Default setup: scheduled scans and expanded language support
Earlier this year, GitHub introduced default setup for code scanning as a way to enable security analysis on a repository with a few clicks, then followed up with multi-repository enablement to roll the same configuration out across an organization. Those pieces were about making the initial turn-on fast. The latest update focuses on what happens after that: keeping scans current and broadening the languages that the automated configuration can handle.
Default setup now provisions weekly scheduled scans automatically and supports every language that CodeQL covers.
Weekly scans, without the setup step
Running scans on a schedule has always been part of code scanning, but it previously required a separate configuration step. With default setup, that schedule is now part of the initial configuration. The weekly cadence means new vulnerabilities introduced between runs are caught on a regular interval, so the alerts shown for a repository reflect its current state rather than a one-time snapshot.
All CodeQL languages, with self-correcting configuration
CodeQL supports C, C++, JavaScript, TypeScript, Python, Ruby, Go, Kotlin/Java, Swift, and C#. Default setup can now be used on any repository that uses one of these languages. The configuration process picks the best setup for the repo's mix of languages, and if any language fails during the process, it is automatically deselected while analysis and alerts continue for the languages that succeeded.
The configuration also adapts as the repository changes. When a new language is added later, default setup evolves to include it in future runs, and if that language happens to fail, the setup rolls back to the prior working configuration without requiring manual intervention.
For more on enabling GitHub security features, see the getting started guide.
