From the course: GitHub Advanced Security Cert Prep by Microsoft Press

Unlock this course with a free trial

Join today to access over 24,700 courses taught by industry experts.

Introduce a CodeQL analysis workflow to a repository

Introduce a CodeQL analysis workflow to a repository - GitHub Tutorial

From the course: GitHub Advanced Security Cert Prep by Microsoft Press

Start my 1-month free trial Buy for my team

Introduce a CodeQL analysis workflow to a repository

“

- [Presenter] Here we're reminded that by integrating CodeQL into our repository workflows using GitHub actions to perform automated security analysis, code scanning, we're bringing and wielding enterprise-class security tools, that is CodeQL is something that full-time security researchers use and for us as none, we may or may not be, full-time information security researchers, I think it's pretty cool that we can bring that depth of analysis into our workflows in a relatively straightforward manner. So therefore, by integrating CodeQL into workflow, we're regularly scanning based on say, push or pull request events for proactive vulnerability detection, we're seamlessly automating with GitHub actions and we've got tailored analysis with an enormous library of built-in QL queries we can get from GitHub and we also can extend these with our own queries.

Contents