Skip to main content

이 버전의 GitHub Enterprise는 다음 날짜에 중단되었습니다. 2024-09-25. 중요한 보안 문제에 대해서도 패치 릴리스가 이루어지지 않습니다. 더 뛰어난 성능, 향상된 보안, 새로운 기능을 위해 최신 버전의 GitHub Enterprise Server로 업그레이드합니다. 업그레이드에 대한 도움말은 GitHub Enterprise 지원에 문의하세요.

코드 스캔을 위한 기본 설정 구성

code scanning에 대한 기본 설정을 사용하여 리포지토리에서 코드를 신속하게 보호할 수 있습니다.

누가 이 기능을 사용할 수 있나요?

리포지토리 소유자, 조직 소유자, 보안 관리자 및 관리자 역할이 있는 사용자

GitHub Advanced Security을(를) 사용하도록 설정된 조직 소유 리포지토리

About default setup

Default setup for code scanning is the quickest, easiest, most low-maintenance way to enable code scanning for your repository. Based on the code in your repository, default setup will automatically create a custom code scanning configuration. After enabling default setup, the code written in CodeQL-supported languages in your repository will be scanned:

  • On each push to the repository's default branch, or any protected branch. For more information on protected branches, see "About protected branches."
  • When creating or committing to a pull request based against the repository's default branch, or any protected branch, excluding pull requests from forks.

You can also enable default setup for multiple or all repositories in an organization at the same time. For information on bulk enablement, see "Configuring default setup for code scanning at scale."

If you need more granular control over your code scanning configuration, you should instead configure advanced setup. For more information, see "Configuring advanced setup for code scanning."

Requirements for using default setup

Your repository is eligible for default setup for code scanning if:

  • It includes at least one CodeQL-supported language aside from Swift.
  • GitHub Actions are enabled.
  • GitHub Advanced Security is enabled.

If your repository includes at least one CodeQL-supported language, you can use default setup even if your repository also includes languages that aren't supported by CodeQL, such as R. Unsupported languages will not be scanned by default setup. For more information on CodeQL-supported languages, see "About code scanning with CodeQL."

You can use default setup with self-hosted runners for all CodeQL-supported languages except Swift. Default setup runs the autobuild action, so you should configure your self-hosted runners to make sure they can run all the necessary commands for C/C++, C#, Go, Java, Kotlin, and Swift analysis. Analysis of JavaScript/TypeScript, Go, Ruby, Python, and Kotlin code does not currently require special configuration.

Customizing default setup

We recommend that you start using code scanning with default setup. After you've initially configured default setup, you can evaluate code scanning to see how it's working for you. If you find that something isn't working as you expect, you can customize default setup to better meet your code security needs. For more information, see "Evaluating default setup for code scanning."

About adding compiled languages to your default setup

Compiled languages are not automatically included in default setup configuration because they often require more advanced configuration, but you can manually select any CodeQL-supported compiled language other than Swift for analysis.

Configuring default setup for a repository

Note: At least one CodeQL-supported language's analysis in a repository must succeed, or else default setup will not be successfully enabled in that repository.

  1. On GitHub, navigate to the main page of the repository.

    Note: If you are configuring default setup on a fork, you must first enable GitHub Actions. To enable GitHub Actions, under your repository name, click Actions, then click I understand my workflows, go ahead and enable them. Be aware that this will enable all existing workflows on your fork.

  2. Under your repository name, click Settings. If you cannot see the "Settings" tab, select the dropdown menu, then click Settings.

    Screenshot of a repository header showing the tabs. The "Settings" tab is highlighted by a dark orange outline.

  3. In the "Security" section of the sidebar, click Code security and analysis.

  4. In the "Code scanning" section, select Set up , then click Default.

    Screenshot of the "Code scanning" section of "Code security and analysis" settings. The "Default setup" button is highlighted with an orange outline.

    You will then see a "CodeQL default configuration" dialog summarizing the code scanning configuration automatically created by default setup.

    Note: If your repository contains only compiled CodeQL-supported languages (for example, Java), you will be taken to the settings page to select the languages you want to add to your default setup configuration.

  5. Optionally, to customize your code scanning setup, click Edit.

    • To add or remove a language from the analysis performed by default setup, select or deselect that language in the "Languages" section. If you would like to analyze a CodeQL-supported compiled language with default setup, select that language here.
    • To specify the CodeQL query suite you would like to use, select your preferred query suite in the "Query suites" section.
  6. Review the settings for default setup on your repository, then click Enable CodeQL. This will trigger a workflow that tests the new, automatically generated configuration.

    Note: If you are switching to default setup from advanced setup, you will see a warning informing you that default setup will override existing code scanning configurations. This warning means default setup will disable the existing workflow file and block any CodeQL analysis API uploads.

  7. Optionally, to view your default setup configuration after enablement, select , then click View CodeQL configuration.

Next steps

After your configuration runs successfully at least once, you can start examining and resolving code scanning alerts. For more information on code scanning alerts, see "About code scanning alerts" and "Assessing code scanning alerts for your repository."

After you've configured default setup for code scanning, you can read about evaluating how it's working for you and the next steps you can take to customize it. For more information, see "Evaluating default setup for code scanning."

You can find detailed information about your code scanning configuration, including timestamps for each scan and the percentage of files scanned, on the tool status page. For more information, see "About the tool status page for code scanning."

When you configure default setup, you may encounter an error. For information on troubleshooting specific errors, see "Troubleshooting code scanning."