You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: content/code-security/concepts/code-scanning/codeql/codeql-query-suites.md
+12-9Lines changed: 12 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -17,20 +17,19 @@ topics:
17
17
contentType: concepts
18
18
---
19
19
20
-
## About {% data variables.product.prodname_codeql %} query suites
20
+
## What are query suites?
21
21
22
-
With {% data variables.product.prodname_codeql %} {% data variables.product.prodname_code_scanning %}, you can select a specific group of {% data variables.product.prodname_codeql %} queries, called a {% data variables.product.prodname_codeql %} query suite, to run against your code. The following built-in query suites are available through {% data variables.product.prodname_dotcom %}:
22
+
Query suites allow you to pass multiple queries to {% data variables.product.prodname_codeql %} without having to specify the path to each query file individually. They provide a way of selecting queries based on their filename, metadata properties, or location on disk or in a {% data variables.product.prodname_codeql %} pack.
23
23
24
-
*`default` query suite.
25
-
*`security-extended` query suite. This suite is referred to as the "Extended" query suite on {% data variables.product.prodname_dotcom %}.
24
+
You should use query suites for the queries that you want to frequently use in your {% data variables.product.prodname_codeql %} analyses. You can use a built-in query suite available through {% data variables.product.github %}, or you can create your own.
26
25
27
-
Currently, both the `default` query suite and the `security-extended` query suite are available for default setup for {% data variables.product.prodname_code_scanning %}. Additionally, organization owners and security managers can recommend a query suite for use with default setup throughout their organization. For more information on configuring default setup for individual repositories, see [AUTOTITLE](/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning). For more information on configuring default setup at scale and recommending a query suite, see [AUTOTITLE](/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale).
26
+
## Built-in {% data variables.product.prodname_codeql %}query suites
28
27
29
-
To use a custom query suite, you must configure advanced setup for {% data variables.product.prodname_codeql %} {% data variables.product.prodname_code_scanning %}. For more information on advanced setups and creating a query suite, see [AUTOTITLE](/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/configuring-advanced-setup-for-code-scanning#configuring-advanced-setup-for-code-scanning-with-codeql) and [AUTOTITLE](/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/creating-codeql-query-suites).
28
+
The built-in {% data variables.product.prodname_codeql %} query suites, `default` and `security-extended`, are created and maintained by {% data variables.product.prodname_dotcom %}. Both of these query suites are available with default setup for every {% data variables.product.prodname_codeql %}-supported language.
30
29
31
-
## Built-in {% data variables.product.prodname_codeql %} query suites
30
+
Organization owners and security managers can recommend a query suite for use with default setup throughout their organization. For more information, see [AUTOTITLE](/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning-at-scale).
32
31
33
-
The built-in {% data variables.product.prodname_codeql %} query suites, `default` and `security-extended`, are created and maintained by {% data variables.product.prodname_dotcom %}. Both of these query suites are available for every {% data variables.product.prodname_codeql %}-supported language. For more information on {% data variables.product.prodname_codeql %}-supported languages, see [AUTOTITLE](/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning-with-codeql#about-codeql).
32
+
For a complete list of queries included in each query suite for every language, see [AUTOTITLE](/code-security/code-scanning/reference/code-ql-built-in-queries).
34
33
35
34
### `default` query suite
36
35
@@ -44,7 +43,11 @@ The built-in {% data variables.product.prodname_codeql %} query suites, `default
44
43
* Relative to the `default` query suite, the `security-extended` suite may return a greater number of false positive {% data variables.product.prodname_code_scanning %} results.
45
44
* This query suite is available for use with default setup for {% data variables.product.prodname_code_scanning %}, and is referred to as the "Extended" query suite on {% data variables.product.prodname_dotcom %}.
46
45
47
-
For a complete list of queries included in each query suite for every language, see [AUTOTITLE](/code-security/code-scanning/reference/code-ql-built-in-queries).
46
+
## Custom query suites
47
+
48
+
To use a custom query suite, you must configure advanced setup for {% data variables.product.prodname_codeql %} {% data variables.product.prodname_code_scanning %}. For more information, see [AUTOTITLE](/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/configuring-advanced-setup-for-code-scanning).
49
+
50
+
Query suite definitions are stored in YAML files with the extension `.qls`. A suite definition is a sequence of instructions, where each instruction is a YAML mapping with (usually) a single key. The instructions are executed in the order they appear in the query suite definition. After all the instructions in the suite definition have been executed, the result is a set of selected queries. For more information, see [AUTOTITLE](/code-security/tutorials/customize-code-scanning/creating-codeql-query-suites).
Copy file name to clipboardExpand all lines: content/code-security/concepts/code-scanning/setup-types.md
+16-2Lines changed: 16 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -20,14 +20,28 @@ Default setup for {% data variables.product.prodname_code_scanning %} is the qui
20
20
* When creating or committing to a pull request based against the repository's default branch, or any protected branch, excluding pull requests from forks.
21
21
* On a weekly schedule.
22
22
23
-
If you need more granular control over your {% data variables.product.prodname_code_scanning %} configuration, you should instead configure advanced setup.
24
-
25
23
### Supported languages
26
24
27
25
{% data reusables.code-scanning.default-setup-pre-enablement-explanation %}
28
26
29
27
If the code in a repository changes to include any {% data variables.product.prodname_codeql %}-supported languages, {% data variables.product.prodname_dotcom %} will automatically update the {% data variables.product.prodname_code_scanning %} configuration to include the new language. If {% data variables.product.prodname_code_scanning %} fails with the new configuration, {% data variables.product.prodname_dotcom %} will resume the previous configuration automatically so the repository does not lose {% data variables.product.prodname_code_scanning %} coverage.
30
28
29
+
## Customization of default setup
30
+
31
+
After running an initial analysis of your code with default setup, you can make changes to your configuration to better meet your needs.
32
+
33
+
If you need more granular control over your {% data variables.product.prodname_code_scanning %} configuration, you should instead configure advanced setup.
34
+
35
+
### Configuration options
36
+
37
+
For existing configurations of default setup, you can edit:
38
+
39
+
* Which languages default setup will analyze.
40
+
* The query suite run during analysis. For more information on the available query suites, see [AUTOTITLE](/code-security/code-scanning/managing-your-code-scanning-configuration/codeql-query-suites).
41
+
* The threat models ({% data variables.release-phases.public_preview %}) to use for analysis. Your choice of threat model determines which sources of tainted data are treated as a risk to your application. During the {% data variables.release-phases.public_preview %}, threat models are supported only for analysis of {% data variables.code-scanning.code_scanning_threat_model_support %}. For more information about threat models, see [Including local sources of tainted data in default setup](/code-security/how-tos/scan-code-for-vulnerabilities/manage-your-configuration/editing-your-configuration-of-default-setup#including-local-sources-of-tainted-data-in-default-setup).
42
+
43
+
If your codebase depends on a library or framework that is not recognized by the standard libraries included with {% data variables.product.prodname_codeql %}, you can also extend the {% data variables.product.prodname_codeql %} coverage in default setup using {% data variables.product.prodname_codeql %} model packs. For more information, see [Extending CodeQL coverage with CodeQL model packs in default setup](/code-security/how-tos/scan-code-for-vulnerabilities/manage-your-configuration/editing-your-configuration-of-default-setup#extending-codeql-coverage-with-codeql-model-packs-in-default-setup).
44
+
31
45
### Available runners
32
46
33
47
You can use default setup for all {% data variables.product.prodname_codeql %}-supported languages on self-hosted runners or {% data variables.product.prodname_dotcom %}-hosted runners.
Copy file name to clipboardExpand all lines: content/code-security/how-tos/scan-code-for-vulnerabilities/manage-your-configuration/editing-your-configuration-of-default-setup.md
+1-8Lines changed: 1 addition & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -15,14 +15,7 @@ redirect_from:
15
15
contentType: how-tos
16
16
---
17
17
18
-
## About editing your configuration of default setup
19
-
20
-
After running an initial analysis of your code with default setup, you may need to make changes to your configuration to better meet your needs. For existing configurations of default setup, you can edit:
21
-
* Which languages default setup will analyze.
22
-
* The query suite run during analysis. For more information on the available query suites, see [AUTOTITLE](/code-security/code-scanning/managing-your-code-scanning-configuration/codeql-query-suites).
23
-
* The threat models ({% data variables.release-phases.public_preview %}) to use for analysis. Your choice of threat model determines which sources of tainted data are treated as a risk to your application. During the {% data variables.release-phases.public_preview %}, threat models are supported only for analysis of {% data variables.code-scanning.code_scanning_threat_model_support %}. For more information about threat models, see [Including local sources of tainted data in default setup](#including-local-sources-of-tainted-data-in-default-setup).
24
-
25
-
If your codebase depends on a library or framework that is not recognized by the standard libraries included with {% data variables.product.prodname_codeql %}, you can also extend the {% data variables.product.prodname_codeql %} coverage in default setup using {% data variables.product.prodname_codeql %} model packs. For more information, see [Extending CodeQL coverage with CodeQL model packs in default setup](#extending-codeql-coverage-with-codeql-model-packs-in-default-setup).
18
+
After running an initial analysis of your code with default setup, you can make changes to your configuration to better meet your needs. For more information on setup types and customization options, see [AUTOTITLE](/code-security/concepts/code-scanning/setup-types).
26
19
27
20
If you need to change any other aspects of your {% data variables.product.prodname_code_scanning %} configuration, consider configuring advanced setup. For more information, see [AUTOTITLE](/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/configuring-advanced-setup-for-code-scanning).
Copy file name to clipboardExpand all lines: content/code-security/how-tos/view-and-interpret-data/analyze-organization-data/exporting-data-from-security-overview.md
{% data reusables.security-overview.download-csv-files %}
25
23
26
-
The overview page contains data about security alerts across your organization or enterprise, while the risk and coverage pages contain data about repositories and how they are affected by security alerts or covered by security features. The {% data variables.product.prodname_codeql %} pull request alerts page contains data about {% data variables.product.prodname_codeql %} alerts that were caught in pull requests merged to the default branch.
27
-
28
24
The CSV file you download will contain data corresponding to the filters you have applied to security overview. For example, if you add the filter `dependabot-alerts:enabled`, your file will only contain data for repositories that have enabled {% data variables.product.prodname_dependabot_alerts %}.
Copy file name to clipboardExpand all lines: content/code-security/tutorials/customize-code-scanning/creating-codeql-query-suites.md
+1-11Lines changed: 1 addition & 11 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -17,19 +17,9 @@ redirect_from:
17
17
contentType: tutorials
18
18
---
19
19
20
-
## About creating {% data variables.product.prodname_codeql %} query suites
21
-
22
20
{% data reusables.code-scanning.codeql-cli-version-ghes %}
23
21
24
-
{% data variables.product.prodname_codeql %} query suites provide a way of selecting queries, based on their
25
-
filename, location on disk or in a {% data variables.product.prodname_codeql %} pack, or metadata properties.
26
-
Create query suites for the queries that you want to frequently use in
27
-
your {% data variables.product.prodname_codeql %} analyses.
28
-
29
-
Query suites allow you to pass multiple queries to {% data variables.product.prodname_codeql %} without having to specify the path to each query file individually. Query suite definitions are stored in YAML files with the extension `.qls`. A suite definition is a sequence of instructions, where each instruction is a YAML
30
-
mapping with (usually) a single key. The instructions are executed in the order
31
-
they appear in the query suite definition. After all the instructions in the
32
-
suite definition have been executed, the result is a set of selected queries.
22
+
You can create query suites for the queries that you want to frequently use in your {% data variables.product.prodname_codeql %} analyses. For more information, see [AUTOTITLE](/code-security/concepts/code-scanning/codeql/codeql-query-suites).
33
23
34
24
> [!NOTE]
35
25
> Any custom queries that you want to add to a query suite must be in a [{% data variables.product.prodname_codeql %} pack](/code-security/codeql-cli/getting-started-with-the-codeql-cli/customizing-analysis-with-codeql-packs) and contain the correct query metadata. For more information, see [Using custom queries with the {% data variables.product.prodname_codeql_cli %}](/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/using-custom-queries-with-the-codeql-cli).
Copy file name to clipboardExpand all lines: content/copilot/how-tos/configure-custom-instructions/add-repository-instructions.md
-52Lines changed: 0 additions & 52 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -531,58 +531,6 @@ Whitespace between instructions is ignored, so the instructions can be written a
531
531
532
532
<!-- end of Xcode tab -->
533
533
534
-
<!-- START COPILOT CLI TAB -->
535
-
536
-
{% copilotcli %}
537
-
538
-
This version of this article is for using repository custom instructions with the {% data variables.product.prodname_copilot %} CLI. Click the tabs above for instructions on using custom instructions in other environments.
539
-
540
-
## Creating custom instructions
541
-
542
-
{% data variables.product.prodname_copilot %} supports three types of repository custom instructions.
543
-
544
-
***Repository-wide custom instructions**, which apply to all requests made in the context of a repository.
545
-
546
-
These are specified in a `copilot-instructions.md` file in the `.github` directory of the repository. See [Creating repository-wide custom instructions](#creating-repository-wide-custom-instructions).
547
-
548
-
***Path-specific custom instructions**, which apply to requests made in the context of files that match a specified path.
549
-
550
-
These are specified in one or more `NAME.instructions.md` files within or below the `.github/instructions` directory in the repository. See [Creating path-specific custom instructions](#creating-path-specific-custom-instructions).
551
-
552
-
If the path you specify matches a file that {% data variables.product.prodname_copilot_short %} is working on, and a repository-wide custom instructions file also exists, then the instructions from both files are used. You should avoid potential conflicts between instructions as {% data variables.product.prodname_copilot_short %}'s choice between conflicting instructions is non-deterministic.
553
-
554
-
***Agent instructions** are used by AI agents.
555
-
556
-
{% data reusables.copilot.custom-instructions-agents %}
557
-
558
-
Alternatively, you can use a single `CLAUDE.md` or `GEMINI.md` file stored in the root of the repository.
559
-
560
-
## Creating repository-wide custom instructions
561
-
562
-
1. In the root of your repository, create a file named `.github/copilot-instructions.md`.
563
-
564
-
Create the `.github` directory if it does not already exist.
565
-
566
-
1. Add natural language instructions to the file, in Markdown format.
567
-
568
-
Whitespace between instructions is ignored, so the instructions can be written as a single paragraph, each on a new line, or separated by blank lines for legibility.
569
-
570
-
## Creating path-specific custom instructions
571
-
572
-
{% data reusables.copilot.custom-instructions-path %}
573
-
574
-
{% data reusables.copilot.custom-instructions-note %}
intro: 'Create repository custom instructions files that give {% data variables.product.prodname_copilot_short %} additional context on how to understand your project and how to build, test and validate its changes.'
5
+
versions:
6
+
feature: copilot
7
+
topics:
8
+
- Copilot
9
+
contentType: how-tos
10
+
---
11
+
12
+
This version of this article is for using repository custom instructions with the {% data variables.product.prodname_copilot %} CLI. Click the tabs above for instructions on using custom instructions in other environments.
13
+
14
+
## Creating custom instructions
15
+
16
+
{% data variables.product.prodname_copilot %} supports three types of repository custom instructions.
17
+
18
+
***Repository-wide custom instructions**, which apply to all requests made in the context of a repository.
19
+
20
+
These are specified in a `copilot-instructions.md` file in the `.github` directory of the repository. See [Creating repository-wide custom instructions](#creating-repository-wide-custom-instructions).
21
+
22
+
***Path-specific custom instructions**, which apply to requests made in the context of files that match a specified path.
23
+
24
+
These are specified in one or more `NAME.instructions.md` files within or below the `.github/instructions` directory in the repository. See [Creating path-specific custom instructions](#creating-path-specific-custom-instructions).
25
+
26
+
If the path you specify matches a file that {% data variables.product.prodname_copilot_short %} is working on, and a repository-wide custom instructions file also exists, then the instructions from both files are used. You should avoid potential conflicts between instructions as {% data variables.product.prodname_copilot_short %}'s choice between conflicting instructions is non-deterministic.
27
+
28
+
***Agent instructions** are used by AI agents.
29
+
30
+
{% data reusables.copilot.custom-instructions-agents %}
31
+
32
+
Alternatively, you can use a single `CLAUDE.md` or `GEMINI.md` file stored in the root of the repository.
33
+
34
+
## Creating repository-wide custom instructions
35
+
36
+
1. In the root of your repository, create a file named `.github/copilot-instructions.md`.
37
+
38
+
Create the `.github` directory if it does not already exist.
39
+
40
+
1. Add natural language instructions to the file, in Markdown format.
41
+
42
+
Whitespace between instructions is ignored, so the instructions can be written as a single paragraph, each on a new line, or separated by blank lines for legibility.
43
+
44
+
## Creating path-specific custom instructions
45
+
46
+
{% data reusables.copilot.custom-instructions-path %}
47
+
48
+
{% data reusables.copilot.custom-instructions-note %}
0 commit comments