Skip to content

Commit 0240147

Browse files
felicitymayfelicitymay
authored
Group user docs on code security into a new "product" (github#18196)
1 parent 8f63a44 commit 0240147

File tree

96 files changed

+2747
-129
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

96 files changed

+2747
-129
lines changed

content/github/administering-a-repository/about-securing-your-repository.md renamed to content/code-security/getting-started/about-securing-your-repository.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
---
22
title: About securing your repository
33
intro: '{% data variables.product.product_name %} provides a number of ways that you can help keep your repository secure.'
4+
redirect_from:
5+
- /github/administering-a-repository/about-securing-your-repository
46
versions:
57
free-pro-team: '*'
68
enterprise-server: '>=3.0'

‎content/code-security/getting-started/index.md‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
---
2+
title: Getting started with code security
3+
shortTitle: Getting started
4+
intro: 'Introduction to code security with {% data variables.product.product_name %}.'
5+
versions:
6+
free-pro-team: '*'
7+
enterprise-server: '>=3.0'
8+
github-ae: '*'
9+
---
10+
11+
### Table of Contents
12+
13+
{% link_in_list /about-securing-your-repository %}

‎content/code-security/index.md‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
---
2+
title: Code security
3+
shortTitle: Code security
4+
intro: 'Learn how to keep the code stored in your repositories secure.'
5+
versions:
6+
free-pro-team: '*'
7+
enterprise-server: '>=3.0'
8+
github-ae: '*'
9+
---
10+
11+
{% link_with_intro /getting-started %}
12+
13+
{% link_with_intro /secret-security %}
14+
15+
{% link_with_intro /secure-coding %}
16+
17+
{% link_with_intro /security-advisories %}
18+
19+
{% link_with_intro /supply-chain-security %}

content/github/administering-a-repository/about-secret-scanning.md renamed to content/code-security/secret-security/about-secret-scanning.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ redirect_from:
66
- /github/administering-a-repository/about-token-scanning
77
- /articles/about-token-scanning
88
- /articles/about-token-scanning-for-private-repositories
9+
- /github/administering-a-repository/about-secret-scanning
910
versions:
1011
free-pro-team: '*'
1112
enterprise-server: '>=3.0'

content/github/administering-a-repository/configuring-secret-scanning-for-your-repositories.md renamed to content/code-security/secret-security/configuring-secret-scanning-for-your-repositories.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ intro: 'You can configure how {% data variables.product.prodname_dotcom %} scans
44
permissions: 'People with admin permissions to a repository can enable {% data variables.product.prodname_secret_scanning %} for the repository.'
55
redirect_from:
66
- /github/administering-a-repository/configuring-secret-scanning-for-private-repositories
7+
- /github/administering-a-repository/configuring-secret-scanning-for-your-repositories
78
product: '{% data reusables.gated-features.secret-scanning %}'
89
versions:
910
free-pro-team: '*'

‎content/code-security/secret-security/index.md‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
---
2+
title: Keeping secrets secure
3+
shortTitle: Secret security
4+
intro: 'Let GitHub do the hard work of ensuring that tokens, private keys, and other code secrets are not exposed in your repository.'
5+
product: '{% data reusables.gated-features.secret-scanning %}'
6+
versions:
7+
free-pro-team: '*'
8+
enterprise-server: '>=3.0'
9+
github-ae: '*'
10+
---
11+
12+
### Table of Contents
13+
14+
{% link_in_list /about-secret-scanning %}
15+
{% link_in_list /configuring-secret-scanning-for-your-repositories %}
16+
{% link_in_list /managing-alerts-from-secret-scanning %}

content/github/administering-a-repository/managing-alerts-from-secret-scanning.md renamed to content/code-security/secret-security/managing-alerts-from-secret-scanning.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@
22
title: Managing alerts from secret scanning
33
intro: You can view and close alerts for secrets checked in to your repository.
44
product: '{% data reusables.gated-features.secret-scanning %}'
5+
redirect_from:
6+
- /github/administering-a-repository/managing-alerts-from-secret-scanning
57
versions:
68
free-pro-team: '*'
79
enterprise-server: '>=3.0'

‎content/code-security/secure-coding/about-code-scanning.md‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
---
2+
title: About code scanning
3+
intro: 'You can use {% data variables.product.prodname_code_scanning %} to find security vulnerabilities and errors in the code for your project on {% data variables.product.prodname_dotcom %}.'
4+
product: '{% data reusables.gated-features.code-scanning %}'
5+
redirect_from:
6+
- /github/finding-security-vulnerabilities-and-errors-in-your-code/about-code-scanning
7+
versions:
8+
free-pro-team: '*'
9+
enterprise-server: '>=3.0'
10+
github-ae: '*'
11+
---
12+
13+
{% data reusables.code-scanning.beta %}
14+
{% data reusables.code-scanning.enterprise-enable-code-scanning %}
15+
16+
### About {% data variables.product.prodname_code_scanning %}
17+
18+
{% data reusables.code-scanning.about-code-scanning %}
19+
20+
You can use {% data variables.product.prodname_code_scanning %} to find, triage, and prioritize fixes for existing problems in your code. {% data variables.product.prodname_code_scanning_capc %} also prevents developers from introducing new problems. You can schedule scans for specific days and times, or trigger scans when a specific event occurs in the repository, such as a push.
21+
22+
If {% data variables.product.prodname_code_scanning %} finds a potential vulnerability or error in your code, {% data variables.product.prodname_dotcom %} displays an alert in the repository. After you fix the code that triggered the alert, {% data variables.product.prodname_dotcom %} closes the alert. For more information, see "[Managing {% data variables.product.prodname_code_scanning %} alerts for your repository](/code-security/secure-coding/managing-code-scanning-alerts-for-your-repository)."
23+
24+
To monitor results from {% data variables.product.prodname_code_scanning %} across your repositories or your organization, you can use webhooks and the {% data variables.product.prodname_code_scanning %} API. For information about the webhooks for {% data variables.product.prodname_code_scanning %}, see
25+
"[Webhook events and payloads](/developers/webhooks-and-events/webhook-events-and-payloads#code_scanning_alert)." For information about API endpoints, see "[{% data variables.product.prodname_code_scanning_capc %}](/rest/reference/code-scanning)."
26+
27+
To get started with {% data variables.product.prodname_code_scanning %}, see "[Setting up {% data variables.product.prodname_code_scanning %} for a repository](/code-security/secure-coding/setting-up-code-scanning-for-a-repository)."
28+
29+
### About {% data variables.product.prodname_codeql %}
30+
31+
You can use {% data variables.product.prodname_code_scanning %} with {% data variables.product.prodname_codeql %}, a semantic code analysis engine. {% data variables.product.prodname_codeql %} treats code as data, allowing you to find potential vulnerabilities in your code with greater confidence than traditional static analyzers.
32+
33+
{% data variables.product.prodname_ql %} is the query language that powers {% data variables.product.prodname_codeql %}. {% data variables.product.prodname_ql %} is an object-oriented logic programming language. {% data variables.product.company_short %}, language experts, and security researchers create the queries used for {% data variables.product.prodname_code_scanning %}, and the queries are open source. The community maintains and updates the queries to improve analysis and reduce false positives. For more information, see [{% data variables.product.prodname_codeql %}](https://securitylab.github.com/tools/codeql) on the GitHub Security Lab website.
34+
35+
{% data variables.product.prodname_code_scanning_capc %} with {% data variables.product.prodname_codeql %} supports both compiled and interpreted languages, and can find vulnerabilities and errors in code that's written in the supported languages.
36+
37+
{% data reusables.code-scanning.supported-languages %}
38+
39+
You can view and contribute to the queries for {% data variables.product.prodname_code_scanning %} in the [`github/codeql`](https://github.com/github/codeql) repository. For more information, see [{% data variables.product.prodname_codeql %} queries](https://codeql.github.com/docs/writing-codeql-queries/codeql-queries/) in the {% data variables.product.prodname_codeql %} documentation.
40+
41+
{% if currentVersion == "free-pro-team@latest" %}
42+
43+
### About billing for {% data variables.product.prodname_code_scanning %}
44+
45+
{% data variables.product.prodname_code_scanning_capc %} uses {% data variables.product.prodname_actions %}, and each run of a {% data variables.product.prodname_code_scanning %} workflow consumes minutes for {% data variables.product.prodname_actions %}. For more information, see "[About billing for {% data variables.product.prodname_actions %}](/github/setting-up-and-managing-billing-and-payments-on-github/about-billing-for-github-actions)."
46+
47+
{% endif %}
48+
49+
### About third-party code scanning tools
50+
51+
{% data reusables.code-scanning.you-can-upload-third-party-analysis %}
52+
53+
{% data reusables.code-scanning.interoperable-with-tools-that-output-sarif %}
54+
55+
{% data reusables.code-scanning.get-started-uploading-third-party-data %}
56+
57+
### Further reading
58+
59+
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.22" %}
60+
- "[About securing your repository](/github/administering-a-repository/about-securing-your-repository)"{% endif %}
61+
- [{% data variables.product.prodname_security %}](https://securitylab.github.com/)
62+
- [OASIS Static Analysis Results Interchange Format (SARIF) TC](https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=sarif) on the OASIS Committee website

‎content/code-security/secure-coding/about-integration-with-code-scanning.md‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
---
2+
title: About integration with code scanning
3+
shortTitle: About integration
4+
intro: 'You can perform {% data variables.product.prodname_code_scanning %} externally and then display the results in {% data variables.product.prodname_dotcom %}, or set up webhooks that listen to {% data variables.product.prodname_code_scanning %} activity in your repository.'
5+
product: '{% data reusables.gated-features.code-scanning %}'
6+
redirect_from:
7+
- /github/finding-security-vulnerabilities-and-errors-in-your-code/about-integration-with-code-scanning
8+
versions:
9+
free-pro-team: '*'
10+
enterprise-server: '>=3.0'
11+
github-ae: '*'
12+
---
13+
14+
{% data reusables.code-scanning.beta %}
15+
{% data reusables.code-scanning.enterprise-enable-code-scanning %}
16+
17+
As an alternative to running {% data variables.product.prodname_code_scanning %} within {% data variables.product.prodname_dotcom %}, you can perform analysis elsewhere and then upload the results. Alerts for {% data variables.product.prodname_code_scanning %} that you run externally are displayed in the same way as those for {% data variables.product.prodname_code_scanning %} that you run within {% data variables.product.prodname_dotcom %}. For more information, see "[Managing {% data variables.product.prodname_code_scanning %} alerts for your repository](/code-security/secure-coding/managing-code-scanning-alerts-for-your-repository)."
18+
19+
If you use a third-party static analysis tool that can produce results as Static Analysis Results Interchange Format (SARIF) 2.1.0 data, you can upload this to {% data variables.product.prodname_dotcom %}. For more information, see "[Uploading a SARIF file to GitHub](/code-security/secure-coding/uploading-a-sarif-file-to-github)."
20+
21+
### Integrations with webhooks
22+
23+
You can use {% data variables.product.prodname_code_scanning %} webhooks to build or set up integrations, such as [{% data variables.product.prodname_github_app %}s](/apps/building-github-apps/) or [{% data variables.product.prodname_oauth_app %}s](/apps/building-oauth-apps/), that subscribe to {% data variables.product.prodname_code_scanning %} events in your repository. For example, you could build an integration that creates an issue on {% data variables.product.product_name %} or sends you a Slack notification when a new {% data variables.product.prodname_code_scanning %} alert is added in your repository. For more information, see "[Creating webhooks](/developers/webhooks-and-events/creating-webhooks)" and "[Webhook events and payloads](/developers/webhooks-and-events/webhook-events-and-payloads#code_scanning_alert)."
24+
25+
### Further reading
26+
27+
* "[About {% data variables.product.prodname_code_scanning %}](/code-security/secure-coding/about-code-scanning)"
28+
* "[Using {% data variables.product.prodname_codeql %} {% data variables.product.prodname_code_scanning %} with your existing CI system](/code-security/secure-coding/using-codeql-code-scanning-with-your-existing-ci-system)"
29+
* "[SARIF support for {% data variables.product.prodname_code_scanning %}](/code-security/secure-coding/sarif-support-for-code-scanning)"

‎content/code-security/secure-coding/automatically-scanning-your-code-for-vulnerabilities-and-errors.md‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
---
2+
title: Automatically scanning your code for vulnerabilities and errors
3+
shortTitle: Scanning automatically
4+
intro: 'You can find vulnerabilities and errors in your project''s code on {% data variables.product.prodname_dotcom %}, as well as view, triage, understand, and resolve the related {% data variables.product.prodname_code_scanning %} alerts.'
5+
mapTopic: true
6+
product: '{% data reusables.gated-features.code-scanning %}'
7+
redirect_from:
8+
- /github/finding-security-vulnerabilities-and-errors-in-your-code/automatically-scanning-your-code-for-vulnerabilities-and-errors
9+
versions:
10+
free-pro-team: '*'
11+
enterprise-server: '>=3.0'
12+
github-ae: '*'
13+
---
14+

0 commit comments

Comments
 (0)