What's changed: New GH-500 Chapter 4 (approaches & setup = CodeQL [native dataflow SAST], third-party & SARIF ingestion, Actions default/external CI enablement, workflow templates, matrix builds, scan frequency; analysis & optimization = dataflow source→sink review, severity/category (CWE), alert lifecycle and autofix [validate], advanced config/query suites, scan-failure [build/language/resource] and performance troubleshooting)
4.1Code Security Approaches and Setup
Understand native (CodeQL) vs third-party code scanning, choosing between CodeQL and third-party analysis, SARIF ingestion and interoperability, and enabling via GitHub Actions or external CI with workflow templates, matrix builds, and scan frequency.
Code Security (the product name; its code-analysis feature is code scanning / CodeQL) finds vulnerabilities by statically analyzing (SAST) source code. Its core engine is CodeQL, which builds a database of code and uses queries to find "dangerous data flow (dataflow)." Beyond native CodeQL, you can ingest results from third-party analysis tools.
4.1.1CodeQL, third-party, and SARIF
CodeQL is GitHub-native, supports many languages, and detects vulnerabilities with powerful dataflow analysis. If an org already uses a third-party SAST or wants to cover languages/aspects CodeQL doesn’t, you can ingest third-party results. The common format is SARIF (Static Analysis Results Interchange Format). Uploading a third-party tool’s SARIF to GitHub surfaces them as Code Scanning alerts managed in the same UI. Choose "CodeQL vs ingest third-party via SARIF" by requirements.
Continue reading — free sign-up
You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.