GitHub Code Security

https://docs.github.com/en/code-security
Admin
GitHub Code Security provides comprehensive tools for securing code, managing vulnerabilities,...
Tokens:818,804
Snippets:5,214
Trust Score:10
Update:1 week ago
Show doc for...
Tokens:
Raw
### Example: Specify a search path for CodeQL packs

Source: https://docs.github.com/en/code-security/how-tos/find-and-fix-code-vulnerabilities/scan-from-the-command-line/specify-command-options

Globally specifies a directory for CodeQL to scan for CodeQL packs, which is not a sibling of the installation directory. The placeholder <path-to-directory> should be replaced with the actual directory path.

```shell
--search-path <path-to-directory>
```

--------------------------------

### Install dependencies with codeql pack install

Source: https://docs.github.com/en/code-security/tutorials/customize-code-scanning/create-and-work-with-codeql-packs

Use this command to install dependencies after manually editing the `qlpack.yml` file. It downloads all dependencies to the shared cache on the local disk. By default, it installs dependencies from the Container registry on GitHub.com; to use a GitHub Enterprise Server Container registry, create a `qlconfig.yml` file.

```shell
codeql pack install
```

--------------------------------

### Initialize database with indirect build tracing

Source: https://docs.github.com/en/code-security/tutorials/customize-code-scanning/prepare-code-for-analysis

Run this command from the checkout root to create a new CodeQL database with indirect build tracing. The <database> path must not exist. Use --begin-tracing to generate environment setup scripts.

```shell
codeql database init ... --begin-tracing <database>
```

--------------------------------

### Initialize a CodeQL pack with codeql pack init

Source: https://docs.github.com/en/code-security/tutorials/customize-code-scanning/create-and-work-with-codeql-packs

Run this command from the checkout root of your project to create a CodeQL pack. Replace <scope> with the GitHub organization or user account you will publish to, and <pack> with the pack name. By default, it creates a query pack; edit qlpack.yml to add library:true for a library pack.

```shell
codeql pack init <scope>/<pack>
```

--------------------------------

### Yarn Berry lockfile entry showing private registry URL

Source: https://docs.github.com/en/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configure-private-registries

Example of a yarn.lock entry after running yarn install with private registry access. The resolved field includes the private registry URL.

```shell
encoding@^0.1.11:
  version "0.1.13"
  resolved "https://private_registry_url/encoding/-/encoding-0.1.13.tgz#56574afdd791f54a8e9b2785c0582a2d26210fa9"
  integrity sha512-ETBauow1T35Y/WZMkio9jiM0Z5xjHHmJ4XmjZOq1l/dXz3lr2sRn87nJy20RupqSh1F2m3HHPSp8ShIPQJrJ3A==
  dependencies:
    iconv-lite "^0.6.2"
```

--------------------------------

### Specify directory range with globbing patterns

Source: https://docs.github.com/en/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/controlling-dependencies-updated

Use globbing patterns in `directories` to specify a range of directories. This example includes the root directory and all directories starting with `lib-` for the Composer package ecosystem, with weekly updates.

```yaml
# Specify the root directory and directories that start with "lib-",
# using globbing, for locations of manifest files

version: 2
updates:
  - package-ecosystem: "composer"
    directories:
      - "/"
      - "/lib-*"
    schedule:
      interval: "weekly"
```

--------------------------------

### Initialize database with --overlay-changes

Source: https://docs.github.com/en/code-security/how-tos/find-and-fix-code-vulnerabilities/scan-from-the-command-line/incremental-analysis

Initialize the database with --overlay-changes against the restored cached overlay-base database. PATH_TO_DATABASE must point to the restored cached overlay-base database, not a new empty directory. Do not pass --overwrite or --force-overwrite in overlay mode.

```shell
codeql database init \
  --overlay-changes=PATH_TO_OVERLAY_CHANGES_JSON \
  --db-cluster \
  PATH_TO_DATABASE \
  --source-root=PATH_TO_SOURCE \
  --language=LANGUAGE
```

--------------------------------

### codeql execute cli-server synopsis

Source: https://docs.github.com/en/code-security/reference/code-scanning/codeql/codeql-cli-manual/execute-cli-server

Shows the basic command syntax for invoking the CodeQL CLI server. Use this to start the server for running multiple commands without repeated JVM initialization.

```shell
codeql execute cli-server <options>...
```

--------------------------------

### exclude-paths YAML configuration example

Source: https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference

Example Dependabot configuration using `exclude-paths` to ignore specific directories and files. The patterns are relative to the `directory` and support glob syntax like `**` and `*`. The example ignores `src/test/assets`, all files under `vendor/`, JavaScript files directly under `src/`, and the file `src/test/helper.js`.

```yaml
version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "daily"
    exclude-paths:
      - "src/test/assets"
      - "vendor/**"
      - "src/*.js"
      - "src/test/helper.js"

# Sample patterns that can be used-

# Pattern: docs/*.json
# Matches: docs/foo.json, docs/bar.json

# Pattern: *.lock
# Matches: Gemfile.lock, package.lock, foo.lock (in any directory)

# Pattern: test/**
# Matches: test/foo.rb, test/bar/baz.rb, test/any/depth/file.txt

# Pattern: config/settings.yml
# Matches: config/settings.yml

# Pattern: **/*.md
# Matches: README.md, docs/guide.md, any/depth/file.md

# Pattern: src/*
# Matches: src/main.rb, src/app.js
# Does NOT match: src/utils/helper.rb

# Pattern: hidden/.*
# Matches: hidden/.env, hidden/.secret
```
Tokens:
Raw