CodeQL code scanning: default setup vs advanced setup
Verdict: Default setup auto-generates and manages the CodeQL configuration with minimal effort. Advanced setup commits an editable workflow file for custom query suites, schedules, path filters and explicit build steps. Switching to default setup overrides an existing advanced configuration.
| Criterion | Default setup | Advanced setup |
|---|---|---|
| Configuration | GitHub generates and manages it | Committed workflow YAML the team edits |
| Customization | Limited; query suite can be selected | Full: extra queries, path filters, schedules, build steps |
| Query suite | Default suite; can switch to security-extended | Set in the workflow init step |
| Complex builds | Automatic detection; can fail on C or C++ multi-system builds | Explicit build commands in the workflow |
| Choose when | Fast onboarding, standard languages | Custom queries, schedules or builds default setup cannot detect |
Rules
- Advanced setup provides a committed, editable workflow file needed for custom schedules or non-default query suites.
- Default setup automatically generates the CodeQL configuration for fast, low-maintenance scanning.
- Switching a repo to default setup overrides an existing advanced configuration, with a warning shown first.
- Switch from the default query suite to security-extended to surface additional lower-confidence findings.
- When default setup's automatic build detection fails, advanced setup lets you define explicit build commands.
- A security configuration must explicitly allow advanced setup for repository owners to switch to it.
Traps
- Default setup does not permanently block a later move to advanced setup.
- Default setup does not expose direct YAML editing for custom schedules or query suites.
- Query suites apply to CodeQL code scanning, not to Dependabot dependency alerts.