GitHub enables the development of functional safety applications by adding support for coding standards AUTOSAR C++ and CERT C++

Standards compliance lands in GitHub code scanning

Modern vehicles run on millions of lines of code spread across interconnected systems, and the engineering teams behind that software have to balance rapid feature development against strict safety requirements. Governance frameworks like ISO 26262 set expectations for functional safety, and the newer ISO 21434 extends those expectations to cybersecurity. Meeting those standards requires teams to verify that code is free of defects that could lead to critical failures—work that historically demanded separate compliance tooling outside the normal development workflow.

GitHub has now released CodeQL queries, developed with Woven Planet, that implement the CERT C++ and AUTOSAR C++ coding standards. The queries are designed to help teams demonstrate compliance with ISO 26262 Part 6, which covers "Product Development at the Software Level." Because the checks run through GitHub's code scanning and the CodeQL analysis engine, violations are surfaced as alerts directly in pull requests—before vulnerable or non-compliant code is merged. That lets automotive teams keep their existing collaboration model and CI/CD processes while adding standards enforcement at the point where code changes are reviewed.

GitHub plans to open source the CodeQL queries as part of its broader effort to make standards-compliant embedded software development more accessible. The company's position is that giving open source maintainers and developers the same compliance tooling used by automotive OEMs will accelerate innovation in embedded systems.

What code scanning can—and can't—do for ISO 26262

Static analysis alone cannot fully certify compliance with ISO 26262. But Part 6, which concerns the correctness of software design and implementation, is a place where automated checking can meaningfully assist. The new CodeQL queries report violations of CERT C++ and AUTOSAR C++ (covering C++11 and C++14 rules) automatically through code scanning. That gives developers a way to catch both security bugs and coding-standard violations at the moment they are introduced into the codebase.

Running the queries on your repository

To use the new queries, enable code scanning from the security tab of your repository. GitHub walks through a quick setup workflow, after which scanning runs immediately.

Extending the queries

Developers who want broader coverage can contribute to the CodeQL packs. Published packs are shareable and can be executed in any CI/CD pipeline. Queries that are general-purpose and applicable across repositories can be contributed to the open source CodeQL query repository, where they will run on pull requests in any repository with code scanning enabled.

Security features and other resources

GitHub positions its code security tooling as applicable to any team looking to ship safer code without disrupting the developer experience. Guidance for enabling security features across repositories is available in the GitHub getting started guide.