diff --git a/content/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/assess-alerts.md b/content/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/assess-alerts.md index 28bd92244a0f..ba217baadfca 100644 --- a/content/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/assess-alerts.md +++ b/content/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/assess-alerts.md @@ -15,7 +15,7 @@ category: - Find and fix code vulnerabilities --- -Anyone with read permission for a repository can see {% data variables.product.prodname_code_scanning %} annotations on pull requests. For more information, see [AUTOTITLE](/code-security/code-scanning/managing-code-scanning-alerts/triaging-code-scanning-alerts-in-pull-requests). +Anyone with read permission for a repository can see {% data variables.product.prodname_code_scanning %} annotations on pull requests. For more information, see [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/triage-alerts-in-pull-requests). ## Viewing the alerts for a repository @@ -43,16 +43,16 @@ By default, the {% data variables.product.prodname_code_scanning %} alerts page 1. Alerts from {% data variables.product.prodname_codeql %} analysis include a description of the problem. Click **Show more** for guidance on how to fix your code. {% data reusables.security.alert-assignee-step %} -For more information, see [AUTOTITLE](/code-security/code-scanning/managing-code-scanning-alerts/about-code-scanning-alerts). +For more information, see [AUTOTITLE](/code-security/concepts/code-scanning/code-scanning-alerts). > [!NOTE] -> You can see information about when {% data variables.product.prodname_code_scanning %} analysis last ran on the tool status page. For more information, see [AUTOTITLE](/code-security/code-scanning/managing-your-code-scanning-configuration/about-the-tool-status-page). +> You can see information about when {% data variables.product.prodname_code_scanning %} analysis last ran on the tool status page. For more information, see [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/use-the-tools-status-page-for-code-scanning). {% ifversion copilot-chat-ghas-alerts %} ## Asking {% data variables.copilot.copilot_chat %} about {% data variables.product.prodname_code_scanning %} alerts -With a {% data variables.copilot.copilot_enterprise %} license, you can ask {% data variables.copilot.copilot_chat_short %} for help to better understand security alerts, including {% data variables.product.prodname_code_scanning %} alerts, in repositories in your organization. For more information, see [AUTOTITLE](/copilot/using-github-copilot/asking-github-copilot-questions-in-githubcom#asking-questions-about-alerts-from-github-advanced-security-features). +With a {% data variables.copilot.copilot_enterprise %} license, you can ask {% data variables.copilot.copilot_chat_short %} for help to better understand security alerts, including {% data variables.product.prodname_code_scanning %} alerts, in repositories in your organization. For more information, see [AUTOTITLE](/copilot/how-tos/copilot-on-github/chat-with-copilot/chat-in-github#asking-questions-about-alerts-from-github-advanced-security-features). {% endif %} @@ -76,7 +76,7 @@ You can prefix the `tag` filter with `-` to exclude results with that tag. For e ### Restricting results to application code only -You can use the "Only alerts in application code" filter or `autofilter:true` keyword and value to restrict results to alerts in application code. For more information about the types of code that are automatically labeled as not application code, see [AUTOTITLE](/code-security/code-scanning/managing-code-scanning-alerts/about-code-scanning-alerts#about-labels-for-alerts-that-are-not-found-in-application-code). +You can use the "Only alerts in application code" filter or `autofilter:true` keyword and value to restrict results to alerts in application code. For more information about the types of code that are automatically labeled as not application code, see [AUTOTITLE](/code-security/concepts/code-scanning/code-scanning-alerts#about-labels-for-alerts-that-are-not-found-in-application-code). ## Searching {% data variables.product.prodname_code_scanning %} alerts @@ -109,7 +109,7 @@ You can search the list of alerts. This is useful if there is a large number of ## Further reading -* [AUTOTITLE](/code-security/code-scanning/managing-code-scanning-alerts/resolving-code-scanning-alerts) -* [AUTOTITLE](/code-security/code-scanning/managing-code-scanning-alerts/triaging-code-scanning-alerts-in-pull-requests) -* [AUTOTITLE](/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning) -* [AUTOTITLE](/code-security/code-scanning/integrating-with-code-scanning/about-integration-with-code-scanning) +* [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/resolve-alerts) +* [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/triage-alerts-in-pull-requests) +* [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/configure-code-scanning/configure-code-scanning) +* [AUTOTITLE](/code-security/concepts/code-scanning/integration-with-code-scanning) diff --git a/content/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/disabling-autofix-for-code-scanning.md b/content/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/disabling-autofix-for-code-scanning.md index 9e8ec940aac9..f6913eab7091 100644 --- a/content/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/disabling-autofix-for-code-scanning.md +++ b/content/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/disabling-autofix-for-code-scanning.md @@ -57,7 +57,7 @@ Disabling {% data variables.copilot.copilot_autofix_short %} at the organization {% data reusables.security-configurations.display-global-settings %} 1. Under the "{% data variables.product.prodname_code_scanning_caps %}" section, deselect **{% data variables.copilot.copilot_autofix_short %}**. -For more information about configuring global {% data variables.product.prodname_code_scanning %} settings, see [AUTOTITLE](/code-security/securing-your-organization/enabling-security-features-in-your-organization/configuring-global-security-settings-for-your-organization#configuring-global-code-scanning-settings). +For more information about configuring global {% data variables.product.prodname_code_scanning %} settings, see [AUTOTITLE](/code-security/how-tos/secure-at-scale/configure-organization-security/establish-complete-coverage/configure-global-settings#configuring-global-code-scanning-settings). ### Disabling {% data variables.copilot.copilot_autofix_short %} for a repository diff --git a/content/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/enable-delegated-alert-dismissal.md b/content/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/enable-delegated-alert-dismissal.md index 61cf801b213f..7a0a0a18d2ae 100644 --- a/content/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/enable-delegated-alert-dismissal.md +++ b/content/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/enable-delegated-alert-dismissal.md @@ -33,7 +33,7 @@ You must configure delegated dismissal for your organization using a custom secu {% data reusables.security-configurations.custom-security-configurations-org %} 1. When creating the custom security configuration, under "{% data variables.product.prodname_code_scanning_caps %}", set "Prevent direct alert dismissals" to **Enabled**. 1. Click **Save configuration**. -1. Apply the security configuration to all (or selected) repositories in your organization. See [AUTOTITLE](/code-security/securing-your-organization/enabling-security-features-in-your-organization/applying-a-custom-security-configuration). +1. Apply the security configuration to all (or selected) repositories in your organization. See [AUTOTITLE](/code-security/how-tos/secure-at-scale/configure-organization-security/establish-complete-coverage/apply-custom-configuration). ## Configuring delegated dismissal for an enterprise @@ -42,10 +42,10 @@ You must configure delegated dismissal for your enterprise using a custom securi {% data reusables.security-configurations.custom-security-configurations-enterprise %} 1. When creating the custom security configuration, under "{% data variables.product.prodname_code_scanning %}", ensure that the dropdown menu for "Prevent direct alert dismissals" is set to **Enabled**. 1. Click **Save configuration**. -1. Apply the security configuration to all (or selected) repositories in your enterprise. See [AUTOTITLE](/admin/managing-code-security/securing-your-enterprise/applying-a-custom-security-configuration-to-your-enterprise). +1. Apply the security configuration to all (or selected) repositories in your enterprise. See [AUTOTITLE](/code-security/how-tos/secure-at-scale/configure-enterprise-security/establish-complete-coverage/apply-custom-configuration). -To learn more about security configurations, see [AUTOTITLE](/code-security/securing-your-organization/introduction-to-securing-your-organization-at-scale/about-enabling-security-features-at-scale). +To learn more about security configurations, see [AUTOTITLE](/code-security/concepts/security-at-scale/organization-security). ## Next steps -Now that you have enabled delegated alert dismissal for {% data variables.product.prodname_code_scanning %}, you should regularly review alert dismissal requests to maintain an accurate alert count and unblock your developers. See [AUTOTITLE](/code-security/security-overview/review-alert-dismissal-requests). +Now that you have enabled delegated alert dismissal for {% data variables.product.prodname_code_scanning %}, you should regularly review alert dismissal requests to maintain an accurate alert count and unblock your developers. See [AUTOTITLE](/code-security/how-tos/manage-security-alerts/remediate-alerts-at-scale/review-alert-dismissal-requests). diff --git a/content/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/resolve-alerts.md b/content/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/resolve-alerts.md index d7d9f2eb9a6b..5664ee312cb4 100644 --- a/content/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/resolve-alerts.md +++ b/content/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/resolve-alerts.md @@ -27,7 +27,7 @@ category: ## Asking {% data variables.copilot.copilot_chat %} about {% data variables.product.prodname_code_scanning %} alerts -With a {% data variables.copilot.copilot_enterprise %} license, you can ask {% data variables.copilot.copilot_chat_short %} for help to better understand security alerts, including {% data variables.product.prodname_code_scanning %} alerts, in repositories in your organization. See [AUTOTITLE](/copilot/using-github-copilot/asking-github-copilot-questions-in-githubcom#asking-questions-about-alerts-from-github-advanced-security-features). +With a {% data variables.copilot.copilot_enterprise %} license, you can ask {% data variables.copilot.copilot_chat_short %} for help to better understand security alerts, including {% data variables.product.prodname_code_scanning %} alerts, in repositories in your organization. See [AUTOTITLE](/copilot/how-tos/copilot-on-github/chat-with-copilot/chat-in-github#asking-questions-about-alerts-from-github-advanced-security-features). {% endif %} @@ -89,7 +89,7 @@ You can also use the Autofix API for historical alerts endpoints to generate, ge ## Fixing an alert {% ifversion code-scanning-autofix %}manually{% endif %} -Anyone with write permission for a repository can fix an alert by committing a correction to the code. If the repository has {% data variables.product.prodname_code_scanning %} scheduled to run on pull requests, it's best to raise a pull request with your correction. This will trigger {% data variables.product.prodname_code_scanning %} analysis of the changes and test that your fix doesn't introduce any new problems. See [AUTOTITLE](/code-security/code-scanning/managing-code-scanning-alerts/triaging-code-scanning-alerts-in-pull-requests). +Anyone with write permission for a repository can fix an alert by committing a correction to the code. If the repository has {% data variables.product.prodname_code_scanning %} scheduled to run on pull requests, it's best to raise a pull request with your correction. This will trigger {% data variables.product.prodname_code_scanning %} analysis of the changes and test that your fix doesn't introduce any new problems. See [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/triage-alerts-in-pull-requests). {% data reusables.code-scanning.track-alert-in-issue %} @@ -141,7 +141,7 @@ If you dismiss an alert but later realize that you need to fix the alert, you ca ## Removing stale configurations and alerts from a branch -You may have multiple {% data variables.product.prodname_code_scanning %} configurations on a single repository. When run, multiple configurations can generate the same alert. Additionally, if the configurations are run on different schedules, the alert statuses may become out-of-date for infrequent or stale configurations. For more information on alerts from multiple configurations, see [AUTOTITLE](/code-security/code-scanning/managing-code-scanning-alerts/about-code-scanning-alerts#about-alerts-from-multiple-configurations). +You may have multiple {% data variables.product.prodname_code_scanning %} configurations on a single repository. When run, multiple configurations can generate the same alert. Additionally, if the configurations are run on different schedules, the alert statuses may become out-of-date for infrequent or stale configurations. For more information on alerts from multiple configurations, see [AUTOTITLE](/code-security/concepts/code-scanning/code-scanning-alerts#about-alerts-from-multiple-configurations). {% data reusables.repositories.navigate-to-repo %} {% data reusables.repositories.sidebar-security %} @@ -164,6 +164,6 @@ You may have multiple {% data variables.product.prodname_code_scanning %} config ## Further reading -* [AUTOTITLE](/code-security/code-scanning/managing-code-scanning-alerts/triaging-code-scanning-alerts-in-pull-requests) +* [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/triage-alerts-in-pull-requests) * [AUTOTITLE](/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning) * [AUTOTITLE](/code-security/code-scanning/integrating-with-code-scanning/about-integration-with-code-scanning) diff --git a/content/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/track-alerts-in-issues.md b/content/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/track-alerts-in-issues.md index 36c111214399..b2212f7d935c 100644 --- a/content/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/track-alerts-in-issues.md +++ b/content/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/track-alerts-in-issues.md @@ -16,7 +16,7 @@ redirect_from: {% data reusables.code-scanning.enterprise-enable-code-scanning %} -When {% data variables.product.prodname_code_scanning %} identifies a vulnerability, you can link it to a new or existing {% data variables.product.github %} issue. This makes security fixes visible in your planning and project boards alongside your team's regular development work. For more information about how alert tracking works, see [AUTOTITLE](/code-security/concepts/code-scanning/code-scanning-alert-tracking-using-issues). +When {% data variables.product.prodname_code_scanning %} identifies a vulnerability, you can link it to a new or existing {% data variables.product.github %} issue. This makes security fixes visible in your planning and project boards alongside your team's regular development work. For more information about how alert tracking works, see [AUTOTITLE](/code-security/concepts/code-scanning/alert-tracking-with-issues). ## Creating an issue from an alert diff --git a/content/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/triage-alerts-in-pull-requests.md b/content/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/triage-alerts-in-pull-requests.md index daa88bc747fa..28de6caa799e 100644 --- a/content/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/triage-alerts-in-pull-requests.md +++ b/content/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/triage-alerts-in-pull-requests.md @@ -20,13 +20,13 @@ category: - Find and fix code vulnerabilities --- -Depending on your configuration, {% data variables.product.prodname_code_scanning %} results may appear as check results and annotations on pull requests. For more information, see [AUTOTITLE](/code-security/concepts/code-scanning/about-code-scanning-alerts#about-alerts-in-pull-requests). +Depending on your configuration, {% data variables.product.prodname_code_scanning %} results may appear as check results and annotations on pull requests. For more information, see [AUTOTITLE](/code-security/concepts/code-scanning/code-scanning-alerts#about-alerts-in-pull-requests). ## Viewing results of the {% data variables.product.prodname_code_scanning %} check For all configurations of {% data variables.product.prodname_code_scanning %}, the check that contains the results of {% data variables.product.prodname_code_scanning %} is: **{% data variables.product.prodname_code_scanning_caps %} results**. The results for each analysis tool used are shown separately. Any new alerts on lines of code changed in the pull request are shown as annotations. -To see the full set of alerts for the analyzed branch, click **View all branch alerts**. This opens the full alert view where you can filter all the alerts on the branch by type, severity, tag, etc. For more information, see [AUTOTITLE](/code-security/code-scanning/managing-code-scanning-alerts/assessing-code-scanning-alerts-for-your-repository#filtering-and-searching-for-code-scanning-alerts). +To see the full set of alerts for the analyzed branch, click **View all branch alerts**. This opens the full alert view where you can filter all the alerts on the branch by type, severity, tag, etc. For more information, see [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/assess-alerts#filtering-and-searching-for-code-scanning-alerts). ![Screenshot of the {% data variables.product.prodname_code_scanning_caps %} results check on a pull request. The "View all branch alerts" link is highlighted with a dark orange outline.](/assets/images/help/repository/code-scanning-results-check.png) @@ -36,7 +36,7 @@ If the {% data variables.product.prodname_code_scanning %} results check finds a ![Screenshot of the merge box for a pull request. The "Code scanning results / CodeQL" check has "1 new alert including 1 high severity security v..."](/assets/images/help/repository/code-scanning-check-failure.png) -You can override the default behavior in your repository settings, by specifying the level of severities and security severities that will cause a pull request check failure. For more information, see [AUTOTITLE](/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#defining-the-severities-causing-pull-request-check-failure). +You can override the default behavior in your repository settings, by specifying the level of severities and security severities that will cause a pull request check failure. For more information, see [AUTOTITLE](/code-security/reference/code-scanning/workflow-configuration-options#defining-the-severities-causing-pull-request-check-failure). ## Diagnosing issues with your {% data variables.product.prodname_code_scanning %} configuration @@ -44,7 +44,7 @@ Depending on your configuration, you may see additional checks running on pull r For example, if the repository uses the {% data variables.code-scanning.codeql_workflow %} a **{% data variables.product.prodname_codeql %} / Analyze (LANGUAGE)** check is run for each language before the results check runs. The analysis check may fail if there are configuration problems, or if the pull request breaks the build for a language that the analysis compiles (for example, {% data variables.code-scanning.compiled_languages %}). -As with other pull request checks, you can see full details of the check failure on the **Checks** tab. For more information about configuring and troubleshooting, see [AUTOTITLE](/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning) or [AUTOTITLE](/code-security/code-scanning/troubleshooting-code-scanning). +As with other pull request checks, you can see full details of the check failure on the **Checks** tab. For more information about configuring and troubleshooting, see [AUTOTITLE](/code-security/reference/code-scanning/workflow-configuration-options) or [AUTOTITLE](/code-security/reference/code-scanning/troubleshoot-analysis-errors). ## Viewing an alert on your pull request @@ -54,7 +54,7 @@ You can see any {% data variables.product.prodname_code_scanning %} alerts that You can also view all {% data variables.product.prodname_code_scanning %} alerts that are inside the diff of the changes introduced in the pull request in the **Files changed** tab. -If you add a new code scanning configuration in your pull request, you will see a comment on your pull request directing you to the **{% data variables.product.prodname_security_and_quality_tab %}** tab of the repository so you can view all the alerts on the pull request branch. For more information about viewing the alerts for a repository, see [AUTOTITLE](/code-security/code-scanning/managing-code-scanning-alerts/assessing-code-scanning-alerts-for-your-repository#viewing-the-alerts-for-a-repository). +If you add a new code scanning configuration in your pull request, you will see a comment on your pull request directing you to the **{% data variables.product.prodname_security_and_quality_tab %}** tab of the repository so you can view all the alerts on the pull request branch. For more information about viewing the alerts for a repository, see [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/assess-alerts#viewing-the-alerts-for-a-repository). If you have write permission for the repository, some annotations contain links with extra context for the alert. In the example above, from {% data variables.product.prodname_codeql %} analysis, you can click **user-provided value** to see where the untrusted data enters the data flow (this is referred to as the source). In this case you can also view the full path from the source to the code that uses the data (the sink) by clicking **Show paths**. This makes it easy to check whether the data is untrusted or if the analysis failed to recognize a data sanitization step between the source and the sink. For information about analyzing data flow using {% data variables.product.prodname_codeql %}, see [About data flow analysis](https://codeql.github.com/docs/writing-codeql-queries/about-data-flow-analysis/). @@ -90,13 +90,13 @@ Anyone with push access to a pull request can fix a {% data variables.product.pr ### Generating {% data variables.copilot.copilot_autofix_short %} suggestions and publishing to a pull request -When {% data variables.copilot.copilot_autofix_short %} is enabled for a repository, alerts are displayed in pull requests as normal and information from any alerts found by {% data variables.product.prodname_code_scanning %} is automatically sent to the LLM for processing. When LLM analysis is complete, any results are published as comments on relevant alerts. For more information, see [AUTOTITLE](/code-security/code-scanning/managing-code-scanning-alerts/responsible-use-autofix-code-scanning). +When {% data variables.copilot.copilot_autofix_short %} is enabled for a repository, alerts are displayed in pull requests as normal and information from any alerts found by {% data variables.product.prodname_code_scanning %} is automatically sent to the LLM for processing. When LLM analysis is complete, any results are published as comments on relevant alerts. For more information, see [AUTOTITLE](/code-security/responsible-use/security-and-quality-ai-features). > [!NOTE] -> * {% data variables.copilot.copilot_autofix_short %} supports a subset of {% data variables.product.prodname_codeql %} queries. For information about the availability of {% data variables.copilot.copilot_autofix_short %}, see the query tables linked from [AUTOTITLE](/code-security/code-scanning/reference/code-ql-built-in-queries). +> * {% data variables.copilot.copilot_autofix_short %} supports a subset of {% data variables.product.prodname_codeql %} queries. For information about the availability of {% data variables.copilot.copilot_autofix_short %}, see the query tables linked from [AUTOTITLE](/code-security/reference/code-scanning/codeql/codeql-queries). > * When analysis is complete, all relevant results are published to the pull request at once. If at least one alert in your pull request has an {% data variables.copilot.copilot_autofix_short %} suggestion, you should assume that the LLM has finished identifying potential fixes for your code. > * On alerts generated from queries that are not supported by {% data variables.copilot.copilot_autofix_short %}, you will see a note telling you that the query is not supported. If a suggestion for a supported query fails to generate, you will see a note on the alert prompting you to try pushing another commit or to contact support. -> * {% data variables.copilot.copilot_autofix_short %} for {% data variables.product.prodname_code_scanning %} alerts won't be able to generate a fix for every alert in every situation. The feature operates on a best-effort basis and is not guaranteed to succeed 100% of the time. For information about the limitations of automatically generated fixes, see [Limitations of suggestions](/code-security/code-scanning/managing-code-scanning-alerts/about-autofix-for-codeql-code-scanning#limitations-of-suggestions). +> * {% data variables.copilot.copilot_autofix_short %} for {% data variables.product.prodname_code_scanning %} alerts won't be able to generate a fix for every alert in every situation. The feature operates on a best-effort basis and is not guaranteed to succeed 100% of the time. For information about the limitations of automatically generated fixes, see [Limitations of suggestions](/code-security/responsible-use/security-and-quality-ai-features#limitations-of-suggestions). Usually, when you suggest changes to a pull request, your comment contains changes for a single file that is changed in the pull request. The following screenshot shows an {% data variables.copilot.copilot_autofix_short %} comment that suggests changes to the `index.js` file where the alert is displayed. Since the potential fix requires a new dependency on `escape-html`, the comment also suggests adding this dependency to the `package.json` file, even though the original pull request makes no changes to this file. @@ -104,7 +104,7 @@ Usually, when you suggest changes to a pull request, your comment contains chang ### Assessing and committing an {% data variables.copilot.copilot_autofix_short %} suggestion -Each {% data variables.copilot.copilot_autofix_short %} suggestion demonstrates a potential solution for a {% data variables.product.prodname_code_scanning %} alert in your codebase. You must assess the suggested changes to determine whether they are a good solution for your codebase and to ensure that they maintain the intended behavior. For information about the limitations of {% data variables.copilot.copilot_autofix_short %} suggestions, see [Limitations of suggestions](/code-security/code-scanning/managing-code-scanning-alerts/responsible-use-autofix-code-scanning#limitations-of-suggestions) and [Mitigating the limitations of suggestions](/code-security/code-scanning/managing-code-scanning-alerts/responsible-use-autofix-code-scanning#mitigating-the-limitations-of-suggestions) in "Responsible use of {% data variables.copilot.copilot_autofix_short %} for {% data variables.product.prodname_code_scanning %}." +Each {% data variables.copilot.copilot_autofix_short %} suggestion demonstrates a potential solution for a {% data variables.product.prodname_code_scanning %} alert in your codebase. You must assess the suggested changes to determine whether they are a good solution for your codebase and to ensure that they maintain the intended behavior. For information about the limitations of {% data variables.copilot.copilot_autofix_short %} suggestions, see [Limitations of suggestions](/code-security/responsible-use/security-and-quality-ai-features#limitations-of-suggestions) and [Mitigating the limitations of suggestions](/code-security/responsible-use/security-and-quality-ai-features#mitigating-the-limitations-of-suggestions) in "Responsible use of {% data variables.copilot.copilot_autofix_short %} for {% data variables.product.prodname_code_scanning %}." 1. Click **Edit** to display the editing options and select your preferred method. * Under **Edit with {% data variables.product.prodname_cli %}**, follow the instructions for checking out the pull request locally and applying the suggested fix. @@ -132,4 +132,4 @@ An alternative way of closing an alert is to dismiss it. You can dismiss an aler {% data reusables.code-scanning.false-positive-fix-codeql %} -For more information about dismissing alerts, see [AUTOTITLE](/code-security/code-scanning/managing-code-scanning-alerts/resolving-code-scanning-alerts#dismissing--alerts). +For more information about dismissing alerts, see [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/resolve-alerts#dismissing-alerts). diff --git a/content/code-security/how-tos/manage-security-alerts/manage-dependabot-alerts/enable-delegated-alert-dismissal.md b/content/code-security/how-tos/manage-security-alerts/manage-dependabot-alerts/enable-delegated-alert-dismissal.md index 5d256149930c..87767d17480e 100644 --- a/content/code-security/how-tos/manage-security-alerts/manage-dependabot-alerts/enable-delegated-alert-dismissal.md +++ b/content/code-security/how-tos/manage-security-alerts/manage-dependabot-alerts/enable-delegated-alert-dismissal.md @@ -27,20 +27,20 @@ category: You must configure delegated dismissal for your organization using a custom security configuration. You can then apply the security configuration to all (or selected) repositories in your organization. -1. Start creating or editing a custom security configuration. See [AUTOTITLE](/code-security/securing-your-organization/enabling-security-features-in-your-organization/creating-a-custom-security-configuration#creating-a-custom-security-configuration). +1. Start creating or editing a custom security configuration. See [AUTOTITLE](/code-security/how-tos/secure-at-scale/configure-organization-security/establish-complete-coverage/create-custom-configuration#creating-a-custom-security-configuration). 1. In the "Dependency scanning" section of your security configuration, set "Prevent direct alert dismissals" to **Enabled**. 1. Click **Save configuration**. -1. Apply the security configuration to repositories in your organization. See [AUTOTITLE](/code-security/securing-your-organization/enabling-security-features-in-your-organization/applying-a-custom-security-configuration). +1. Apply the security configuration to repositories in your organization. See [AUTOTITLE](/code-security/how-tos/secure-at-scale/configure-organization-security/establish-complete-coverage/apply-custom-configuration). ## Configuring delegated dismissal for an enterprise You must configure delegated dismissal for your enterprise using a custom security configuration. You can then apply the security configuration to all (or selected) repositories in your enterprise. -1. Start creating or editing a custom security configuration. See [AUTOTITLE](/admin/managing-code-security/securing-your-enterprise/creating-a-custom-security-configuration-for-your-enterprise). +1. Start creating or editing a custom security configuration. See [AUTOTITLE](/code-security/how-tos/secure-at-scale/configure-enterprise-security/establish-complete-coverage/create-custom-configuration). 1. In the "Dependency scanning" section of your security configuration, set "Prevent direct alert dismissals" to **Enabled**. 1. Click **Save configuration**. -1. Apply the security configuration to repositories in your enterprise. See [AUTOTITLE](/admin/managing-code-security/securing-your-enterprise/applying-a-custom-security-configuration-to-your-enterprise). +1. Apply the security configuration to repositories in your enterprise. See [AUTOTITLE](/code-security/how-tos/secure-at-scale/configure-enterprise-security/establish-complete-coverage/apply-custom-configuration). ## Next steps -Now that you have enabled delegated alert dismissal for {% data variables.product.prodname_dependabot %}, you should regularly review alert dismissal requests to maintain an accurate alert count and unblock your developers. See [AUTOTITLE](/code-security/security-overview/review-alert-dismissal-requests). +Now that you have enabled delegated alert dismissal for {% data variables.product.prodname_dependabot %}, you should regularly review alert dismissal requests to maintain an accurate alert count and unblock your developers. See [AUTOTITLE](/code-security/how-tos/manage-security-alerts/remediate-alerts-at-scale/review-alert-dismissal-requests). diff --git a/content/code-security/how-tos/manage-security-alerts/manage-dependabot-alerts/manage-malware-alerts.md b/content/code-security/how-tos/manage-security-alerts/manage-dependabot-alerts/manage-malware-alerts.md index 4b28969278b5..1dc0e04cfe8d 100644 --- a/content/code-security/how-tos/manage-security-alerts/manage-dependabot-alerts/manage-malware-alerts.md +++ b/content/code-security/how-tos/manage-security-alerts/manage-dependabot-alerts/manage-malware-alerts.md @@ -52,4 +52,4 @@ category: ## Next steps -To help reduce false positives for internal packages and low-risk alerts, you can configure {% data variables.dependabot.auto_triage_rules %} to automatically dismiss alerts that meet certain criteria. See [AUTOTITLE](/code-security/dependabot/dependabot-auto-triage-rules/about-dependabot-auto-triage-rules). +To help reduce false positives for internal packages and low-risk alerts, you can configure {% data variables.dependabot.auto_triage_rules %} to automatically dismiss alerts that meet certain criteria. See [AUTOTITLE](/code-security/concepts/supply-chain-security/dependabot-auto-triage-rules). diff --git a/content/code-security/how-tos/manage-security-alerts/manage-dependabot-alerts/view-dependabot-alerts.md b/content/code-security/how-tos/manage-security-alerts/manage-dependabot-alerts/view-dependabot-alerts.md index 3631d1a30758..d597a9b826c7 100644 --- a/content/code-security/how-tos/manage-security-alerts/manage-dependabot-alerts/view-dependabot-alerts.md +++ b/content/code-security/how-tos/manage-security-alerts/manage-dependabot-alerts/view-dependabot-alerts.md @@ -21,7 +21,7 @@ category: {% data reusables.dependabot.enterprise-enable-dependabot %} -Your repository's {% data variables.product.prodname_dependabot %} tab lists all open and closed {% data variables.product.prodname_dependabot_alerts %} and corresponding {% data variables.product.prodname_dependabot_security_updates %}. You can filter alerts by package, ecosystem, or manifest. You can sort the list of alerts, and you can click into specific alerts for more details. You can also dismiss or reopen alerts, either one by one or by selecting multiple alerts at once. For more information, see [AUTOTITLE](/code-security/dependabot/dependabot-alerts/about-dependabot-alerts). +Your repository's {% data variables.product.prodname_dependabot %} tab lists all open and closed {% data variables.product.prodname_dependabot_alerts %} and corresponding {% data variables.product.prodname_dependabot_security_updates %}. You can filter alerts by package, ecosystem, or manifest. You can sort the list of alerts, and you can click into specific alerts for more details. You can also dismiss or reopen alerts, either one by one or by selecting multiple alerts at once. For more information, see [AUTOTITLE](/code-security/concepts/supply-chain-security/dependabot-alerts). ## About updates for vulnerable dependencies in your repository @@ -29,7 +29,7 @@ Each {% data variables.product.prodname_dependabot %} alert has a unique numeric You can filter and sort {% data variables.product.prodname_dependabot_alerts %} using a variety of filters and sort options available on the user interface. For more information, see [Viewing and prioritizing {% data variables.product.prodname_dependabot_alerts %}](#viewing-and-prioritizing-dependabot-alerts) below. -You can also audit actions taken in response to {% data variables.product.prodname_dependabot %} alerts. For more information, see [AUTOTITLE](/code-security/getting-started/auditing-security-alerts). +You can also audit actions taken in response to {% data variables.product.prodname_dependabot %} alerts. For more information, see [AUTOTITLE](/code-security/concepts/security-at-scale/audit-security-alerts). ## Viewing and prioritizing {% data variables.product.prodname_dependabot_alerts %} @@ -75,14 +75,14 @@ When you assign an alert to an AI agent, the agent automatically creates a sessi * Select a custom agent you have configured (recommended for specialized tasks). {% endif %} -1. Optionally, to suggest an improvement to the related security advisory, on the right-hand side of the alert details page, click **Suggest improvements for this advisory on the {% data variables.product.prodname_advisory_database %}**. See [AUTOTITLE](/code-security/security-advisories/working-with-global-security-advisories-from-the-github-advisory-database/editing-security-advisories-in-the-github-advisory-database). +1. Optionally, to suggest an improvement to the related security advisory, on the right-hand side of the alert details page, click **Suggest improvements for this advisory on the {% data variables.product.prodname_advisory_database %}**. See [AUTOTITLE](/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/edit-advisory-database). ### Tips for prioritizing alerts * Use the **Most important** sort order to focus on alerts with the highest potential impact. * Prioritize alerts that affect production dependencies over development dependencies.{% ifversion dependabot-alerts-assignees %} * Use the **Assignees** feature to clarify who is responsible for addressing each alert, so your team can track and remediate vulnerabilities more effectively.{% endif %} -* Use {% data variables.dependabot.auto_triage_rules %} to automatically prioritize or manage alerts. See [AUTOTITLE](/code-security/concepts/supply-chain-security/about-dependabot-auto-triage-rules). +* Use {% data variables.dependabot.auto_triage_rules %} to automatically prioritize or manage alerts. See [AUTOTITLE](/code-security/concepts/supply-chain-security/dependabot-auto-triage-rules). For more information about supported ecosystems and manifest files for dependency scope, see [AUTOTITLE](/code-security/reference/supply-chain-security/supported-ecosystems-and-manifests-for-dependency-scope). @@ -94,7 +94,7 @@ To retrieve alerts programmatically, see the [AUTOTITLE](/rest/dependabot/alerts {% ifversion copilot-chat-ghas-alerts %} -With a {% data variables.copilot.copilot_enterprise %} license, you can also ask {% data variables.copilot.copilot_chat %} for help to better understand {% data variables.product.prodname_dependabot_alerts %} in repositories in your organization. For more information, see [AUTOTITLE](/copilot/using-github-copilot/asking-github-copilot-questions-in-githubcom#asking-questions-about-alerts-from-github-advanced-security-features). +With a {% data variables.copilot.copilot_enterprise %} license, you can also ask {% data variables.copilot.copilot_chat %} for help to better understand {% data variables.product.prodname_dependabot_alerts %} in repositories in your organization. For more information, see [AUTOTITLE](/copilot/how-tos/copilot-on-github/chat-with-copilot/chat-in-github#asking-questions-about-alerts-from-github-advanced-security-features). {% endif %} @@ -110,7 +110,7 @@ You can review the details of a {% data variables.product.prodname_dependabot %} 1. Optionally, if you do not use {% data variables.product.prodname_dependabot_security_updates %}, you can use the information on the page to decide which version of the dependency to upgrade to and create a pull request to update the dependency to a secure version. 1. When you're ready to update your dependency and resolve the vulnerability, merge the pull request. - Each pull request raised by {% data variables.product.prodname_dependabot %} includes information on commands you can use to control {% data variables.product.prodname_dependabot %}. For more information, see [AUTOTITLE](/code-security/dependabot/working-with-dependabot/managing-pull-requests-for-dependency-updates#managing-dependabot-pull-requests-with-comment-commands). + Each pull request raised by {% data variables.product.prodname_dependabot %} includes information on commands you can use to control {% data variables.product.prodname_dependabot %}. For more information, see [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/manage-dependabot-prs#managing-dependabot-pull-requests-with-comment-commands). ## Dismissing {% data variables.product.prodname_dependabot_alerts %} diff --git a/content/code-security/how-tos/manage-security-alerts/manage-secret-scanning-alerts/enable-delegated-dismissal.md b/content/code-security/how-tos/manage-security-alerts/manage-secret-scanning-alerts/enable-delegated-dismissal.md index 30486a360d42..9999d44f3d54 100644 --- a/content/code-security/how-tos/manage-security-alerts/manage-secret-scanning-alerts/enable-delegated-dismissal.md +++ b/content/code-security/how-tos/manage-security-alerts/manage-secret-scanning-alerts/enable-delegated-dismissal.md @@ -34,9 +34,9 @@ You must configure delegated dismissal for your organization using a custom secu {% data reusables.security-configurations.custom-security-configurations-org %} 1. When defining the custom security configuration, under "{% data variables.product.prodname_secret_scanning_caps %}", ensure that the dropdown menu for "Prevent direct alert dismissals" is set to **Enabled**. 1. Click **Save configuration**. -1. Apply the security configuration to all (or selected) repositories in your organization. See [AUTOTITLE](/code-security/securing-your-organization/enabling-security-features-in-your-organization/applying-a-custom-security-configuration). +1. Apply the security configuration to all (or selected) repositories in your organization. See [AUTOTITLE](/code-security/how-tos/secure-at-scale/configure-organization-security/establish-complete-coverage/apply-custom-configuration). -To learn more about security configurations, see [AUTOTITLE](/code-security/securing-your-organization/introduction-to-securing-your-organization-at-scale/about-enabling-security-features-at-scale). +To learn more about security configurations, see [AUTOTITLE](/code-security/concepts/security-at-scale/organization-security). >[!NOTE] > You can use {% data variables.product.prodname_github_apps %} with fine-grained permissions to programmatically review and approve delegated dismissal requests. This enables your organization to streamline security request reviews and enforce policies, or integrate with external security tools, ensuring that all reviews meet established standards. _For {% data variables.product.prodname_ghe_server %}, the use of {% data variables.product.prodname_github_apps %} to review requests for delegated dismissals is available from version 3.19._ @@ -49,10 +49,10 @@ To learn more about security configurations, see [AUTOTITLE](/code-security/secu {% data reusables.security-configurations.custom-security-configurations-enterprise %} 1. When defining the custom security configuration, under "{% data variables.product.prodname_secret_protection %}", ensure that the dropdown menu for "Prevent direct alert dismissals" is set to **Enabled**. 1. Click **Save configuration**. -1. Apply the security configuration to all (or selected) repositories in your enterprise. See [AUTOTITLE](/admin/managing-code-security/securing-your-enterprise/applying-a-custom-security-configuration-to-your-enterprise). +1. Apply the security configuration to all (or selected) repositories in your enterprise. See [AUTOTITLE](/code-security/how-tos/secure-at-scale/configure-enterprise-security/establish-complete-coverage/apply-custom-configuration). {% endif %} ## Next steps -Now that you have enabled delegated alert dismissal for {% data variables.product.prodname_secret_scanning %}, you should regularly review alert dismissal requests to maintain an accurate alert count and unblock your developers. See [AUTOTITLE](/code-security/security-overview/review-alert-dismissal-requests). +Now that you have enabled delegated alert dismissal for {% data variables.product.prodname_secret_scanning %}, you should regularly review alert dismissal requests to maintain an accurate alert count and unblock your developers. See [AUTOTITLE](/code-security/how-tos/manage-security-alerts/remediate-alerts-at-scale/review-alert-dismissal-requests). diff --git a/content/code-security/how-tos/manage-security-alerts/manage-secret-scanning-alerts/resolving-alerts.md b/content/code-security/how-tos/manage-security-alerts/manage-secret-scanning-alerts/resolving-alerts.md index 6456f5cf4609..1db51a08b1ea 100644 --- a/content/code-security/how-tos/manage-security-alerts/manage-secret-scanning-alerts/resolving-alerts.md +++ b/content/code-security/how-tos/manage-security-alerts/manage-secret-scanning-alerts/resolving-alerts.md @@ -19,9 +19,9 @@ category: Once a secret has been committed to a repository, you should consider the secret compromised. {% data variables.product.github %} recommends the following actions for compromised secrets: -1. Verify that the secret committed to {% data variables.product.github %} is valid. {% ifversion fpt or ghec %}**Applies to {% data variables.product.github %} tokens only**. See [Checking a secret's validity](/code-security/secret-scanning/managing-alerts-from-secret-scanning/evaluating-alerts#checking-a-secrets-validity) and [Performing an on-demand validity check](/code-security/secret-scanning/managing-alerts-from-secret-scanning/evaluating-alerts#performing-an-on-demand-validity-check).{% endif %}{% ifversion secret-scanning-report-secret-github-pat %} +1. Verify that the secret committed to {% data variables.product.github %} is valid. {% ifversion fpt or ghec %}**Applies to {% data variables.product.github %} tokens only**. See [Checking a secret's validity](/code-security/tutorials/remediate-leaked-secrets/evaluating-alerts#checking-a-secrets-validity) and [Performing an on-demand validity check](/code-security/tutorials/remediate-leaked-secrets/evaluating-alerts#performing-an-on-demand-validity-check).{% endif %}{% ifversion secret-scanning-report-secret-github-pat %} 1. For secrets detected in private repositories, report the leaked secret to {% data variables.product.github %}, who will treat it like any publicly leaked secret and revoke it. **Applies to active or unconfirmed {% data variables.product.github %} {% data variables.product.pat_generic %}s only**. See [Reporting a leaked secret in a private repository](#reporting-a-leaked-secret-in-a-private-repository). {% endif %} -1. Review and update any services that use the old token. For {% data variables.product.github %} {% data variables.product.pat_generic %}s, delete the compromised token and create a new token. See [AUTOTITLE](/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token). +1. Review and update any services that use the old token. For {% data variables.product.github %} {% data variables.product.pat_generic %}s, delete the compromised token and create a new token. See [AUTOTITLE](/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens). 1. Depending on the secret provider, check your security logs for any unauthorized activity. {% ifversion secret-scanning-report-secret-github-pat %} @@ -61,4 +61,4 @@ Once a secret has been committed to a repository, you should consider the secret ## Next steps -* [AUTOTITLE](/code-security/secret-scanning/managing-alerts-from-secret-scanning/monitoring-alerts) +* [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-secret-scanning-alerts/monitoring-alerts) diff --git a/content/code-security/how-tos/manage-security-alerts/manage-secret-scanning-alerts/viewing-alerts.md b/content/code-security/how-tos/manage-security-alerts/manage-secret-scanning-alerts/viewing-alerts.md index 42c13bf08d91..f27c236e6397 100644 --- a/content/code-security/how-tos/manage-security-alerts/manage-secret-scanning-alerts/viewing-alerts.md +++ b/content/code-security/how-tos/manage-security-alerts/manage-secret-scanning-alerts/viewing-alerts.md @@ -40,14 +40,14 @@ You can apply various filters to the alerts list to help you find the alerts you |Qualifier|Description| |---------|-----------| -|`bypassed`|Display alerts for secrets where push protection has been bypassed (`true`). For more information, see [AUTOTITLE](/code-security/concepts/secret-security/about-push-protection).| +|`bypassed`|Display alerts for secrets where push protection has been bypassed (`true`). For more information, see [AUTOTITLE](/code-security/concepts/secret-security/push-protection).| |`is`|Display alerts that are open (`open`), closed (`closed`), found in a public repository (`publicly-leaked`), or found in more than one repository within the same organization or enterprise (`multi-repository`). | |`props`|Display alerts for repositories with a specific custom property (`CUSTOM_PROPERTY_NAME`) set. For example, `props:data_sensitivity:high` display results for repositories with the `data_sensitivity` property set to the value `high`. | |`provider`|Display alerts for a specific provider (`PROVIDER-NAME`), for example, `provider:github`. For a list of supported partners, see [AUTOTITLE](/code-security/reference/secret-security/supported-secret-scanning-patterns#supported-secrets).| |`repo`|Display alerts detected in a specified repository (`REPOSITORY-NAME`), for example: `repo:octo-repository`.| |`resolution`|Display alerts closed as "false positive" (`false-positive`), "hidden by config" (`hidden-by-config`), "pattern deleted" (`pattern-deleted`), "pattern edited" (`pattern-edited`), "revoked" (`revoked`), "used in tests" (`used-in-tests`), or "won't fix" (`wont-fix`).| |{% ifversion fpt or ghec %}| -|`results`|Display alerts for supported secrets and custom patterns (`default`), or for generic patterns (`generic`) such as private keys, and AI-detected generic secrets such as passwords. See [AUTOTITLE](/code-security/reference/secret-security/supported-secret-scanning-patterns), and for more information about AI-detected generic secrets, see [AUTOTITLE](/code-security/secret-scanning/copilot-secret-scanning/responsible-ai-generic-secrets).| +|`results`|Display alerts for supported secrets and custom patterns (`default`), or for generic patterns (`generic`) such as private keys, and AI-detected generic secrets such as passwords. See [AUTOTITLE](/code-security/reference/secret-security/supported-secret-scanning-patterns), and for more information about AI-detected generic secrets, see [AUTOTITLE](/code-security/responsible-use/security-and-quality-ai-features).| |{% elsif ghes %}| |`results`|Display alerts for supported secrets and custom patterns (`default`), or generic patterns such as private keys (`generic`). See [AUTOTITLE](/code-security/reference/secret-security/supported-secret-scanning-patterns).| |{% endif %}| diff --git a/content/code-security/how-tos/manage-security-alerts/remediate-alerts-at-scale/creating-managing-security-campaigns.md b/content/code-security/how-tos/manage-security-alerts/remediate-alerts-at-scale/creating-managing-security-campaigns.md index d5b944a03f41..ff678d0d03ff 100644 --- a/content/code-security/how-tos/manage-security-alerts/remediate-alerts-at-scale/creating-managing-security-campaigns.md +++ b/content/code-security/how-tos/manage-security-alerts/remediate-alerts-at-scale/creating-managing-security-campaigns.md @@ -76,7 +76,7 @@ Additional default filters for {% data variables.product.prodname_code_scanning * `autofilter:true` includes only alerts that appear to be in application code. {% ifversion security-campaigns-autofix %} * `autofix:supported` includes only alerts that are for rules that are supported for {% data variables.copilot.copilot_autofix %}.{% endif %} -For more information about filtering alerts, see [AUTOTITLE](/code-security/securing-your-organization/fixing-security-alerts-at-scale/best-practice-fix-alerts-at-scale#selecting-security-alerts-for-remediation) and [AUTOTITLE](/code-security/security-overview/filtering-alerts-in-security-overview). +For more information about filtering alerts, see [AUTOTITLE](/code-security/tutorials/secure-your-organization/best-practice-fix-alerts-at-scale#selecting-security-alerts-for-remediation) and [AUTOTITLE](/code-security/how-tos/manage-security-alerts/remediate-alerts-at-scale/filtering-alerts-in-security-overview). {% ifversion security-campaigns-secrets %} @@ -86,7 +86,7 @@ For more information about filtering alerts, see [AUTOTITLE](/code-security/secu In addition to the core filters, you will usually want to add a filter to limit results to a specific rule name, severity, or tag. -* `is:open autofilter:true {% ifversion security-campaigns-autofix %}autofix:supported {% endif %}rule:java/log-injection` to show only alerts for log injection in Java code. See [AUTOTITLE](/code-security/code-scanning/reference/code-ql-built-in-queries). +* `is:open autofilter:true {% ifversion security-campaigns-autofix %}autofix:supported {% endif %}rule:java/log-injection` to show only alerts for log injection in Java code. See [AUTOTITLE](/code-security/reference/code-scanning/codeql/codeql-queries). * `is:open autofilter:true {% ifversion security-campaigns-autofix %}autofix:supported {% endif %}tag:external/cwe/cwe-117` to show only alerts for "CWE 117: Improper Output Neutralization for Logs". This includes log injection in Java and other languages. * `is:open autofilter:true {% ifversion security-campaigns-autofix %}autofix:supported {% endif %}severity:critical` to show only alerts with a security severity of critical. @@ -97,7 +97,7 @@ In addition to the core filters, you will usually want to add a filter to limit In addition to the core filters, you will usually want to add a filter to limit results to a specific provider, secret type, or secrets that bypassed push protection (enterprise accounts only). * `is:open provider:azure` to show only alerts for the token provider Azure. -* `is:open secret-type:azure_ai_services_key,azure_cognitive_services_key` to show only alerts for the tokens "azure_ai_services_key" and "azure_cognitive_services_key". See [AUTOTITLE](/code-security/secret-scanning/introduction/supported-secret-scanning-patterns#supported-secrets). +* `is:open secret-type:azure_ai_services_key,azure_cognitive_services_key` to show only alerts for the tokens "azure_ai_services_key" and "azure_cognitive_services_key". See [AUTOTITLE](/code-security/reference/secret-security/supported-secret-scanning-patterns#supported-secrets). * `is:open props.BusinessPriority:Urgent` to show only alerts for repositories where the custom property "BusinessPriority" has the value "Urgent". See [AUTOTITLE](/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization). {% endif %} @@ -121,7 +121,7 @@ The new campaign is shown in the sidebar of the **{% data variables.product.prod {% ifversion code-secret-alert-assignees %} > [!TIP] -> You can assign a campaign alert to anyone with **write** access to the repository, see [Assigning alerts](/code-security/securing-your-organization/fixing-security-alerts-at-scale/about-security-campaigns#assigning-alerts). +> You can assign a campaign alert to anyone with **write** access to the repository, see [Assigning alerts](/code-security/concepts/security-at-scale/about-security-campaigns#assigning-alerts). {% endif %} {% else %} @@ -130,11 +130,11 @@ When a campaign is started, anyone with **write** access to a repository include {% endif %} -For more information about the developer experience, see [AUTOTITLE](/code-security/code-scanning/managing-code-scanning-alerts/fixing-alerts-in-security-campaign). +For more information about the developer experience, see [AUTOTITLE](/code-security/how-tos/manage-security-alerts/remediate-alerts-at-scale/fixing-alerts-in-security-campaign). ### How to increase engagement with the security campaign -The best way to increase engagement with a campaign is to publicize it to the teams you want to collaborate with to remediate alerts. For example, you might work with engineering managers to choose a quieter development period to run a series of security campaigns, each focused on a different type of alert, with associated training sessions. For more ideas, see [AUTOTITLE](/code-security/securing-your-organization/fixing-security-alerts-at-scale/best-practice-fix-alerts-at-scale). +The best way to increase engagement with a campaign is to publicize it to the teams you want to collaborate with to remediate alerts. For example, you might work with engineering managers to choose a quieter development period to run a series of security campaigns, each focused on a different type of alert, with associated training sessions. For more ideas, see [AUTOTITLE](/code-security/tutorials/secure-your-organization/best-practice-fix-alerts-at-scale). ## Editing security campaign details @@ -179,4 +179,4 @@ If you don't need to retain the campaign or its data, you can delete it. ## Next steps -* [AUTOTITLE](/code-security/securing-your-organization/fixing-security-alerts-at-scale/tracking-security-campaigns) +* [AUTOTITLE](/code-security/how-tos/manage-security-alerts/remediate-alerts-at-scale/tracking-security-campaigns) diff --git a/content/code-security/how-tos/manage-security-alerts/remediate-alerts-at-scale/filtering-alerts-in-security-overview.md b/content/code-security/how-tos/manage-security-alerts/remediate-alerts-at-scale/filtering-alerts-in-security-overview.md index 1cfb9722d266..47ffca2b191b 100644 --- a/content/code-security/how-tos/manage-security-alerts/remediate-alerts-at-scale/filtering-alerts-in-security-overview.md +++ b/content/code-security/how-tos/manage-security-alerts/remediate-alerts-at-scale/filtering-alerts-in-security-overview.md @@ -21,7 +21,7 @@ Security overview can show alerts across many repositories in your organization You can combine multiple filters to narrow your results. For example, you can show only critical {% data variables.product.prodname_dependabot_alerts %} in public repositories owned by a specific team. -For a complete list of available filters, see [AUTOTITLE](/code-security/reference/security-alert-management/available-filters-for-security-overview). +For a complete list of available filters, see [AUTOTITLE](/code-security/reference/security-at-scale/overview-dashboard-filters). > [!NOTE] > {% data reusables.security-overview.information-varies-GHAS %} diff --git a/content/code-security/how-tos/manage-security-alerts/remediate-alerts-at-scale/review-alert-dismissal-requests.md b/content/code-security/how-tos/manage-security-alerts/remediate-alerts-at-scale/review-alert-dismissal-requests.md index 1cdf2e4eeff9..1c8e31d83d25 100644 --- a/content/code-security/how-tos/manage-security-alerts/remediate-alerts-at-scale/review-alert-dismissal-requests.md +++ b/content/code-security/how-tos/manage-security-alerts/remediate-alerts-at-scale/review-alert-dismissal-requests.md @@ -18,9 +18,9 @@ category: ## Prerequisites To receive and manage alert dismissal requests, you need to enable delegated alert dismissal. For an introduction to delegated alert dismissal and enablement instructions for specific features, see: -* [AUTOTITLE](/code-security/code-scanning/managing-your-code-scanning-configuration/enabling-delegated-alert-dismissal-for-code-scanning) -* [AUTOTITLE](/code-security/secret-scanning/using-advanced-secret-scanning-and-push-protection-features/enabling-delegated-alert-dismissal-for-secret-scanning){% ifversion dependabot-delegated-alert-dismissal %} -* [AUTOTITLE](/code-security/dependabot/dependabot-alerts/enable-delegated-alert-dismissal){% endif %} +* [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/enable-delegated-alert-dismissal) +* [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-secret-scanning-alerts/enable-delegated-dismissal){% ifversion dependabot-delegated-alert-dismissal %} +* [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-dependabot-alerts/enable-delegated-alert-dismissal){% endif %} ## Reviewing requests for an organization diff --git a/content/code-security/how-tos/report-and-fix-vulnerabilities/configure-vulnerability-reporting/add-security-policy.md b/content/code-security/how-tos/report-and-fix-vulnerabilities/configure-vulnerability-reporting/add-security-policy.md index c8553b5283bb..0c26339dcd02 100644 --- a/content/code-security/how-tos/report-and-fix-vulnerabilities/configure-vulnerability-reporting/add-security-policy.md +++ b/content/code-security/how-tos/report-and-fix-vulnerabilities/configure-vulnerability-reporting/add-security-policy.md @@ -31,6 +31,6 @@ category: ## Further reading * [AUTOTITLE](/communities/setting-up-your-project-for-healthy-contributions/creating-a-default-community-health-file) -* [AUTOTITLE](/code-security/getting-started/securing-your-repository) +* [AUTOTITLE](/code-security/getting-started/quickstart-for-securing-your-repository) * [AUTOTITLE](/communities/setting-up-your-project-for-healthy-contributions){% ifversion fpt or ghec %} * [{% data variables.product.prodname_security %}]({% data variables.product.prodname_security_link %}){% endif %} diff --git a/content/code-security/how-tos/report-and-fix-vulnerabilities/configure-vulnerability-reporting/configure-for-a-repository.md b/content/code-security/how-tos/report-and-fix-vulnerabilities/configure-vulnerability-reporting/configure-for-a-repository.md index f2b331e36e65..1caa1add20d6 100644 --- a/content/code-security/how-tos/report-and-fix-vulnerabilities/configure-vulnerability-reporting/configure-for-a-repository.md +++ b/content/code-security/how-tos/report-and-fix-vulnerabilities/configure-vulnerability-reporting/configure-for-a-repository.md @@ -15,9 +15,9 @@ category: - Report and disclose vulnerabilities --- -Enabling private vulnerability reporting gives security researchers a secure, structured way to disclose vulnerabilities directly in your repository. Once enabled, researchers can submit reports through without resorting to public disclosure or informal channels. For background on private vulnerability reporting and how it fits into coordinated disclosure, see [AUTOTITLE](/code-security/concepts/vulnerability-reporting-and-management/about-coordinated-disclosure-of-security-vulnerabilities). +Enabling private vulnerability reporting gives security researchers a secure, structured way to disclose vulnerabilities directly in your repository. Once enabled, researchers can submit reports through your repository's private vulnerability reporting form without resorting to public disclosure or informal channels. For background on private vulnerability reporting and how it fits into coordinated disclosure, see [AUTOTITLE](/code-security/concepts/vulnerability-reporting-and-management/coordinated-disclosure). -The instructions in this article refer to enablement at repository level. For information about enabling the feature at organization level, see [AUTOTITLE](/code-security/security-advisories/working-with-repository-security-advisories/configuring-private-vulnerability-reporting-for-an-organization). +The instructions in this article refer to enablement at repository level. For information about enabling the feature at organization level, see [AUTOTITLE](/code-security/how-tos/secure-at-scale/configure-organization-security/establish-complete-coverage/create-custom-configuration). ## Enabling or disabling private vulnerability reporting for a repository diff --git a/content/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/add-collaborators.md b/content/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/add-collaborators.md index 8da2ee8be6a4..1ed18b599131 100644 --- a/content/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/add-collaborators.md +++ b/content/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/add-collaborators.md @@ -20,12 +20,12 @@ category: - Report and disclose vulnerabilities --- -This article applies to repository-level security advisories in a public repository. To edit a global advisory in the {% data variables.product.prodname_advisory_database %}, see [AUTOTITLE](/code-security/security-advisories/working-with-global-security-advisories-from-the-github-advisory-database/editing-security-advisories-in-the-github-advisory-database). +This article applies to repository-level security advisories in a public repository. To edit a global advisory in the {% data variables.product.prodname_advisory_database %}, see [AUTOTITLE](/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/edit-advisory-database). -Collaborators have write permissions to the security advisory. For more information, see [AUTOTITLE](/code-security/security-advisories/working-with-repository-security-advisories/permission-levels-for-repository-security-advisories). +Collaborators have write permissions to the security advisory. For more information, see [AUTOTITLE](/code-security/reference/permissions/repository-security-advisory). > [!NOTE] -> {% data reusables.repositories.security-advisory-collaborators-public-repositories %} For more information about removing a collaborator on a security advisory, see [AUTOTITLE](/code-security/security-advisories/working-with-repository-security-advisories/removing-a-collaborator-from-a-repository-security-advisory). +> {% data reusables.repositories.security-advisory-collaborators-public-repositories %} For more information about removing a collaborator on a security advisory, see [AUTOTITLE](/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/remove-collaborators). {% data reusables.repositories.navigate-to-repo %} {% data reusables.repositories.sidebar-security %} @@ -37,4 +37,4 @@ Collaborators have write permissions to the security advisory. For more informat ## Further reading -* [AUTOTITLE](/code-security/security-advisories/working-with-repository-security-advisories/collaborating-in-a-temporary-private-fork-to-resolve-a-repository-security-vulnerability) +* [AUTOTITLE](/code-security/tutorials/fix-reported-vulnerabilities/collaborate-in-a-fork) diff --git a/content/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/browse-advisory-database.md b/content/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/browse-advisory-database.md index 84d032e5a73e..180398d67d9c 100644 --- a/content/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/browse-advisory-database.md +++ b/content/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/browse-advisory-database.md @@ -36,13 +36,13 @@ You can access any advisory in the {% data variables.product.prodname_advisory_d 1. Click an advisory to view details. By default, you will see {% data variables.product.company_short %}-reviewed advisories for security vulnerabilities. To show malware advisories, use `type:malware` in the search bar. -The database is also accessible using the GraphQL API. By default, queries will return {% data variables.product.company_short %}-reviewed advisories for security vulnerabilities unless you specify `type:malware`. For more information, see the [AUTOTITLE](/webhooks-and-events/webhooks/webhook-events-and-payloads#security_advisory). +The database is also accessible using the GraphQL API. By default, queries will return {% data variables.product.company_short %}-reviewed advisories for security vulnerabilities unless you specify `type:malware`. For more information, see the [AUTOTITLE](/webhooks/webhook-events-and-payloads#security_advisory). Additionally, you can access the {% data variables.product.prodname_advisory_database %} using the REST API. For more information, see [AUTOTITLE](/rest/security-advisories/global-advisories). ## Editing an advisory in the {% data variables.product.prodname_advisory_database %} -You can suggest improvements to any advisory in the {% data variables.product.prodname_advisory_database %}. For more information, see [AUTOTITLE](/code-security/security-advisories/working-with-global-security-advisories-from-the-github-advisory-database/editing-security-advisories-in-the-github-advisory-database). +You can suggest improvements to any advisory in the {% data variables.product.prodname_advisory_database %}. For more information, see [AUTOTITLE](/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/edit-advisory-database). ## Searching the {% data variables.product.prodname_advisory_database %} @@ -72,11 +72,11 @@ You can search the database, and use qualifiers to narrow your search. For examp | `created:YYYY-MM-DD`| [`created:2021-01-13`](https://github.com/advisories?utf8=%E2%9C%93&query=created%3A2021-01-13) will show only advisories created on this date. | | `updated:YYYY-MM-DD`| [`updated:2021-01-13`](https://github.com/advisories?utf8=%E2%9C%93&query=updated%3A2021-01-13) will show only advisories updated on this date. | -A `GHSA-ID` qualifier is a unique ID that we at {% data variables.product.prodname_dotcom %} automatically assign to every advisory in the {% data variables.product.prodname_advisory_database %}. For more information about these identifiers, see [About the {% data variables.product.prodname_advisory_database %}](/code-security/security-advisories/working-with-global-security-advisories-from-the-github-advisory-database/about-the-github-advisory-database#about-ghsa-ids). +A `GHSA-ID` qualifier is a unique ID that we at {% data variables.product.prodname_dotcom %} automatically assign to every advisory in the {% data variables.product.prodname_advisory_database %}. For more information about these identifiers, see [About the {% data variables.product.prodname_advisory_database %}](/code-security/concepts/vulnerability-reporting-and-management/github-advisory-database#about-ghsa-ids). ## Viewing your vulnerable repositories -For any {% data variables.product.company_short %}-reviewed advisory in the {% data variables.product.prodname_advisory_database %}, you can see which of your repositories are affected by that security vulnerability or malware. To see a vulnerable repository, you must have access to {% data variables.product.prodname_dependabot_alerts %} for that repository. For more information, see [AUTOTITLE](/code-security/dependabot/dependabot-alerts/about-dependabot-alerts#access-to-dependabot-alerts). +For any {% data variables.product.company_short %}-reviewed advisory in the {% data variables.product.prodname_advisory_database %}, you can see which of your repositories are affected by that security vulnerability or malware. To see a vulnerable repository, you must have access to {% data variables.product.prodname_dependabot_alerts %} for that repository. For more information, see [AUTOTITLE](/code-security/concepts/supply-chain-security/dependabot-alerts#access-to-dependabot-alerts). 1. Navigate to [https://github.com/advisories](https://github.com/advisories?ref_product=security-advisories&ref_type=engagement&ref_style=text). 1. Click an advisory. @@ -89,7 +89,7 @@ For any {% data variables.product.company_short %}-reviewed advisory in the {% d ## Accessing the local advisory database on {% data variables.product.prodname_ghe_server %} -If your site administrator has enabled {% data variables.product.prodname_github_connect %} for your instance, you can also browse reviewed advisories locally. For more information, see [AUTOTITLE](/admin/configuration/configuring-github-connect/about-github-connect). +If your site administrator has enabled {% data variables.product.prodname_github_connect %} for your instance, you can also browse reviewed advisories locally. For more information, see [AUTOTITLE](/admin/configuring-settings/configuring-github-connect/about-github-connect). You can use your local advisory database to check whether a specific security vulnerability is included, and therefore whether you'd get alerts for vulnerable dependencies. You can also view any vulnerable repositories. @@ -101,13 +101,13 @@ You can use your local advisory database to check whether a specific security vu 1. Click an advisory to view details. By default, you will see {% data variables.product.company_short %}-reviewed advisories for security vulnerabilities. To show malware advisories, use `type:malware` in the search bar. -You can also suggest improvements to any advisory directly from your local advisory database. For more information, see [AUTOTITLE](/code-security/security-advisories/working-with-global-security-advisories-from-the-github-advisory-database/editing-security-advisories-in-the-github-advisory-database#editing-advisories-from-your-github-enterprise-server-instance). +You can also suggest improvements to any advisory directly from your local advisory database. For more information, see [AUTOTITLE](/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/edit-advisory-database#editing-advisories-from-your-github-enterprise-server-instance). ### Viewing vulnerable repositories for your instance {% data reusables.repositories.enable-security-alerts %} -In the local advisory database, you can see which repositories are affected by each security vulnerability or malware. To see a vulnerable repository, you must have access to {% data variables.product.prodname_dependabot_alerts %} for that repository. For more information, see [AUTOTITLE](/code-security/dependabot/dependabot-alerts/about-dependabot-alerts#access-to-dependabot-alerts). +In the local advisory database, you can see which repositories are affected by each security vulnerability or malware. To see a vulnerable repository, you must have access to {% data variables.product.prodname_dependabot_alerts %} for that repository. For more information, see [AUTOTITLE](/code-security/concepts/supply-chain-security/dependabot-alerts#access-to-dependabot-alerts). 1. Navigate to `https://HOSTNAME/advisories`. 1. Click an advisory. diff --git a/content/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/create-repository-advisory.md b/content/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/create-repository-advisory.md index 3079fdaceb08..cb2bfc6fe1bb 100644 --- a/content/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/create-repository-advisory.md +++ b/content/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/create-repository-advisory.md @@ -79,7 +79,7 @@ If someone accepts credit, the person's username appears in the "Credits" sectio ## Next steps * Comment on the draft security advisory to discuss the vulnerability with your team. -* Add collaborators to the security advisory. For more information, see [AUTOTITLE](/code-security/security-advisories/working-with-repository-security-advisories/adding-a-collaborator-to-a-repository-security-advisory). -* Privately collaborate to fix the vulnerability in a temporary private fork. For more information, see [AUTOTITLE](/code-security/security-advisories/working-with-repository-security-advisories/collaborating-in-a-temporary-private-fork-to-resolve-a-repository-security-vulnerability). -* Add individuals who should receive credit for contributing to the security advisory. For more information, see [AUTOTITLE](/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory#about-credits-for-security-advisories). -* Publish the security advisory to notify your community of the security vulnerability. For more information, see [AUTOTITLE](/code-security/security-advisories/working-with-repository-security-advisories/publishing-a-repository-security-advisory). +* Add collaborators to the security advisory. For more information, see [AUTOTITLE](/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/add-collaborators). +* Privately collaborate to fix the vulnerability in a temporary private fork. For more information, see [AUTOTITLE](/code-security/tutorials/fix-reported-vulnerabilities/collaborate-in-a-fork). +* Add individuals who should receive credit for contributing to the security advisory. For more information, see [AUTOTITLE](/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/edit-repository-advisories#about-credits-for-security-advisories). +* Publish the security advisory to notify your community of the security vulnerability. For more information, see [AUTOTITLE](/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/publish-repository-advisory). diff --git a/content/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/delete-repository-advisories.md b/content/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/delete-repository-advisories.md index d64a41da3c50..f08818b9ad35 100644 --- a/content/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/delete-repository-advisories.md +++ b/content/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/delete-repository-advisories.md @@ -25,4 +25,4 @@ If you publish a security advisory in error, you can delete the security advisor ## Further reading -* [AUTOTITLE](/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory) +* [AUTOTITLE](/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/edit-repository-advisories) diff --git a/content/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/edit-advisory-database.md b/content/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/edit-advisory-database.md index 959c89376aa4..98e895bb4299 100644 --- a/content/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/edit-advisory-database.md +++ b/content/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/edit-advisory-database.md @@ -28,7 +28,7 @@ category: 1. Navigate to [https://github.com/advisories](https://github.com/advisories?ref_product=security-advisories&ref_type=engagement&ref_style=text). 1. Select the security advisory you would like to contribute to. 1. On the right-hand side of the page, click the **Suggest improvements for this vulnerability** link. -1. In the "Improve security advisory" form, make the desired improvements. You can edit or add any detail.{% ifversion fpt or ghec %} For information about correctly specifying information on the form, including affected versions, see [AUTOTITLE](/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/best-practices-for-writing-repository-security-advisories).{% endif %} +1. In the "Improve security advisory" form, make the desired improvements. You can edit or add any detail.{% ifversion fpt or ghec %} For information about correctly specifying information on the form, including affected versions, see [AUTOTITLE](/code-security/tutorials/fix-reported-vulnerabilities/write-security-advisories).{% endif %} 1. Under **Reason for change**, explain why you want to make this improvement. If you include links to supporting material this will help our reviewers. 1. When you finish editing the advisory, click **Submit improvements**. 1. Once you submit your community contribution, a pull request containing your changes will be created for review in [github/advisory-database](https://github.com/github/advisory-database) by the {% data variables.product.prodname_security %} curation team. If the advisory originated from a {% data variables.product.prodname_dotcom %} repository, we will also tag the original publisher for optional commentary. You can view the pull request and get notifications when it is updated or closed. diff --git a/content/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/edit-repository-advisories.md b/content/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/edit-repository-advisories.md index 2bdb9df52af7..7b4571ae560b 100644 --- a/content/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/edit-repository-advisories.md +++ b/content/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/edit-repository-advisories.md @@ -38,7 +38,7 @@ You can also use the REST API to edit repository security advisories. For more i {% data reusables.repositories.security-advisory-edit-cwe %} 1. Optionally, under "Credits", remove existing credits, or use the search box to find additional people you want to credit on the security advisory, then click their username to add them. {% ifversion security-advisories-credit-types %} - * Use the dropdown menu next to the name of the person you're crediting to assign a credit type. For more information about credit types, see [AUTOTITLE](/code-security/security-advisories/working-with-repository-security-advisories/creating-a-repository-security-advisory#about-credits-for-repository-security-advisories). + * Use the dropdown menu next to the name of the person you're crediting to assign a credit type. For more information about credit types, see [AUTOTITLE](/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/create-repository-advisory#about-credits-for-repository-security-advisories). ![Screenshot of a draft security advisory. A dropdown menu, labeled "Choose a credit type," is highlighted with an orange outline.](/assets/images/help/security/security-advisories-choose-credit-type.png) @@ -49,4 +49,4 @@ You can also use the REST API to edit repository security advisories. For more i ## Further reading -* [AUTOTITLE](/code-security/security-advisories/working-with-repository-security-advisories/deleting-a-repository-security-advisory) +* [AUTOTITLE](/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/delete-repository-advisories) diff --git a/content/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/manage-vulnerability-reports.md b/content/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/manage-vulnerability-reports.md index 5ea71c570460..5e916e691d6a 100644 --- a/content/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/manage-vulnerability-reports.md +++ b/content/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/manage-vulnerability-reports.md @@ -19,7 +19,7 @@ When a security researcher reports a vulnerability privately, you are notified a {% data reusables.security-advisory.private-vulnerability-reporting-configure-notifications %} -For more information about configuring notification preferences, see [AUTOTITLE](/code-security/security-advisories/working-with-repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository#configuring-notifications-for-private-vulnerability-reporting). +For more information about configuring notification preferences, see [AUTOTITLE](/code-security/how-tos/report-and-fix-vulnerabilities/configure-vulnerability-reporting/configure-for-a-repository#configuring-notifications-for-private-vulnerability-reporting). {% data reusables.repositories.navigate-to-repo %} {% data reusables.repositories.sidebar-security %} @@ -33,7 +33,7 @@ For more information about configuring notification preferences, see [AUTOTITLE] * To accept the reported vulnerability, click **Accept and open as draft** to accept the vulnerability report as a draft advisory on {% data variables.product.prodname_dotcom %}. If you choose this option: * This doesn't make the report public. * The report becomes a draft repository security advisory and you can work on it in the same way as any draft advisory that you create. - For more information on security advisories, see [AUTOTITLE](/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories). + For more information on security advisories, see [AUTOTITLE](/code-security/concepts/vulnerability-reporting-and-management/repository-security-advisories). * To ask for more information, or to open a discussion with the reporter, you can comment on the advisory. Any comments are visible only to the reporter and to any collaborators on the advisory. * If you have enough information to determine that the problem the reporter describes is not a security risk, click **Close security advisory**. Where possible, you should add a comment explaining why you don't consider the report a security risk before you close the advisory. diff --git a/content/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/publish-repository-advisory.md b/content/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/publish-repository-advisory.md index 1567e7d4f4ab..2c95c8fa49cc 100644 --- a/content/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/publish-repository-advisory.md +++ b/content/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/publish-repository-advisory.md @@ -25,7 +25,7 @@ category: ## Prerequisites -Before you can publish a security advisory or request a CVE identification number, you must create a draft security advisory and provide information about the versions of your project affected by the security vulnerability. See [AUTOTITLE](/code-security/security-advisories/working-with-repository-security-advisories/creating-a-repository-security-advisory) and [AUTOTITLE](/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory). +Before you can publish a security advisory or request a CVE identification number, you must create a draft security advisory and provide information about the versions of your project affected by the security vulnerability. See [AUTOTITLE](/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/create-repository-advisory) and [AUTOTITLE](/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/edit-repository-advisories). ## Publishing a security advisory @@ -58,4 +58,4 @@ If you don't already have a CVE identification number for a security vulnerabili ## Further reading -* [AUTOTITLE](/code-security/security-advisories/working-with-repository-security-advisories/deleting-a-repository-security-advisory) +* [AUTOTITLE](/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/delete-repository-advisories) diff --git a/content/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/remove-collaborators.md b/content/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/remove-collaborators.md index 1340bb1b7f58..977d6321a6b7 100644 --- a/content/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/remove-collaborators.md +++ b/content/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/remove-collaborators.md @@ -35,5 +35,5 @@ category: ## Further reading -* [AUTOTITLE](/code-security/security-advisories/working-with-repository-security-advisories/permission-levels-for-repository-security-advisories) -* [AUTOTITLE](/code-security/security-advisories/working-with-repository-security-advisories/adding-a-collaborator-to-a-repository-security-advisory) +* [AUTOTITLE](/code-security/reference/permissions/repository-security-advisory) +* [AUTOTITLE](/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/add-collaborators) diff --git a/content/code-security/how-tos/report-and-fix-vulnerabilities/report-privately.md b/content/code-security/how-tos/report-and-fix-vulnerabilities/report-privately.md index e0f5a6e93c15..fdf947b2f880 100644 --- a/content/code-security/how-tos/report-and-fix-vulnerabilities/report-privately.md +++ b/content/code-security/how-tos/report-and-fix-vulnerabilities/report-privately.md @@ -23,13 +23,13 @@ category: {% data reusables.security-advisory.private-vulnerability-reporting-enable %} > [!NOTE] -> * If you have admin or security permissions for a public repository, you don’t need to submit a vulnerability report. Instead, create a draft security advisory directly. See [AUTOTITLE](/code-security/security-advisories/working-with-repository-security-advisories/creating-a-repository-security-advisory). +> * If you have admin or security permissions for a public repository, you don’t need to submit a vulnerability report. Instead, create a draft security advisory directly. See [AUTOTITLE](/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/create-repository-advisory). > * Private vulnerability reporting is separate from a repository’s `SECURITY.md` file. You can only report vulnerabilities privately for repositories where this feature is enabled, and you don’t need to follow the instructions in `SECURITY.md`. If a public repository has private vulnerability reporting enabled, anyone can submit a private vulnerability report to the repository maintainers. -If the repository doesn't have private vulnerability reporting enabled, you need to initiate the reporting process by following the instructions in the security policy for the repository, or by creating an issue asking the maintainers for a preferred security contact. See [AUTOTITLE](/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/about-coordinated-disclosure-of-security-vulnerabilities#about-reporting-and-disclosing-vulnerabilities-in-projects-on-github). +If the repository doesn't have private vulnerability reporting enabled, you need to initiate the reporting process by following the instructions in the security policy for the repository, or by creating an issue asking the maintainers for a preferred security contact. See [AUTOTITLE](/code-security/concepts/vulnerability-reporting-and-management/coordinated-disclosure#about-reporting-and-disclosing-vulnerabilities-in-projects-on-github). {% data reusables.security-advisory.reporting-a-vulnerability-non-admin %} -The next steps depend on the action taken by the repository maintainer. See [AUTOTITLE](/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/managing-privately-reported-security-vulnerabilities). +The next steps depend on the action taken by the repository maintainer. See [AUTOTITLE](/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/manage-vulnerability-reports). diff --git a/content/code-security/how-tos/secure-at-scale/configure-enterprise-security/configure-specific-tools/allow-github-code-quality-in-enterprise.md b/content/code-security/how-tos/secure-at-scale/configure-enterprise-security/configure-specific-tools/allow-github-code-quality-in-enterprise.md index b403982e482c..a35701e125e7 100644 --- a/content/code-security/how-tos/secure-at-scale/configure-enterprise-security/configure-specific-tools/allow-github-code-quality-in-enterprise.md +++ b/content/code-security/how-tos/secure-at-scale/configure-enterprise-security/configure-specific-tools/allow-github-code-quality-in-enterprise.md @@ -29,4 +29,4 @@ category: ## Next steps -To see {% data variables.product.prodname_code_quality_short %} in action, turn the feature on for one or more repositories. See [AUTOTITLE](/code-security/code-quality/how-tos/enable-code-quality). +To see {% data variables.product.prodname_code_quality_short %} in action, turn the feature on for one or more repositories. See [AUTOTITLE](/code-security/how-tos/maintain-quality-code/enable-code-quality). diff --git a/content/code-security/how-tos/secure-at-scale/configure-enterprise-security/configure-specific-tools/configure-dependency-review.md b/content/code-security/how-tos/secure-at-scale/configure-enterprise-security/configure-specific-tools/configure-dependency-review.md index ee97fcba5c81..0ff71abf29a8 100644 --- a/content/code-security/how-tos/secure-at-scale/configure-enterprise-security/configure-specific-tools/configure-dependency-review.md +++ b/content/code-security/how-tos/secure-at-scale/configure-enterprise-security/configure-specific-tools/configure-dependency-review.md @@ -26,17 +26,17 @@ Some additional features, such as license checks, blocking of pull requests, and ## Prerequisites for dependency review -* A license for {% data variables.product.prodname_GH_code_security %} or {% data variables.product.prodname_GHAS %} (see [AUTOTITLE](/billing/managing-billing-for-your-products/managing-billing-for-github-advanced-security/about-billing-for-github-advanced-security)). +* A license for {% data variables.product.prodname_GH_code_security %} or {% data variables.product.prodname_GHAS %} (see [AUTOTITLE](/billing/concepts/product-billing/github-advanced-security)). -* The dependency graph enabled for the instance. Site administrators can enable the dependency graph via the management console or the administrative shell (see [AUTOTITLE](/admin/code-security/managing-supply-chain-security-for-your-enterprise/enabling-the-dependency-graph-for-your-enterprise)). +* The dependency graph enabled for the instance. Site administrators can enable the dependency graph via the management console or the administrative shell (see [AUTOTITLE](/code-security/how-tos/secure-at-scale/configure-enterprise-security/configure-specific-tools/enable-dependency-graph)). -* {% data variables.product.prodname_github_connect %} enabled to download and synchronize vulnerabilities from the {% data variables.product.prodname_advisory_database %}. This is usually configured as part of setting up {% data variables.product.prodname_dependabot %} (see [AUTOTITLE](/admin/configuration/configuring-github-connect/enabling-dependabot-for-your-enterprise)). +* {% data variables.product.prodname_github_connect %} enabled to download and synchronize vulnerabilities from the {% data variables.product.prodname_advisory_database %}. This is usually configured as part of setting up {% data variables.product.prodname_dependabot %} (see [AUTOTITLE](/admin/configuring-settings/configuring-github-connect/enabling-dependabot-for-your-enterprise)). ## Enabling and disabling dependency review To enable or disable dependency review, you need to enable or disable the dependency graph for your instance. -For more information, see [AUTOTITLE](/admin/code-security/managing-supply-chain-security-for-your-enterprise/enabling-the-dependency-graph-for-your-enterprise). +For more information, see [AUTOTITLE](/code-security/how-tos/secure-at-scale/configure-enterprise-security/configure-specific-tools/enable-dependency-graph). ## Running dependency review using {% data variables.product.prodname_actions %} @@ -46,4 +46,4 @@ The dependency review action is included in your installation of {% data variabl {% data reusables.dependency-review.dependency-review-action-overview %} -Users run the dependency review action using a {% data variables.product.prodname_actions %} workflow. If you have not already set up runners for {% data variables.product.prodname_actions %}, you must do this to enable users to run workflows. You can provision self-hosted runners at the repository, organization, or enterprise account level. For information, see [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners) and [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners). +Users run the dependency review action using a {% data variables.product.prodname_actions %} workflow. If you have not already set up runners for {% data variables.product.prodname_actions %}, you must do this to enable users to run workflows. You can provision self-hosted runners at the repository, organization, or enterprise account level. For information, see [AUTOTITLE](/actions/concepts/runners/self-hosted-runners) and [AUTOTITLE](/actions/how-tos/manage-runners/self-hosted-runners/add-runners). diff --git a/content/code-security/how-tos/secure-at-scale/configure-enterprise-security/configure-specific-tools/configure-limited-internet-access.md b/content/code-security/how-tos/secure-at-scale/configure-enterprise-security/configure-specific-tools/configure-limited-internet-access.md index 45f188a2164f..4f04f710dd6f 100644 --- a/content/code-security/how-tos/secure-at-scale/configure-enterprise-security/configure-specific-tools/configure-limited-internet-access.md +++ b/content/code-security/how-tos/secure-at-scale/configure-enterprise-security/configure-specific-tools/configure-limited-internet-access.md @@ -16,9 +16,9 @@ category: ## About {% data variables.product.prodname_dependabot %} updates -You can use {% data variables.product.prodname_dependabot_updates %} to fix vulnerabilities and keep dependencies updated to the latest version in {% data variables.product.prodname_ghe_server %}. {% data variables.product.prodname_dependabot_updates %} require {% data variables.product.prodname_actions %} with self-hosted runners set up for {% data variables.product.prodname_dependabot %} to use. {% data variables.product.prodname_dependabot %} alerts and security updates use information from the {% data variables.product.prodname_advisory_database %} accessed using {% data variables.product.prodname_github_connect %}. For more information, see [AUTOTITLE](/admin/github-actions/enabling-github-actions-for-github-enterprise-server/managing-self-hosted-runners-for-dependabot-updates) and [AUTOTITLE](/admin/configuration/configuring-github-connect/enabling-dependabot-for-your-enterprise). +You can use {% data variables.product.prodname_dependabot_updates %} to fix vulnerabilities and keep dependencies updated to the latest version in {% data variables.product.prodname_ghe_server %}. {% data variables.product.prodname_dependabot_updates %} require {% data variables.product.prodname_actions %} with self-hosted runners set up for {% data variables.product.prodname_dependabot %} to use. {% data variables.product.prodname_dependabot %} alerts and security updates use information from the {% data variables.product.prodname_advisory_database %} accessed using {% data variables.product.prodname_github_connect %}. For more information, see [AUTOTITLE](/admin/managing-github-actions-for-your-enterprise/enabling-github-actions-for-github-enterprise-server/managing-self-hosted-runners-for-dependabot-updates) and [AUTOTITLE](/admin/configuring-settings/configuring-github-connect/enabling-dependabot-for-your-enterprise). -{% data reusables.dependabot.private-registry-support %} Alternatively, if your instance has limited or no internet access, you can configure {% data variables.product.prodname_dependabot %} to use only private registries as a source for security and version updates. For information on which ecosystems are supported as private registries, see [AUTOTITLE](/code-security/dependabot/maintain-dependencies/removing-dependabot-access-to-public-registries#about-configuring-dependabot-to-only-access-private-registries). +{% data reusables.dependabot.private-registry-support %} Alternatively, if your instance has limited or no internet access, you can configure {% data variables.product.prodname_dependabot %} to use only private registries as a source for security and version updates. For information on which ecosystems are supported as private registries, see [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/remove-access-to-public-registries#about-configuring-dependabot-to-only-access-private-registries). The instructions below assume that you need to set up {% data variables.product.prodname_dependabot %} runners with the following limitations. * No internet access. @@ -26,7 +26,7 @@ The instructions below assume that you need to set up {% data variables.product. ## Restricting internet access for {% data variables.product.prodname_dependabot %} runners -Before configuring {% data variables.product.prodname_dependabot %}, install Docker on your self-hosted runner. For more information, see [AUTOTITLE](/admin/github-actions/enabling-github-actions-for-github-enterprise-server/managing-self-hosted-runners-for-dependabot-updates#configuring-self-hosted-runners-for-dependabot-updates). +Before configuring {% data variables.product.prodname_dependabot %}, install Docker on your self-hosted runner. For more information, see [AUTOTITLE](/admin/managing-github-actions-for-your-enterprise/enabling-github-actions-for-github-enterprise-server/managing-self-hosted-runners-for-dependabot-updates#configuring-self-hosted-runners-for-dependabot-updates). 1. On {% data variables.product.prodname_ghe_server %}, navigate to the `github/dependabot-action` repository and retrieve information about the `dependabot-updater` and `dependabot-proxy` container images from the `containers.json` file. @@ -45,7 +45,7 @@ Before configuring {% data variables.product.prodname_dependabot %}, install Doc {%- endif %} > [!NOTE] - > You will need to repeat this step when you upgrade to a new minor version of {% data variables.product.prodname_ghe_server %}, or if you manually update the {% data variables.product.prodname_dependabot %} action from {% data variables.product.prodname_dotcom_the_website %}. For more information, see [AUTOTITLE](/admin/github-actions/managing-access-to-actions-from-githubcom/manually-syncing-actions-from-githubcom). + > You will need to repeat this step when you upgrade to a new minor version of {% data variables.product.prodname_ghe_server %}, or if you manually update the {% data variables.product.prodname_dependabot %} action from {% data variables.product.prodname_dotcom_the_website %}. For more information, see [AUTOTITLE](/admin/managing-github-actions-for-your-enterprise/managing-access-to-actions-from-githubcom/manually-syncing-actions-from-githubcom). 1. When you have finished adding these images to the runner, you are ready to restrict internet access to the {% data variables.product.prodname_dependabot %} runner, ensuring that it can still access your private registries for the required ecosystems and for {% data variables.product.prodname_ghe_server %}. @@ -53,7 +53,7 @@ Before configuring {% data variables.product.prodname_dependabot %}, install Doc ## Verifying the configuration of {% data variables.product.prodname_dependabot %} runners -1. For a test repository, configure {% data variables.product.prodname_dependabot %} to access private registries and remove access to public registries. For more information, see [AUTOTITLE](/code-security/dependabot/working-with-dependabot/configuring-access-to-private-registries-for-dependabot) and [AUTOTITLE](/code-security/dependabot/maintain-dependencies/removing-dependabot-access-to-public-registries). +1. For a test repository, configure {% data variables.product.prodname_dependabot %} to access private registries and remove access to public registries. For more information, see [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configure-access-to-private-registries) and [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/remove-access-to-public-registries). 1. In the **Insights** tab for the repository, click **Dependency graph** to display details of the dependencies. 1. Click **{% data variables.product.prodname_dependabot %}** to display the ecosystems configured for version updates. @@ -62,4 +62,4 @@ Before configuring {% data variables.product.prodname_dependabot %}, install Doc When the check for updates is complete, you should check the "Update logs" view to verify that {% data variables.product.prodname_dependabot %} accessed the configured private registries on your instance to check for version updates. -After you have verified that the configuration is correct, ask repository administrators to update their {% data variables.product.prodname_dependabot %} configurations to use private registries only. For more information, see [AUTOTITLE](/code-security/dependabot/maintain-dependencies/removing-dependabot-access-to-public-registries). +After you have verified that the configuration is correct, ask repository administrators to update their {% data variables.product.prodname_dependabot %} configurations to use private registries only. For more information, see [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/remove-access-to-public-registries). diff --git a/content/code-security/how-tos/secure-at-scale/configure-enterprise-security/configure-specific-tools/configure-secret-scanning.md b/content/code-security/how-tos/secure-at-scale/configure-enterprise-security/configure-specific-tools/configure-secret-scanning.md index d9c5c333d6ef..3448ca4bc1cd 100644 --- a/content/code-security/how-tos/secure-at-scale/configure-enterprise-security/configure-specific-tools/configure-secret-scanning.md +++ b/content/code-security/how-tos/secure-at-scale/configure-enterprise-security/configure-specific-tools/configure-secret-scanning.md @@ -17,7 +17,7 @@ category: ## About {% data variables.product.prodname_secret_scanning %} -If someone checks a secret with a known pattern into a repository, {% data variables.product.prodname_secret_scanning %} catches the secret as it's checked in, and helps you mitigate the impact of the leak. Repository administrators are notified about any commit that contains a secret, and they can quickly view all detected secrets in the **{% data variables.product.prodname_security_and_quality_tab %}** tab for the repository. See [AUTOTITLE](/code-security/secret-scanning/introduction/about-secret-scanning). +If someone checks a secret with a known pattern into a repository, {% data variables.product.prodname_secret_scanning %} catches the secret as it's checked in, and helps you mitigate the impact of the leak. Repository administrators are notified about any commit that contains a secret, and they can quickly view all detected secrets in the **{% data variables.product.prodname_security_and_quality_tab %}** tab for the repository. See [AUTOTITLE](/code-security/concepts/secret-security/secret-scanning). ## Availability @@ -30,15 +30,15 @@ When the enterprise has [{% data variables.product.prodname_GH_secret_protection * The SSSE3 (Supplemental Streaming SIMD Extensions 3) CPU flag needs to be enabled on the VM/KVM that runs {% data variables.product.prodname_ghe_server %}. For more information about SSSE3, see [Intel 64 and IA-32 Architectures Optimization Reference Manual](https://cdrdv2-public.intel.com/671488/248966-Software-Optimization-Manual-R047.pdf) in the Intel documentation. -* A license for {% data variables.product.prodname_GH_secret_protection %} or {% data variables.product.prodname_GHAS %} (see [AUTOTITLE](/billing/managing-billing-for-your-products/managing-billing-for-github-advanced-security/about-billing-for-github-advanced-security)) +* A license for {% data variables.product.prodname_GH_secret_protection %} or {% data variables.product.prodname_GHAS %} (see [AUTOTITLE](/billing/concepts/product-billing/github-advanced-security)) -* {% data variables.product.prodname_secret_scanning_caps %} enabled in the management console (see [AUTOTITLE](/admin/code-security/managing-github-advanced-security-for-your-enterprise/enabling-github-advanced-security-for-your-enterprise)) +* {% data variables.product.prodname_secret_scanning_caps %} enabled in the management console (see [AUTOTITLE](/code-security/how-tos/secure-at-scale/configure-enterprise-security/establish-complete-coverage/enabling-github-advanced-security-for-your-enterprise)) ### Checking support for the SSSE3 flag on your vCPUs The SSSE3 set of instructions is required because {% data variables.product.prodname_secret_scanning %} leverages hardware accelerated pattern matching to find potential credentials committed to your {% data variables.product.prodname_dotcom %} repositories. SSSE3 is enabled for most modern CPUs. You can check whether SSSE3 is enabled for the vCPUs available to your {% data variables.product.prodname_ghe_server %} instance. -1. Connect to the administrative shell for your {% data variables.product.prodname_ghe_server %} instance. See [AUTOTITLE](/admin/configuration/configuring-your-enterprise/accessing-the-administrative-shell-ssh). +1. Connect to the administrative shell for your {% data variables.product.prodname_ghe_server %} instance. See [AUTOTITLE](/admin/administering-your-instance/administering-your-instance-from-the-command-line/accessing-the-administrative-shell-ssh). 1. Enter the following command: ```shell @@ -61,9 +61,9 @@ The SSSE3 set of instructions is required because {% data variables.product.prod Optionally, to allow your users to enable validity checks at the enterprise, organization, or repository level, configure validity checks for {% data variables.product.prodname_secret_scanning %}. -1. Click **{% data variables.product.prodname_secret_scanning %} validity checks**. For information about validity checks, see [AUTOTITLE](/code-security/secret-scanning/enabling-secret-scanning-features/enabling-validity-checks-for-your-repository#about-validity-checks). +1. Click **{% data variables.product.prodname_secret_scanning %} validity checks**. For information about validity checks, see [AUTOTITLE](/code-security/how-tos/secure-your-secrets/customize-leak-detection/enable-validity-checks#about-validity-checks). - >[!NOTE] + > [!NOTE] > Enabling validity checks will send outbound requests to partner services to verify detected secrets. This means secret metadata will leave your instance. You need to ensure that this aligns with your enterprise's security and compliance policies before enabling. 1. To run a simple connection test to verify that outbound connections are possible, click **Validity checks connection test**. diff --git a/content/code-security/how-tos/secure-at-scale/configure-enterprise-security/configure-specific-tools/configuring-code-scanning-for-your-appliance.md b/content/code-security/how-tos/secure-at-scale/configure-enterprise-security/configure-specific-tools/configuring-code-scanning-for-your-appliance.md index 32548421635a..483e0a812690 100644 --- a/content/code-security/how-tos/secure-at-scale/configure-enterprise-security/configure-specific-tools/configuring-code-scanning-for-your-appliance.md +++ b/content/code-security/how-tos/secure-at-scale/configure-enterprise-security/configure-specific-tools/configuring-code-scanning-for-your-appliance.md @@ -36,9 +36,9 @@ You can configure {% data variables.product.prodname_code_scanning %} to run {% ## Prerequisites for {% data variables.product.prodname_code_scanning %} -* A license for {% data variables.product.prodname_GH_code_security %} or {% data variables.product.prodname_GHAS %}, (see [AUTOTITLE](/billing/managing-billing-for-your-products/managing-billing-for-github-advanced-security/about-billing-for-github-advanced-security)) +* A license for {% data variables.product.prodname_GH_code_security %} or {% data variables.product.prodname_GHAS %}, (see [AUTOTITLE](/billing/concepts/product-billing/github-advanced-security)) -* {% data variables.product.prodname_code_scanning_caps %} enabled in the management console (see [AUTOTITLE](/admin/code-security/managing-github-advanced-security-for-your-enterprise/enabling-github-advanced-security-for-your-enterprise)) +* {% data variables.product.prodname_code_scanning_caps %} enabled in the management console (see [AUTOTITLE](/code-security/how-tos/secure-at-scale/configure-enterprise-security/establish-complete-coverage/enabling-github-advanced-security-for-your-enterprise)) * A VM or container for {% data variables.product.prodname_code_scanning %} analysis to run in. @@ -55,19 +55,19 @@ You can configure {% data variables.product.prodname_code_scanning %} to run {% ## Provisioning a self-hosted runner > [!NOTE] -> * If your enterprise uses {% data variables.product.prodname_dotcom %}-hosted runners with {% data variables.product.prodname_actions %}, proceed directly to configuring {% data variables.product.prodname_code_scanning %} through {% data variables.product.prodname_dotcom_the_website %}. See [AUTOTITLE](/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning) and [AUTOTITLE](/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale). -> * With the exception of Swift analysis, default setup can now run on {% data variables.actions.hosted_runners %}. See [AUTOTITLE](/actions/using-github-hosted-runners/about-larger-runners/about-larger-runners) and [AUTOTITLE](/code-security/code-scanning/managing-your-code-scanning-configuration/configuring-larger-runners-for-default-setup). +> * If your enterprise uses {% data variables.product.prodname_dotcom %}-hosted runners with {% data variables.product.prodname_actions %}, proceed directly to configuring {% data variables.product.prodname_code_scanning %} through {% data variables.product.prodname_dotcom_the_website %}. See [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/configure-code-scanning/configure-code-scanning) and [AUTOTITLE](/code-security/how-tos/secure-at-scale/configure-organization-security/configure-specific-tools/code-scanning-at-scale). +> * With the exception of Swift analysis, default setup can now run on {% data variables.actions.hosted_runners %}. See [AUTOTITLE](/actions/concepts/runners/larger-runners) and [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/configure-larger-runners). {% endif %} -{% data variables.product.github %} can run {% data variables.product.prodname_code_scanning %} using a {% data variables.product.prodname_actions %} workflow. First, you need to provision one or more self-hosted {% data variables.product.prodname_actions %} runners in your environment. You can provision self-hosted runners at the repository, organization, or enterprise account level. See [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners) and [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners). +{% data variables.product.github %} can run {% data variables.product.prodname_code_scanning %} using a {% data variables.product.prodname_actions %} workflow. First, you need to provision one or more self-hosted {% data variables.product.prodname_actions %} runners in your environment. You can provision self-hosted runners at the repository, organization, or enterprise account level. See [AUTOTITLE](/actions/concepts/runners/self-hosted-runners) and [AUTOTITLE](/actions/how-tos/manage-runners/self-hosted-runners/add-runners). {% ifversion default-setup-self-hosted-runners-GHEC %} If you are provisioning a self-hosted runner for {% data variables.product.prodname_codeql %} analysis, your runner must use a {% data variables.product.prodname_codeql %}-supported operating system version and CPU architecture. See the [{% data variables.product.prodname_codeql %} system requirements](https://codeql.github.com/docs/codeql-overview/system-requirements/). -If you are using default setup for {% data variables.product.prodname_code_scanning %}, you can assign self-hosted runners with the default `code-scanning` label, or you can optionally give them custom labels so that individual repositories can use different runners. See [AUTOTITLE](/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning#assigning-labels-to-runners). +If you are using default setup for {% data variables.product.prodname_code_scanning %}, you can assign self-hosted runners with the default `code-scanning` label, or you can optionally give them custom labels so that individual repositories can use different runners. See [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/configure-code-scanning/configure-code-scanning#assigning-labels-to-runners). -For information about using default setup for code scanning analysis of compiled languages, see [AUTOTITLE](/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/codeql-code-scanning-for-compiled-languages). +For information about using default setup for code scanning analysis of compiled languages, see [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/codeql-for-compiled-languages). {% endif %} @@ -84,7 +84,7 @@ You must ensure that Git is in the PATH variable on any self-hosted runners you ### Provisioning a runner scale set -You can use {% data variables.product.prodname_actions_runner_controller %} to create a dedicated runner scale set for your {% data variables.product.prodname_ghe_server %} instance. See [AUTOTITLE](/enterprise-server@latest/actions/hosting-your-own-runners/managing-self-hosted-runners-with-actions-runner-controller/deploying-runner-scale-sets-with-actions-runner-controller#using-arc-with-dependabot-and-code-scanning). +You can use {% data variables.product.prodname_actions_runner_controller %} to create a dedicated runner scale set for your {% data variables.product.prodname_ghe_server %} instance. See [AUTOTITLE](/enterprise-server@latest/actions/how-tos/manage-runners/use-actions-runner-controller/deploy-runner-scale-sets#using-arc-with-dependabot-and-code-scanning). ### Provisioning the actions for {% data variables.product.prodname_code_scanning %} @@ -92,7 +92,7 @@ If you want to use actions to run {% data variables.product.prodname_code_scanni The {% data variables.product.prodname_codeql %} action is included in your installation of {% data variables.product.prodname_ghe_server %}. If both {% data variables.product.prodname_ghe_server %} {{ allVersions[currentVersion].currentRelease }} and your {% data variables.product.prodname_actions %} runner have access to the internet, the action will automatically download the {% data variables.product.prodname_codeql %} {% data variables.product.codeql_cli_ghes_recommended_version %} bundle required to perform analysis. Alternatively, you can use a synchronization tool to make the latest released version of the {% data variables.product.prodname_codeql %} analysis bundle available locally. See [Configuring {% data variables.product.prodname_codeql %} analysis on a server without internet access](#configuring-codeql-analysis-on-a-server-without-internet-access) below. -You can also make third-party actions available to users for {% data variables.product.prodname_code_scanning %}, by setting up {% data variables.product.prodname_github_connect %}. See [AUTOTITLE](/admin/code-security/managing-github-advanced-security-for-your-enterprise/configuring-code-scanning-for-your-appliance#configuring-github-connect-to-sync-github-actions) below. +You can also make third-party actions available to users for {% data variables.product.prodname_code_scanning %}, by setting up {% data variables.product.prodname_github_connect %}. See [AUTOTITLE](/code-security/how-tos/secure-at-scale/configure-enterprise-security/configure-specific-tools/configuring-code-scanning-for-your-appliance#configuring-github-connect-to-sync-github-actions) below. ### Configuring {% data variables.product.prodname_codeql %} analysis on a server without internet access @@ -102,14 +102,14 @@ If you configure the {% data variables.product.prodname_codeql %} action sync to ### Configuring {% data variables.product.prodname_github_connect %} to sync {% data variables.product.prodname_actions %} -1. If you want to download action workflows on demand from {% data variables.product.prodname_dotcom_the_website %}, you need to enable {% data variables.product.prodname_github_connect %}. See [AUTOTITLE](/admin/configuration/configuring-github-connect/managing-github-connect#enabling-github-connect). -1. You'll also need to enable {% data variables.product.prodname_actions %}. See [AUTOTITLE](/admin/github-actions/getting-started-with-github-actions-for-your-enterprise/getting-started-with-github-actions-for-github-enterprise-server). -1. The next step is to configure access to actions on {% data variables.product.prodname_dotcom_the_website %} using {% data variables.product.prodname_github_connect %}. See [AUTOTITLE](/admin/github-actions/managing-access-to-actions-from-githubcom/enabling-automatic-access-to-githubcom-actions-using-github-connect). -1. Add a self-hosted runner to your repository, organization, or enterprise account. See [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners). +1. If you want to download action workflows on demand from {% data variables.product.prodname_dotcom_the_website %}, you need to enable {% data variables.product.prodname_github_connect %}. See [AUTOTITLE](/admin/configuring-settings/configuring-github-connect/enabling-github-connect-for-githubcom#enabling-github-connect). +1. You'll also need to enable {% data variables.product.prodname_actions %}. See [AUTOTITLE](/admin/managing-github-actions-for-your-enterprise/getting-started-with-github-actions-for-your-enterprise/getting-started-with-github-actions-for-github-enterprise-server). +1. The next step is to configure access to actions on {% data variables.product.prodname_dotcom_the_website %} using {% data variables.product.prodname_github_connect %}. See [AUTOTITLE](/admin/managing-github-actions-for-your-enterprise/managing-access-to-actions-from-githubcom/enabling-automatic-access-to-githubcom-actions-using-github-connect). +1. Add a self-hosted runner to your repository, organization, or enterprise account. See [AUTOTITLE](/actions/how-tos/manage-runners/self-hosted-runners/add-runners). ## Running code scanning using the {% data variables.product.prodname_codeql_cli %} If you don't want to use {% data variables.product.prodname_actions %}, you should run {% data variables.product.prodname_code_scanning %} using the {% data variables.product.prodname_codeql_cli %}. -The {% data variables.product.prodname_codeql_cli %} is a command-line tool that you use to analyze codebases on any machine, including a third-party CI/CD system. See [AUTOTITLE](/code-security/code-scanning/integrating-with-code-scanning/using-code-scanning-with-your-existing-ci-system). +The {% data variables.product.prodname_codeql_cli %} is a command-line tool that you use to analyze codebases on any machine, including a third-party CI/CD system. See [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/integrate-with-existing-tools/use-with-existing-ci-system). {% endif %} diff --git a/content/code-security/how-tos/secure-at-scale/configure-enterprise-security/configure-specific-tools/enable-dependency-graph.md b/content/code-security/how-tos/secure-at-scale/configure-enterprise-security/configure-specific-tools/enable-dependency-graph.md index 74838ab3802c..b80a5b0cc4fe 100644 --- a/content/code-security/how-tos/secure-at-scale/configure-enterprise-security/configure-specific-tools/enable-dependency-graph.md +++ b/content/code-security/how-tos/secure-at-scale/configure-enterprise-security/configure-specific-tools/enable-dependency-graph.md @@ -16,11 +16,11 @@ category: ## About the dependency graph -{% data reusables.dependabot.about-the-dependency-graph %} For more information, see [AUTOTITLE](/code-security/supply-chain-security/understanding-your-software-supply-chain/about-the-dependency-graph) +{% data reusables.dependabot.about-the-dependency-graph %} For more information, see [AUTOTITLE](/code-security/concepts/supply-chain-security/dependency-graph) {% data reusables.dependency-review.dependency-review-enabled-ghes %} -After you enable the dependency graph for your enterprise, you can enable {% data variables.product.prodname_dependabot %} to detect insecure dependencies in your repository and automatically fix the vulnerabilities. For more information, see [AUTOTITLE](/admin/configuration/configuring-github-connect/enabling-dependabot-for-your-enterprise). +After you enable the dependency graph for your enterprise, you can enable {% data variables.product.prodname_dependabot %} to detect insecure dependencies in your repository and automatically fix the vulnerabilities. For more information, see [AUTOTITLE](/admin/configuring-settings/configuring-github-connect/enabling-dependabot-for-your-enterprise). You can enable the dependency graph via the {% data variables.enterprise.management_console %} or the administrative shell. We recommend using the {% data variables.enterprise.management_console %} unless your instance uses clustering. @@ -46,7 +46,7 @@ If your instance uses clustering, you cannot enable the dependency graph with th ``` > [!NOTE] - > For more information about enabling access to the administrative shell via SSH, see [AUTOTITLE](/admin/configuration/configuring-your-enterprise/accessing-the-administrative-shell-ssh). + > For more information about enabling access to the administrative shell via SSH, see [AUTOTITLE](/admin/administering-your-instance/administering-your-instance-from-the-command-line/accessing-the-administrative-shell-ssh). 1. Apply the configuration. diff --git a/content/code-security/how-tos/secure-at-scale/configure-enterprise-security/configure-specific-tools/setting-dependabot-to-run-on-github-hosted-runners-using-vnet.md b/content/code-security/how-tos/secure-at-scale/configure-enterprise-security/configure-specific-tools/setting-dependabot-to-run-on-github-hosted-runners-using-vnet.md index 290286bef037..1ed048039c87 100644 --- a/content/code-security/how-tos/secure-at-scale/configure-enterprise-security/configure-specific-tools/setting-dependabot-to-run-on-github-hosted-runners-using-vnet.md +++ b/content/code-security/how-tos/secure-at-scale/configure-enterprise-security/configure-specific-tools/setting-dependabot-to-run-on-github-hosted-runners-using-vnet.md @@ -41,7 +41,7 @@ After configuring your Azure resources, you can use an Azure Virtual Network (VN 1. Add a new network configuration for your enterprise. See [Add a new network configuration for your enterprise](/enterprise-cloud@latest/admin/configuring-settings/configuring-private-networking-for-hosted-compute-products/configuring-private-networking-for-github-hosted-runners-in-your-enterprise#1-add-a-new-network-configuration-for-your-enterprise) in the {% data variables.product.prodname_ghe_cloud %} documentation. 1. Create a runner group for the enterprise and select the organizations that you want to run {% data variables.product.prodname_dependabot_updates %} for. See [Create a runner group for your enterprise](/enterprise-cloud@latest/admin/configuring-settings/configuring-private-networking-for-hosted-compute-products/configuring-private-networking-for-github-hosted-runners-in-your-enterprise#2-create-a-runner-group-for-your-enterprise) in the {% data variables.product.prodname_ghe_cloud %} documentation. -1. Create and add a {% data variables.product.company_short %}-hosted runner to the enterprise runner group. See [Adding a larger runner to an enterprise](/enterprise-cloud@latest/actions/using-github-hosted-runners/using-larger-runners/managing-larger-runners#adding-a-larger-runner-to-an-enterprise) in the {% data variables.product.prodname_ghe_cloud %} documentation. Important points are as follows: +1. Create and add a {% data variables.product.company_short %}-hosted runner to the enterprise runner group. See [Adding a larger runner to an enterprise](/enterprise-cloud@latest/actions/how-tos/manage-runners/larger-runners/manage-larger-runners#adding-a-larger-runner-to-an-enterprise) in the {% data variables.product.prodname_ghe_cloud %} documentation. Important points are as follows: * The runner name must be **dependabot** * Choose a Linux x64 platform. * Select the suitable Ubuntu version. @@ -56,7 +56,7 @@ After configuring your Azure resources, you can use an Azure Virtual Network (VN ## Enabling {% data variables.product.prodname_dependabot %} for the organization -You now need to enable {% data variables.product.prodname_dependabot %} on _self-hosted runners_ for your organization in order to enable {% data variables.product.prodname_dependabot %} on large runners. See [Enabling or disabling {% data variables.product.prodname_dependabot %} on larger runners](/code-security/dependabot/working-with-dependabot/about-dependabot-on-github-actions-runners#enabling-or-disabling-dependabot-on-larger-runners). +You now need to enable {% data variables.product.prodname_dependabot %} on _self-hosted runners_ for your organization in order to enable {% data variables.product.prodname_dependabot %} on large runners. See [Enabling or disabling {% data variables.product.prodname_dependabot %} on larger runners](/code-security/concepts/supply-chain-security/dependabot-on-actions#enabling-or-disabling-dependabot-on-larger-runners). {% data reusables.profile.access_org %} {% data reusables.organizations.org_settings %} diff --git a/content/code-security/how-tos/secure-at-scale/configure-enterprise-security/configure-specific-tools/view-vulnerability-data.md b/content/code-security/how-tos/secure-at-scale/configure-enterprise-security/configure-specific-tools/view-vulnerability-data.md index 89912363529c..8e64a2f96f72 100644 --- a/content/code-security/how-tos/secure-at-scale/configure-enterprise-security/configure-specific-tools/view-vulnerability-data.md +++ b/content/code-security/how-tos/secure-at-scale/configure-enterprise-security/configure-specific-tools/view-vulnerability-data.md @@ -18,7 +18,7 @@ If {% data variables.product.prodname_dependabot_alerts %} are enabled for your You can manually sync vulnerability data from {% data variables.product.prodname_dotcom_the_website %} to update the list. -Before you can view vulnerability data, you must enable {% data variables.product.prodname_dependabot_alerts %}. For more information, see [AUTOTITLE](/admin/configuration/configuring-github-connect/enabling-dependabot-for-your-enterprise). +Before you can view vulnerability data, you must enable {% data variables.product.prodname_dependabot_alerts %}. For more information, see [AUTOTITLE](/admin/configuring-settings/configuring-github-connect/enabling-dependabot-for-your-enterprise). {% data reusables.enterprise_site_admin_settings.access-settings %} 1. In the left sidebar, under **{% octicon "rocket" aria-hidden="true" aria-label="rocket" %} Site admin**, click **Vulnerabilities**. diff --git a/content/code-security/how-tos/secure-at-scale/configure-enterprise-security/establish-complete-coverage/apply-custom-configuration.md b/content/code-security/how-tos/secure-at-scale/configure-enterprise-security/establish-complete-coverage/apply-custom-configuration.md index 0199c980cdff..988c963e37d4 100644 --- a/content/code-security/how-tos/secure-at-scale/configure-enterprise-security/establish-complete-coverage/apply-custom-configuration.md +++ b/content/code-security/how-tos/secure-at-scale/configure-enterprise-security/establish-complete-coverage/apply-custom-configuration.md @@ -17,7 +17,7 @@ category: After you create a {% data variables.product.prodname_custom_security_configuration %}, you need to apply it to repositories in your enterprise to enable the configuration's settings on those repositories. -The repository list displays each repository's configuration status. For the full list of statuses and recommended actions, see [AUTOTITLE](/code-security/reference/security-at-scale/security-configuration-statuses). +The repository list displays each repository's configuration status. For the full list of statuses and recommended actions, see [AUTOTITLE](/code-security/reference/security-at-scale/configuration-statuses). {% data reusables.security-configurations.security-features-use-actions %} @@ -35,4 +35,4 @@ The repository list displays each repository's configuration status. For the ful ## Next steps -To learn how to edit your {% data variables.product.prodname_custom_security_configuration %}, see [AUTOTITLE](/admin/managing-code-security/securing-your-enterprise/editing-a-custom-security-configuration). +To learn how to edit your {% data variables.product.prodname_custom_security_configuration %}, see [AUTOTITLE](/code-security/how-tos/secure-at-scale/configure-enterprise-security/manage-your-coverage/edit-custom-configuration). diff --git a/content/code-security/how-tos/secure-at-scale/configure-enterprise-security/establish-complete-coverage/configure-additional-settings.md b/content/code-security/how-tos/secure-at-scale/configure-enterprise-security/establish-complete-coverage/configure-additional-settings.md index 743bd9fbd166..02dbd802aeff 100644 --- a/content/code-security/how-tos/secure-at-scale/configure-enterprise-security/establish-complete-coverage/configure-additional-settings.md +++ b/content/code-security/how-tos/secure-at-scale/configure-enterprise-security/establish-complete-coverage/configure-additional-settings.md @@ -56,6 +56,6 @@ You can customize which secret patterns are included in push protection, giving {% data reusables.secret-scanning.pattern-enablement-org-enterprise %} -For more information on how to read data on the {% data variables.product.prodname_secret_scanning %} pattern configuration page, see [AUTOTITLE](/code-security/reference/secret-security/secret-scanning-pattern-configuration-data). +For more information on how to read data on the {% data variables.product.prodname_secret_scanning %} pattern configuration page, see [AUTOTITLE](/code-security/reference/secret-security/secret-pattern-data). {% endif %} diff --git a/content/code-security/reference/code-quality/codeql-detection.md b/content/code-security/reference/code-quality/codeql-detection.md index b90e0766dbe9..7a90531bc013 100644 --- a/content/code-security/reference/code-quality/codeql-detection.md +++ b/content/code-security/reference/code-quality/codeql-detection.md @@ -32,12 +32,12 @@ Each {% data variables.product.prodname_code_quality_short %} rule is written as The rules are continually refined by both {% data variables.product.github %} and open source developers. -* [AUTOTITLE](/code-security/code-quality/reference/codeql-queries/csharp-queries) -* [AUTOTITLE](/code-security/code-quality/reference/codeql-queries/go-queries) -* [AUTOTITLE](/code-security/code-quality/reference/codeql-queries/java-queries) -* [AUTOTITLE](/code-security/code-quality/reference/codeql-queries/javascript-queries) -* [AUTOTITLE](/code-security/code-quality/reference/codeql-queries/python-queries) -* [AUTOTITLE](/code-security/code-quality/reference/codeql-queries/ruby-queries) +* [AUTOTITLE](/code-security/reference/code-quality/codeql-queries/csharp-queries) +* [AUTOTITLE](/code-security/reference/code-quality/codeql-queries/go-queries) +* [AUTOTITLE](/code-security/reference/code-quality/codeql-queries/java-queries) +* [AUTOTITLE](/code-security/reference/code-quality/codeql-queries/javascript-queries) +* [AUTOTITLE](/code-security/reference/code-quality/codeql-queries/python-queries) +* [AUTOTITLE](/code-security/reference/code-quality/codeql-queries/ruby-queries) For more information about the {% data variables.product.prodname_codeql %} project, see [https://codeql.github.com/](https://codeql.github.com). @@ -51,8 +51,8 @@ If your organization has configured caching of private registries, these will be For more information, see: -* [AUTOTITLE](/code-security/code-quality/how-tos/enable-code-quality) -* [AUTOTITLE](/code-security/securing-your-organization/enabling-security-features-in-your-organization/giving-org-access-private-registries#code-quality-access-to-private-registries) +* [AUTOTITLE](/code-security/how-tos/maintain-quality-code/enable-code-quality) +* [AUTOTITLE](/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries#code-quality-access-to-private-registries) ## Pull request status checks @@ -66,4 +66,4 @@ The workflow failed to run. For example, your budget for actions minutes is exha ### Merging is blocked: Code quality findings were detected -The scan found problems in the code that exceed the quality gate set by a code quality branch rule for the repository. You need to resolve these problems before you can merge the pull request. See [AUTOTITLE](/code-security/code-quality/how-tos/unblock-your-pr). +The scan found problems in the code that exceed the quality gate set by a code quality branch rule for the repository. You need to resolve these problems before you can merge the pull request. See [AUTOTITLE](/code-security/how-tos/maintain-quality-code/unblock-your-pr). diff --git a/content/code-security/reference/code-quality/metrics-and-ratings.md b/content/code-security/reference/code-quality/metrics-and-ratings.md index 16c1c28cf9d7..750df81e4384 100644 --- a/content/code-security/reference/code-quality/metrics-and-ratings.md +++ b/content/code-security/reference/code-quality/metrics-and-ratings.md @@ -46,4 +46,4 @@ For details about how {% data variables.product.prodname_code_quality_short %} m ## Further reading * [AUTOTITLE](/code-security/concepts/code-quality/code-quality) -* [AUTOTITLE](/code-security/code-quality/how-tos/interpret-results) +* [AUTOTITLE](/code-security/how-tos/maintain-quality-code/interpret-results) diff --git a/content/code-security/reference/code-scanning/code-scanning-logs.md b/content/code-security/reference/code-scanning/code-scanning-logs.md index 5ec7f04375b5..22088a0e7c91 100644 --- a/content/code-security/reference/code-scanning/code-scanning-logs.md +++ b/content/code-security/reference/code-scanning/code-scanning-logs.md @@ -11,14 +11,14 @@ category: - Find and fix code vulnerabilities --- -The log and diagnostic information available to you depends on the method you use for {% data variables.product.prodname_code_scanning %} in your repository. You can check the type of {% data variables.product.prodname_code_scanning %} you're using in the **{% data variables.product.prodname_security_and_quality_tab %}** tab of your repository, by using the **Tool** drop-down menu in the alert list. To access this page, see [AUTOTITLE](/code-security/code-scanning/managing-code-scanning-alerts/assessing-code-scanning-alerts-for-your-repository#viewing-the-alerts-for-a-repository). +The log and diagnostic information available to you depends on the method you use for {% data variables.product.prodname_code_scanning %} in your repository. You can check the type of {% data variables.product.prodname_code_scanning %} you're using in the **{% data variables.product.prodname_security_and_quality_tab %}** tab of your repository, by using the **Tool** drop-down menu in the alert list. To access this page, see [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/assess-alerts#viewing-the-alerts-for-a-repository). ## Logs on {% data variables.product.github %} You can see analysis and diagnostic information for {% data variables.product.prodname_code_scanning %} run using {% data variables.product.prodname_codeql %} analysis on {% data variables.product.prodname_dotcom %}. -* Analysis information is shown for the most recent analysis in a header at the top of the list of alerts. See [AUTOTITLE](/code-security/code-scanning/managing-code-scanning-alerts/assessing-code-scanning-alerts-for-your-repository#viewing-the-alerts-for-a-repository). -* Diagnostic information is displayed in the {% data variables.product.prodname_actions %} workflow logs and consists of summary metrics and extractor diagnostics. To access these logs, see [AUTOTITLE](/code-security/how-tos/view-and-interpret-data/viewing-code-scanning-logs). +* Analysis information is shown for the most recent analysis in a header at the top of the list of alerts. See [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/assess-alerts#viewing-the-alerts-for-a-repository). +* Diagnostic information is displayed in the {% data variables.product.prodname_actions %} workflow logs and consists of summary metrics and extractor diagnostics. To access these logs, see [AUTOTITLE](/code-security/how-tos/view-and-interpret-data/view-code-scanning-logs). ### Summary metrics @@ -28,7 +28,7 @@ You can see analysis and diagnostic information for {% data variables.product.pr {% data reusables.code-scanning.extractor-diagnostics %} -You can see more detailed information about {% data variables.product.prodname_codeql %} extractor errors and warnings that occurred during database creation by enabling debug logging. See [AUTOTITLE](/code-security/code-scanning/troubleshooting-code-scanning/logs-are-not-detailed-enough#creating-codeql-debugging-artifacts-by-re-running-jobs-with-debug-logging-enabled). +You can see more detailed information about {% data variables.product.prodname_codeql %} extractor errors and warnings that occurred during database creation by enabling debug logging. See [AUTOTITLE](/code-security/reference/code-scanning/troubleshoot-analysis-errors/logs-not-detailed-enough#creating-codeql-debugging-artifacts-by-re-running-jobs-with-debug-logging-enabled). {% ifversion org-private-registry %} @@ -36,7 +36,7 @@ You can see more detailed information about {% data variables.product.prodname_c {% data variables.product.prodname_code_scanning_caps %} default setup workflows include a `Setup proxy for registries` step. When you are looking at a workflow run for default setup, you can expand this step to view the corresponding log. This contains information about which private package registry configurations were available to the analysis. Additionally, the log contains some diagnostic information which may help with troubleshooting if the private package registries are not successfully used by {% data variables.product.prodname_code_scanning %} default setup. Look for the following messages: -* `Using registries_credentials input.` At least one private registry is configured for the organization. This includes configurations for private registry types which are not supported by {% data variables.product.prodname_code_scanning %} default setup. For more details about supported registry types, see [AUTOTITLE](/code-security/securing-your-organization/enabling-security-features-in-your-organization/giving-org-access-private-registries#code-scanning-default-setup-access-to-private-registries). +* `Using registries_credentials input.` At least one private registry is configured for the organization. This includes configurations for private registry types which are not supported by {% data variables.product.prodname_code_scanning %} default setup. For more details about supported registry types, see [AUTOTITLE](/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries#code-scanning-default-setup-access-to-private-registries). * `Credentials loaded for the following registries:` * If no list of configurations follows, then no private registry configurations supported by {% data variables.product.prodname_code_scanning %} default setup were found. @@ -47,9 +47,9 @@ You can see more detailed information about {% data variables.product.prodname_c * Following this, there may be messages about the outcomes of connection tests which try to reach the configured private package registries through the authentication proxy. This is a best-effort process. If these checks are not successful for some registries, it does not necessarily mean that the relevant configurations are not working. However, if you find that {% data variables.product.prodname_code_scanning %} default setup is unable to successfully access dependencies in the private registries during the analysis, then this may provide some information to help troubleshoot the issue. -If the output from the `Setup proxy for registries` step is as expected, but {% data variables.product.prodname_code_scanning %} default setup is unable to successfully access dependencies in the private registries, you can obtain additional troubleshooting information. See [AUTOTITLE](/code-security/how-tos/scan-code-for-vulnerabilities/troubleshooting/troubleshooting-analysis-errors/logs-not-detailed-enough#creating-codeql-debugging-artifacts-for-codeql-default-setup). +If the output from the `Setup proxy for registries` step is as expected, but {% data variables.product.prodname_code_scanning %} default setup is unable to successfully access dependencies in the private registries, you can obtain additional troubleshooting information. See [AUTOTITLE](/code-security/reference/code-scanning/troubleshoot-analysis-errors/logs-not-detailed-enough#creating-codeql-debugging-artifacts-for-codeql-default-setup). -For more information about giving {% data variables.product.prodname_code_scanning %} default setup access to private registries, see [AUTOTITLE](/code-security/securing-your-organization/enabling-security-features-in-your-organization/giving-org-access-private-registries). +For more information about giving {% data variables.product.prodname_code_scanning %} default setup access to private registries, see [AUTOTITLE](/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries). {% endif %} @@ -63,4 +63,4 @@ Progress and error messages are displayed as notifications in the bottom right c You can access separate logs for the {% data variables.product.prodname_codeql %} extension, language server, query Server, or tests. The Language Server log contains more advanced debug logs for {% data variables.product.prodname_codeql %} language maintainers. You should only need these to provide details in a bug report. -To access these logs, see [AUTOTITLE](/code-security/how-tos/scan-code-for-vulnerabilities/scan-from-vs-code/accessing-logs). +To access these logs, see [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/scan-from-vs-code/accessing-logs). diff --git a/content/code-security/reference/code-scanning/codeql/build-options-for-compiled-languages.md b/content/code-security/reference/code-scanning/codeql/build-options-for-compiled-languages.md index 96a439cc0c87..ef13ef5e2b66 100644 --- a/content/code-security/reference/code-scanning/codeql/build-options-for-compiled-languages.md +++ b/content/code-security/reference/code-scanning/codeql/build-options-for-compiled-languages.md @@ -17,7 +17,7 @@ redirect_from: ## Autobuild steps for compiled languages -{% ifversion fpt or ghec %}{% data variables.product.prodname_dotcom %}-hosted runners are always run with the software required by `autobuild`.{% endif %} If you use self-hosted runners for {% data variables.product.prodname_actions %}, you may need to install additional software to use the `autobuild` process. Additionally, if your repository requires a specific version of a build tool, you may need to install it manually. {% ifversion ghes or default-setup-self-hosted-runners-GHEC %} For self-hosted runners, you should install dependencies directly in the runners themselves. We provide examples of common dependencies for C/C++, C#, and Java in each of the `autobuild` sections of this article for those languages. For more information, see [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners).{% endif %} +{% ifversion fpt or ghec %}{% data variables.product.prodname_dotcom %}-hosted runners are always run with the software required by `autobuild`.{% endif %} If you use self-hosted runners for {% data variables.product.prodname_actions %}, you may need to install additional software to use the `autobuild` process. Additionally, if your repository requires a specific version of a build tool, you may need to install it manually. {% ifversion ghes or default-setup-self-hosted-runners-GHEC %} For self-hosted runners, you should install dependencies directly in the runners themselves. We provide examples of common dependencies for C/C++, C#, and Java in each of the `autobuild` sections of this article for those languages. For more information, see [AUTOTITLE](/actions/concepts/runners/self-hosted-runners).{% endif %} > [!NOTE] > If your workflow uses a `language` matrix, `autobuild` attempts to build each of the compiled languages listed in the matrix. Without a matrix `autobuild` attempts to build the supported compiled language that has the most source files in the repository. With the exception of Go, analysis of other compiled languages in your repository will fail unless you supply explicit build commands. @@ -76,7 +76,7 @@ On Linux and macOS, the `autobuild` step reviews the files present in the reposi #### Runner requirements for C/C++ -On Ubuntu Linux runners, `autobuild` may try to automatically install dependencies required by the detected configuration and build steps. By default, this behavior is enabled on {% data variables.product.prodname_dotcom %}-hosted runners and disabled on self-hosted runners. You can enable or disable this feature explicitly by setting `CODEQL_EXTRACTOR_CPP_AUTOINSTALL_DEPENDENCIES` to `true` or `false` in the environment. For more information about defining environment variables, see [AUTOTITLE](/actions/learn-github-actions/variables#defining-environment-variables-for-a-single-workflow). +On Ubuntu Linux runners, `autobuild` may try to automatically install dependencies required by the detected configuration and build steps. By default, this behavior is enabled on {% data variables.product.prodname_dotcom %}-hosted runners and disabled on self-hosted runners. You can enable or disable this feature explicitly by setting `CODEQL_EXTRACTOR_CPP_AUTOINSTALL_DEPENDENCIES` to `true` or `false` in the environment. For more information about defining environment variables, see [AUTOTITLE](/actions/how-tos/write-workflows/choose-what-workflows-do/use-variables#defining-environment-variables-for-a-single-workflow). For self-hosted runners, unless automatic installation of dependencies is enabled, you will likely need to install the `gcc` compiler, and specific projects may also require access to `clang` or `msvc` executables. You will also need to install the build system (for example `msbuild`, `make`, `cmake`, `bazel`) and utilities (such as `python`, `perl`, `lex`, and `yacc`) that your projects depend on. If you enable automatic installation of dependencies, you must ensure that the runner is using Ubuntu and that it can run `sudo apt-get` without requiring a password. @@ -93,7 +93,7 @@ When you enable default setup for a repository that contains C# code, the build {% data variables.product.prodname_codeql %} restores dependencies and generates a few additional source files, to give more accurate results, before creating a database from all the source files and dependencies. -Dependencies are restored using multiple heuristics and strategies. The following files are the primary source of information: `*.csproj`, `*.sln`, `nuget.config`, `packages.config`, `global.json`, and `project.assets.json`. {% ifversion org-private-registry %}If a private NuGet feed is defined for the organization, this is also used, see [Code scanning default setup access to private registries](/code-security/securing-your-organization/enabling-security-features-in-your-organization/giving-org-access-private-registries#code-scanning-default-setup-access-to-private-registries) and [Determining whether code scanning default setup used any private registries](/code-security/code-scanning/managing-your-code-scanning-configuration/viewing-code-scanning-logs#determining-whether-code-scanning-default-setup-used-any-private-registries).{% endif %} +Dependencies are restored using multiple heuristics and strategies. The following files are the primary source of information: `*.csproj`, `*.sln`, `nuget.config`, `packages.config`, `global.json`, and `project.assets.json`. {% ifversion org-private-registry %}If a private NuGet feed is defined for the organization, this is also used, see [Code scanning default setup access to private registries](/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries#default-setup-access-to-private-registries) and [Determining whether code scanning default setup used any private registries](/code-security/reference/code-scanning/code-scanning-logs#diagnostic-information-for-private-package-registries).{% endif %} The following generated source files are optional, but significantly increase the correctness of the {% data variables.product.prodname_codeql %} database: @@ -108,7 +108,7 @@ Creating a {% data variables.product.prodname_codeql %} database without buildin You can ensure a more accurate analysis by taking the following steps: -* Provide access to the public internet or ensure that access to a private NuGet feed is available{% ifversion org-private-registry %}, see [Code scanning default setup access to private registries](/code-security/securing-your-organization/enabling-security-features-in-your-organization/giving-org-access-private-registries#code-scanning-default-setup-access-to-private-registries){% endif %}. +* Provide access to the public internet or ensure that access to a private NuGet feed is available{% ifversion org-private-registry %}, see [Code scanning default setup access to private registries](/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries#code-scanning-default-setup-access-to-private-registries){% endif %}. * Check whether the repository requires multiple versions of the same NuGet dependency. {% data variables.product.prodname_codeql %} can use only one version and usually chooses the newer version where there are multiple versions. This approach may not work for all repositories. * Check whether multiple versions of .NET are referenced, for example, `net48`, `net5.0`, and `netstandard1.6`. {% data variables.product.prodname_codeql %} can use only one version and this may affect accuracy. * Avoid colliding class names, otherwise this may cause missing method call targets, which has an impact on dataflow analysis. @@ -170,7 +170,7 @@ Setting this option to `false` disables the use of the shared compilation featur Setting this option to `true` will emit compiler-generated files during the build process. This option causes the compiler to generate additional source files that are used to support features such as improved regular expression support, serialization, and web application view generation. These generated artifacts are typically not written to disk by the compiler, but setting the option to `true` forces writing the files to disk, and so the extractor can process the files. -For some legacy projects, and projects that use `.sqlproj` files, you may see that the injected `/p:EmitCompilerGeneratedFiles=true` property causes unexpected issues with `msbuild`. For information about troubleshooting this, see [AUTOTITLE](/code-security/code-scanning/troubleshooting-code-scanning/c-sharp-compiler-unexpectedly-failing). +For some legacy projects, and projects that use `.sqlproj` files, you may see that the injected `/p:EmitCompilerGeneratedFiles=true` property causes unexpected issues with `msbuild`. For information about troubleshooting this, see [AUTOTITLE](/code-security/reference/code-scanning/troubleshoot-analysis-errors/c-sharp-compiler-unexpectedly-failing). ## Building Go @@ -210,13 +210,13 @@ Additionally, `vendor` directories are excluded from {% data variables.product.p When you first enable default setup for a repository, if only Java code is detected then the build mode is set to `none`. If Kotlin or a combination of Java and Kotlin code is detected, then the build mode is set to `autobuild`. -If you later add Kotlin code to a repository that uses the `none` build mode, {% data variables.product.prodname_codeql %} analysis reports a warning message explaining that Kotlin is not supported. You will need to disable default setup and re-enable it. When you re-enable default setup, the build mode will change to `autobuild` so that both languages can be analyzed. Alternatively, you can change to an advanced setup. For more information, see [AUTOTITLE](/code-security/code-scanning/troubleshooting-code-scanning/kotlin-detected-in-no-build). +If you later add Kotlin code to a repository that uses the `none` build mode, {% data variables.product.prodname_codeql %} analysis reports a warning message explaining that Kotlin is not supported. You will need to disable default setup and re-enable it. When you re-enable default setup, the build mode will change to `autobuild` so that both languages can be analyzed. Alternatively, you can change to an advanced setup. For more information, see [AUTOTITLE](/code-security/reference/code-scanning/troubleshoot-analysis-errors/kotlin-detected-in-no-build). ### No build for Java {% data variables.product.prodname_codeql %} will attempt to run Gradle or Maven to extract accurate dependency information (but not to invoke a build), before creating a database from all Java files present. Every root Maven or Gradle project file (a build script without any build script present in an ancestor directory) is queried for dependency information, and more recent dependency versions are preferred if there is a clash. For information about the runner requirements to run Maven or Gradle, see [Runner requirements for Java](#runner-requirements-for-java). - {% ifversion org-private-registry %}If a private Maven registry is defined for the organization, this is also used, see [Code scanning default setup access to private registries](/code-security/securing-your-organization/enabling-security-features-in-your-organization/giving-org-access-private-registries#code-scanning-default-setup-access-to-private-registries) and [Determining whether code scanning default setup used any private registries](/code-security/code-scanning/managing-your-code-scanning-configuration/viewing-code-scanning-logs#determining-whether-code-scanning-default-setup-used-any-private-registries).{% endif %} + {% ifversion org-private-registry %}If a private Maven registry is defined for the organization, this is also used, see [Code scanning default setup access to private registries](/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries#default-setup-access-to-private-registries) and [Determining whether code scanning default setup used any private registries](/code-security/reference/code-scanning/code-scanning-logs#diagnostic-information-for-private-package-registries).{% endif %} #### Accuracy of no build analysis for Java @@ -227,7 +227,7 @@ Creating a {% data variables.product.prodname_codeql %} Java database without a You can ensure a more accurate analysis by taking the following steps: -* Provide access to the public internet or ensure that access to a private artifact repository is available{% ifversion org-private-registry %}, see [Code scanning default setup access to private registries](/code-security/securing-your-organization/enabling-security-features-in-your-organization/giving-org-access-private-registries#code-scanning-default-setup-access-to-private-registries){% endif %}. +* Provide access to the public internet or ensure that access to a private artifact repository is available{% ifversion org-private-registry %}, see [Code scanning default setup access to private registries](/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries#code-scanning-default-setup-access-to-private-registries){% endif %}. * Check whether the repository requires multiple versions of the same dependency. {% data variables.product.prodname_codeql %} can use only one version and usually chooses the newer version where there are multiple versions. This approach may not work for all repositories. * Check whether more than one version of the JDK API is required by different source Java files. When multiple versions are seen, {% data variables.product.prodname_codeql %} will use the highest version required by any build script. This may mean that some files that require a lower version of the JDK will be partially analyzed. For example, if some files require JDK 8 but a JDK 17 requirement is found in one or more build scripts, {% data variables.product.prodname_codeql %} will use JDK 17. Any files that require JDK 8 and could not be built using JDK 17 will be partially analyzed. * Avoid colliding class names (for example, multiple files defining `org.myproject.Test`), otherwise this may cause missing method call targets, which has an impact on dataflow analysis. @@ -294,7 +294,7 @@ Rust analysis requires `rustup` and `cargo` to be installed. The `autobuild` process tries to build the biggest target from an Xcode project or workspace. -Code scanning of Swift code uses macOS runners by default. {% ifversion fpt or ghec %}Since {% data variables.product.company_short %}-hosted macOS runners are more expensive than Linux and Windows runners, we recommend that you build only the code that you want to analyze. For more information about pricing for {% data variables.product.company_short %}-hosted runners, see [AUTOTITLE](/billing/managing-billing-for-github-actions/about-billing-for-github-actions).{% endif %} +Code scanning of Swift code uses macOS runners by default. {% ifversion fpt or ghec %}Since {% data variables.product.company_short %}-hosted macOS runners are more expensive than Linux and Windows runners, we recommend that you build only the code that you want to analyze. For more information about pricing for {% data variables.product.company_short %}-hosted runners, see [AUTOTITLE](/billing/concepts/product-billing/github-actions).{% endif %} {% data reusables.code-scanning.default-setup-swift-self-hosted-runners %} diff --git a/content/code-security/reference/code-scanning/codeql/codeql-cli-manual/database-create.md b/content/code-security/reference/code-scanning/codeql/codeql-cli-manual/database-create.md index 9b4420d7105b..067b1ef8a04f 100644 --- a/content/code-security/reference/code-scanning/codeql/codeql-cli-manual/database-create.md +++ b/content/code-security/reference/code-scanning/codeql/codeql-cli-manual/database-create.md @@ -71,7 +71,7 @@ delete the entire database directory. \[Advanced] Read a Code Scanning configuration file specifying options on how to create the CodeQL databases and what queries to run in later steps. For more details on the format of this configuration file, refer -to [AUTOTITLE](/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning). To run queries from +to [AUTOTITLE](/code-security/reference/code-scanning/workflow-configuration-options). To run queries from this file in a later step, invoke [codeql database analyze](/code-security/reference/code-scanning/codeql/codeql-cli-manual/database-analyze) without any other queries specified. #### `--[no-]db-cluster` diff --git a/content/code-security/reference/code-scanning/codeql/codeql-cli-manual/database-init.md b/content/code-security/reference/code-scanning/codeql/codeql-cli-manual/database-init.md index 1e797b008ebe..25478f969478 100644 --- a/content/code-security/reference/code-scanning/codeql/codeql-cli-manual/database-init.md +++ b/content/code-security/reference/code-scanning/codeql/codeql-cli-manual/database-init.md @@ -84,7 +84,7 @@ delete the entire database directory. \[Advanced] Read a Code Scanning configuration file specifying options on how to create the CodeQL databases and what queries to run in later steps. For more details on the format of this configuration file, refer -to [AUTOTITLE](/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning). To run queries from +to [AUTOTITLE](/code-security/reference/code-scanning/workflow-configuration-options). To run queries from this file in a later step, invoke [codeql database analyze](/code-security/reference/code-scanning/codeql/codeql-cli-manual/database-analyze) without any other queries specified. #### `--[no-]db-cluster` @@ -141,7 +141,7 @@ Available since `v2.16.4`. build tracing," which allows integration into existing build workflows when an explicit build command is not available. For information about when and how to use this feature, please refer to our documentation at -[AUTOTITLE](/code-security/codeql-cli/getting-started-with-the-codeql-cli/preparing-your-code-for-codeql-analysis). +[AUTOTITLE](/code-security/tutorials/customize-code-scanning/prepare-code-for-analysis). ### Baseline calculation options diff --git a/content/code-security/reference/code-scanning/codeql/codeql-cli-manual/github-merge-results.md b/content/code-security/reference/code-scanning/codeql/codeql-cli-manual/github-merge-results.md index df8c3f22cbbd..176d4dbebfea 100644 --- a/content/code-security/reference/code-scanning/codeql/codeql-cli-manual/github-merge-results.md +++ b/content/code-security/reference/code-scanning/codeql/codeql-cli-manual/github-merge-results.md @@ -40,7 +40,7 @@ codeql github merge-results --sarif= --output= ... \[Mandatory] Path to the SARIF files to use. This should be the output of [codeql database analyze](/code-security/reference/code-scanning/codeql/codeql-cli-manual/database-analyze) (or [codeql database interpret-results](/code-security/reference/code-scanning/codeql/codeql-cli-manual/database-interpret-results)) with `--format sarif-latest` for upload to github.com or the appropriate supported format tag for GitHub Enterprise Server -instances (see [AUTOTITLE](/enterprise-server@latest/code-security/code-scanning/integrating-with-code-scanning/sarif-support-for-code-scanning) for +instances (see [AUTOTITLE](/enterprise-server@latest/code-security/reference/code-scanning/sarif-files/sarif-support) for SARIF versions supported by your release). #### `-o, --output=` diff --git a/content/code-security/reference/code-scanning/codeql/codeql-cli-manual/github-upload-results.md b/content/code-security/reference/code-scanning/codeql/codeql-cli-manual/github-upload-results.md index d0081583346c..9c624813e7cb 100644 --- a/content/code-security/reference/code-scanning/codeql/codeql-cli-manual/github-upload-results.md +++ b/content/code-security/reference/code-scanning/codeql/codeql-cli-manual/github-upload-results.md @@ -33,7 +33,7 @@ codeql github upload-results --sarif= [--github-auth-stdin] [--github-url= Uploads a SARIF file to GitHub code scanning. -See: [AUTOTITLE](/code-security/codeql-cli/getting-started-with-the-codeql-cli/uploading-codeql-analysis-results-to-github) +See: [AUTOTITLE](/code-security/tutorials/customize-code-scanning/upload-results) A GitHub Apps token or personal access token must be set. For best security practices, it is recommended to set the `--github-auth-stdin` @@ -51,7 +51,7 @@ This token must have the `security_events` scope. \[Mandatory] Path to the SARIF files to use. This should be the output of [codeql database analyze](/code-security/reference/code-scanning/codeql/codeql-cli-manual/database-analyze) (or [codeql database interpret-results](/code-security/reference/code-scanning/codeql/codeql-cli-manual/database-interpret-results)) with `--format sarif-latest` for upload to github.com or the appropriate supported format tag for GitHub Enterprise Server -instances (see [AUTOTITLE](/enterprise-server@latest/code-security/code-scanning/integrating-with-code-scanning/sarif-support-for-code-scanning) for +instances (see [AUTOTITLE](/enterprise-server@latest/code-security/reference/code-scanning/sarif-files/sarif-support) for SARIF versions supported by your release). #### `-r, --repository=` diff --git a/content/code-security/reference/code-scanning/codeql/codeql-cli/codeql-query-packs.md b/content/code-security/reference/code-scanning/codeql/codeql-cli/codeql-query-packs.md index 83b884dce7f3..b3879fa8c473 100644 --- a/content/code-security/reference/code-scanning/codeql/codeql-cli/codeql-query-packs.md +++ b/content/code-security/reference/code-scanning/codeql/codeql-cli/codeql-query-packs.md @@ -85,7 +85,7 @@ The following properties are supported in `qlpack.yml` files. If you are unsure or it does not matter which version should be used, then you can use `"*"`, which indicates that any version of this dependency is compatible with this pack. In practice, this will usually resolve to the highest published version of the dependency. - There is a special version placeholder, `${workspace}`, which indicates that this {% data variables.product.prodname_codeql %} pack depends on whatever version of the dependency is in the same workspace. For more information, see [AUTOTITLE](/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/about-codeql-workspaces#using-workspace-as-a-version-range-in-qlpackyml-files). + There is a special version placeholder, `${workspace}`, which indicates that this {% data variables.product.prodname_codeql %} pack depends on whatever version of the dependency is in the same workspace. For more information, see [AUTOTITLE](/code-security/concepts/code-scanning/codeql/codeql-workspaces#using-workspace-as-a-version-range-in-qlpackyml-files). #### `defaultSuiteFile` @@ -158,7 +158,7 @@ The following properties are supported in `qlpack.yml` files. #### `extractor` * Required by all packs containing {% data variables.product.prodname_codeql %} tests. -* Defines the {% data variables.product.prodname_codeql %} language extractor to use when running the {% data variables.product.prodname_codeql %} tests in the pack. For more information about testing queries, see [AUTOTITLE](/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/testing-custom-queries). For example: +* Defines the {% data variables.product.prodname_codeql %} language extractor to use when running the {% data variables.product.prodname_codeql %} tests in the pack. For more information about testing queries, see [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/scan-from-the-command-line/test-custom-queries). For example: ```yaml extractor: javascript-typescript @@ -252,7 +252,7 @@ dependencies: version: 1.2.4 ``` -The `codeql/cpp-all` dependency is locked to version 0.1.4. The `my-user/my-lib` dependency is locked to version 0.2.4. The `my-user/transitive-dependency`, which is a transitive dependency and is not specified in the `qlpack.yml` file, is locked to version 1.2.4. The `other-dependency/from-source` is absent from the lock file since it is resolved from source. This dependency must be available in the same {% data variables.product.prodname_codeql %} workspace as the pack. For more information about {% data variables.product.prodname_codeql %} workspaces and resolving dependencies from source, see [AUTOTITLE](/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/about-codeql-workspaces). +The `codeql/cpp-all` dependency is locked to version 0.1.4. The `my-user/my-lib` dependency is locked to version 0.2.4. The `my-user/transitive-dependency`, which is a transitive dependency and is not specified in the `qlpack.yml` file, is locked to version 1.2.4. The `other-dependency/from-source` is absent from the lock file since it is resolved from source. This dependency must be available in the same {% data variables.product.prodname_codeql %} workspace as the pack. For more information about {% data variables.product.prodname_codeql %} workspaces and resolving dependencies from source, see [AUTOTITLE](/code-security/concepts/code-scanning/codeql/codeql-workspaces). In most cases, the `codeql-pack.lock.yml` file is only relevant for query packs since library packs are non-executable and usually do not need their transitive dependencies to be fixed. The exception to this is for library packs that contain tests. In this case, the `codeql-pack.lock.yml` file is used to ensure that the tests are always run with the same versions of dependencies to avoid spurious failures when there are mismatched dependencies. @@ -298,7 +298,7 @@ databases. You may also wish to specify the `tests` property. {% data reusables.codeql-cli.test-qlpack %} -For more information about running tests, see [AUTOTITLE](/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/testing-custom-queries). +For more information about running tests, see [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/scan-from-the-command-line/test-custom-queries). ## Example {% data variables.product.prodname_codeql %} packs in the {% data variables.product.prodname_codeql %} repository @@ -350,7 +350,7 @@ defaultSuiteFile: codeql-suites/cpp-code-scanning.qls Some extra notes on the following properties: -* `dependencies`: This query pack depends on `codeql/cpp-all` and `codeql/suite-helpers`. Since these dependencies are resolved from source, it does not matter what version of the {% data variables.product.prodname_codeql %} pack they are compatible with. For more information about resolving dependencies from source, see [Source Dependencies](/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/about-codeql-workspaces#source-dependencies). +* `dependencies`: This query pack depends on `codeql/cpp-all` and `codeql/suite-helpers`. Since these dependencies are resolved from source, it does not matter what version of the {% data variables.product.prodname_codeql %} pack they are compatible with. For more information about resolving dependencies from source, see [Source Dependencies](/code-security/concepts/code-scanning/codeql/codeql-workspaces#source-dependencies). * `suites`: Indicates the directory containing "well-known" query suites. diff --git a/content/code-security/reference/code-scanning/codeql/codeql-cli/exit-codes.md b/content/code-security/reference/code-scanning/codeql/codeql-cli/exit-codes.md index 6edc1712e744..90b142254f86 100644 --- a/content/code-security/reference/code-scanning/codeql/codeql-cli/exit-codes.md +++ b/content/code-security/reference/code-scanning/codeql/codeql-cli/exit-codes.md @@ -29,7 +29,7 @@ Success, normal termination. The command successfully determined that the answer to your question is "no". -This exit code is only used by a few commands, such as [AUTOTITLE](/code-security/codeql-cli/codeql-cli-manual/test-run), [AUTOTITLE](/code-security/codeql-cli/codeql-cli-manual/dataset-check), [AUTOTITLE](/code-security/codeql-cli/codeql-cli-manual/query-format),and [AUTOTITLE](/code-security/codeql-cli/codeql-cli-manual/resolve-extractor). +This exit code is only used by a few commands, such as [AUTOTITLE](/code-security/reference/code-scanning/codeql/codeql-cli-manual/test-run), [AUTOTITLE](/code-security/reference/code-scanning/codeql/codeql-cli-manual/dataset-check), [AUTOTITLE](/code-security/reference/code-scanning/codeql/codeql-cli-manual/query-format), and [AUTOTITLE](/code-security/reference/code-scanning/codeql/codeql-cli-manual/resolve-extractor). For more details, see the documentation for those commands. ## 2 @@ -47,7 +47,7 @@ In this case, the launcher can’t start the Java code for the {% data variables ## 32 -The extractor didn’t find any code to analyze when running [AUTOTITLE](/code-security/codeql-cli/codeql-cli-manual/database-create) or [AUTOTITLE](/code-security/codeql-cli/codeql-cli-manual/database-finalize). +The extractor didn’t find any code to analyze when running [AUTOTITLE](/code-security/reference/code-scanning/codeql/codeql-cli-manual/database-create) or [AUTOTITLE](/code-security/reference/code-scanning/codeql/codeql-cli-manual/database-finalize). ## 33 diff --git a/content/code-security/reference/code-scanning/codeql/codeql-cli/sarif-output.md b/content/code-security/reference/code-scanning/codeql/codeql-cli/sarif-output.md index f82f4567bb0b..24d6105b57cc 100644 --- a/content/code-security/reference/code-scanning/codeql/codeql-cli/sarif-output.md +++ b/content/code-security/reference/code-scanning/codeql/codeql-cli/sarif-output.md @@ -20,7 +20,7 @@ category: ## About SARIF output SARIF is designed to represent the output of a broad range of static analysis tools, and there are many features in the SARIF specification that are -considered "optional". This document details the output produced when using the format type `sarifv2.1.0`, which corresponds to the SARIF v2.1.0.csd1 specification. For more information on selecting a file format for your analysis results, see [AUTOTITLE](/code-security/codeql-cli/codeql-cli-manual/database-analyze). +considered "optional". This document details the output produced when using the format type `sarifv2.1.0`, which corresponds to the SARIF v2.1.0.csd1 specification. For more information on selecting a file format for your analysis results, see [AUTOTITLE](/code-security/reference/code-scanning/codeql/codeql-cli-manual/database-analyze). ## SARIF specification and schema diff --git a/content/code-security/reference/code-scanning/codeql/codeql-for-vs-code/controller-repository-warning.md b/content/code-security/reference/code-scanning/codeql/codeql-for-vs-code/controller-repository-warning.md index 6bea3463445e..ac86fd64b0b7 100644 --- a/content/code-security/reference/code-scanning/codeql/codeql-for-vs-code/controller-repository-warning.md +++ b/content/code-security/reference/code-scanning/codeql/codeql-for-vs-code/controller-repository-warning.md @@ -29,4 +29,4 @@ When you run variant analysis, you'll see any errors and warnings displayed in t ## Fixing the problem -To analyze private repositories, you should edit your settings to update your controller repository to a private repository. For information on how to edit the controller repository, see [AUTOTITLE](/code-security/codeql-for-vs-code/using-the-advanced-functionality-of-the-codeql-for-vs-code-extension/customizing-settings#configuring-settings-for-variant-analysis). +To analyze private repositories, you should edit your settings to update your controller repository to a private repository. For information on how to edit the controller repository, see [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/scan-from-vs-code/customize-settings#configuring-settings-for-variant-analysis). diff --git a/content/code-security/reference/code-scanning/codeql/codeql-for-vs-code/telemetry-in-codeql-for-visual-studio-code.md b/content/code-security/reference/code-scanning/codeql/codeql-for-vs-code/telemetry-in-codeql-for-visual-studio-code.md index 657704941b74..511cfe7854a8 100644 --- a/content/code-security/reference/code-scanning/codeql/codeql-for-vs-code/telemetry-in-codeql-for-visual-studio-code.md +++ b/content/code-security/reference/code-scanning/codeql/codeql-for-vs-code/telemetry-in-codeql-for-visual-studio-code.md @@ -41,7 +41,7 @@ If telemetry is enabled, {% data variables.product.company_short %} collects the * IP address of the client sending the telemetry data. This is discarded before aggregation. -* Whether any {% data variables.product.prodname_codeql %} for {% data variables.product.prodname_vscode_shortname %} extension settings are configured. For more information about customizing settings, see [AUTOTITLE](/code-security/codeql-for-vs-code/using-the-advanced-functionality-of-the-codeql-for-vs-code-extension/customizing-settings). +* Whether any {% data variables.product.prodname_codeql %} for {% data variables.product.prodname_vscode_shortname %} extension settings are configured. For more information about customizing settings, see [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/scan-from-vs-code/customize-settings). ## How long data is retained diff --git a/content/code-security/reference/code-scanning/codeql/codeql-queries/built-in-queries.md b/content/code-security/reference/code-scanning/codeql/codeql-queries/built-in-queries.md index c46843119ba3..d877f00952aa 100644 --- a/content/code-security/reference/code-scanning/codeql/codeql-queries/built-in-queries.md +++ b/content/code-security/reference/code-scanning/codeql/codeql-queries/built-in-queries.md @@ -22,4 +22,4 @@ For each language, the following articles list which queries are included in the {% data reusables.code-scanning.codeql-query-tables.links-to-all-tables %} -For more information about CodeQL query suites, see [AUTOTITLE](/code-security/code-scanning/managing-your-code-scanning-configuration/codeql-query-suites). +For more information about CodeQL query suites, see [AUTOTITLE](/code-security/concepts/code-scanning/codeql/codeql-query-suites). diff --git a/content/code-security/reference/code-scanning/sarif-files/sarif-support.md b/content/code-security/reference/code-scanning/sarif-files/sarif-support.md index 03d53ff67c06..e79f8a3ff0dc 100644 --- a/content/code-security/reference/code-scanning/sarif-files/sarif-support.md +++ b/content/code-security/reference/code-scanning/sarif-files/sarif-support.md @@ -39,7 +39,7 @@ The filepath has to be consistent across the runs to enable a computation of a s {% data variables.product.prodname_dotcom %} uses the `partialFingerprints` property in the OASIS standard to detect when two results are logically identical. For more information, see the [partialFingerprints property](https://docs.oasis-open.org/sarif/sarif/v2.1.0/cs01/sarif-v2.1.0-cs01.html#_Toc16012611) entry in the OASIS documentation. -SARIF files created by the {% data variables.code-scanning.codeql_workflow %}, or using the {% data variables.product.prodname_codeql_cli %} include fingerprint data. If you upload a SARIF file using the `upload-sarif` action and this data is missing, {% data variables.product.prodname_dotcom %} attempts to populate the `partialFingerprints` field from the source files. For more information about uploading results, see [AUTOTITLE](/code-security/code-scanning/integrating-with-code-scanning/uploading-a-sarif-file-to-github). +SARIF files created by the {% data variables.code-scanning.codeql_workflow %}, or using the {% data variables.product.prodname_codeql_cli %} include fingerprint data. If you upload a SARIF file using the `upload-sarif` action and this data is missing, {% data variables.product.prodname_dotcom %} attempts to populate the `partialFingerprints` field from the source files. For more information about uploading results, see [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/integrate-with-existing-tools/upload-sarif-file). If you upload a SARIF file without fingerprint data using the `/code-scanning/sarifs` API endpoint, the {% data variables.product.prodname_code_scanning %} alerts will be processed and displayed, but users may see duplicate alerts. To avoid seeing duplicate alerts, you should calculate fingerprint data and populate the `partialFingerprints` property before you upload the SARIF file. You may find the script that the `upload-sarif` action uses a helpful starting point: https://github.com/github/codeql-action/blob/main/src/fingerprints.ts. For more information about the API, see [AUTOTITLE](/rest/code-scanning/code-scanning#upload-an-analysis-as-sarif-data). @@ -100,13 +100,13 @@ If the relative URI for a result is matched against a file defined using a symli You can check a SARIF file is compatible with {% data variables.product.prodname_code_scanning %} by testing it against the {% data variables.product.prodname_dotcom %} ingestion rules. For more information, visit the [Microsoft SARIF validator](https://sarifweb.azurewebsites.net/). -For each gzip-compressed SARIF file, SARIF upload supports a maximum size of 10 MB. Any uploads over this limit will be rejected. If your SARIF file is too large because it contains too many results, you should update the configuration to focus on results for the most important rules or queries. For more information, see [AUTOTITLE](/code-security/how-tos/scan-code-for-vulnerabilities/troubleshooting/troubleshooting-sarif-uploads/file-too-large). +For each gzip-compressed SARIF file, SARIF upload supports a maximum size of 10 MB. Any uploads over this limit will be rejected. If your SARIF file is too large because it contains too many results, you should update the configuration to focus on results for the most important rules or queries. For more information, see [AUTOTITLE](/code-security/reference/code-scanning/sarif-files/troubleshoot-sarif-uploads/file-too-large). -{% data variables.product.prodname_code_scanning_caps %} supports uploading a maximum number of entries for the data objects in the following table. If any of these objects exceeds its maximum value the SARIF file is rejected. For some objects, there is also an additional limit on the number of values that will be displayed. Whenever possible the most important values are shown. To get the most out of your analysis when it includes data above the supported limits, try to optimize the analysis configuration (for example, for the {% data variables.product.prodname_codeql %} tool, identify and disable the most noisy queries). For more information, see [AUTOTITLE](/code-security/how-tos/scan-code-for-vulnerabilities/troubleshooting/troubleshooting-sarif-uploads/results-exceed-limit). +{% data variables.product.prodname_code_scanning_caps %} supports uploading a maximum number of entries for the data objects in the following table. If any of these objects exceeds its maximum value the SARIF file is rejected. For some objects, there is also an additional limit on the number of values that will be displayed. Whenever possible the most important values are shown. To get the most out of your analysis when it includes data above the supported limits, try to optimize the analysis configuration (for example, for the {% data variables.product.prodname_codeql %} tool, identify and disable the most noisy queries). For more information, see [AUTOTITLE](/code-security/reference/code-scanning/sarif-files/troubleshoot-sarif-uploads/results-exceed-limit). {% data reusables.code-scanning.sarif-limits %} -For information about other errors, see [AUTOTITLE](/code-security/how-tos/scan-code-for-vulnerabilities/troubleshooting/troubleshooting-sarif-uploads). +For information about other errors, see [AUTOTITLE](/code-security/reference/code-scanning/sarif-files/troubleshoot-sarif-uploads). ## Supported properties diff --git a/content/code-security/reference/code-scanning/sarif-files/troubleshoot-sarif-uploads/file-too-large.md b/content/code-security/reference/code-scanning/sarif-files/troubleshoot-sarif-uploads/file-too-large.md index bb959188fd8f..220793232d1e 100644 --- a/content/code-security/reference/code-scanning/sarif-files/troubleshoot-sarif-uploads/file-too-large.md +++ b/content/code-security/reference/code-scanning/sarif-files/troubleshoot-sarif-uploads/file-too-large.md @@ -29,7 +29,7 @@ A fatal error occurred: SARIF file is too large One of these errors is reported if a process attempts to upload a SARIF file that is larger than the maximum size of 10 MB. {% data variables.product.prodname_code_scanning_caps %} does not accept files above this size. There are several different ways to reduce the number of results generated for upload to {% data variables.product.prodname_code_scanning %}. -You could see this error for SARIF files generated by {% data variables.product.prodname_codeql %} or by third-party analysis tools. For information about the limits on uploads, see {% data variables.product.prodname_code_scanning %}, see [AUTOTITLE](/code-security/code-scanning/integrating-with-code-scanning/sarif-support-for-code-scanning#file-compatibility). +You could see this error for SARIF files generated by {% data variables.product.prodname_codeql %} or by third-party analysis tools. For information about the limits on uploads to {% data variables.product.prodname_code_scanning %}, see [AUTOTITLE](/code-security/reference/code-scanning/sarif-files/sarif-support#file-compatibility). ## Confirming the cause of the error @@ -53,7 +53,7 @@ If you have too many results, you should configure analysis to analyze only the ### Number of queries run -If you still have too many results, check how many queries you are using to analyze the code. Try running fewer queries. You can reintroduce additional queries when the initial alerts are fixed. For example, for {% data variables.product.prodname_codeql %} analysis you could run just the default suite of queries. For more information, see [AUTOTITLE](/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#using-queries-in-ql-packs). +If you still have too many results, check how many queries you are using to analyze the code. Try running fewer queries. You can reintroduce additional queries when the initial alerts are fixed. For example, for {% data variables.product.prodname_codeql %} analysis you could run just the default suite of queries. For more information, see [AUTOTITLE](/code-security/reference/code-scanning/workflow-configuration-options#using-queries-in-ql-packs). ### Number of results found by queries @@ -70,29 +70,29 @@ The following options are listed in order of complexity. You need to revise the Excluding non-production code from analysis is a simple way to reduce the size of the results file. -* {% data variables.product.prodname_codeql %} advanced setup for {% data variables.product.prodname_code_scanning %}: use `paths` and `paths-ignore` in the workflow file to specify what code to analyze. For more information, see [AUTOTITLE](/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#specifying-directories-to-scan). -* {% data variables.product.prodname_codeql_cli %} `database create`: create a YAML configuration file for code scanning using the same syntax to define which code to analyze. Update the `database create` command to call this configuration file using the `--codescanning-config` option. For more information, see [AUTOTITLE](/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#specifying-directories-to-scan). +* {% data variables.product.prodname_codeql %} advanced setup for {% data variables.product.prodname_code_scanning %}: use `paths` and `paths-ignore` in the workflow file to specify what code to analyze. For more information, see [AUTOTITLE](/code-security/reference/code-scanning/workflow-configuration-options#specifying-directories-to-scan). +* {% data variables.product.prodname_codeql_cli %} `database create`: create a YAML configuration file for code scanning using the same syntax to define which code to analyze. Update the `database create` command to call this configuration file using the `--codescanning-config` option. For more information, see [AUTOTITLE](/code-security/reference/code-scanning/workflow-configuration-options#specifying-directories-to-scan). ### Optimizing the build command Using a build command that compiles only one variant is a simple way to reduce the size of the results file. -* {% data variables.product.prodname_codeql %} advanced setup for {% data variables.product.prodname_code_scanning %}: update the workflow file to specify your chosen build command. For more information, see [AUTOTITLE](/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages#adding-build-steps-for-a-compiled-language). -* {% data variables.product.prodname_codeql_cli %} `database create`: specify your chosen build command either by calling the `database create` command with the `--command` option, or by defining the build command in a YAML configuration file for code scanning and calling the file using the `--codescanning-config` option. For more information, see [AUTOTITLE](/code-security/codeql-cli/getting-started-with-the-codeql-cli/preparing-your-code-for-codeql-analysis#specifying-build-commands). +* {% data variables.product.prodname_codeql %} advanced setup for {% data variables.product.prodname_code_scanning %}: update the workflow file to specify your chosen build command. For more information, see [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/codeql-for-compiled-languages#adding-build-steps-for-a-compiled-language). +* {% data variables.product.prodname_codeql_cli %} `database create`: specify your chosen build command either by calling the `database create` command with the `--command` option, or by defining the build command in a YAML configuration file for code scanning and calling the file using the `--codescanning-config` option. For more information, see [AUTOTITLE](/code-security/tutorials/customize-code-scanning/prepare-code-for-analysis#specifying-build-commands). ### Defining the query suite to run You may already be running only the default security queries, but it is worth checking. -* {% data variables.product.prodname_codeql %} advanced setup for {% data variables.product.prodname_code_scanning %}: check the workflow file for the `queries` keyword. If it is not present, then only the default query suite is run. If it is present, it defines which queries to run. Try commenting out this line of the workflow file. For more information, see [AUTOTITLE](/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#using-queries-in-ql-packs). -* {% data variables.product.prodname_codeql_cli %} `database analyze`: check the database analysis command for any paths that specify queries, query suites, or query packs. If none are present, then only the default query suite is run. If any are present, they define which queries to run, you can try removing them from the call. For more information, see [AUTOTITLE](/code-security/codeql-cli/getting-started-with-the-codeql-cli/analyzing-your-code-with-codeql-queries#running-a-codeql-query-pack). +* {% data variables.product.prodname_codeql %} advanced setup for {% data variables.product.prodname_code_scanning %}: check the workflow file for the `queries` keyword. If it is not present, then only the default query suite is run. If it is present, it defines which queries to run. Try commenting out this line of the workflow file. For more information, see [AUTOTITLE](/code-security/reference/code-scanning/workflow-configuration-options#using-queries-in-ql-packs). +* {% data variables.product.prodname_codeql_cli %} `database analyze`: check the database analysis command for any paths that specify queries, query suites, or query packs. If none are present, then only the default query suite is run. If any are present, they define which queries to run, you can try removing them from the call. For more information, see [AUTOTITLE](/code-security/tutorials/customize-code-scanning/analyze-code#running-a-codeql-query-pack). ### Excluding a query from analysis If the results are dominated by the results for a single rule, excluding the rule from the analysis may be the best solution. -* {% data variables.product.prodname_codeql %} advanced setup for {% data variables.product.prodname_code_scanning %}: use the `query-filters` keyword to exclude one or more queries from analysis. For more information, see [AUTOTITLE](/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#excluding-specific-queries-from-analysis). -* {% data variables.product.prodname_codeql_cli %} `database analyze`: update the database analysis command to exclude one or more queries from analysis. For more information, see [AUTOTITLE](/code-security/codeql-cli/getting-started-with-the-codeql-cli/analyzing-your-code-with-codeql-queries#running-a-subset-of-queries-in-a-codeql-pack). +* {% data variables.product.prodname_codeql %} advanced setup for {% data variables.product.prodname_code_scanning %}: use the `query-filters` keyword to exclude one or more queries from analysis. For more information, see [AUTOTITLE](/code-security/reference/code-scanning/workflow-configuration-options#excluding-specific-queries-from-analysis). +* {% data variables.product.prodname_codeql_cli %} `database analyze`: update the database analysis command to exclude one or more queries from analysis. For more information, see [AUTOTITLE](/code-security/tutorials/customize-code-scanning/analyze-code#running-a-subset-of-queries-in-a-codeql-pack). Alternatively, you can use a tool like the [filter-sarif](https://github.com/advanced-security/filter-sarif) action to rewrite the SARIF file to exclude specific detections via an exclusion pattern. @@ -104,4 +104,4 @@ If there are many deep code paths highlighted in the SARIF results, you can redu ## Further reading -* [AUTOTITLE](/code-security/code-scanning/integrating-with-code-scanning/sarif-support-for-code-scanning) +* [AUTOTITLE](/code-security/reference/code-scanning/sarif-files/sarif-support) diff --git a/content/code-security/reference/code-scanning/sarif-files/troubleshoot-sarif-uploads/ghas-required.md b/content/code-security/reference/code-scanning/sarif-files/troubleshoot-sarif-uploads/ghas-required.md index d73d6350ae97..7ecea7018edd 100644 --- a/content/code-security/reference/code-scanning/sarif-files/troubleshoot-sarif-uploads/ghas-required.md +++ b/content/code-security/reference/code-scanning/sarif-files/troubleshoot-sarif-uploads/ghas-required.md @@ -28,4 +28,4 @@ This error is reported if a process attempts to upload a SARIF file to a reposit You will only see this error for SARIF files that contain results created using {% data variables.product.prodname_codeql %}{% ifversion fpt or ghec %} and for uploads to repositories with private or internal visibility. {% data variables.product.prodname_GH_code_security %} is enabled by default for all public repositories{% endif %}. -For information on how to confirm this error and fix the problem, see [AUTOTITLE](/code-security/code-scanning/troubleshooting-code-scanning/advanced-security-must-be-enabled). +For information on how to confirm this error and fix the problem, see [AUTOTITLE](/code-security/reference/code-scanning/troubleshoot-analysis-errors/advanced-security-must-be-enabled). diff --git a/content/code-security/reference/code-scanning/sarif-files/troubleshoot-sarif-uploads/results-exceed-limit.md b/content/code-security/reference/code-scanning/sarif-files/troubleshoot-sarif-uploads/results-exceed-limit.md index 41c8bb326e6f..085a53341ac6 100644 --- a/content/code-security/reference/code-scanning/sarif-files/troubleshoot-sarif-uploads/results-exceed-limit.md +++ b/content/code-security/reference/code-scanning/sarif-files/troubleshoot-sarif-uploads/results-exceed-limit.md @@ -46,7 +46,7 @@ You could see these errors for SARIF files generated by {% data variables.produc {% data reusables.code-scanning.sarif-limits %} -For information about validating your SARIF file, see [AUTOTITLE](/code-security/code-scanning/integrating-with-code-scanning/sarif-support-for-code-scanning#file-compatibility). +For information about validating your SARIF file, see [AUTOTITLE](/code-security/reference/code-scanning/sarif-files/sarif-support#file-compatibility). ## Fixing soft limit errors @@ -54,7 +54,7 @@ When soft limits are exceeded, {% data variables.product.prodname_code_scanning ## Fixing "Analysis SARIF file rejected due to results limits" -There are many considerations and potential solutions for reducing the number of results included in a SARIF results file. For guidance, see [AUTOTITLE](/code-security/how-tos/scan-code-for-vulnerabilities/troubleshooting/troubleshooting-sarif-uploads/file-too-large). +There are many considerations and potential solutions for reducing the number of results included in a SARIF results file. For guidance, see [AUTOTITLE](/code-security/reference/code-scanning/sarif-files/troubleshoot-sarif-uploads/file-too-large). ## Fixing "Alert(s) in SARIF file exceeded thread flow location limits" @@ -64,28 +64,28 @@ You can configure the analysis to limit the number of dataflow paths included in ## Fixing "Analysis SARIF file rejected due to run limits" -The simplest approach is generate a new SARIF file for each run and upload each file separately. You add a "category" to each results and this enables {% data variables.product.prodname_code_scanning %} to store and display the results appropriately. For more information, see [AUTOTITLE](/code-security/how-tos/scan-code-for-vulnerabilities/integrate-with-existing-tools/uploading-a-sarif-file-to-github#uploading-more-than-one-sarif-file-for-a-commit). +The simplest approach is generate a new SARIF file for each run and upload each file separately. You add a "category" to each results and this enables {% data variables.product.prodname_code_scanning %} to store and display the results appropriately. For more information, see [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/integrate-with-existing-tools/upload-sarif-file#uploading-more-than-one-sarif-file-for-a-commit). ## Fixing "Analysis SARIF file rejected due to rule limits" There are two possible approaches here. -1. Reduce the number of rules you use to analyze the code. For more information, see [Defining the query suite to run](/code-security/how-tos/scan-code-for-vulnerabilities/troubleshooting/troubleshooting-sarif-uploads/file-too-large#defining-the-query-suite-to-run) and [Excluding a query from analysis](/code-security/how-tos/scan-code-for-vulnerabilities/troubleshooting/troubleshooting-sarif-uploads/file-too-large#excluding-a-query-from-analysis) in "SARIF results file too large." -1. Run the analysis twice, each time with a different set of rules, and upload both results files to {% data variables.product.prodname_code_scanning %}. For more information, see [AUTOTITLE](/code-security/how-tos/scan-code-for-vulnerabilities/integrate-with-existing-tools/uploading-a-sarif-file-to-github#uploading-more-than-one-sarif-file-for-a-commit). +1. Reduce the number of rules you use to analyze the code. For more information, see [Defining the query suite to run](/code-security/reference/code-scanning/sarif-files/troubleshoot-sarif-uploads/file-too-large#defining-the-query-suite-to-run) and [Excluding a query from analysis](/code-security/reference/code-scanning/sarif-files/troubleshoot-sarif-uploads/file-too-large#excluding-a-query-from-analysis) in "SARIF results file too large." +1. Run the analysis twice, each time with a different set of rules, and upload both results files to {% data variables.product.prodname_code_scanning %}. For more information, see [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/integrate-with-existing-tools/upload-sarif-file#uploading-more-than-one-sarif-file-for-a-commit). ## Fixing "Analysis SARIF file rejected due to extension limits" -The simplest approach is to create a separate SARIF file each time you run the tool and upload each file separately. You may also need to contact the maintainer of the tool. For more information, see [AUTOTITLE](/code-security/how-tos/scan-code-for-vulnerabilities/integrate-with-existing-tools/uploading-a-sarif-file-to-github#uploading-more-than-one-sarif-file-for-a-commit). +The simplest approach is to create a separate SARIF file each time you run the tool and upload each file separately. You may also need to contact the maintainer of the tool. For more information, see [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/integrate-with-existing-tools/upload-sarif-file#uploading-more-than-one-sarif-file-for-a-commit). {% data variables.product.prodname_codeql %} analysis should not generate this error. If you see this error while using the {% data variables.product.prodname_codeql %} action or {% data variables.product.prodname_codeql_cli %}, you should contact {% data variables.contact.github_support %} to let us know. For more information, see [AUTOTITLE](/support/contacting-github-support). ## Fixing "Analysis SARIF file rejected due to location limit" -The best way to resolve this problem is usually to identify the query that reports too many locations and exclude it from analysis. For information on how to do this, see [AUTOTITLE](/code-security/how-tos/scan-code-for-vulnerabilities/troubleshooting/troubleshooting-sarif-uploads/file-too-large#excluding-a-query-from-analysis). +The best way to resolve this problem is usually to identify the query that reports too many locations and exclude it from analysis. For information on how to do this, see [AUTOTITLE](/code-security/reference/code-scanning/sarif-files/troubleshoot-sarif-uploads/file-too-large#excluding-a-query-from-analysis). ## Fixing "Analysis SARIF file rejected due to rule tag limits" -You need to update the SARIF file or the generator so that the array of tags reported for each `reportingDescriptor` object is fewer than 10. For more information, see `properties.tags[]` in [AUTOTITLE](/code-security/code-scanning/integrating-with-code-scanning/sarif-support-for-code-scanning#reportingdescriptor-object). +You need to update the SARIF file or the generator so that the array of tags reported for each `reportingDescriptor` object is fewer than 10. For more information, see `properties.tags[]` in [AUTOTITLE](/code-security/reference/code-scanning/sarif-files/sarif-support#reportingdescriptor-object). ## Fixing "Repository is at risk of exceeding the alert limit" & "All analysis uploads blocked due to alert limit" diff --git a/content/code-security/reference/code-scanning/sarif-files/troubleshoot-sarif-uploads/sarif-invalid.md b/content/code-security/reference/code-scanning/sarif-files/troubleshoot-sarif-uploads/sarif-invalid.md index 849d517215f1..a5c30cc4c1d2 100644 --- a/content/code-security/reference/code-scanning/sarif-files/troubleshoot-sarif-uploads/sarif-invalid.md +++ b/content/code-security/reference/code-scanning/sarif-files/troubleshoot-sarif-uploads/sarif-invalid.md @@ -31,8 +31,8 @@ You are unlikely to see this error when using {% data variables.product.prodname ## Confirming the cause of the error -You can investigate the underlying cause of the error by looking at the log for the workflow run that uploaded the analysis and by checking the SARIF file in a validator. For more information, see [AUTOTITLE](/actions/monitoring-and-troubleshooting-workflows/using-workflow-run-logs) and visit the [Microsoft SARIF validator](https://sarifweb.azurewebsites.net/). +You can investigate the underlying cause of the error by looking at the log for the workflow run that uploaded the analysis and by checking the SARIF file in a validator. For more information, see [AUTOTITLE](/actions/how-tos/monitor-workflows/use-workflow-run-logs) and visit the [Microsoft SARIF validator](https://sarifweb.azurewebsites.net/). ## Fixing the problem -After you identify the invalid parts of the SARIF file, you may be able to resolve smaller issues manually, but you may need to talk to the maintainers of the tool. For information about validation and the format supported by {% data variables.product.prodname_code_scanning %}, see [AUTOTITLE](/code-security/code-scanning/integrating-with-code-scanning/sarif-support-for-code-scanning). +After you identify the invalid parts of the SARIF file, you may be able to resolve smaller issues manually, but you may need to talk to the maintainers of the tool. For information about validation and the format supported by {% data variables.product.prodname_code_scanning %}, see [AUTOTITLE](/code-security/reference/code-scanning/sarif-files/sarif-support). diff --git a/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/advanced-security-must-be-enabled.md b/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/advanced-security-must-be-enabled.md index f5b28536a214..51cac93fc601 100644 --- a/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/advanced-security-must-be-enabled.md +++ b/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/advanced-security-must-be-enabled.md @@ -27,7 +27,7 @@ This error is reported if you try to run {% data variables.product.prodname_code {% ifversion fpt or ghec %}You will only see this error for repositories with private or internal visibility. {% data variables.product.prodname_GH_code_security %} is enabled by default for all public repositories.{% endif %} {% ifversion fpt %} -If you are on a **{% data variables.product.prodname_free_team %}** or **{% data variables.product.prodname_pro %}** plan, you can only use {% data variables.product.prodname_code_scanning %} on repositories that are publicly available. To enable {% data variables.product.prodname_code_scanning %} for private or internal repositories, you must upgrade to {% data variables.product.prodname_team %} or {% data variables.product.prodname_enterprise %} with {% data variables.product.prodname_GH_code_security %} and enable {% data variables.product.prodname_code_security %} for the repository. For more information, see [AUTOTITLE](/get-started/learning-about-github/githubs-products#github-team) and [AUTOTITLE](/get-started/learning-about-github/about-github-advanced-security). +If you are on a **{% data variables.product.prodname_free_team %}** or **{% data variables.product.prodname_pro %}** plan, you can only use {% data variables.product.prodname_code_scanning %} on repositories that are publicly available. To enable {% data variables.product.prodname_code_scanning %} for private or internal repositories, you must upgrade to {% data variables.product.prodname_team %} or {% data variables.product.prodname_enterprise %} with {% data variables.product.prodname_GH_code_security %} and enable {% data variables.product.prodname_code_security %} for the repository. For more information, see [AUTOTITLE](/get-started/learning-about-github/githubs-plans#github-team) and [AUTOTITLE](/get-started/learning-about-github/about-github-advanced-security). {% endif %} ## Confirming the cause of the error @@ -49,7 +49,7 @@ If {% data variables.product.prodname_GH_code_security %} is blocked by a policy ### Requesting access to {% data variables.product.prodname_GH_code_security %} -1. In the "{% data variables.product.UI_advanced_security %}" settings, click the enterprise name to display a list of users with access to edit the policy that controls access to {% data variables.product.prodname_code_security %} products. For more information, see [AUTOTITLE](/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-code-security-and-analysis-for-your-enterprise#enforcing-a-policy-for-the-use-of-github-advanced-security-in-your-enterprises-organizations). +1. In the "{% data variables.product.UI_advanced_security %}" settings, click the enterprise name to display a list of users with access to edit the policy that controls access to {% data variables.product.prodname_code_security %} products. For more information, see [AUTOTITLE](/admin/enforcing-policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-code-security-and-analysis-for-your-enterprise#enforcing-a-policy-for-the-use-of-github-advanced-security-in-your-enterprises-organizations). 1. Follow your company's policy for requesting access to additional features. ### Enabling {% data variables.product.prodname_GH_code_security %} diff --git a/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/analysis-takes-too-long.md b/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/analysis-takes-too-long.md index 549b3189351c..d0e8a6bf94ba 100644 --- a/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/analysis-takes-too-long.md +++ b/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/analysis-takes-too-long.md @@ -24,21 +24,21 @@ There are several approaches you can try to reduce the build time in a {% data v {% ifversion fpt or ghec %} -If you're using {% data variables.product.company_short %}-hosted runners for your {% data variables.product.prodname_code_scanning %} analysis, consider upgrading to {% data variables.actions.hosted_runners %}. These are {% data variables.product.company_short %}-hosted runners with more RAM, CPU, and disk space than standard runners. For more information about {% data variables.actions.hosted_runners %} and {% data variables.product.prodname_code_scanning %}, see [AUTOTITLE](/actions/using-github-hosted-runners/about-larger-runners) and [AUTOTITLE](/code-security/code-scanning/managing-your-code-scanning-configuration/configuring-larger-runners-for-default-setup). +If you're using {% data variables.product.company_short %}-hosted runners for your {% data variables.product.prodname_code_scanning %} analysis, consider upgrading to {% data variables.actions.hosted_runners %}. These are {% data variables.product.company_short %}-hosted runners with more RAM, CPU, and disk space than standard runners. For more information about {% data variables.actions.hosted_runners %} and {% data variables.product.prodname_code_scanning %}, see [AUTOTITLE](/actions/how-tos/manage-runners/larger-runners) and [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/configure-larger-runners). -If you're using self-hosted runners to run {% data variables.product.prodname_code_scanning %} analysis, you can increase the memory or the number of cores on those runners. If you're using {% data variables.product.prodname_codeql %} with advanced setup for your analysis, review the recommended hardware resources for {% data variables.product.prodname_codeql %} to make sure your self-hosted runners meet those requirements. For more information, see [AUTOTITLE](/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/recommended-hardware-resources-for-running-codeql). +If you're using self-hosted runners to run {% data variables.product.prodname_code_scanning %} analysis, you can increase the memory or the number of cores on those runners. If you're using {% data variables.product.prodname_codeql %} with advanced setup for your analysis, review the recommended hardware resources for {% data variables.product.prodname_codeql %} to make sure your self-hosted runners meet those requirements. For more information, see [AUTOTITLE](/code-security/reference/code-scanning/codeql/hardware-resources-for-codeql). {% elsif ghes %} -You can increase the memory or disk space available on your runners. If you're using {% data variables.product.prodname_codeql %} for your {% data variables.product.prodname_code_scanning %} analysis, you can review the recommended hardware resources for {% data variables.product.prodname_codeql %} to make sure your runners meet those requirements. For more information, see [AUTOTITLE](/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/recommended-hardware-resources-for-running-codeql). +You can increase the memory or disk space available on your runners. If you're using {% data variables.product.prodname_codeql %} for your {% data variables.product.prodname_code_scanning %} analysis, you can review the recommended hardware resources for {% data variables.product.prodname_codeql %} to make sure your runners meet those requirements. For more information, see [AUTOTITLE](/code-security/reference/code-scanning/codeql/hardware-resources-for-codeql). {% endif %} ## Use matrix builds to parallelize the analysis -To speed up analysis of workflows that involve multiple jobs, you can modify your workflow to use a matrix. For more information, see [AUTOTITLE](/actions/using-jobs/using-a-matrix-for-your-jobs). +To speed up analysis of workflows that involve multiple jobs, you can modify your workflow to use a matrix. For more information, see [AUTOTITLE](/actions/how-tos/write-workflows/choose-what-workflows-do/run-job-variations). -The default {% data variables.code-scanning.codeql_workflow %} uses a matrix of languages, which causes the analysis of each language to run in parallel. However, if you're using {% data variables.product.prodname_codeql %} with advanced setup and you have specified the languages you want to analyze directly in the "Initialize CodeQL" step, analysis of each language will happen sequentially. In this configuration, you can speed up your analysis by modifying your advanced setup workflow to use a matrix. For an example, see the workflow extract in [AUTOTITLE](/code-security/code-scanning/troubleshooting-code-scanning/some-languages-were-not-analyzed). +The default {% data variables.code-scanning.codeql_workflow %} uses a matrix of languages, which causes the analysis of each language to run in parallel. However, if you're using {% data variables.product.prodname_codeql %} with advanced setup and you have specified the languages you want to analyze directly in the "Initialize CodeQL" step, analysis of each language will happen sequentially. In this configuration, you can speed up your analysis by modifying your advanced setup workflow to use a matrix. For an example, see the workflow extract in [AUTOTITLE](/code-security/reference/code-scanning/troubleshoot-analysis-errors/some-languages-not-analyzed). ## Reduce the amount of code being analyzed in a single workflow @@ -50,7 +50,7 @@ If you split your {% data variables.product.prodname_codeql %} analysis into mul ## Run only during a `schedule` event -You may find that your analysis is slow during `push` or `pull_request` events. If so, you can set your analysis to only trigger on the `schedule` event. If you're using {% data variables.product.prodname_codeql %} for your {% data variables.product.prodname_code_scanning %} analysis, you can configure this with an advanced setup workflow, but not in default setup. For more information, see [AUTOTITLE](/actions/learn-github-actions/understanding-github-actions#events). +You may find that your analysis is slow during `push` or `pull_request` events. If so, you can set your analysis to only trigger on the `schedule` event. If you're using {% data variables.product.prodname_codeql %} for your {% data variables.product.prodname_code_scanning %} analysis, you can configure this with an advanced setup workflow, but not in default setup. For more information, see [AUTOTITLE](/actions/get-started/understand-github-actions#events). ## Check which queries or rules the workflow runs @@ -58,4 +58,4 @@ Another option to reduce analysis time is to run only the queries or rules that In {% data variables.product.prodname_codeql %}, there are two main query suites available for each language. If you have optimized the {% data variables.product.prodname_codeql %} database build and the process is still too long, you could reduce the number of queries you run. The default query suite is run automatically: it provides the best possible compromise between quality and speed. -If you're using {% data variables.product.prodname_codeql %} with advanced setup, you may be running extra queries or query suites in addition to the default queries. Check whether the workflow defines an additional query suite or additional queries to run using the `queries` element. You can experiment with disabling the additional query suite or queries. For more information, see [AUTOTITLE](/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#using-queries-in-ql-packs). +If you're using {% data variables.product.prodname_codeql %} with advanced setup, you may be running extra queries or query suites in addition to the default queries. Check whether the workflow defines an additional query suite or additional queries to run using the `queries` element. You can experiment with disabling the additional query suite or queries. For more information, see [AUTOTITLE](/code-security/reference/code-scanning/workflow-configuration-options#using-queries-in-ql-packs). diff --git a/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/automatic-build-failed.md b/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/automatic-build-failed.md index 84178363aa32..4932e735a749 100644 --- a/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/automatic-build-failed.md +++ b/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/automatic-build-failed.md @@ -22,5 +22,5 @@ If an automatic build of code for a compiled language within your project fails, ## Further reading -* [AUTOTITLE](/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning). -* [CodeQL build modes](/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages#codeql-build-modes) +* [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/configure-code-scanning/configuring-advanced-setup-for-code-scanning). +* [CodeQL build modes](/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/codeql-for-compiled-languages#codeql-build-modes) diff --git a/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/c-sharp-compiler-unexpectedly-failing.md b/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/c-sharp-compiler-unexpectedly-failing.md index 2a2c804f401f..5ce87f713b75 100644 --- a/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/c-sharp-compiler-unexpectedly-failing.md +++ b/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/c-sharp-compiler-unexpectedly-failing.md @@ -17,7 +17,7 @@ category: ## About these errors -The {% data variables.product.prodname_codeql %} tracer injects some flags into the C# compiler invocation to ensure every component is built and included in the {% data variables.product.prodname_codeql %} database, which may cause your C# code to build differently to what you expect during {% data variables.product.prodname_codeql %} analysis. See [AUTOTITLE](/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages). +The {% data variables.product.prodname_codeql %} tracer injects some flags into the C# compiler invocation to ensure every component is built and included in the {% data variables.product.prodname_codeql %} database, which may cause your C# code to build differently to what you expect during {% data variables.product.prodname_codeql %} analysis. See [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/codeql-for-compiled-languages). `/p:EmitCompilerGeneratedFiles=true` is one of the injected properties, and emits compiler-generated files during the build process. This option causes the compiler to generate additional files that are used to support features such as improved regular expression support, serialization, and web application view generation. These generated artifacts are typically not written to disk by the compiler, but setting the option to `true` forces writing the files to disk, and so the extractor can process the files. diff --git a/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/default-setup-timeout.md b/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/default-setup-timeout.md index 34aa265eae69..1a3763e0e87e 100644 --- a/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/default-setup-timeout.md +++ b/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/default-setup-timeout.md @@ -21,4 +21,4 @@ When you enable default setup, a workflow is triggered with the automatically ge You can check on the progress of the test run for default setup on the **Actions** tab. If the run is taking too long, try canceling the workflow run and restarting the configuration process. -To restart your configuration, navigate to the main page of your repository, then click **{% octicon "play" aria-hidden="true" aria-label="play" %} Actions**. Click the **{% data variables.product.prodname_codeql %}** workflow run that's in progress, then click **Cancel workflow**. Once {% octicon "stop" aria-label="cancelled" %} appears beside the workflow run name, navigate back to the **{% data variables.product.UI_advanced_security %}** settings and re-enable default setup. If default setup continues to stall, please contact {% data variables.contact.contact_support %} or try enabling advanced setup. For more information, see [AUTOTITLE](/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/configuring-advanced-setup-for-code-scanning). +To restart your configuration, navigate to the main page of your repository, then click **{% octicon "play" aria-hidden="true" aria-label="play" %} Actions**. Click the **{% data variables.product.prodname_codeql %}** workflow run that's in progress, then click **Cancel workflow**. Once {% octicon "stop" aria-label="cancelled" %} appears beside the workflow run name, navigate back to the **{% data variables.product.UI_advanced_security %}** settings and re-enable default setup. If default setup continues to stall, please contact {% data variables.contact.contact_support %} or try enabling advanced setup. For more information, see [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/configure-code-scanning/configuring-advanced-setup-for-code-scanning). diff --git a/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/fewer-lines-scanned-than-expected.md b/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/fewer-lines-scanned-than-expected.md index 2a7a7fcee59e..444ba65a92e1 100644 --- a/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/fewer-lines-scanned-than-expected.md +++ b/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/fewer-lines-scanned-than-expected.md @@ -29,7 +29,7 @@ If your {% data variables.product.prodname_codeql %} analysis scans fewer lines ## Change to a `manual` build process Replace the `autobuild` process with the same build commands you would use in production. This makes sure that {% data variables.product.prodname_codeql %} knows exactly how to compile all of the source files you want to scan. -For more information about defining build steps, see [AUTOTITLE](/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages#using-build-mode-manual-and-specifying-build-steps). +For more information about defining build steps, see [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/codeql-for-compiled-languages#using-build-mode-manual-and-specifying-build-steps). ## Inspect the copy of the source files in the {% data variables.product.prodname_codeql %} database @@ -42,6 +42,6 @@ You may be able to understand why some source files haven't been analyzed by ins debug: true ``` -This uploads the database as an actions artifact that you can download to your local machine. For more information, see [AUTOTITLE](/actions/using-workflows/storing-workflow-data-as-artifacts). +This uploads the database as an actions artifact that you can download to your local machine. For more information, see [AUTOTITLE](/actions/tutorials/store-and-share-data). The artifact will contain an archived copy of the source files scanned by {% data variables.product.prodname_codeql %} called _src.zip_. If you compare the source code files in the repository and the files in _src.zip_, you can see which types of file are missing. Once you know what types of file are not being analyzed, it is easier to understand how you may need to change the workflow for {% data variables.product.prodname_codeql %} analysis. diff --git a/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/kotlin-detected-in-no-build.md b/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/kotlin-detected-in-no-build.md index 418f0620e23b..1ab7555ec9b8 100644 --- a/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/kotlin-detected-in-no-build.md +++ b/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/kotlin-detected-in-no-build.md @@ -46,13 +46,13 @@ If you want to update the analysis to also include Kotlin files, then {% data va 1. Wait until the Kotlin code is merged into the default branch for the repository. 1. Disable and then re-enable default setup on the "Settings" page for your repository. -This will trigger a new analysis using automatic build detection. See [AUTOTITLE](/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning) and [Building Java and Kotlin](/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages#building-java-and-kotlin). +This will trigger a new analysis using automatic build detection. See [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/configure-code-scanning/configure-code-scanning) and [Building Java and Kotlin](/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/codeql-for-compiled-languages#building-java-and-kotlin). If the automatic build detection fails, you will need to use advanced setup with the correct build commands for the project to analyze both languages. ### {% data variables.product.prodname_code_scanning_caps %} advanced setup -If you already use advanced setup, you can edit the {% data variables.product.prodname_codeql %} workflow and change the build mode for `java-kotlin` from `none` to either `autobuild` to automatically build your project, or `manual` to specify your own build steps. [Building Java and Kotlin](/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages#building-java-and-kotlin). +If you already use advanced setup, you can edit the {% data variables.product.prodname_codeql %} workflow and change the build mode for `java-kotlin` from `none` to either `autobuild` to automatically build your project, or `manual` to specify your own build steps. [Building Java and Kotlin](/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/codeql-for-compiled-languages#building-java-and-kotlin). If you need to convert from default setup to advanced setup, you need enable advanced setup on the on the "Settings" page for your repository and create a {% data variables.product.prodname_codeql %} workflow. Then you can define a `manual` build mode for `java-kotlin` and define the build commands for the project. @@ -62,6 +62,6 @@ Update your calls to run the {% data variables.product.prodname_codeql_cli %} fo ## Further reading -* [AUTOTITLE](/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning) -* [Building Java and Kotlin](/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages#building-java-and-kotlin) -* [CodeQL build modes](/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages#codeql-build-modes) +* [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/configure-code-scanning/configuring-advanced-setup-for-code-scanning) +* [Building Java and Kotlin](/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/codeql-for-compiled-languages#building-java-and-kotlin) +* [CodeQL build modes](/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/codeql-for-compiled-languages#codeql-build-modes) diff --git a/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/logs-not-detailed-enough.md b/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/logs-not-detailed-enough.md index d59dcb60dc03..816d5e4e2ed5 100644 --- a/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/logs-not-detailed-enough.md +++ b/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/logs-not-detailed-enough.md @@ -27,7 +27,7 @@ To enable step debug logging: 1. In the repository that contains the workflow, set the following secret or variable: `ACTIONS_STEP_DEBUG` to `true`. If both the secret and variable are set, the value of the secret takes precedence over the variable. 1. Re-run the workflow or trigger a new run. -After setting the secret or variable, more debug events are shown in the step logs. See [AUTOTITLE](/actions/monitoring-and-troubleshooting-workflows/using-workflow-run-logs#viewing-logs-to-diagnose-failures). +After setting the secret or variable, more debug events are shown in the step logs. See [AUTOTITLE](/actions/how-tos/monitor-workflows/use-workflow-run-logs#viewing-logs-to-diagnose-failures). You can also use the `runner.debug` context to conditionally run steps only when debug logging is enabled. See [AUTOTITLE](/actions/reference/workflows-and-actions/contexts#runner-context). @@ -37,7 +37,7 @@ You can also use the `runner.debug` context to conditionally run steps only when > {% data variables.product.prodname_codeql %} debugging artifacts contain a copy of the source code being analyzed by {% data variables.product.prodname_codeql %}, therefore we suggest sharing these bundles only with people who are authorized to access that source code. You can obtain artifacts to help you debug {% data variables.product.prodname_codeql %}. -The debug artifacts will be uploaded to the workflow run as artifacts with names starting with `debug-artifacts`. If {% data variables.product.prodname_codeql %} analyzes multiple languages concurrently as part of the workflow run, there will be one such artifact for every language. The data contains the {% data variables.product.prodname_codeql %} logs, {% data variables.product.prodname_codeql %} databases, extracted source code files, and any SARIF files produced by the workflow. For more information about downloading {% data variables.product.prodname_codeql %} artifacts, see [AUTOTITLE](/actions/managing-workflow-runs/downloading-workflow-artifacts). +The debug artifacts will be uploaded to the workflow run as artifacts with names starting with `debug-artifacts`. If {% data variables.product.prodname_codeql %} analyzes multiple languages concurrently as part of the workflow run, there will be one such artifact for every language. The data contains the {% data variables.product.prodname_codeql %} logs, {% data variables.product.prodname_codeql %} databases, extracted source code files, and any SARIF files produced by the workflow. For more information about downloading {% data variables.product.prodname_codeql %} artifacts, see [AUTOTITLE](/actions/how-tos/manage-workflow-runs/download-workflow-artifacts). These artifacts will help you debug problems with {% data variables.product.prodname_codeql %} {% data variables.product.prodname_code_scanning %}. If you contact {% data variables.contact.github_support %}, they might ask for this data. @@ -57,7 +57,7 @@ Debugging artifacts for {% data variables.product.prodname_codeql %} advanced se #### Re-running jobs with debug logging enabled -The easiest option to create debugging artifacts for {% data variables.product.prodname_codeql %} advanced setup is by re-running jobs with debug logging enabled. For more information about re-running {% data variables.product.prodname_actions %} workflows and jobs, see [AUTOTITLE](/actions/managing-workflow-runs/re-running-workflows-and-jobs). +The easiest option to create debugging artifacts for {% data variables.product.prodname_codeql %} advanced setup is by re-running jobs with debug logging enabled. For more information about re-running {% data variables.product.prodname_actions %} workflows and jobs, see [AUTOTITLE](/actions/how-tos/manage-workflow-runs/re-run-workflows-and-jobs). You need to ensure that you select **Enable debug logging**. This option enables runner diagnostic logging and step debug logging for the run. You'll then be able to download {% data variables.product.prodname_codeql %} debugging artifacts to investigate further. You do not need to modify the workflow file when creating {% data variables.product.prodname_codeql %} debugging artifacts by re-running jobs. diff --git a/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/no-source-code-seen-during-build.md b/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/no-source-code-seen-during-build.md index 7029a73e92eb..bee3db8c1fb6 100644 --- a/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/no-source-code-seen-during-build.md +++ b/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/no-source-code-seen-during-build.md @@ -19,7 +19,7 @@ category: If your workflow fails with `Error: "No source code was seen during the build"` or `The process '/opt/hostedtoolcache/CodeQL/0.0.0-20200630/x64/codeql/codeql' failed with exit code 32`, this indicates that {% data variables.product.prodname_codeql %} was unable to monitor your code. There are six possible reasons for this: -1. _No supported languages:_ The repository may not contain source code that is written in languages supported by {% data variables.product.prodname_codeql %}. Check the list of supported languages and, if this is the case, remove the {% data variables.product.prodname_codeql %} workflow. For more information, see [AUTOTITLE](/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning-with-codeql#about-codeql). +1. _No supported languages:_ The repository may not contain source code that is written in languages supported by {% data variables.product.prodname_codeql %}. Check the list of supported languages and, if this is the case, remove the {% data variables.product.prodname_codeql %} workflow. For more information, see [AUTOTITLE](/code-security/concepts/code-scanning/codeql/codeql-code-scanning#about-codeql). 1. _No analyzable code of the detected languages:_ Automatic language detection identified a supported language, but there is no analyzable code of that language in the repository. A typical example is when our language detection service finds a file associated with a particular programming language like a `.h`, or `.gyp` file, but no corresponding executable code is present in the repository. To solve the problem, you can manually define the languages you want to analyze by updating the list of languages in the `language` matrix. For example, the following configuration will analyze only Go, and JavaScript. @@ -32,9 +32,9 @@ If your workflow fails with `Error: "No source code was seen during the build"` language: ['go', 'javascript-typescript'] ``` - For more information, see the workflow extract in [AUTOTITLE](/code-security/code-scanning/troubleshooting-code-scanning/some-languages-were-not-analyzed). + For more information, see the workflow extract in [AUTOTITLE](/code-security/reference/code-scanning/troubleshoot-analysis-errors/some-languages-not-analyzed). -1. _Compilation of a compiled language failed:_ Your {% data variables.product.prodname_code_scanning %} workflow tries to compile a compiled language (C, C++, C#, Go, or Java), but the code was not compiled. When a workflow specifies `build-mode: autobuild` for a language or contains an `autobuild` step, {% data variables.product.prodname_codeql %} makes a best effort to detect a suitable build method and build your code. The `autobuild` process may not succeed in building your code, depending on your specific build environment. Compilation may also fail if you have removed the `autobuild` step and did not include build steps manually. For more information about defining build steps, see [AUTOTITLE](/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages#using-build-mode-manual-and-specifying-build-steps). +1. _Compilation of a compiled language failed:_ Your {% data variables.product.prodname_code_scanning %} workflow tries to compile a compiled language (C, C++, C#, Go, or Java), but the code was not compiled. When a workflow specifies `build-mode: autobuild` for a language or contains an `autobuild` step, {% data variables.product.prodname_codeql %} makes a best effort to detect a suitable build method and build your code. The `autobuild` process may not succeed in building your code, depending on your specific build environment. Compilation may also fail if you have removed the `autobuild` step and did not include build steps manually. For more information about defining build steps, see [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/codeql-for-compiled-languages#using-build-mode-manual-and-specifying-build-steps). 1. _Cached components not detected:_ Your workflow builds a compiled language (C, C++, C#, Go, or Java) to create a {% data variables.product.prodname_codeql %} database for analysis, but portions of your build are cached to improve performance (most likely to occur with build systems like Gradle or Bazel). Since {% data variables.product.prodname_codeql %} observes the activity of the compiler to understand the data flows in a repository, {% data variables.product.prodname_codeql %} requires a complete build to take place in order to perform analysis. @@ -42,10 +42,10 @@ If your workflow fails with `Error: "No source code was seen during the build"` 1. _Compilation not detected by {% data variables.product.prodname_codeql %}:_ Your compiled code (in C, C++, C#, Go, or Java) was compiled successfully, but {% data variables.product.prodname_codeql %} was unable to detect the compiler invocations. The most common causes are: - * Running your build process in a separate container to {% data variables.product.prodname_codeql %}. For more information, see [AUTOTITLE](/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/running-codeql-code-scanning-in-a-container). + * Running your build process in a separate container to {% data variables.product.prodname_codeql %}. For more information, see [AUTOTITLE](/code-security/tutorials/customize-code-scanning/run-in-a-container). * Building using a distributed build system external to GitHub Actions, using a daemon process. * {% data variables.product.prodname_codeql %} isn't aware of the specific compiler you are using. If you encounter another problem with your specific compiler or configuration, contact {% data variables.contact.contact_support %}. -For more information about specifying build steps, see [AUTOTITLE](/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages#adding-build-steps-for-a-compiled-language). +For more information about specifying build steps, see [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/codeql-for-compiled-languages#adding-build-steps-for-a-compiled-language). diff --git a/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/out-of-disk-or-memory.md b/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/out-of-disk-or-memory.md index 52bbbcdb9f39..c26217f93519 100644 --- a/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/out-of-disk-or-memory.md +++ b/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/out-of-disk-or-memory.md @@ -26,7 +26,7 @@ You may see these errors when running {% data variables.product.prodname_code_sc ## Confirming the cause of the problem -You can review the recommended hardware resources for running {% data variables.product.prodname_codeql %} to make sure the runners that you use for {% data variables.product.prodname_code_scanning %} meet those requirements. For more information, see [AUTOTITLE](/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/recommended-hardware-resources-for-running-codeql). +You can review the recommended hardware resources for running {% data variables.product.prodname_codeql %} to make sure the runners that you use for {% data variables.product.prodname_code_scanning %} meet those requirements. For more information, see [AUTOTITLE](/code-security/reference/code-scanning/codeql/hardware-resources-for-codeql). ## Fixing the problem @@ -38,7 +38,7 @@ You may need to increase the memory or disk space available on the runners used If the runners you're using don't meet the recommended hardware requirements, consider using either {% data variables.actions.hosted_runners %} or self-hosted runners. -{% data variables.actions.hosted_runner_caps %}s are {% data variables.product.company_short %}-hosted runners with more RAM, CPU, and disk space than standard runners. These runners have the runner application and other tools preinstalled. For more information about {% data variables.actions.hosted_runners %} and {% data variables.product.prodname_code_scanning %}, see [AUTOTITLE](/actions/using-github-hosted-runners/about-larger-runners) and [AUTOTITLE](/code-security/code-scanning/managing-your-code-scanning-configuration/configuring-larger-runners-for-default-setup). +{% data variables.actions.hosted_runner_caps %}s are {% data variables.product.company_short %}-hosted runners with more RAM, CPU, and disk space than standard runners. These runners have the runner application and other tools preinstalled. For more information about {% data variables.actions.hosted_runners %} and {% data variables.product.prodname_code_scanning %}, see [AUTOTITLE](/actions/how-tos/manage-runners/larger-runners) and [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/configure-larger-runners). -Self-hosted runners offer more control of hardware, operating system, and software tools than {% data variables.product.company_short %}-hosted runners can provide. For more information, see [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners). +Self-hosted runners offer more control of hardware, operating system, and software tools than {% data variables.product.company_short %}-hosted runners can provide. For more information, see [AUTOTITLE](/actions/concepts/runners/self-hosted-runners). {% endif %} diff --git a/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/private-repository-enablement.md b/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/private-repository-enablement.md index 41aca3598a13..e98bf443d79a 100644 --- a/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/private-repository-enablement.md +++ b/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/private-repository-enablement.md @@ -17,7 +17,7 @@ category: --- {% ifversion fpt %} -If you are on a **{% data variables.product.prodname_free_team %}** or **{% data variables.product.prodname_pro %}** plan, you can only use {% data variables.product.prodname_code_scanning %} on repositories that are publicly available. To enable {% data variables.product.prodname_code_scanning %} for private or internal repositories, you must upgrade to {% data variables.product.prodname_team %} or {% data variables.product.prodname_enterprise %} with {% data variables.product.prodname_GH_code_security %} and enable {% data variables.product.prodname_code_security %} for the repository. For more information, see [AUTOTITLE](/get-started/learning-about-github/githubs-products#github-team) and [AUTOTITLE](/get-started/learning-about-github/about-github-advanced-security). +If you are on a **{% data variables.product.prodname_free_team %}** or **{% data variables.product.prodname_pro %}** plan, you can only use {% data variables.product.prodname_code_scanning %} on repositories that are publicly available. To enable {% data variables.product.prodname_code_scanning %} for private or internal repositories, you must upgrade to {% data variables.product.prodname_team %} or {% data variables.product.prodname_enterprise %} with {% data variables.product.prodname_GH_code_security %} and enable {% data variables.product.prodname_code_security %} for the repository. For more information, see [AUTOTITLE](/get-started/learning-about-github/githubs-plans#github-team) and [AUTOTITLE](/get-started/learning-about-github/about-github-advanced-security). {% endif %} ## Confirm whether {% data variables.product.prodname_GH_code_security %} is enabled diff --git a/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/results-different-than-expected.md b/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/results-different-than-expected.md index d4560cabfc61..793610b67a1c 100644 --- a/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/results-different-than-expected.md +++ b/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/results-different-than-expected.md @@ -20,6 +20,6 @@ If your {% data variables.product.prodname_code_scanning %} results are differen To check if default setup is enabled, navigate to the main page of the repository, then click **{% octicon "gear" aria-hidden="true" aria-label="gear" %} Settings**. In the "Security" section of the sidebar, click **{% octicon "codescan" aria-hidden="true" aria-label="codescan" %} {% data variables.product.UI_advanced_security %}**. In the "{% data variables.product.prodname_code_scanning_caps %}" section of the page, next to "{% data variables.product.prodname_codeql %} analysis", click {% octicon "kebab-horizontal" aria-label="Menu" %}. If there is a **{% octicon "workflow" aria-hidden="true" aria-label="workflow" %} Switch to advanced** option, you are currently using default setup. -If you want to return to using advanced setup and get {% data variables.product.prodname_code_scanning %} results from your custom workflow file, click **{% octicon "stop" aria-hidden="true" aria-label="stop" %} Disable {% data variables.product.prodname_codeql %}** to disable default setup. Then you should re-enable your pre-existing workflows to start triggering and uploading results from advanced setup. For more information, see [AUTOTITLE](/actions/managing-workflow-runs/disabling-and-enabling-a-workflow) and [AUTOTITLE](/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/configuring-advanced-setup-for-code-scanning). +If you want to return to using advanced setup and get {% data variables.product.prodname_code_scanning %} results from your custom workflow file, click **{% octicon "stop" aria-hidden="true" aria-label="stop" %} Disable {% data variables.product.prodname_codeql %}** to disable default setup. Then you should re-enable your pre-existing workflows to start triggering and uploading results from advanced setup. For more information, see [AUTOTITLE](/actions/how-tos/manage-workflow-runs/disable-and-enable-workflows) and [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/configure-code-scanning/configuring-advanced-setup-for-code-scanning). {% data reusables.code-scanning.troubleshooting-multiple-configurations %} diff --git a/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/some-languages-not-analyzed.md b/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/some-languages-not-analyzed.md index b272956497b8..db9a0e38f769 100644 --- a/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/some-languages-not-analyzed.md +++ b/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/some-languages-not-analyzed.md @@ -42,4 +42,4 @@ If you're using advanced setup and your workflow doesn't explicitly specify the languages: {% raw %}${{ matrix.language }}{% endraw %} ``` - For more information about editing the workflow, see [AUTOTITLE](/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning). + For more information about editing the workflow, see [AUTOTITLE](/code-security/reference/code-scanning/workflow-configuration-options). diff --git a/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/two-codeql-workflows.md b/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/two-codeql-workflows.md index d2170d18c456..8729a930f7f9 100644 --- a/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/two-codeql-workflows.md +++ b/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/two-codeql-workflows.md @@ -17,7 +17,7 @@ category: {% data reusables.code-scanning.codeql-action-version-ghes %} -Default setup overrides existing {% data variables.product.prodname_codeql %} setups by disabling any existing {% data variables.product.prodname_codeql %} workflows, and blocking any {% data variables.product.prodname_codeql %} analysis API uploads. This behavior stops you using {% data variables.product.prodname_actions %} minutes to run workflows for {% data variables.product.prodname_codeql %} advanced setup when only the results from default setup will be used. For more information about switching between advanced and default setups, see [AUTOTITLE](/code-security/code-scanning/troubleshooting-code-scanning/results-are-different-than-expected). +Default setup overrides existing {% data variables.product.prodname_codeql %} setups by disabling any existing {% data variables.product.prodname_codeql %} workflows, and blocking any {% data variables.product.prodname_codeql %} analysis API uploads. This behavior stops you using {% data variables.product.prodname_actions %} minutes to run workflows for {% data variables.product.prodname_codeql %} advanced setup when only the results from default setup will be used. For more information about switching between advanced and default setups, see [AUTOTITLE](/code-security/reference/code-scanning/troubleshoot-analysis-errors/results-different-than-expected). Optionally, if you are certain you no longer need the pre-existing workflow file, you can delete the file from your repository. For more information, see [AUTOTITLE](/repositories/working-with-files/managing-files/deleting-files-in-a-repository). diff --git a/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/unclear-what-triggered-a-workflow.md b/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/unclear-what-triggered-a-workflow.md index cd9ba67b9270..e5b3f6f44bf4 100644 --- a/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/unclear-what-triggered-a-workflow.md +++ b/content/code-security/reference/code-scanning/troubleshoot-analysis-errors/unclear-what-triggered-a-workflow.md @@ -16,6 +16,6 @@ category: - Troubleshoot security tools --- -The {% data variables.code-scanning.tool_status_page %} shows you how well {% data variables.product.prodname_code_scanning %} tools are working for a repository, when files in the repository were first scanned and most recently scanned, and when scans are scheduled. For integrated tools like {% data variables.product.prodname_codeql %}, you can also see more detailed information, including a percentage of files scanned and specific error messages. For more information about the {% data variables.code-scanning.tool_status_page %}, see [AUTOTITLE](/code-security/code-scanning/managing-your-code-scanning-configuration/about-the-tool-status-page). +The {% data variables.code-scanning.tool_status_page %} shows you how well {% data variables.product.prodname_code_scanning %} tools are working for a repository, when files in the repository were first scanned and most recently scanned, and when scans are scheduled. For integrated tools like {% data variables.product.prodname_codeql %}, you can also see more detailed information, including a percentage of files scanned and specific error messages. For more information about the {% data variables.code-scanning.tool_status_page %}, see [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/use-the-tools-status-page-for-code-scanning). -You can also view the logging output from {% data variables.product.prodname_code_scanning %} runs using {% data variables.product.prodname_actions %} ({% data variables.product.prodname_codeql %} or third-party). For more information, see [AUTOTITLE](/code-security/code-scanning/managing-your-code-scanning-configuration/viewing-code-scanning-logs). +You can also view the logging output from {% data variables.product.prodname_code_scanning %} runs using {% data variables.product.prodname_actions %} ({% data variables.product.prodname_codeql %} or third-party). For more information, see [AUTOTITLE](/code-security/how-tos/view-and-interpret-data/view-code-scanning-logs). diff --git a/content/code-security/reference/code-scanning/workflow-configuration-options.md b/content/code-security/reference/code-scanning/workflow-configuration-options.md index ac6f39b74d51..fc0b1f081819 100644 --- a/content/code-security/reference/code-scanning/workflow-configuration-options.md +++ b/content/code-security/reference/code-scanning/workflow-configuration-options.md @@ -40,19 +40,19 @@ Scanning code when someone pushes a change, and whenever a pull request is creat ### Scanning on push -By default, the {% data variables.code-scanning.codeql_workflow %} uses the `on:push` event to trigger a code scan on every push to the default branch of the repository and any protected branches. For {% data variables.product.prodname_code_scanning %} to be triggered on a specified branch, the workflow must exist in that branch. For more information, see [AUTOTITLE](/actions/using-workflows/workflow-syntax-for-github-actions#on). +By default, the {% data variables.code-scanning.codeql_workflow %} uses the `on:push` event to trigger a code scan on every push to the default branch of the repository and any protected branches. For {% data variables.product.prodname_code_scanning %} to be triggered on a specified branch, the workflow must exist in that branch. For more information, see [AUTOTITLE](/actions/reference/workflows-and-actions/workflow-syntax#on). -If you scan on push, then the results appear in the **{% data variables.product.prodname_security_and_quality_tab %}** tab for your repository. For more information, see [AUTOTITLE](/code-security/code-scanning/managing-code-scanning-alerts/assessing-code-scanning-alerts-for-your-repository#viewing-the-alerts-for-a-repository). +If you scan on push, then the results appear in the **{% data variables.product.prodname_security_and_quality_tab %}** tab for your repository. For more information, see [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/assess-alerts#viewing-the-alerts-for-a-repository). -Additionally, when an `on:push` scan returns results that can be mapped to an open pull request, these alerts will automatically appear on the pull request in the same places as other pull request alerts. The alerts are identified by comparing the existing analysis of the head of the branch to the analysis for the target branch. For more information on {% data variables.product.prodname_code_scanning %} alerts in pull requests, see [AUTOTITLE](/code-security/code-scanning/managing-code-scanning-alerts/triaging-code-scanning-alerts-in-pull-requests). +Additionally, when an `on:push` scan returns results that can be mapped to an open pull request, these alerts will automatically appear on the pull request in the same places as other pull request alerts. The alerts are identified by comparing the existing analysis of the head of the branch to the analysis for the target branch. For more information on {% data variables.product.prodname_code_scanning %} alerts in pull requests, see [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/triage-alerts-in-pull-requests). ### Scanning pull requests The default {% data variables.code-scanning.codeql_workflow %} uses the `pull_request` event to trigger a code scan on pull requests targeted against the default branch. {% ifversion ghes %}The `pull_request` event is not triggered if the pull request was opened from a private fork.{% else %}If a pull request is from a private fork, the `pull_request` event will only be triggered if you've selected the "Run workflows from fork pull requests" option in the repository settings. For more information, see [AUTOTITLE](/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks).{% endif %} -For more information about the `pull_request` event, see [AUTOTITLE](/actions/using-workflows/events-that-trigger-workflows#pull_request). +For more information about the `pull_request` event, see [AUTOTITLE](/actions/reference/workflows-and-actions/events-that-trigger-workflows#pull_request). -If you scan pull requests, then the results appear as alerts in a pull request check. For more information, see [AUTOTITLE](/code-security/code-scanning/managing-code-scanning-alerts/triaging-code-scanning-alerts-in-pull-requests). +If you scan pull requests, then the results appear as alerts in a pull request check. For more information, see [AUTOTITLE](/code-security/how-tos/manage-security-alerts/manage-code-scanning-alerts/triage-alerts-in-pull-requests). Using the `pull_request` trigger, configured to scan the pull request's merge commit rather than the head commit, will produce more efficient and accurate results than scanning the head of the branch on each push. However, if you use a CI/CD system that cannot be configured to trigger on pull requests, you can still use the `on:push` trigger and {% data variables.product.prodname_code_scanning %} will map the results to open pull requests on the branch and add the alerts as annotations on the pull request. For more information, see [Scanning on push](#scanning-on-push). @@ -81,7 +81,7 @@ on: > [!NOTE] > `on:pull_request:paths-ignore` and `on:pull_request:paths` set conditions that determine whether the actions in the workflow will run on a pull request. They don't determine what files will be analyzed when the actions _are_ run. When a pull request contains any files that are not matched by `on:pull_request:paths-ignore` or `on:pull_request:paths`, the workflow runs the actions and scans all of the files changed in the pull request, including those matched by `on:pull_request:paths-ignore` or `on:pull_request:paths`, unless the files have been excluded. For information on how to exclude files from analysis, see [Specifying directories to scan](#specifying-directories-to-scan). -For more information about using `on:pull_request:paths-ignore` and `on:pull_request:paths` to determine when a workflow will run for a pull request, see [AUTOTITLE](/actions/using-workflows/workflow-syntax-for-github-actions#onpushpull_requestpull_request_targetpathspaths-ignore). +For more information about using `on:pull_request:paths-ignore` and `on:pull_request:paths` to determine when a workflow will run for a pull request, see [AUTOTITLE](/actions/reference/workflows-and-actions/workflow-syntax#onpushpull_requestpull_request_targetpathspaths-ignore). ### Scanning on a schedule @@ -112,7 +112,7 @@ This workflow scans: ## Operating system > [!NOTE] -> * Code scanning of Swift code uses macOS runners by default. {% ifversion fpt or ghec %}{% data variables.product.company_short %}-hosted macOS runners are more expensive than Linux and Windows runners, so you should consider only scanning the build step. For more information about configuring code scanning for Swift, see [AUTOTITLE](/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages#considerations-for-building-swift). For more information about pricing for {% data variables.product.company_short %}-hosted runners, see [AUTOTITLE](/billing/managing-billing-for-github-actions/about-billing-for-github-actions).{% endif %} +> * Code scanning of Swift code uses macOS runners by default. {% ifversion fpt or ghec %}{% data variables.product.company_short %}-hosted macOS runners are more expensive than Linux and Windows runners, so you should consider only scanning the build step. For more information about configuring code scanning for Swift, see [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/codeql-for-compiled-languages#considerations-for-building-swift). For more information about pricing for {% data variables.product.company_short %}-hosted runners, see [AUTOTITLE](/billing/concepts/product-billing/github-actions).{% endif %} > > * {% data reusables.code-scanning.default-setup-swift-self-hosted-runners %} @@ -134,11 +134,11 @@ jobs: runs-on: [self-hosted, ubuntu-latest] ``` -{% data variables.product.prodname_codeql %} {% data variables.product.prodname_code_scanning %} supports the latest versions of Ubuntu, Windows, and macOS. Typical values for this setting are therefore: `ubuntu-latest`, `windows-latest`, and `macos-latest`. For more information, see [AUTOTITLE](/actions/using-jobs/choosing-the-runner-for-a-job) and [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/using-labels-with-self-hosted-runners). +{% data variables.product.prodname_codeql %} {% data variables.product.prodname_code_scanning %} supports the latest versions of Ubuntu, Windows, and macOS. Typical values for this setting are therefore: `ubuntu-latest`, `windows-latest`, and `macos-latest`. For more information, see [AUTOTITLE](/actions/how-tos/write-workflows/choose-where-workflows-run/choose-the-runner-for-a-job) and [AUTOTITLE](/actions/how-tos/manage-runners/self-hosted-runners/apply-labels). -{% ifversion ghes %}You must ensure that Git is in the PATH variable on your self-hosted runners.{% else %}If you use a self-hosted runner, you must ensure that Git is in the PATH variable.{% endif %} For more information, see [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners) and [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners). +{% ifversion ghes %}You must ensure that Git is in the PATH variable on your self-hosted runners.{% else %}If you use a self-hosted runner, you must ensure that Git is in the PATH variable.{% endif %} For more information, see [AUTOTITLE](/actions/concepts/runners/self-hosted-runners) and [AUTOTITLE](/actions/how-tos/manage-runners/self-hosted-runners/add-runners). -For recommended specifications (RAM, CPU cores, and disk) for running {% data variables.product.prodname_codeql %} analysis{% ifversion not ghes %} on self-hosted machines{% endif %}, see [AUTOTITLE](/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/recommended-hardware-resources-for-running-codeql). +For recommended specifications (RAM, CPU cores, and disk) for running {% data variables.product.prodname_codeql %} analysis{% ifversion not ghes %} on self-hosted machines{% endif %}, see [AUTOTITLE](/code-security/reference/code-scanning/codeql/hardware-resources-for-codeql). ## {% data variables.product.prodname_codeql %} database location @@ -150,7 +150,7 @@ In general, you do not need to worry about where the {% data variables.code-scan db-location: {% raw %}'${{ github.runner_temp }}/my_location'{% endraw %} ``` -The {% data variables.code-scanning.codeql_workflow %} will expect the path provided in `db-location` to be writable, and either not exist, or be an empty directory. When using this parameter in a job running on a self-hosted runner or using a Docker container, it's the responsibility of the user to ensure that the chosen directory is cleared between runs, or that the databases are removed once they are no longer needed. This is not necessary for jobs running on {% data variables.product.prodname_dotcom %}-hosted runners, which obtain a fresh instance and a clean filesystem each time they run. For more information, see [AUTOTITLE](/actions/using-github-hosted-runners/about-github-hosted-runners). +The {% data variables.code-scanning.codeql_workflow %} will expect the path provided in `db-location` to be writable, and either not exist, or be an empty directory. When using this parameter in a job running on a self-hosted runner or using a Docker container, it's the responsibility of the user to ensure that the chosen directory is cleared between runs, or that the databases are removed once they are no longer needed. This is not necessary for jobs running on {% data variables.product.prodname_dotcom %}-hosted runners, which obtain a fresh instance and a clean filesystem each time they run. For more information, see [AUTOTITLE](/actions/concepts/runners/github-hosted-runners). If this parameter is not used, the {% data variables.code-scanning.codeql_workflow %} will create databases in a temporary location of its own choice. Currently the default value is {% raw %}`${{ github.runner_temp }}/codeql_databases`{% endraw %}. @@ -165,7 +165,7 @@ If this parameter is not used, the {% data variables.code-scanning.codeql_workfl {% data reusables.code-scanning.codeql-language-identifiers-table %} > [!NOTE] -> If you specify one of the alternative identifiers, this is equivalent to using the standard language identifier. For example, specifying `javascript` instead of `javascript-typescript` will not exclude analysis of TypeScript code. Instead, you can use a custom configuration file to exclude files from analysis using the `paths-ignore` setting. For more information, see [Using a custom configuration file](/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#custom-configuration-files) and [Specifying directories to scan](/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#specifying-directories-to-scan). +> If you specify one of the alternative identifiers, this is equivalent to using the standard language identifier. For example, specifying `javascript` instead of `javascript-typescript` will not exclude analysis of TypeScript code. Instead, you can use a custom configuration file to exclude files from analysis using the `paths-ignore` setting. For more information, see [Using a custom configuration file](/code-security/reference/code-scanning/workflow-configuration-options#custom-configuration-files) and [Specifying directories to scan](/code-security/reference/code-scanning/workflow-configuration-options#specifying-directories-to-scan). These language identifiers can be used as arguments to the `languages` input of the `init` action. We recommend that only one language is provided as an argument: @@ -175,7 +175,7 @@ These language identifiers can be used as arguments to the `languages` input of languages: javascript-typescript ``` -The default {% data variables.code-scanning.codeql_workflow %} file created after [configuring advanced setup for code scanning with CodeQL](/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/configuring-advanced-setup-for-code-scanning#configuring-advanced-setup-for-code-scanning-with-codeql) defines a matrix containing a property named `language` which lists the languages in your repository that will be analyzed. This matrix has been automatically pre-populated with supported languages detected in your repository. Using the `language` matrix allows {% data variables.product.prodname_codeql %} to run each language analysis in parallel and to customize analysis for each language. In an individual analysis, the name of the language from the matrix is provided to the `init` action as the argument for the `languages` input. We recommend that all workflows adopt this configuration. For more information about matrices, see [AUTOTITLE](/actions/using-jobs/using-a-matrix-for-your-jobs). +The default {% data variables.code-scanning.codeql_workflow %} file created after [configuring advanced setup for code scanning with CodeQL](/code-security/how-tos/find-and-fix-code-vulnerabilities/configure-code-scanning/configuring-advanced-setup-for-code-scanning#configuring-advanced-setup-for-code-scanning-with-codeql) defines a matrix containing a property named `language` which lists the languages in your repository that will be analyzed. This matrix has been automatically pre-populated with supported languages detected in your repository. Using the `language` matrix allows {% data variables.product.prodname_codeql %} to run each language analysis in parallel and to customize analysis for each language. In an individual analysis, the name of the language from the matrix is provided to the `init` action as the argument for the `languages` input. We recommend that all workflows adopt this configuration. For more information about matrices, see [AUTOTITLE](/actions/how-tos/write-workflows/choose-what-workflows-do/run-job-variations). ```yaml copy - uses: {% data reusables.actions.action-codeql-action-init %} @@ -200,7 +200,7 @@ jobs: build-mode: none ``` -For compiled languages, the matrix can also be used to configure which build mode should be used for analysis by changing the value of the `build-mode` property. For more information about build modes, see [AUTOTITLE](/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages#about-build-mode-none-for-codeql). +For compiled languages, the matrix can also be used to configure which build mode should be used for analysis by changing the value of the `build-mode` property. For more information about build modes, see [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/codeql-for-compiled-languages#about-build-mode-none-for-codeql). If your workflow does not provide an argument to the `languages` input of the `init` action, then {% data variables.product.prodname_codeql %} is configured to run analyses sequentially. In this case, {% data variables.product.prodname_codeql %} automatically detects, and attempts to analyze, any supported languages in the repository. Depending on the size of the repository and the number of languages, this may take a long time. If analysis for one language fails in this mode, then the analysis for all languages fails. Therefore, we do not recommend this configuration. @@ -213,7 +213,7 @@ You can use rulesets to prevent pull requests from being merged when one of the {% data reusables.code-scanning.merge-protection-rulesets-conditions %} -For more information, see [AUTOTITLE](/code-security/code-scanning/managing-your-code-scanning-configuration/set-code-scanning-merge-protection). For more general information about rulesets, see [AUTOTITLE](/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/about-rulesets). +For more information, see [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/set-merge-protection). For more general information about rulesets, see [AUTOTITLE](/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/about-rulesets). ## Analysis category @@ -235,19 +235,19 @@ If you don't specify a `category` parameter in your workflow, {% data variables. * The `.github/workflows/codeql-analysis.yml` workflow and the `analyze` action will produce the category `.github/workflows/codeql.yml:analyze`. * The `.github/workflows/codeql-analysis.yml` workflow, the `analyze` action, and the `{language: javascript-typescript, os: linux}` matrix variables will produce the category `.github/workflows/codeql-analysis.yml:analyze/language:javascript-typescript/os:linux`. -The `category` value will appear as the `.automationDetails.id` property in SARIF v2.1.0. For more information, see [AUTOTITLE](/code-security/code-scanning/integrating-with-code-scanning/sarif-support-for-code-scanning#runautomationdetails-object). +The `category` value will appear as the `.automationDetails.id` property in SARIF v2.1.0. For more information, see [AUTOTITLE](/code-security/reference/code-scanning/sarif-files/sarif-support#runautomationdetails-object). Your specified category will not overwrite the details of the `runAutomationDetails` object in the SARIF file, if included. ## {% data variables.product.prodname_codeql %} model packs -If your codebase depends on a library or framework that is not recognized by the standard queries in {% data variables.product.prodname_codeql %}, you can extend the {% data variables.product.prodname_codeql %} coverage in your {% data variables.product.prodname_code_scanning %} workflow by specifying published {% data variables.product.prodname_codeql %} model packs. For more information about creating your own model packs, see [AUTOTITLE](/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/creating-and-working-with-codeql-packs#creating-a-model-pack). +If your codebase depends on a library or framework that is not recognized by the standard queries in {% data variables.product.prodname_codeql %}, you can extend the {% data variables.product.prodname_codeql %} coverage in your {% data variables.product.prodname_code_scanning %} workflow by specifying published {% data variables.product.prodname_codeql %} model packs. For more information about creating your own model packs, see [AUTOTITLE](/code-security/tutorials/customize-code-scanning/create-and-work-with-codeql-packs#creating-a-model-pack). {% data reusables.code-scanning.beta-model-packs %} ### Using {% data variables.product.prodname_codeql %} model packs -To add one or more published {% data variables.product.prodname_codeql %} model packs, specify them inside the `with: packs:` entry within the `uses: {% data reusables.actions.action-codeql-action-init %}` section of the workflow. Within `packs` you specify one or more packages to use and, optionally, which version to download. Where you don't specify a version, the latest version is downloaded. If you want to use packages that are not publicly available, you need to set the `GITHUB_TOKEN` environment variable to a secret that has access to the packages. For more information, see [AUTOTITLE](/actions/security-guides/automatic-token-authentication) and [AUTOTITLE](/actions/security-guides/encrypted-secrets). +To add one or more published {% data variables.product.prodname_codeql %} model packs, specify them inside the `with: packs:` entry within the `uses: {% data reusables.actions.action-codeql-action-init %}` section of the workflow. Within `packs` you specify one or more packages to use and, optionally, which version to download. Where you don't specify a version, the latest version is downloaded. If you want to use packages that are not publicly available, you need to set the `GITHUB_TOKEN` environment variable to a secret that has access to the packages. For more information, see [AUTOTITLE](/actions/tutorials/authenticate-with-github_token) and [AUTOTITLE](/actions/how-tos/write-workflows/choose-what-workflows-do/use-secrets). ``` yaml copy - uses: {% data reusables.actions.action-codeql-action-init %} @@ -265,7 +265,7 @@ In this example, the default queries will be run for Java, as well as the querie ### Using query packs -To add one or more {% data variables.product.prodname_codeql %} query packs, add a `with: packs:` entry within the `uses: {% data reusables.actions.action-codeql-action-init %}` section of the workflow. Within `packs` you specify one or more packages to use and, optionally, which version to download. Where you don't specify a version, the latest version is downloaded. If you want to use packages that are not publicly available, you need to set the `GITHUB_TOKEN` environment variable to a secret that has access to the packages. For more information, see [AUTOTITLE](/actions/security-guides/automatic-token-authentication) and [AUTOTITLE](/actions/security-guides/encrypted-secrets). +To add one or more {% data variables.product.prodname_codeql %} query packs, add a `with: packs:` entry within the `uses: {% data reusables.actions.action-codeql-action-init %}` section of the workflow. Within `packs` you specify one or more packages to use and, optionally, which version to download. Where you don't specify a version, the latest version is downloaded. If you want to use packages that are not publicly available, you need to set the `GITHUB_TOKEN` environment variable to a secret that has access to the packages. For more information, see [AUTOTITLE](/actions/tutorials/authenticate-with-github_token) and [AUTOTITLE](/actions/how-tos/write-workflows/choose-what-workflows-do/use-secrets). > [!NOTE] > For workflows that generate {% data variables.product.prodname_codeql %} databases for multiple languages, you must instead specify the {% data variables.product.prodname_codeql %} query packs in a configuration file. For more information, see [Specifying {% data variables.product.prodname_codeql %} query packs](#specifying-codeql-query-packs) below. @@ -465,7 +465,7 @@ query-filters: id: js/useless-assignment-to-local ``` -To find the id of a query, you can click the alert in the list of alerts in the **{% data variables.product.prodname_security_and_quality_tab %}** tab. This opens the alert details page. The `Rule ID` field contains the query id. For more information about the alert details page, see [AUTOTITLE](/code-security/code-scanning/managing-code-scanning-alerts/about-code-scanning-alerts#about-alert-details). +To find the id of a query, you can click the alert in the list of alerts in the **{% data variables.product.prodname_security_and_quality_tab %}** tab. This opens the alert details page. The `Rule ID` field contains the query id. For more information about the alert details page, see [AUTOTITLE](/code-security/concepts/code-scanning/code-scanning-alerts#about-alert-details). > [!TIP] > * The order of the filters is important. The first filter instruction that appears after the instructions about the queries and query packs determines whether the queries are included or excluded by default. @@ -473,7 +473,7 @@ To find the id of a query, you can click the alert in the list of alerts in the You can find another example illustrating the use of these filters in the [Example configuration files](#example-configuration-files) section. -For more information about using `exclude` and `include` filters in your custom configuration file, see [AUTOTITLE](/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/creating-codeql-query-suites#filtering-the-queries-in-a-query-suite). For information on the query metadata you can filter on, see [Metadata for CodeQL queries](https://codeql.github.com/docs/writing-codeql-queries/metadata-for-codeql-queries/). +For more information about using `exclude` and `include` filters in your custom configuration file, see [AUTOTITLE](/code-security/tutorials/customize-code-scanning/create-query-suites#filtering-the-queries-in-a-query-suite). For information on the query metadata you can filter on, see [Metadata for CodeQL queries](https://codeql.github.com/docs/writing-codeql-queries/metadata-for-codeql-queries/). ### Specifying directories to scan @@ -488,13 +488,13 @@ paths-ignore: ``` > [!NOTE] -> * The `paths` and `paths-ignore` keywords, used in the context of the {% data variables.product.prodname_code_scanning %} configuration file, should not be confused with the same keywords when used for `on..paths` in a workflow. When they are used to modify `on.` in a workflow, they determine whether the actions will be run when someone modifies code in the specified directories. For more information, see [AUTOTITLE](/actions/using-workflows/workflow-syntax-for-github-actions#onpushpull_requestpull_request_targetpathspaths-ignore). +> * The `paths` and `paths-ignore` keywords, used in the context of the {% data variables.product.prodname_code_scanning %} configuration file, should not be confused with the same keywords when used for `on..paths` in a workflow. When they are used to modify `on.` in a workflow, they determine whether the actions will be run when someone modifies code in the specified directories. For more information, see [AUTOTITLE](/actions/reference/workflows-and-actions/workflow-syntax#onpushpull_requestpull_request_targetpathspaths-ignore). > * The filter pattern characters `?`, `+`, `[`, `]`, and `!` are not supported and will be matched literally. > * `**` characters can only be at the start or end of a line, or surrounded by slashes, and you can't mix `**` and other characters. For example, `foo/**`, `**/foo`, and `foo/**/bar` are all allowed syntax, but `**foo` isn't. However you can use single stars along with other characters, as shown in the example. You'll need to quote anything that contains a `*` character. -For analysis where code is built, if you want to limit {% data variables.product.prodname_code_scanning %} to specific directories in your project, you must specify appropriate build steps in the workflow. The commands you need to use to exclude a directory from the build will depend on your build system. For more information, see [AUTOTITLE](/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages#adding-build-steps-for-a-compiled-language). +For analysis where code is built, if you want to limit {% data variables.product.prodname_code_scanning %} to specific directories in your project, you must specify appropriate build steps in the workflow. The commands you need to use to exclude a directory from the build will depend on your build system. For more information, see [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/codeql-for-compiled-languages#adding-build-steps-for-a-compiled-language). -You can quickly analyze small portions of a monorepo when you modify code in specific directories. You'll need to both exclude directories in your build steps and use the `paths-ignore` and `paths` keywords for [`on.`](/actions/using-workflows/workflow-syntax-for-github-actions#onpushpull_requestpull_request_targetpathspaths-ignore) in your workflow. +You can quickly analyze small portions of a monorepo when you modify code in specific directories. You'll need to both exclude directories in your build steps and use the `paths-ignore` and `paths` keywords for [`on.`](/actions/reference/workflows-and-actions/workflow-syntax#onpushpull_requestpull_request_targetpathspaths-ignore) in your workflow. @@ -529,7 +529,7 @@ You can use the same approach to specify any valid configuration options in the > [!TIP] > You can share one configuration across multiple repositories using {% data variables.product.prodname_actions %} variables. One benefit of this approach is that you can update the configuration in a single place without editing the workflow file. > -> In the following example, `vars.CODEQL_CONF` is a {% data variables.product.prodname_actions %} variable. Its value can be the contents of any valid configuration file. For more information, see [AUTOTITLE](/actions/learn-github-actions/variables#defining-configuration-variables-for-multiple-workflows). +> In the following example, `vars.CODEQL_CONF` is a {% data variables.product.prodname_actions %} variable. Its value can be the contents of any valid configuration file. For more information, see [AUTOTITLE](/actions/how-tos/write-workflows/choose-what-workflows-do/use-variables#defining-configuration-variables-for-multiple-workflows). > > ```yaml > - uses: {% data reusables.actions.action-codeql-action-init %} @@ -540,8 +540,8 @@ You can use the same approach to specify any valid configuration options in the ## Compiled languages -For compiled languages, you can decide how the {% data variables.product.prodname_codeql %} action creates a {% data variables.product.prodname_codeql %} database for analysis. For information about the build options available, see [AUTOTITLE](/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages). +For compiled languages, you can decide how the {% data variables.product.prodname_codeql %} action creates a {% data variables.product.prodname_codeql %} database for analysis. For information about the build options available, see [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/codeql-for-compiled-languages). ## Data upload -{% data variables.product.prodname_dotcom %} can display code analysis data generated externally by a third-party tool. You can upload code analysis data with the `upload-sarif` action. For more information, see [AUTOTITLE](/code-security/code-scanning/integrating-with-code-scanning/uploading-a-sarif-file-to-github). +{% data variables.product.prodname_dotcom %} can display code analysis data generated externally by a third-party tool. You can upload code analysis data with the `upload-sarif` action. For more information, see [AUTOTITLE](/code-security/how-tos/find-and-fix-code-vulnerabilities/integrate-with-existing-tools/upload-sarif-file). diff --git a/content/copilot/reference/review-excluded-files.md b/content/copilot/reference/review-excluded-files.md index be94825f4416..d307505559f3 100644 --- a/content/copilot/reference/review-excluded-files.md +++ b/content/copilot/reference/review-excluded-files.md @@ -84,4 +84,7 @@ Files matching these patterns are also excluded: * `**/bin/**/*` > [!NOTE] - > Rust files matching `**/bin/**/*.rs` _are_ included for review. + > Some files matching `**/bin/**/*` _are_ included for review: + > + > * Rust files matching `**/bin/**/*.rs` + > * SAP Commerce Cloud (Hybris) files under `**/hybris/bin/custom/**`