GitHub Advanced Security cheat sheet

GHAS is a paid add-on for GitHub Enterprise Cloud and GitHub Enterprise Server that bundles code scanning (CodeQL), secret scanning with push protection, and Dependabot with dependency review.

CodeQL analyzes code by compiling it into a database and running queries; default setup is configured in repository Settings > Code security, while advanced setup commits a workflow file using github/codeql-action.

Code scanning alerts appear under the Security tab; severity levels are Critical, High, Medium, Low, and Note, and alerts can be dismissed as false positive, won't fix, or used in tests.

Secret scanning detects partner patterns and custom patterns; push protection blocks a push containing a detected secret before it reaches the repository, and bypass requires a reason and permission.

Dependabot alerts are driven by the dependency graph and GitHub Advisory Database; Dependabot security updates open PRs to fix vulnerable dependencies, and version updates follow dependabot.yml schedules.

Dependency review runs on pull requests and fails the check when a PR introduces a dependency with a known vulnerability at or above the configured severity threshold.

The security overview page aggregates alert counts across an organization or enterprise, filterable by repository, team, tool, and severity, and is exportable as CSV for reporting.

GHAS license consumption is per active committer; enabling GHAS on a repository counts unique committers to private and internal repositories toward billing, while public repositories are free for code scanning and secret scanning.

Custom CodeQL queries use QL; a query has metadata (@name, @description, @kind problem or path-problem, @id, @severity) and selects results with a message and location.

CodeQL query packs are published to GitHub Container Registry and referenced in a workflow via packs or queries fields; the standard packs are codeql/javascript-queries and equivalents per language.

CodeQL supports compiled languages (C/C++, C#, Go, Java/Kotlin, Swift) via autobuild or manual build, and interpreted languages (JavaScript/TypeScript, Python, Ruby) without a build step.

Code scanning can ingest SARIF 2.1.0 results from third-party tools via upload-sarif in github/codeql-action; SARIF files must be under 10 MB per upload and use valid rule and result objects.

A CodeQL configuration file can specify paths, paths-ignore, queries, and disable-default-queries; it is referenced in the workflow with the config-file parameter or stored at .github/codeql/codeql-config.yml.

CodeQL query suites (default, security-extended, security-and-quality) trade precision for coverage; security-extended adds lower-precision queries and security-and-quality adds maintainability queries.

Secret scanning custom patterns are defined with regular expressions in organization or enterprise settings; each pattern requires a name, a secret format regex, and optionally a post-match validation endpoint.

Push protection customizations include allowlists of patterns, paths, and users, plus a resource link shown to developers explaining how to request a bypass.

Security advisories are drafted in the repository Security tab, assigned a GHSA identifier, and published to the GitHub Advisory Database; a CVE can be requested through GitHub as a CNA.

Repository security policies live in SECURITY.md and are surfaced on the Security tab; the file can be set at organization level as a default community health file.

Private vulnerability reporting lets external researchers submit reports through a repository form without opening a public issue, and maintainers triage in the Security tab.

Code scanning and secret scanning alerts support assignment, comments, and status tracking; the REST API endpoints are /repos/{owner}/{repo}/code-scanning/alerts and /secret-scanning/alerts.

Webhooks such as code_scanning_alert, secret_scanning_alert, and repository_vulnerability_alert deliver alert events to external systems for ticketing and automation.

The audit log records GHAS configuration changes (enabling features, dismissing alerts, bypassing push protection) and is available to organization owners and enterprise owners.

Dependabot alerts can be auto-dismissed with rules based on severity, package, or scope, and dismissed alerts retain a reason and optional comment for auditability.

The security manager role grants read access to security alerts and settings across an organization without full administrative rights.

Actions workflows for code scanning use permissions: security-events: write to upload SARIF, and contents: read; missing security-events write is the most common upload failure.

Code scanning runs on a schedule via cron in the workflow trigger; default setup runs on push, pull request, and a weekly schedule that can be adjusted.

Branch protection and rulesets can require the code scanning results check to pass before merging, blocking PRs that introduce new alerts above a chosen severity.

Organization-level security configurations apply GHAS settings to many repositories at once; they can be enforced so repository admins cannot disable the features.

Code scanning can be enabled for all repositories in an organization through the security overview's 'Enable GHAS' action or via the REST API and GitHub CLI.

Dependabot PRs created by security updates are authored by dependabot[bot]; workflows triggered by these PRs run with a read-only GITHUB_TOKEN unless configured otherwise.

Self-hosted runners for CodeQL require adequate disk and memory (commonly 8 GB RAM or more for large databases) and network access to download the CodeQL CLI bundle.

The CodeQL CLI (codeql database create, codeql database analyze) can run locally for debugging and produces SARIF that can be uploaded to GitHub.

GHAS metrics tracked in security overview include open alert counts, alert age, mean time to remediation, and the percentage of repositories with GHAS enabled.

Security risk is prioritized by severity, exploitability (for example, whether the advisory lists a known exploit), and whether the vulnerable dependency is reachable in production code.

Dependabot alert severity comes from the GitHub Advisory Database CVSS rating; the CVSS vector distinguishes attack vector, complexity, privileges required, and impact.

Secret scanning alerts show validity (active, inactive, unknown) when the partner supports validation; revoking the leaked credential is the required first remediation step.

Code scanning pull request checks compare alerts on the base branch with the head branch to report new, fixed, and existing alerts.

The dependency graph supports manifest files for many ecosystems; a dependency submitted via the dependency submission API appears in the graph even without a supported manifest.

Security campaigns group alerts by a chosen criteria and deadline so teams can burn down a backlog; progress is tracked in security overview.

GitHub Advisory Database entries carry CVE or GHSA identifiers; GHSA IDs are GitHub's own and may later be mapped to a CVE.

Code scanning default setup supports a limited set of languages and cannot use custom query packs; custom queries and third-party SARIF require advanced setup.

Secret scanning push protection does not scan all files: it skips certain binary files and has a per-push limit, and it can be bypassed by users with bypass permission.

CodeQL analysis of compiled languages needs a successful build; if autobuild fails, the workflow must specify manual build commands.

SARIF upload rejects results without a valid ruleId or with a category collision; each upload needs a distinct category when multiple tools report to the same repository.

Dependabot version updates require a .github/dependabot.yml file; security updates do not require this file but do require alerts to be enabled.

Enabling GHAS on a fork or a repository transferred between organizations may require re-running setup; alerts do not transfer with the code.

Actions on private repositories consume GHAS-licensed minutes only for private repository workflows; public repository workflow minutes are free.

The code scanning API returns alert instances with ref (branch) and analysis_key; filtering by ref is required to see alerts for a specific branch.

Secret scanning alerts can be closed as resolved, false positive, or used in tests; reopening is possible, and the state is recorded in the audit log.

Code scanning alert dismissal requires a reason from a fixed list; dismissed alerts can be reopened, and dismissal does not delete the underlying analysis result.

Dependabot security update PRs are grouped when compatible; grouping reduces PR noise but can complicate review when many dependencies change at once.

Secret scanning's validity check queries the partner to see if the leaked credential is still active; an inactive secret may still warrant rotation if it was exposed.

GitHub recommends rotating any secret caught by push protection even if the push was blocked, because the value may have been exposed locally or in logs.

The dependency review action fails on vulnerabilities but can also flag license issues and disallowed dependencies via configuration.

Security advisories can be published as a temporary private fork for coordinated disclosure; collaborators are invited to the private fork to prepare a fix.

GHAS trial availability and feature parity differ between GitHub Enterprise Cloud and GitHub Enterprise Server; some features (for example, certain secret scanning validations) are cloud-only.

The code scanning REST API supports listing alerts filtered by state, severity, tool, and ref, and supports PATCH to update an alert's state and dismissal reason.

The secret scanning REST API exposes alerts with secret_type, resolution, and validity fields; the endpoint requires a token with the appropriate security_events scope.

GitHub Apps and fine-grained PATs need the security_events permission to read or write code scanning and secret scanning alerts.

Webhook payloads for code_scanning_alert include action (created, reopened, closed_by_user, fixed) and the alert object with rule and most_recent_instance.

The dependency submission API (POST /repos/{owner}/{repo}/dependency-graph/snapshots) accepts a snapshot of resolved dependencies with a correlator and SHA.

GitHub CLI commands such as gh api can query code scanning and secret scanning alerts; gh secret set and gh secret list manage Actions secrets, not secret scanning alerts.

Security overview data can be exported as CSV from the UI, and the same data is reachable through the organization and enterprise security API endpoints.

Audit log streaming to SIEM tools (for example, Splunk or Amazon S3) can capture GHAS events for long-term retention beyond the UI's retention window.

A custom CodeQL query must declare @kind problem for single-location results or path-problem for data-flow results that include a source and sink path.

Data-flow queries use the DataFlow library with source, sink, and configuration classes; isSource and isSink predicates define the taint flow.

CodeQL predicates are defined with a signature returning a result type; classes extend types and can declare characteristic predicates such as getName.

The CodeQL CLI can create a query pack with codeql pack init and publish it with codeql pack publish to GitHub Container Registry.

Custom queries are referenced in a CodeQL config file under the queries key, either as a local path or as a pack reference like owner/pack@version:query.

CodeQL's security-and-quality suite includes queries for code quality; the default suite is tuned for low false positives on pull requests.

SARIF rule metadata such as security-severity (a numeric CVSS-like score) drives the severity shown in the GitHub UI for third-party results.

The CodeQL bundle version used by a workflow is pinned by the github/codeql-action version tag; mismatched CLI and query pack versions can cause analysis errors.

Security configurations can set code scanning default setup, secret scanning, push protection, Dependabot alerts, and Dependabot security updates for a group of repositories.

A configuration can be enforced, which prevents repository admins from changing the covered settings; otherwise repository-level settings can override it.

Security configurations apply to repositories by name pattern or by selecting repositories; enterprise-level configurations can cascade to organizations.

Enabling GHAS for an organization requires the enterprise to have GHAS licensed seats, and the organization owner must have permission to enable it.

The security overview's 'coverage' view shows which repositories have each GHAS feature enabled, identifying gaps in rollout.

Repository-level GHAS features can be enabled by repository admins with admin permission; organization owners can enable them across all repositories at once.

Disabling a GHAS feature stops new alerts but does not delete existing alerts; re-enabling resumes analysis without backfilling the disabled period.

The GitHub-recommended rollout order is dependency graph and Dependabot alerts first, then secret scanning with push protection, then code scanning.

Code scanning alerts are generated per analysis; the same alert on multiple branches appears as separate alert instances sharing an alert number.

The most_recent_instance field on a code scanning alert includes the branch, commit SHA, location, and message from the latest analysis.

Dependabot alerts are keyed by the dependency, the advisory, and the manifest path; the same vulnerability in two manifests produces two alerts.

Dependabot security updates open a PR only when a patched version exists; otherwise the alert remains open with no automated fix.

Secret scanning alerts are deduplicated per secret value per repository; the same secret committed on multiple branches may appear as one alert with multiple locations.

Code scanning requires a supported language and a buildable project; repositories with only configuration or documentation files will not produce meaningful CodeQL results.

SARIF results from third-party tools are stored as code scanning alerts, so they appear alongside CodeQL alerts and can be dismissed and filtered the same way.

CodeQL databases are per-language; a repository with multiple languages runs one analysis job per language in a matrix.

GitHub Copilot Autofix suggests fixes for code scanning alerts and is available for CodeQL-supported languages; the suggestion is a diff the developer reviews before committing.

Autofix suggestions are generated from the alert context and the CodeQL query; they are not automatically applied and do not guarantee correctness.

Secret scanning push protection bypasses require a reason when the user has bypass permission; the bypass is recorded and can be reviewed in the audit log.

The security overview's alert trends show open alerts over time, helping measure whether remediation outpaces new introductions.

Dependabot alert auto-dismissal rules can target alerts by severity, package ecosystem, or dependency scope to reduce noise from dev-only dependencies.

Code scanning's 'pull request check' fails only on new alerts introduced by the PR, not on pre-existing alerts, when configured with the default behavior.

Security advisories can be linked to code scanning alerts when the alert's rule maps to a published advisory, providing remediation guidance in the alert view.

Mean time to remediate is computed from alert creation to closure; dismissed alerts are excluded from remediation time in security overview metrics.