Setting the file. One moment.
Subchapter 78.1
references/alert-management.mdMarkdown6 KBView on GitHub
Guide for understanding, triaging, dismissing, and resolving code scanning alerts generated by CodeQL.
All code scanning alerts have one of these severity levels:
| Level | Description |
|---|---|
Error | High-confidence, high-impact issues that should be fixed |
Warning | Moderate-confidence or moderate-impact issues |
Note | Low-confidence or informational findings |
Security alerts additionally have a security severity derived from CVSS scores:
| Level | CVSS Score Range | Description |
|---|---|---|
Critical | > 9.0 | Severe vulnerabilities requiring immediate attention |
High | 7.0 – 8.9 | Significant vulnerabilities that should be prioritized |
Medium | 4.0 – 6.9 | Moderate vulnerabilities to address in normal workflow |
Low | 0.1 – 3.9 | Minor issues with limited security impact |
When a security severity is present, it takes precedence over the standard severity for display and sorting.
For each CodeQL security query added to the Default or Extended suite:
Alerts in non-application code receive category labels:
| Label | Description |
|---|---|
| Generated | Code generated by the build process |
| Test | Test code (detected by file path) |
| Library | Library or third-party code |
| Documentation | Documentation files |
These labels are assigned automatically based on file paths. They cannot be manually overridden.
By default, the check fails if alerts have severity of error, critical, or high. Override this threshold via repository Settings → Rules → Rulesets → Code scanning.
Configure rulesets to block PR merging when:
GitHub Copilot Autofix automatically generates fix suggestions for CodeQL alerts in pull requests.
package.json)Click Dismiss suggestion on the comment to reject a suggestion.
Dismiss alerts when:
Choose the appropriate reason — it affects whether the query continues running:
| Reason | When to Use |
|---|---|
| False positive | The alert is incorrect; the code is actually safe |
| Won’t fix | The risk is accepted or the code is being deprecated |
| Used in tests | The vulnerable pattern is only in test code |
alerts/{alert_number} → dismissed_commentFor false positives from unsupported sanitization libraries, consider contributing to the CodeQL repository to improve analysis accuracy.
If alerts persist from old/disabled configurations:
For path-problem queries, alerts include data flow information:
Click Show paths on alert annotations to visualize the full data flow.
When multiple code scanning configurations analyze the same file:
GET /repos/{owner}/{repo}/code-scanning/alerts — list alertsGET /repos/{owner}/{repo}/code-scanning/alerts/{alert_number} — get alert detailsPATCH /repos/{owner}/{repo}/code-scanning/alerts/{alert_number} — update alert status