Code Scanning

In a nutshell

Code scanning is not CodeQL 📖 Docs

Code scanning is the GitHub feature; CodeQL is one analysis engine. AI findings complement it on pull requests, and third-party tools can supply SARIF results.

How CodeQL works 📖 Docs

Extract code into a database, then compile and evaluate queries against it.

The schema describes the data; the database stores it. Extraction reads source directly or monitors a build, depending on the language and build mode ↗.

Reading a CodeQL query

QL is a declarative logic-programming language. You describe the shape of a bug and the evaluator finds every instance. The structure mirrors SQL’s FROM / WHERE / SELECT.

import java                                       // ① pull in the standard library

from IfStmt ifstmt, Block block                   // ② declare the elements to inspect
where
  block = ifstmt.getThen() and                    // ③ constrain them
  block.getNumStmt() = 0                          //    → a then-branch with no statements
select ifstmt, "This if-statement is redundant."  // ④ what to report, and how

The whole language is that shape: where is the definition of “what the bug looks like”, and the evaluator does the searching.

🔬 Security queries layer DataFlow / TaintTracking on top, defining sources, sinks and sanitizers and searching for paths between them. The packs are open source at github/codeql ↗. In practice they are enough — you write custom queries mainly to teach CodeQL the sources and sinks of your in-house framework.

📘 Details: About CodeQL queries ↗ / About data flow analysis ↗

What CodeQL finds

🌐 Supported languages — C/C++, C#, Go, Java/Kotlin, JavaScript/TypeScript, Python, Ruby, Rust, Swift, GitHub Actions. A repo with no CodeQL-supported language runs no scans and burns no Actions minutes.

Main capabilities ► DEMO

Start with Default setup, customize it with repository properties, and reach for Advanced only when you need your own build.

Why shift left: fix it in the PR

A vulnerability is cheapest to fix in the pull request that introduces it. Once merged, it becomes security debt, and debt rarely gets paid down.

• 📉 Merged means forgotten: historically, only 10% of security debt in merged code gets addressed (GitHub data ↗)
• ⏱️ In the PR, it is fast: with Copilot Autofix, PR-time alerts were fixed in a median 28 min vs 1.5 h manually (GitHub, 2024 ↗)

Copilot Autofix: suggested fixes 📖 Docs

Copilot Autofix can generate a suggested patch for an eligible alert. You review, test and apply it; a successful fix is not guaranteed.

• 🤖 Input: alert details, surrounding code and CodeQL’s data-flow path inform the suggestion.
• 💬 On pull requests: supported alerts can receive inline suggestions automatically.
• 🛠️ On default-branch backlog alerts with Agentic Autofix off: Generate fix → Create PR with fix, if Copilot Autofix is enabled and supports the alert.
• 🆓 Cost: no Copilot license or AI credits for classic Autofix. Included with Code Security; free on public repositories.
• 🔌 Enablement: allowed by default with CodeQL unless an administrator disables it.

Agentic Autofix (GA) 📖 Docs ► DEMO

GA since 2026-10-15. When Agentic Autofix is enabled, Assign to Copilot replaces Generate fix on default-branch backlog alerts.

Autofix vs Agentic Autofix 📖 Docs

Two independent settings, not a cloud-agent switch (2026-10-19).

⚠️ Preview users must enable Agentic Autofix again after GA.

Security Campaigns — drive remediation at scale

Detection is the easy half; what happens after the alert is the real work. At scale, don’t grind the raw alert list — run a time-boxed campaign.

📘 Details: About security campaigns (GitHub Docs) ↗

My recommended starting checklist 📖 Docs ► DEMO

Validate detection, protect new code, then reduce the backlog.

URL templates: replace ORG, OWNER, REPO.

Advanced setup and SARIF

When Default is not enough (monorepo, unusual build, another SAST tool), write the workflow yourself.

# .github/workflows/codeql.yml
name: CodeQL
on:
  push: { branches: [main] }
  pull_request: { branches: [main] }
  schedule: [{ cron: '30 5 * * 1' }]
jobs:
  analyze:
    runs-on: ubuntu-latest
    permissions: { security-events: write, contents: read }
    strategy:
      matrix: { language: [javascript, python] }
    steps:
      - uses: actions/checkout@v4
      - uses: github/codeql-action/init@v3
        with: { languages: '${{ matrix.language }}', queries: security-extended }
      - uses: github/codeql-action/analyze@v3

      # third-party SAST (Semgrep, Snyk, ESLint security) lands in the same UI:
      - uses: github/codeql-action/upload-sarif@v3
        with: { sarif_file: results.sarif }

💡 Point runs-on at a self-hosted runner and the Actions minutes are not billed — the first lever when scan cost bites at scale.

Pricing: three meters 📖 Docs

▸ + UNFOLDS THE DETAIL

Eligibility by repository type 📖 Docs

📦 Core: CodeQL, custom queries, SARIF uploads, eligible Autofix suggestions, PR annotations and Security overview.

💰 Actions*: standard hosted runners are free for public repos. Private repos consume included minutes, then bill overages. Larger runners are always billed.

⚠️ Public → private: Code Security is required to keep code scanning enabled.

Code Security Risk Assessment (free inventory scan)

One click, CodeQL scans the 20 most active repos in your org and shows where the vulnerabilities are. No GHAS / Code Security license needed, completely free (GA April 2026).

• 🔎 Scope — up to 20 repos with the most recent commits, re-selectable each run
• 📊 Output — report by severity, language, rule type, plus how many Copilot Autofix can fix
• 🕒 Frequency — re-runnable once every 90 days; org owners / security managers only
• 🚀 How to run — Org → Security → Assessments → Run code security risk assessment
• 🆓 Cost — no license, no Actions minutes — ideal for evaluating Code Security before buying

📊 Pair this with Secret Risk Assessment (see Secret Scanning ↗) and you get a full posture read in a single day, then decide on Code Security with real numbers.

📘 Details: Code security risk assessment ↗ / How exposed is your code? ↗