tag: Code-Scanning · 3 items
- Platform/SRE — Skip
- CI/CD — Learn: New dismissal reason in GitHub Code Scanning lets teams mark alerts as mitigated by external controls (e.g., WAF), reducing noise without falsely closing vulnerabilities — worth noting if you manage GHAS alert triage workflows.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Plan: If your org uses GitHub code scanning default setup, evaluate adopting the new github-codeql-config-file repository property to standardize CodeQL scan behavior across repos without per-repo overrides.
- Leader — Plan: This enables centralized enforcement of code scanning standards across the org’s repositories — worth incorporating into the golden path or security policy for teams already on GitHub Advanced Security.
- Platform/SRE — Skip
- CI/CD — Plan: GitHub’s AI-powered security detections now surface on PRs for languages CodeQL doesn’t cover — worth enabling to broaden supply-chain and vulnerability coverage in existing GitHub Actions workflows.
- Leader — Learn: Expanded AI security coverage on PRs broadens GitHub’s appeal as a unified code-security platform, relevant if evaluating whether GitHub Advanced Security covers the org’s language portfolio.