GHAS Code Security Series - Part 1: Setting Up Organization-Wide Code Scanning

[vishaljsoni]

Welcome to the first part of our comprehensive three-part series on implementing GitHub Advanced Security with CodeQL! As development teams grow and security threats evolve, establishing robust code scanning practices has become essential for protecting your organization's codebase.

In this series, we'll guide you through a progressive approach to implementing CodeQL security scanning:

• Part 1 (this post): Setting up organization-wide CodeQL scanning using security configurations
• Part 2: Implementing alert-mode repository rulesets for developer education
• Part 3: Enabling blocking controls to prevent vulnerable code merges

Whether you're a security engineer, DevOps professional, or development team lead, this series will help you build a comprehensive security strategy that protects your code while improving developer productivity without disrupting developer workflow.

What is CodeQL and Why It Matters

CodeQL is GitHub's powerful semantic code analysis engine that transforms your source code into a queryable database. Unlike traditional text-based scanners, CodeQL understands the structure and flow of your code, enabling it to:

• Detect complex vulnerabilities by tracking data flow from sources to sinks
• Find variants of known issues across your entire codebase
• Reduce false positives through semantic analysis
• Scale across organizations with hundreds or thousands of repositories

The best part? CodeQL runs automatically in the background, scanning your code on every push and pull request without disrupting your development workflow.

Step 1: Enable Default Setup for CodeQL Using Security Configuration

The foundation of any robust security program is consistent coverage across all repositories. GitHub's security configurations provide the perfect solution for applying CodeQL scanning at organizational scale.

Why Use Security Configurations?

Security configurations are collections of enablement settings for GitHub's security features that you can apply to any repository within your organization. They provide:

• Centralized management of security settings across your organization. You can also apply multiple configuration(s) depending upon your risk profiles across your repositories.
• Consistent security posture across all repositories
• Easy scaling as your organization grows
• Automated application to new repositories

This approach eliminates the need to manually configure each repository individually, ensuring no repository gets missed and maintaining consistent security standards.

Prerequisites

Before you begin, ensure you have:

• Organization owner, security manager, or admin role permissions
• GitHub Advanced Security license (for private repositories)
• GitHub Actions enabled for your organization

Step-by-Step Implementation

1. Navigate to Organization Security Settings

First, let's access your organization's security configuration panel:

1. In the upper-right corner of GitHub, click your profile picture
2. Click Organizations
3. Under your organization name, click Settings
4. In the "Security" section of the sidebar, select the Advanced Security dropdown menu
5. Click Configurations

2. Apply GitHub-Recommended Security Configuration

The easiest way to get started is with GitHub's recommended security configuration, which is created and maintained by GitHub's security experts.

1. In the "GitHub recommended" row of the configurations table
2. Select the Apply to dropdown menu
3. Choose either:
   • All repositories - applies to all current and future repositories
   • All repositories without configurations - only applies to repositories that don't already have a configuration

3. Review and Apply the Configuration

1. Review the detailed information about how your changes will affect:
   • GitHub Secret Protection features
   • GitHub Code Security features
   • GitHub Advanced Security license consumption
2. Click Apply to enable the security configuration

4. Alternative: Create a Custom Security Configuration

If you need more control over the settings, you can create one or more custom security configuration(s):

1. In the "Security configurations" section, click New configuration
2. Name your configuration and add a description
3. Configure the desired security features:
   • Code scanning: Set to "Enabled" to use default setup
   • Secret scanning: Enable as needed
   • Dependency scanning: Configure Dependabot settings
   • Private vulnerability reporting: Enable for better security disclosure

What Happens After Configuration

Once applied, the security configuration will automatically:

• Enable CodeQL default setup on all eligible repositories
• Scan code automatically on pushes to default and protected branches
• Run weekly scheduled scans to catch newly discovered vulnerabilities
• Scan pull requests against default and protected branches
• Apply to both active and archived repositories

Understanding Repository Eligibility

Not all repositories will immediately have CodeQL enabled. For a repository to be eligible:

• GitHub Actions must be enabled on the repository
• Repository must contain supported languages: Go, JavaScript/TypeScript, Python, Ruby, Java, C#, C/C++, Rust, GitHub Actions are supported with default setup without any build, while Kotlin, Swift requires an additonal step to build an application but are supported languages.
• Repository must not conflict with existing advanced setup (unless configured to allow it)

Important Considerations

Advanced Setup Compatibility

If some repositories already use advanced CodeQL setup, you can create a configuration with "Enabled with advanced setup allowed" to avoid conflicts. This ensures both default and advanced setups can coexist.

Cost Management

Applying configurations to private repositories will consume GitHub Advanced Security licenses. Monitor your license usage in the organization billing settings to avoid unexpected costs.

Additionally, when you apply a configuration to repositories, you will clearly see how many additional license(s) for Code Scanning are required to enable the configuration on selected repositories.

Monitoring Coverage

After applying your configuration, regularly check the Security Overview in your organization settings to verify:

• Which repositories have scanning enabled
• Scan completion rates
• Coverage across different languages and teams

Troubleshooting Common Issues

Issue: Configuration not applying to certain repositories
Solution: Check that repositories have GitHub Actions enabled and contain supported languages

Issue: Conflicts with existing advanced setup
Solution: Update your configuration to "Enabled with advanced setup allowed"

Issue: Excessive license consumption
Solution: Use repository filters to target specific repositories or teams initially

What's Next?

Congratulations! You've successfully established the foundation of your organization's security program. CodeQL is now scanning your repositories and identifying potential security issues.

In Part 2 of this series, we'll build upon this foundation by implementing repository rulesets in "alert mode." This approach will help your development teams become familiar with code scanning results while building security awareness—without disrupting their workflow.

Coming up in Part 2:

• Understanding repository rulesets vs. traditional branch protection
• Setting up non-blocking alerts for security findings
• Building developer security awareness
• Monitoring and measuring alert response

Key Takeaways

• Security configurations provide centralized management of CodeQL scanning across your organization
• GitHub-recommended configurations offer a quick start with expert-maintained settings
• Custom configurations provide granular control for specific organizational needs
• Repository eligibility depends on GitHub Actions and supported languages
• Monitor coverage regularly to ensure comprehensive security scanning

Additional Resources

Essential Reading:

• GitHub Docs: Configuring default setup for code scanning
• GitHub Docs: Creating a custom security configuration
• GitHub Blog: Default setup for code scanning

Next Steps:

• Read Part 2: Setting Up Alert-Mode Repository Rulesets (Coming Soon)
• Explore CodeQL documentation for advanced usage
• Join the GitHub Security Community for support and best practices

---

This is Part 1 of our GitHub Advanced Security CodeQL series. Follow along as we build a comprehensive security program that protects your code while empowering your developers. Happy securing! 🔒

Series Navigation:

• Part 1: Setting Up Organization-Wide Code Scanning (You are here)
• Part 2: Alert-Mode Repository Rulesets (Coming Soon)
• Part 3: Blocking Vulnerable Code Merges (Coming Soon)

[jsoref]

Afaict the images in this post are broken:

[adityagadekar212-sudo]

ok add kar do