Customize GitHub code scanning default setup with configuration files
GitHub now allows applying custom configuration files to code scanning's default setup via the new `github-codeql-config-file` repository property. This offers granular control over security analysis for entire organizations without needing individual workflow files. The feature supports organization-wide defaults and custom configurations, with improved syntax for referencing files across repositories and enhanced private registry access. It is now generally available on github.com and will ship with GitHub Enterprise Server 3.23.
- →Apply custom configuration files to default code scanning setup
- →Flexible syntax for referencing configuration files from other repositories
- →Grant default setup access to private registries for custom configurations
Features (1) ›
- Apply custom configuration files to default code scanning setup
Users can now set the `github-codeql-config-file` repository property to a CodeQL configuration file, merging its settings with default analysis. This enables customization of queries, exclusions, and threat models while retaining default setup's low-maintenance benefits.
Enhancements (2) ›
- Flexible syntax for referencing configuration files from other repositories
A new syntax allows referencing configuration files in other repositories by just providing the repository name. The system falls back to a default path on the main branch if no ref or file path is specified, simplifying cross-repository configuration management.
- Grant default setup access to private registries for custom configurations
Organizations can now grant default code scanning access to private registries by configuring a Git Source. This eliminates the need for managing tokens in workflow files, providing a more secure way to use custom configurations from private repositories.
https://github.blog/changelog/2026-08-04-customize-code-scanning-default-setup-at-scale
Related releases
- GitHub Copilot introduces Agent Plugins 1.0 for cross-client development GitHub Changelog ·
- GitHub Details Organization-Level Repository Rule Insights GitHub Changelog ·
- GitHub Enterprise Server 3.22 Release Candidate Now Available GitHub Changelog ·
- GitHub Copilot for JetBrains adds persistent memory, Ollama integration, and enterprise controls GitHub Changelog ·
- Automatically Migrate Branch Protection Rules to Repository Rulesets GitHub Changelog ·
- GitHub Copilot's MAI-Code-1-Flash model slated for deprecation GitHub Changelog ·