Code scanning on pull requests

Understand how CodeQL find and help prevent vulnerabilities in pull requests across your organizations.

Qui peut utiliser cette fonctionnalité ?

L’accès nécessite :

  • Vues de l’organisation : accès en écriture aux référentiels de l’organisation
  • Vues d’entreprise : propriétaires et responsables de la sécurité de l’organisation

Organisations appartenant à un compte GitHub Team avec GitHub Code Security, ou appartenant à un compte GitHub Enterprise avec GitHub Code Security

Dans cet article

Overview

The "Code scanning on pull requests" report in security overview helps you understand how well code scanning is preventing vulnerabilities in pull requests in your organization or across organizations in your enterprise. You can view the entire dataset or filter for specific criteria, making it easy to identify repositories where you may need to take action to find and reduce security risks.

Available metrics

CodeQL metrics

The overview shows you a summary of how many vulnerabilities prevented by CodeQL have been caught in pull requests. The metrics are only tracked for pull requests that have been merged into the default branches of repositories in your organizations.

You can also find more granular metrics, such as how many alerts were fixed, how many were unresolved and merged, and how many were dismissed as false positive or risk accepted.

You can also view:

  • The rules that are causing the most alerts, and how many alerts each rule is associated with.

  • The number of alerts that were merged into the default branch without resolution, and the number of alerts dismissed as an acceptable risk.

Remarque

Metrics for Copilot Autofix are omitted because Copilot Autofix is available only on GitHub cloud platforms.

Visibility

You can see code scanning metrics for a repository if you have:

  • The admin role for the repository
  • A custom repository role with the "View code scanning alerts" fine-grained permissions for the repository
  • Access to alerts for the repository

Next steps

To view the "Code scanning on pull requests" report, see Affichage des indicateurs pour les alertes relatives aux demandes de tirage.