Code Scanning
Use static code analysis to detect security flaws early in pull requests and on main branch.
Simple Explanation (ELI5)
Code scanning is like an automated security reviewer that reads your code and flags risky patterns before merge.
Technical Explanation
Code scanning analyzes source or build artifacts for security issues such as injection flaws, insecure deserialization, and unsafe cryptography. In GHAS, CodeQL queries produce findings mapped to source lines and data flow paths.
Visual Section
Hands-on Commands
name: codeql-analysis
on:
pull_request:
push:
branches: ["main"]
jobs:
analyze:
runs-on: ubuntu-latest
permissions:
actions: read
contents: read
security-events: write
strategy:
matrix:
language: ["javascript"]
steps:
- uses: actions/checkout@v4
- uses: github/codeql-action/init@v3
with:
languages: ${{ matrix.language }}
- uses: github/codeql-action/analyze@v3Debugging Scenarios
- No findings expected but scans fail: Check build dependencies and language detection.
- False positive alert: Verify code path, add reviewed suppression if justified.
- Scan timeout: Optimize build steps or use larger runner.
- PR blocked unexpectedly: Confirm required check names in branch protection.
Real-world Use Case
Code scanning detected a SQL injection pattern in a dynamic query builder. Team replaced string concatenation with parameterized queries before release.
Interview Questions
Beginner
Analyzing code without executing it to find defects and vulnerabilities.
Runs semantic queries over code databases to detect security issues.
To prevent introducing vulnerabilities into main.
Associating findings to exact file and line context.
No, it complements but does not replace dynamic and manual testing.
Intermediate
Validate trace path, tune rules, and suppress with documented justification.
At minimum high and critical severity unresolved findings.
Use path filters and matrix strategy per language/component.
To upload scan results back to GitHub security UI.
Incremental on PRs, full-depth scheduled on main/nightly.
Scenario-based
Block merge, apply fix, rerun scans, and document remediation.
Scope PR scans, cache dependencies, and schedule deep scans off critical path.
Root cause not fully fixed or vulnerable pattern reintroduced; add secure coding guardrails.
Exclude generated paths or patch generator pipeline if controllable.
Evaluate exploitability with security team and adjust severity policy if warranted.
Summary
Code scanning brings security review into normal PR flow and prevents vulnerable code from reaching production.