{"meta":{"title":"Configuring default setup for code scanning","intro":"Quickly set up code scanning to find and fix vulnerable code automatically.","product":"Security and code quality","breadcrumbs":[{"href":"/en/code-security","title":"Security and code quality"},{"href":"/en/code-security/how-tos","title":"How-tos"},{"href":"/en/code-security/how-tos/find-and-fix-code-vulnerabilities","title":"Find and fix code vulnerabilities"},{"href":"/en/code-security/how-tos/find-and-fix-code-vulnerabilities/configure-code-scanning","title":"Configure code scanning"},{"href":"/en/code-security/how-tos/find-and-fix-code-vulnerabilities/configure-code-scanning/configuring-default-setup-for-code-scanning","title":"Configure code scanning"}],"documentType":"article"},"body":"# Configuring default setup for code scanning\n\nQuickly set up code scanning to find vulnerable code automatically.\n\nWe recommend that you start using code scanning with default setup. After you've initially configured default setup, you can evaluate code scanning to see how it's working for you and customize it to better meet your needs. For more information, see [About setup types for code scanning](/en/code-security/concepts/code-scanning/setup-types).\n\n## Prerequisites\n\nYour repository is eligible for default setup for code scanning if:\n\n* GitHub Actions is enabled.\n* It is publicly visible, or GitHub Code Security is enabled.\n\n## Configuring default setup for a repository\n\n> \\[!NOTE]\n> If the analyses fail for all CodeQL-supported languages in a repository, default setup will still be enabled, but it will not run any scans or use any GitHub Actions minutes until another CodeQL-supported language is added to the repository or default setup is manually reconfigured, and the analysis of a CodeQL-supported language succeeds.\n\n1. On GitHub, navigate to the main page of the repository.\n\n > \\[!NOTE]\n > If you are configuring default setup on a fork, you must first enable GitHub Actions. To enable GitHub Actions, under your repository name, click ** Actions**, then click **I understand my workflows, go ahead and enable them**. Be aware that this will enable all existing workflows on your fork.\n\n2. Under your repository name, click ** Settings**. If you cannot see the \"Settings\" tab, select the **** dropdown menu, then click **Settings**.\n\n \n\n3. In the \"Security\" section of the sidebar, click ** Advanced Security**.\n\n4. Under \"Code Security\", to the right of \"CodeQL analysis\", select **Set up** , then click **Default**.\n\n \n\n You will then see a \"CodeQL default configuration\" dialog summarizing the code scanning configuration automatically created by default setup.\n\n5. Optionally, to customize your code scanning setup, click ** Edit**.\n * To add or remove a language from the analysis performed by default setup, select or deselect that language in the \"Languages\" section.\n * To specify the CodeQL query suite you would like to use, select your preferred query suite in the \"Query suites\" section.\n\n6. Review the settings for default setup on your repository, then click **Enable CodeQL**. This will trigger a workflow that tests the new, automatically generated configuration.\n\n > \\[!NOTE]\n > If you are switching to default setup from advanced setup, you will see a warning informing you that default setup will override existing code scanning configurations. This warning means default setup will disable the existing workflow file and block any CodeQL analysis API uploads.\n\n7. If projects in your repository depend on dependencies in private package registries, you can grant code scanning access to them. This can improve the outcomes and quality of analyses. See [Giving security features access to private registries](/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries).\n\n8. Optionally, adjust other configuration options which affect default setup. See [Repository properties for code scanning](/en/code-security/concepts/code-scanning/repository-properties).\n\n9. Optionally, to view your default setup configuration after enablement, select , then click ** View CodeQL configuration**.\n\n> \\[!NOTE]\n> If no pushes and pull requests have occurred in a repository with default setup enabled for 6 months, the weekly schedule will be disabled to save your GitHub Actions minutes.\n\n## Running default setup on self-hosted or larger runners\n\nYou can use default setup for all CodeQL-supported languages on self-hosted runners or GitHub-hosted runners.\n\n> \\[!NOTE]Code scanning sees assigned runners when default setup is enabled. If a runner is assigned to a repository that is already running default setup, you must disable and re-enable default setup to start using the runner. If you add a runner and want to start using it, you can change the configuration manually without needing to disable and re-enable default setup.\n\n### Assigning labels to self-hosted runners\n\nTo assign a self-hosted runner for default setup, you can use the default `code-scanning` label, or you can optionally give them custom labels so that individual repositories can use different runners. For information about assigning labels to self-hosted runners, see [Using labels with self-hosted runners](/en/actions/hosting-your-own-runners/managing-self-hosted-runners/using-labels-with-self-hosted-runners).\n\nOnce you've assigned custom labels to self-hosted runners, your repositories can use those runners for code scanning default setup.\n\nYou can also use security configurations to assign labels to self-hosted runners for code scanning. See [Creating a custom security configuration](/en/code-security/securing-your-organization/meeting-your-specific-security-needs-with-custom-security-configurations/creating-a-custom-security-configuration#creating-a-custom-security-configuration).\n\n### Assigning larger runners\n\nTo assign a larger runner, name the runner `code-scanning`. This will automatically add the `code-scanning` label to the larger runner. An organization can only have one larger runner with the `code-scanning` label, and that runner will handle all code scanning jobs from repositories within your organization with access to the runner's group. See [Configuring larger runners for default setup](/en/code-security/code-scanning/managing-your-code-scanning-configuration/configuring-larger-runners-for-default-setup#provisioning-organization-level-larger-runners-for-default-setup).\n\n### Ensuring build support\n\nDefault setup uses the `none` build mode for C/C++, C#, Java and Rust and uses the `autobuild` build mode for other compiled languages. You should configure your self-hosted runners to make sure they can run all the necessary commands for C/C++, C#, and Swift analysis. Analysis of JavaScript/TypeScript, Go, Ruby, Python, and Kotlin code does not currently require special configuration.\n\n## Next steps\n\nAfter your configuration runs successfully at least once, you can start examining and resolving code scanning alerts. For more information on code scanning alerts, see [About code scanning alerts](/en/code-security/code-scanning/managing-code-scanning-alerts/about-code-scanning-alerts) and [Assessing code scanning alerts for your repository](/en/code-security/code-scanning/managing-code-scanning-alerts/assessing-code-scanning-alerts-for-your-repository).\n\nAfter you've configured default setup for code scanning, you can read about evaluating how it's working for you and the next steps you can take to customize it. For more information, see [Evaluating default setup for code scanning](/en/code-security/code-scanning/enabling-code-scanning/evaluating-default-setup-for-code-scanning).\n\nYou can find detailed information about your code scanning configuration, including timestamps for each scan and the percentage of files scanned, on the tool status page. For more information, see [Use the tool status page for code scanning](/en/code-security/code-scanning/managing-your-code-scanning-configuration/about-the-tool-status-page).\n\nWhen you configure default setup, you may encounter an error. For information on troubleshooting specific errors, see [Troubleshooting code scanning analysis errors](/en/code-security/code-scanning/troubleshooting-code-scanning)."}