Share via

Incorrect events for default CodeQL analysis

Carlos Quintero 140 Reputation points
2024-08-13T09:20:48.1333333+00:00

In module "Configure code scanning on GitHub", unit "What is code scanning?" it says:

In the default CodeQL analysis workflow, code scanning is configured to analyze your code each time you either push a change to any protected branches or raise a pull request against the default branch.

That is incorrect because the push triggers the code analysis to the main branch even if it is not protected, and it also triggers the analysis for a pull request against a protected branch (not necessarily the default branch).

The correct events are:

  • On each push to the repository's default branch, or any protected branch.
  • When creating or committing to a pull request based against the repository's default branch, or any protected branch, excluding pull requests from forks.
  • On a weekly schedule.

See official documentation (https://docs.github.com/en/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning#about-default-setup)

And the user interface is certainly:

User's image

This question is related to the following Learning Module

Windows Training
Windows Training
Windows: A family of Microsoft operating systems that run across personal computers, tablets, laptops, phones, internet of things devices, self-contained mixed reality headsets, large collaboration screens, and other devices.Training: Instruction to develop new skills.
19 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Rakesh Gurram 7,500 Reputation points Microsoft Vendor
    2024-08-15T11:05:00.51+00:00

    Hi Carlos Quintero,

    Thank you reaching out to us on the Microsoft Q&A forum.

    It’s important to note that Microsoft releases updates to preview features. These updates are reflected more quickly in the official documentation than in the learning modules. While the official documentation is updated promptly to include the latest changes, it may take some time for these updates to be incorporated into the corresponding modules. As a result, there might be a slight delay in the modules reflecting the most recent updates compared to the official documentation. 

    The statement provided in the module and the one found in the official documentation are both accurate, as they each describe the default configuration for code scanning using CodeQL. However, the statement in the official documentation offers a more detailed and comprehensive explanation of the process. In contrast, the statement in the module presents a simplified version, which distills the core elements of the workflow. Despite the difference in detail, both statements effectively convey the essential information needed to understand the default setup for CodeQL code scanning.

    Please don't hesitate to reach out to us if you have any other queries.

    If you found the information helpful, we would greatly appreciate it if you could acknowledge it by selecting the Accept Answer & Upvote options.

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.