any GitHub Actions minutes. If CodeQL-supported languages are added to the repository, default setup will automatically begin scanning CodeQL-supported languages and using GitHub Actions minutes. For more information on CodeQL-supported languages, see "About code scanning with CodeQL."

About adding languages to an existing default setup configuration

If the code in a repository changes to include a CodeQL-supported language, GitHub will automatically update the code scanning configuration to include the new language. If code scanning fails with the new configuration, GitHub will resume the previous configuration automatically so the repository does not lose code scanning coverage.

Configuring default setup for all eligible repositories in an organization

Through the "Code security and analysis" page of your organization's settings, you can enable default setup for all eligible repositories in your organization. For more information on repository eligibility, see "Eligible repositories for CodeQL default setup at scale."

  1. Click your profile photo, then click Organizations.
  2. Click Settings next to your organization.
  3. Click Code security & analysis.
  4. Click Enable all next to "Code scanning".
  5. In the "Query suites" section of the "Enable code scanning default setup" dialog box displayed, select the query suite your configuration of default setup will run. For more information, see "CodeQL query suites."
  6. To enable your configuration of default setup, click Enable for eligible repositories.
  7. Optionally, to recommend the "Extended" query suite throughout your organization when enabling default setup, select "Recommend the extended query suite for repositories enabling default setup."

Notes:

  • If you disable CodeQL code scanning for all repositories this change is not reflected in the coverage information shown in security overview for the organization. The repositories will still appear to have code scanning enabled in the "Security Coverage" view.
  • Enabling code scanning for all eligible repositories in an organization will not override existing code scanning configurations. For information on configuring default setup with different settings for specific repositories, see "Configuring default setup for code scanning."
  • Enabling default setup for all eligible repositories in an organization includes eligible repositories without CodeQL-supported languages. If a CodeQL-supported language is later added to one of these repositories, default setup will begin scanning that repository and consuming GitHub Actions minutes.