Page History

...

1. Under the repository name, click  Security. If you cannot see the "Security" tab, select the  dropdown menu, and then click Security.
   Image Modified

1. In the left sidebar, click  Code scanning.
2. Click the name of an alert.
3. If Copilot Autofix can suggest a fix, at the top of the page, click  Generate fix.
4. Once the suggested fix has been generated, at the bottom of the page, you can click Create PR with fix to automatically generate a pull request with the suggested fix. A new branch is created from the default branch, the generated fix is committed and a draft pull request is created. You can test and edit the suggested fix as you would with any other fix.

...

GitHub Copilot Autofix will suggest fixes for alerts from code scanning analysis (including CodeQL analysis) in repositories. For more information on working with suggestions from Copilot Autofix in pull requests, see Working with Copilot Autofix suggestions for alerts on a pull request.

Default setup for CodeQL

Default setup for code scanning is the quickest, easiest, most low-maintenance way to enable code scanning for your repository. Based on the code in your repository, default setup will automatically create a custom code scanning configuration. After enabling default setup, the code written in CodeQL-supported languages in your repository will be scanned:

• On each push to the repository's default branch, or any protected branch. For more information on protected branches, see About protected branches.
• When creating or committing to a pull request based against the repository's default branch, or any protected branch, excluding pull requests from forks.
• On a weekly schedule.

Advanced setup for CodeQL

Advanced setup for code scanning is helpful when you need to customize your code scanning. By creating and editing a workflow file, you can define how to build compiled languages, choose which queries to run, select the languages to scan, use a matrix build, and more. You also have access to all the options for controlling workflows, for example: changing the scan schedule, defining workflow triggers, specifying specialist runners to use. For more information about GitHub Actions workflows, see Workflows.

Recommendations

When you are setting up code scanning for the first time, or across multiple repositories, it's best to use default setup. Default setup uses the simplest method available to generate a CodeQL database and analyze your code, so that you can start fixing alerts as soon as possible. Once you have resolved the initial alerts, you may want to switch to advanced setup with a manual build process for high risk repositories.