{"meta":{"title":"Configuring advanced setup for code scanning","intro":"You can configure advanced setup for a repository to find security vulnerabilities in your code using a highly customizable code scanning configuration.","product":"Security and code quality","breadcrumbs":[{"href":"/en/code-security","title":"Security and code quality"},{"href":"/en/code-security/how-tos","title":"How-tos"},{"href":"/en/code-security/how-tos/find-and-fix-code-vulnerabilities","title":"Find and fix code vulnerabilities"},{"href":"/en/code-security/how-tos/find-and-fix-code-vulnerabilities/configure-code-scanning","title":"Configure code scanning"},{"href":"/en/code-security/how-tos/find-and-fix-code-vulnerabilities/configure-code-scanning/configuring-advanced-setup-for-code-scanning","title":"Configure advanced setup"}],"documentType":"article"},"body":"# Configuring advanced setup for code scanning\n\nYou can configure advanced setup for a repository to find security vulnerabilities in your code using a highly customizable code scanning configuration.\n\nIf you do not need a highly customizable code scanning configuration, consider using default setup for code scanning. For more information, see [About setup types for code scanning](/en/code-security/concepts/code-scanning/setup-types).\n\n## Prerequisites\n\nYour repository is eligible for advanced setup if it meets these requirements.\n\n* It uses CodeQL-supported languages or you plan to generate code scanning results with a third-party tool.\n* GitHub Actions is enabled.\n* It is publicly visible, or GitHub Code Security is enabled.\n\n## Configuring advanced setup for code scanning with CodeQL\n\nYou can customize your CodeQL analysis by creating and editing a workflow file. Selecting advanced setup generates a basic workflow file for you to customize using standard workflow syntax and specifying options for the CodeQL action. See [Workflows](/en/actions/using-workflows/about-workflows) and [Workflow configuration options for code scanning](/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning).\n\nUsing actions to run code scanning will use minutes. For more information, see [GitHub Actions billing](/en/billing/managing-billing-for-github-actions/about-billing-for-github-actions).\n\n> \\[!NOTE]\n> You can configure code scanning for any public repository where you have write access.\n\n1. On GitHub, navigate to the main page of the repository.\n\n2. Under your repository name, click ** Settings**. If you cannot see the \"Settings\" tab, select the **** dropdown menu, then click **Settings**.\n\n \n\n3. In the \"Security\" section of the sidebar, click ** Advanced Security**.\n\n4. Scroll down to \"Code Security\", in the \"CodeQL analysis\" row select **Set up** , then click **Advanced**.\n\n > \\[!NOTE]\n > If you are switching from default setup to advanced setup, in the \"CodeQL analysis\" row, select , then click ** Switch to advanced**. In the pop-up window that appears, click **Disable CodeQL**.\n\n \n\n5. To customize how code scanning scans your code, edit the workflow.\n\n Generally, you can commit the CodeQL analysis workflow without making any changes to it. However, many of the third-party workflows require additional configuration, so read the comments in the workflow before committing.\n\n For more information, see [Workflow configuration options for code scanning](/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning) and [CodeQL code scanning for compiled languages](/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages).\n\n6. Click **Commit changes...** to display the commit changes form.\n\n \n\n7. In the commit message field, type a commit message.\n\n8. Choose whether you'd like to commit directly to the default branch, or create a new branch and start a pull request.\n\n9. Click **Commit new file** to commit the workflow file to the default branch or click **Propose new file** to commit the file to a new branch.\n\n10. If you created a new branch, click **Create pull request** and open a pull request to merge your change into the default branch.\n\nIn the suggested CodeQL analysis workflow, code scanning is configured to analyze your code each time you either push a change to the default branch or any protected branches, or raise a pull request against the default branch. As a result, code scanning will now commence.\n\nThe `on:pull_request` and `on:push` triggers for code scanning are each useful for different purposes. See [Workflow configuration options for code scanning](/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#scan-frequency) and [Triggering a workflow](/en/actions/using-workflows/triggering-a-workflow).\n\nFor information on bulk enablement, see [Configuring advanced setup for code scanning with CodeQL at scale](/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-advanced-setup-for-code-scanning-with-codeql-at-scale).\n\n## Configuring code scanning using third-party actions\n\nGitHub includes workflow templates for third-party actions, as well as the CodeQL action. Using a workflow template is much easier than writing a workflow unaided.\n\nUsing actions to run code scanning will use minutes. For more information, see [GitHub Actions billing](/en/billing/managing-billing-for-github-actions/about-billing-for-github-actions).\n\n1. On GitHub, navigate to the main page of the repository.\n\n2. Under your repository name, click ** Actions**.\n\n \n\n3. If the repository has already at least one workflow configured and running, click **New workflow** to display workflow templates. If there are currently no workflows configured for the repository, go to the next step.\n\n \n\n4. In the \"Choose a workflow\" or \"Get started with GitHub Actions\" view, scroll down to the \"Security\" category and click **Configure** under the workflow you want to configure. You may need to click **View all** to find the security workflow you want to configure.\n\n \n\n5. Follow any instructions in the workflow to customize it to your needs. For more general assistance about workflows, click **Documentation** on the right pane of the workflow page.\n\n \n\n6. When you have finished defining your configuration, add the new workflow to your default branch.\n\n For more information, see [Using workflow templates](/en/actions/learn-github-actions/using-starter-workflows#choosing-and-using-a-starter-workflow) and [Workflow configuration options for code scanning](/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning).\n\n## Next steps\n\nAfter your workflow runs successfully at least once, you are ready to start examining and resolving code scanning alerts. For more information on code scanning alerts, see [About code scanning alerts](/en/code-security/code-scanning/managing-code-scanning-alerts/about-code-scanning-alerts) and [Assessing code scanning alerts for your repository](/en/code-security/code-scanning/managing-code-scanning-alerts/assessing-code-scanning-alerts-for-your-repository).\n\nLearn how code scanning runs behave as checks on pull requests, see [Triaging code scanning alerts in pull requests](/en/code-security/code-scanning/managing-code-scanning-alerts/triaging-code-scanning-alerts-in-pull-requests#about-code-scanning-as-a-pull-request-check).\n\nYou can find detailed information about your code scanning configuration, including timestamps for each scan and the percentage of files scanned, on the tool status page. For more information, see [Use the tool status page for code scanning](/en/code-security/code-scanning/managing-your-code-scanning-configuration/about-the-tool-status-page).\n\n### Further reading\n\n* [Triaging code scanning alerts in pull requests](/en/code-security/code-scanning/managing-code-scanning-alerts/triaging-code-scanning-alerts-in-pull-requests).\n* [Configuring notifications](/en/account-and-profile/managing-subscriptions-and-notifications-on-github/setting-up-notifications/configuring-notifications#github-actions-notification-options).\n* [Workflow configuration options for code scanning](/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning).\n* [Viewing code scanning logs from GitHub Actions](/en/code-security/code-scanning/managing-your-code-scanning-configuration/viewing-code-scanning-logs)."}