Esta versão do GitHub Enterprise Server será descontinuada em 2026-03-17. Nenhum lançamento de patch será feito, mesmo para questões críticas de segurança. Para obter melhor desempenho, segurança aprimorada e novos recursos, atualize para a última versão do GitHub Enterprise Server. Para obter ajuda com a atualização, entre em contato com o suporte do GitHub Enterprise.

About CodeQL code scanning for compiled languages

Understand how CodeQL analyzes compiled languages, the build options available, and learn how you can customize the database generation process if you need to.

Quem pode usar esse recurso?

Usuários com com acesso para gravação if advanced setup is already enabled

O Code scanning está disponível para os seguintes tipos de repositório:

  • Repositórios públicos no GitHub.com
  • Repositórios de propriedade da organização em GitHub Team, GitHub Enterprise Cloudou GitHub Enterprise Server, com GitHub Advanced Security habilitados.

Neste artigo

About the Fluxo de trabalho de análise do CodeQL and compiled languages

Code scanning works by running queries against one or more CodeQL databases. Each database contains a representation of the code in a single language in your repository. For the compiled languages C/C++, C#, Go, Java, Kotlin, Rust (versão prévia pública), e Swift, the process of populating this database often involves building the code and extracting data.

When you enable code scanning, both default and advanced setup generate a CodeQL database for analysis using the simplest method available. For C# e Java, the CodeQL database is generated directly from the codebase without requiring a build (none build mode). For other compiled languages, CodeQL builds the codebase using the autobuild build mode. Alternatively, you can use the manual build mode to specify explicit build commands to analyze only the files that are built by these custom commands.

CodeQL build modes

The CodeQL action supports three different build modes for compiled languages:

  • none - the CodeQL database is created directly from the codebase without building the codebase (supported for all interpreted languages, and additionally supported for C# e Java).
  • autobuild - CodeQL detects the most likely build method and uses this to attempt to build the codebase and create a database for analysis (supported for C/C++, C#, Go, Java, Kotlin e Swift).
  • manual - you define the build steps to use for the codebase in the workflow (supported for C/C++, C#, Go, Java, Kotlin e Swift).

For language-specific autobuild behavior, runner requirements, and guidance for manual builds, see CodeQL build options and steps for compiled languages.