Skip to main content

Editar as definições da configuração padrão

É possível editar a definição existente da configuração padrão para code scanning para melhor atender às suas necessidades de segurança de código.

Quem pode usar esse recurso?

A Code scanning está disponível para todos os repositórios públicos do GitHub.com. A Code scanning também está disponível em repositórios privados pertencentes às organizações que usam o GitHub Enterprise Cloud e que têm uma licença do GitHub Advanced Security. Para obter mais informações, confira "Sobre a Segurança Avançada do GitHub".

About editing your configuration of default setup

After running an initial analysis of your code with default setup, you may need to make changes to your configuration to better meet your code security needs. For existing configurations of default setup, you can edit:

  • Which languages default setup will analyze.
  • The query suite run during analysis. For more information on the available query suites, see "CodeQL query suites."
  • The threat models (beta) to use for analysis. Your choice of threat model determines which sources of tainted data are treated as a risk to your application. During the beta, threat models are supported only for analysis of Java/Kotlin and C#. For more information about threat models, see "Including local sources of tainted data in default setup."

If your codebase depends on a library or framework that is not recognized by the standard libraries included with CodeQL, you can also extend the CodeQL coverage in default setup using CodeQL model packs. For more information, see "Extending CodeQL coverage with CodeQL model packs in default setup."

If you need to change any other aspects of your code scanning configuration, consider configuring advanced setup. For more information, see "Configuring advanced setup for code scanning."

Customizing your existing configuration of default setup

  1. On GitHub.com, navigate to the main page of the repository.

  2. Under your repository name, click Settings. If you cannot see the "Settings" tab, select the dropdown menu, then click Settings.

    Screenshot of a repository header showing the tabs. The "Settings" tab is highlighted by a dark orange outline.

  3. In the "Security" section of the sidebar, click Code security and analysis.

  4. In the "CodeQL analysis" row of the "Code scanning" section, select , then click View CodeQL configuration.

  5. In the "CodeQL default configuration" window, click Edit.

  6. Optionally, in the "Languages" section, select or deselect languages for analysis.

  7. Optionally, in the "Query suite" row of the "Scan settings" section, select a different query suite to run against your code.

  8. (Beta) Optionally, in the "Threat model" row of the "Scan settings" section, select Remote and local sources.

  9. To update your configuration, as well as run an initial analysis of your code with the new configuration, click Save changes. All future analyses will use your new configuration.

Defining the alert severities that cause a check failure for a pull request

When you enable code scanning on pull requests the check fails only if one or more alerts of severity error, or security severity critical or high are detected. The check will succeed if alerts with lower severities or security severities are detected. For important codebases, you may want the code scanning check to fail if any alerts are detected, so that the alert must be fixed or dismissed before the code change is merged. For more information about severity levels, see "About alert severity and security severity levels."

  1. On GitHub.com, navigate to the main page of the repository.

  2. Under your repository name, click Settings. If you cannot see the "Settings" tab, select the dropdown menu, then click Settings.

    Screenshot of a repository header showing the tabs. The "Settings" tab is highlighted by a dark orange outline.

  3. In the "Security" section of the sidebar, click Code security and analysis.

  4. Under "Code scanning", in the "Protection rules" section, use the drop-down menu to define which alerts should cause a check failure. Choose one level for alerts of type "Security" and one level for all other alerts.

Including local sources of tainted data in default setup

Note: Threat models are currently in beta and subject to change. During the beta, threat models are supported only by analysis for Java/Kotlin and C#.

If your codebase only considers remote network requests to be potential sources of tainted data, then we recommend using the default threat model. If your codebase considers sources other than network requests to potentially contain tainted data, then you can use threat models to add these additional sources to your CodeQL analysis. During the beta, you can add local sources (for example: command-line arguments, environment variables, file systems, and databases) that your codebase may consider to be additional sources of tainted data.

You can edit the threat model used in a default setup configuration. For more information, see "Customizing your existing configuration of default setup."

Extending CodeQL coverage with CodeQL model packs in default setup

Note: Model packs are currently in beta and subject to change. During the beta, model packs are supported only by Java/Kotlin and C# analysis.

If you use frameworks and libraries that are not recognized by the standard libraries included with CodeQL, you can model your dependencies and extend code scanning analysis. For more information, see Supported languages and frameworks in the documentation for CodeQL.

For default setup, you need to define the models of your additional dependencies in a CodeQL model pack in your repository. For more information about CodeQL model packs and writing your own, see Using the CodeQL model editor in the CodeQL documentation.

To use CodeQL model packs with default setup, place them in the .github/codeql/extensions directory. They will be automatically detected and used in your code scanning analysis. If you later change your configuration to use advanced setup, any data extensions in the .github/codeql/extensions directory will still be recognized and used.