Code scanning from Azure DevOps

GitHub Advanced Security can now analyze code for semantic vulnerabilities from third-party CI pipelines; previously this capability was limited to GitHub Actions. The results of a scan run outside GitHub resurface in the repository under the Security tab, where developers can review and remediate them.


Organizations without GitHub Advanced Security enabled will not see "Code scanning alerts" or "Detected secrets".

The integration below uses an Azure DevOps pipeline rather than the native GitHub Actions workflow and its standard "Set Up Workflow" experience.

Start in the Azure DevOps pipeline, with the YAML editor, to begin integrating CodeQL.

The agent used here is ephemeral, so the CodeQL package is installed on every pipeline execution. On a self-hosted agent, pre-installing the package saves time and compute resources.

Integration steps

  1. Download the latest CodeQL dependencies on your agent.
  2. Give CodeQL access to your repository.
  3. Initialize the CodeQL executable and create a queryable DB.
  4. Scan your application.
  5. Upload results to GitHub.
  6. Review your results.
  7. Customize your scan further.

Download the CodeQL dependencies

wget targeting the latest Linux release pulls the necessary files into a new codeql directory; permissions on the downloaded file are changed before it is run. This script goes at the bottom of the pipeline:

- script: |
   wget https://github.com/github/codeql-action/releases/latest/download/codeql-runner-linux
   chmod +x codeql-runner-linux
 displayName: 'Get latest CodeQL package. Install on Agent.'

Grant repository access

Authentication can use a Personal Access Token or GitHub Apps. This example uses a PAT stored as the pipeline variable $GITHUB_PAT.

The CodeQL executable is then initialized and a CodeQL database created for the detected language. This script goes at the bottom of the pipeline:

- script: |
   ./codeql-runner-linux init --repository octodemo/ghas-azure-devops-code-scanning --github-url https://github.com --github-auth $GITHUB_PAT
 displayName: 'Initialize CodeQL Executable and create a CodeQL database'

Analyze and upload results

The CodeQL runner databases are populated, analyzed, and the results uploaded to GitHub. This script goes at the bottom of the pipeline:

- script: |
   ./codeql-runner-linux analyze --repository octodemo/ghas-azure-devops-code-scanning --github-url https://github.com --github-auth $GITHUB_PAT --commit 92065de8b22bbfeda511d12571b66c9969ff593b --ref refs/heads/master
 displayName: 'Populate the CodeQL runner databases, analyze them, and upload the results to GitHub.'

The complete pipeline:

# Scan my node app for semantic vulnerabilities with GitHub Code Scanning
# Upload any vulnerabilities back into my GitHub Repo for developer review.
 
trigger:
- master
 
pool:
 vmImage: 'ubuntu-latest'
 
steps:
- task: NodeTool@0
 inputs:
   versionSpec: '10.x'
 displayName: 'Install Node.js'
 
- script: |
   npm install
   npm test
 displayName: 'npm install and test'
 
- script: |
   wget https://github.com/github/codeql-action/releases/download/codeql-bundle-20200826/codeql-runner-linux
   chmod +x codeql-runner-linux
 displayName: 'Get latest CodeQL package. Install on Agent.'
 
- script: |
   ./codeql-runner-linux init --repository octodemo/ghas-azure-devops-code-scanning --github-url https://github.com --github-auth $GITHUB_PAT
 displayName: 'Initialize CodeQ Executable and create a CodeQL database'
 
- script: |
   ./codeql-runner-linux analyze --repository octodemo/ghas-azure-devops-code-scanning --github-url https://github.com --github-auth $GITHUB_PAT --commit 92065de8b22bbfeda511d12571b66c9969ff593b --ref refs/heads/master
 displayName: 'Populate the CodeQL runner databases, analyze them, and upload the results to GitHub.'

On success, the scan results are visible in the repository's security tab under code scanning:

Extending the query set

To include more queries in the scan, add a config-file parameter to init pointing at a custom configuration file in the .github directory:

- script: |
   ./codeql-runner-linux init --repository octodemo/ghas-azure-devops-code-scanning --github-url https://github.com --github-auth $GITHUB_PAT --config-file .github/codeql/codeql-config.yml
 displayName: 'Initialize CodeQ Executable and create a CodeQL database'