GitHub · GH-500
Setting up code scanning
GH-500 · Lesson 10 of 16 · 1:14:53
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the GH-500 exam (GitHub Advanced Security). In this lesson: CodeQL and third-party tools, uploading and managing SARIF results with categories and fingerprints, default setup and advanced setup, running the CodeQL CLI in external CI systems, and matrix builds, build modes, and scan frequency. Includes three original practice questions.
Preview the topics
- Contoso uploads results from two different scanners for the same commit of payments-core, and the second upload keeps replacing the first one’s alerts. What should the team set?
- Contoso’s card-services team builds a C++ application with Jenkins only, and must keep that build there. How should they get CodeQL alerts into GitHub?
- Contoso’s loan portal rarely changes, but the security team wants new CodeQL queries to run against it regularly. What should the workflow include?