Secret scanning and static code analysis tools
Although there are many other SAST tools on the market, GitHub Advanced Security (GHAS) provides the most comprehensive feature set for static security code analysis together with Copilot security support. GHAS features are the following for private GitHub repositories:
- Code scanning uses CodeQL or other tools of your flavor to find vulnerabilities and coding errors. Results are stored in SARIF format, and they are managed at a repository level in GitHub.
- CodeQL CLI is a standalone tool that we can use to scan our code base for vulnerabilities and coding errors. The CodeQL CLI is used in conjunction with the previous point (code scanning), or we can use it in other DevOps tools, such as GitLab or Jenkins.
- Secret scanning looks for secrets, keys, and sensitive tokens in your code base. Pre-commit hooks are also available to block local commits before reaching the repository and creating a new history record.
- Custom auto...
