What's changed: New GH-500 Chapter 4 (approaches & setup = CodeQL [native dataflow SAST], third-party & SARIF ingestion, Actions default/external CI enablement, workflow templates, matrix builds, scan frequency; analysis & optimization = dataflow source→sink review, severity/category (CWE), alert lifecycle and autofix [validate], advanced config/query suites, scan-failure [build/language/resource] and performance troubleshooting)
4.1Code Security Approaches and Setup
Understand native (CodeQL) vs third-party code scanning, choosing between CodeQL and third-party analysis, SARIF ingestion and interoperability, and enabling via GitHub Actions or external CI with workflow templates, matrix builds, and scan frequency.
Code Security (the product name; its code-analysis feature is code scanning / CodeQL) finds vulnerabilities by statically analyzing (SAST) source code. Its core engine is CodeQL, which builds a database of code and uses queries to find "dangerous data flow (dataflow)." Beyond native CodeQL, you can ingest results from third-party analysis tools.
4.1.1CodeQL, third-party, and SARIF
CodeQL is GitHub-native, supports many languages, and detects vulnerabilities with powerful dataflow analysis. If an org already uses a third-party SAST or wants to cover languages/aspects CodeQL doesn’t, you can ingest third-party results. The common format is SARIF (Static Analysis Results Interchange Format). Uploading a third-party tool’s SARIF to GitHub surfaces them as Code Scanning alerts managed in the same UI. Choose "CodeQL vs ingest third-party via SARIF" by requirements.
4.1.2Enabling — Actions and external CI
Code Scanning runs mainly two ways. (1) Via a GitHub Actions workflow (CodeQL starter/workflow templates)—the easiest; default setup enables it in a few clicks. (2) Via an external CI system running the CodeQL CLI (or other tools) and uploading results (SARIF). For multi-language repos, use matrix builds to scan per language in parallel. Set scan frequency (per push/PR, scheduled) by balancing cost and freshness.
Common: (1) Code Security = CodeQL (native SAST with dataflow analysis). (2) Ingest third-party results via SARIF, managed in the same UI. (3) Enable via GitHub Actions (default setup/workflow templates) or external CI running CodeQL CLI → upload SARIF. (4) For multi-language, use matrix builds for parallelism; set scan frequency (push/PR, scheduled).
Watch out: (1) CodeQL (native) and third-party SAST aren’t exclusive—they coexist via SARIF. (2) SARIF is a "results interchange format," not an analysis engine. (3) Don’t confuse default setup (easy) with advanced setup (edit workflow YAML). (4) Mis-specifying languages in a multi-language repo leaves some unscanned—check matrix and build config.
4.1.3Section summary
- Code Security = CodeQL (native SAST with dataflow); ingest third-party results via SARIF, managed together
- Enable via GitHub Actions (default setup/templates) or external CI (CodeQL CLI → SARIF)
- Multi-language: matrix builds for parallelism; scan frequency by push/PR/schedule
- CodeQL and third-party coexist via SARIF; SARIF is an interchange format
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. Which GitHub-native SAST engine builds a database of code and uses dataflow analysis to detect vulnerabilities?
Q2. You want to surface a third-party SAST’s results as GitHub Code Scanning alerts in one place. Which common format do you use?
Q3. What is the easiest way to enable Code Scanning (CodeQL)?
Q4. In a multi-language repo you want to scan each language in parallel. What do you use in the workflow?
Q5. Which correctly relates CodeQL and third-party SAST?
Q6. Which is an appropriate way to think about scan frequency?
Keep track of your progress
The full study guide is free to read. Sign up free to practice with the question bank, track what you have read, review your mistakes, and highlight passages.