LEARN. PRACTICE. GROW.Concept and mechanism
Code scanning can use CodeQL or external tools producing compatible SARIF. Default setup reduces maintenance and now supports customization including configuration and model packs. Advanced setup fits when you need workflow control, build commands, matrix, or scheduling that available options do not meet. Start the decision from the concrete requirement. Compiled-language analysis has none, autobuild, and manual modes with language-specific support. In manual mode, chosen commands determine built and extracted code; a successfully built API does not prove analysis of an omitted batch. Confirm coverage and diagnostics before interpreting few alerts as a good result. A tool’s operational success and its analytical scope answer different questions.
Guided application
In a fictional external scanner, changing build paths and missing fingerprints can create duplicates. Keep rule identifiers, paths, and result identity stable. When producing several analysis sets for the same commit, use distinct consistent SARIF categories. During dataflow triage, follow source, transformations, and sink: a function named sanitize does not prove protection for the relevant SQL or HTTP context. Assess relevant alternative paths too. Autofix is a proposed change; review the diff and confirm behavior, regressions, and fresh analysis. If a tool does not cover a requirement, record the gap and complementary control rather than hiding the limitation.
Manual build compiles only API: add batch analysis or explicitly report the gap.
Common pitfalls
Default as unconfigurable; compiled as always requiring build; green as complete; random SARIF identity as traceable.
Related topics: Products, scope, and prevention · Credentials, response, and exceptions · Dependencies, inventory, and merge prevention
Confirm analyzed code, effective configuration, and stable identity before trusting the result.
Reference: Default and advanced setup · GH-500 skills measured July2026;study guide updated2026-05-14