Skip to content

Instantly share code, notes, and snippets.

@timothywarner

timothywarner/warner-code-scanning-course-resources.md

Last active May 4, 2025 20:34
Show Gist options
  • Save timothywarner/a653aebacc90114b71676af9653d8160 to your computer and use it in GitHub Desktop.
Save timothywarner/a653aebacc90114b71676af9653d8160 to your computer and use it in GitHub Desktop.
Download ZIP
Supplemental resources for CodeQL and GitHub Advanced Security. Quick start, best practices, certification links, and more. Short link: go.techtrainertim.com/codeql
Raw
warner-code-scanning-course-resources.md

📎 Short link for this resource: go.techtrainertim.com/codeql

🛡️ CodeQL & GitHub Advanced Security: Ultimate Resource Hub

📑 Table of Contents

🚀 Quick Start

  1. Enable GitHub Advanced Security (docs)
  2. Add the CodeQL workflow (sample YAML)
  3. Push code or open a PR to trigger scanning
  4. Review alerts in the Security tab
  5. Fix, commit, and repeat!

📬 Contact Information

Website GitHub

🧠 Microsoft Learn Modules

🎓 Pluralsight Courses

🧰 Tools & Resources

🤖 GitHub Copilot

🛡️ GHAS Security Features

  • CodeQL: Static code analysis for vulnerabilities (docs)
  • Dependabot: Automated dependency updates (docs)
  • Secret Scanning: Detect secrets in code (docs)
  • Copilot: AI-powered code suggestions (docs)

🏗️ Sample CodeQL Workflow

name: "CodeQL"

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    - cron: '0 8 * * 4'

jobs:
  analyze:
    name: Analyze
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        language: ['javascript']
    steps:
      - name: Checkout repository
        uses: actions/checkout@v3
      - name: Initialize CodeQL
        uses: github/codeql-action/init@v2
        with:
          languages: ${{ matrix.language }}
      - name: Autobuild
        uses: github/codeql-action/autobuild@v2
      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v2

🧑‍💻 CI/CD & Security Automation

🏆 Best Practices & Pro Tips

  • DRY & SOLID: Modularize queries and workflows for reuse and clarity.
  • Fail Fast: Use fail-fast: false in matrix jobs for full coverage.
  • Observability: Integrate structured logging (e.g., Winston for Node.js).
  • Shift Left: Run scans on every PR, not just main.
  • Security Gates: Block merges on critical findings (branch protection docs)
  • SBOMs: Always generate and store SBOMs for compliance.

🛠️ Troubleshooting & FAQ

🗣️ Community & Support

📖 Glossary

  • CodeQL: Query language for code analysis.
  • GHAS: GitHub Advanced Security.
  • SARIF: Static Analysis Results Interchange Format.
  • SBOM: Software Bill of Materials.
  • Secret Scanning: Automated detection of secrets in code.
  • Dependabot: Automated dependency update tool.
  • Copilot: AI-powered code completion and chat.

📚 Further Learning

🎓 Certification Paths

GitHub Official Certifications

Microsoft Security Certifications

🤝 Contribute & Feedback

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment