16 Configure code scanning on GitHub.md

https://learn.microsoft.com/en-us/training/modules/configure-code-scanning

What is Code Scanning?

CodeQL is the code analysis engine GitHub developed to automate security checks. You can analyze your code using CodeQL and display the results as code scanning alerts.

How can it be set up?

1. Default setup (runs as GitHub action).
2. Advanced setup (uses a customisable CodeQL action as a GitHub Action).
3. Via CI, then upload results to GitHub.

Typically it'll trigger on PR & push (default).

Supported languages

• C or C++
• C#
• Go
• Java/Kotlin
• JavaScript/TypeScript
• Python
• Ruby
• Swift

Exercise

https://github.com/skills/introduction-to-codeql