注意
网站管理员必须启用 code scanning，然后你才能使用此功能。 如果要使用 GitHub Actions 扫描代码，站点管理员还必须启用 GitHub Actions 并设置所需的基础结构。 有关详细信息，请参阅“为设备配置代码扫描”。
注意
本文介绍了此版 GitHub Enterprise Server 的初始发行版中包含的 CodeQL 操作版本和相关 CodeQL CLI 捆绑包中可用的功能。 如果企业使用较新版本的 CodeQL 操作，请参阅本文的 GitHub Enterprise Cloud 版本，了解有关最新功能的信息。 有关使用最新版本的信息，请参阅“为设备配置代码扫描”。
If you do not need a highly customizable code scanning configuration, consider using default setup for code scanning. For more information, see 关于代码扫描的设置类型.
Prerequisites
Your repository is eligible for advanced setup if it meets these requirements.
- It uses CodeQL-supported languages or you plan to generate code scanning results with a third-party tool.
- 已启用 GitHub Actions。
- 已启用 GitHub Code Security。
If the server on which you are running GitHub Enterprise Server is not connected to the internet, your site administrator can enable CodeQL code scanning by making the CodeQL analysis bundle available on the server. For more information, see 为设备配置代码扫描.
Configuring advanced setup for code scanning with CodeQL
You can customize your CodeQL analysis by creating and editing a workflow file. Selecting advanced setup generates a basic workflow file for you to customize using standard workflow syntax and specifying options for the CodeQL action. See 工作流 and 代码扫描的工作流配置选项.
-
在 GitHub 上，导航到存储库的主页面。
-
在仓库名称下，单击 “Settings”****。 如果看不到“设置”选项卡，请选择“”下拉菜单，然后单击“设置”。
-
在边栏的“Security”部分中，单击“ Advanced Security”****。
-
Scroll down to "Code Security", in the "CodeQL analysis" row select Set up , then click Advanced.
注意
If you are switching from default setup to advanced setup, in the "CodeQL analysis" row, select , then click Switch to advanced. In the pop-up window that appears, click Disable CodeQL.
-
To customize how code scanning scans your code, edit the workflow.
Generally, you can commit the CodeQL 分析工作流程 without making any changes to it. However, many of the third-party workflows require additional configuration, so read the comments in the workflow before committing.
For more information, see 代码扫描的工作流配置选项 and CodeQL code scanning for compiled languages.
-
Click Commit changes... to display the commit changes form.
-
In the commit message field, type a commit message.
-
Choose whether you'd like to commit directly to the default branch, or create a new branch and start a pull request.
-
Click Commit new file to commit the workflow file to the default branch or click Propose new file to commit the file to a new branch.
-
If you created a new branch, click Create pull request and open a pull request to merge your change into the default branch.
In the suggested CodeQL 分析工作流程, code scanning is configured to analyze your code each time you either push a change to the default branch or any protected branches, or raise a pull request against the default branch. As a result, code scanning will now commence.
The on:pull_request and on:push triggers for code scanning are each useful for different purposes. See 代码扫描的工作流配置选项 and 触发工作流程.
For information on bulk enablement, see 使用 CodeQL 大规模为代码扫描配置高级设置.
Next steps
After your workflow runs successfully at least once, you are ready to start examining and resolving code scanning alerts. For more information on code scanning alerts, see 关于代码扫描警报 and 访问存储库的代码扫描警报.
Learn how code scanning runs behave as checks on pull requests, see 鉴定拉取请求中的代码扫描警报.
You can find detailed information about your code scanning configuration, including timestamps for each scan and the percentage of files scanned, on the tool status page. For more information, see Use the tool status page for code scanning.