Code scanning broadens its scanner roster

GitHub has added more than 15 integrations with open source security tools to its code scanning feature, widening the language coverage beyond what CodeQL can analyze natively. The new integrations span PHP, Swift, Kotlin, Ruby, PowerShell, Kubernetes manifests, and infrastructure-as-code templates, among others. All are available through GitHub Actions in the Marketplace, and several can be configured directly from the "Security" tab of any repository.

The integrations are contributed by maintainers of the tools themselves and by third-party developers. They follow the SARIF format, which lets results from external scanners appear alongside CodeQL alerts in the GitHub UI.

New scanners by language and platform

Mobile: Kotlin and Swift
Detekt brings static analysis for Kotlin, while MobSF covers Android, iOS Swift, and Windows mobile applications with both static and dynamic analysis. Each has a GitHub Action, and both are surfaced under the "Security" tab in the GitHub UI. CodeQL support for Kotlin and Swift is planned.

PHP
Psalm, the open source PHP static analyzer maintained by Vimeo, now has a GitHub Action with SARIF upload support for code scanning.

Elixir Phoenix Framework
Sobelow, a security-focused static analyzer for the Elixir Phoenix Framework, has been extended with SARIF support and a GitHub Action.

Node.js
nodejsscan is a SAST scanner for Node.js applications and is available as a GitHub Action and through the GitHub UI. Node.js is also covered natively by CodeQL.

Electron
Electronegativity detects misconfigurations and security anti-patterns in Electron-based applications. A GitHub Action is available.

Ruby on Rails
Brakeman, the Rails-specific static analyzer, now supports SARIF output and can be run via existing marketplace actions or configured from the GitHub UI starter workflow. Ruby support in CodeQL is on the roadmap.

PowerShell
PSScriptAnalyzer checks PowerShell modules and scripts for coding issues. A GitHub Action exists, and the tool is listed in the GitHub UI.

Kubernetes YAML
Kubesec, backed by Control Plane, performs security risk analysis for Kubernetes resources and can be run via its GitHub Action or initiated from the GitHub UI.

Terraform
tfsec statically analyzes Terraform templates for potential security issues. It has a GitHub Action with SARIF upload and appears in the Security UI.

C/C++
MSVC code analysis, the correctness checker in the Microsoft compiler, and Flawfinder, a C/C++ source code security checker, are both available. C/C++ is already handled natively by CodeQL, but these add an extra layer of verification.

Multiple languages
Semgrep, sponsored by r2c, supports a wide range of languages and added GitHub SARIF upload via workflow file; it's also visible in the GitHub UI. Security Code Scan adds vulnerability pattern detection for C# and VB.NET with a GitHub Action. C# is also supported by CodeQL. DevSkim covers C, C++, C#, Cobol, Go, Java, JavaScript/TypeScript, Python, and more.

How to integrate your own tool

Maintainers of static analysis tools, linters, or container scanners can follow a step-by-step integration guide to get listed in the GitHub UI and have results appear under the "Security" tab. Fuzzing and DAST tools can also participate by uploading results in SARIF format, attaching links to dynamic analysis output in the SARIF help text metadata field, as demonstrated by ForAllSecure's Mayhem for API action and the StackHawk HawkScan action.

Trying it out

Code scanning can be configured from the "Security" tab of any public repository using either CodeQL or one of the newly added third-party scanners. Prepared demonstration repositories are available for Android Kotlin, iOS Swift, JavaScript, Terraform, and PHP.

A quick walkthrough using MobSF against a deliberately vulnerable Swift iOS app shows the workflow:

  1. Fork the demo repository to your GitHub account.
  2. Open the Actions tab and enable actions if prompted; free minutes are included with your account.
  3. Select the MobSF workflow and click Run workflow to start a manual run.
  4. Within about a minute, results appear under the "Security" tab in "Code scanning alerts."

The workflow connects a repository to a third-party analyzer via GitHub Actions, runs the scan, and uploads SARIF-formatted results back to the repository, where they are presented as pull request annotations and security alerts.