GitHub lets organizations customize CodeQL default setup across repositories

GitHub has made a security-administration change aimed at teams that want broad CodeQL coverage without maintaining a separate workflow file in every repository. In an August 4 changelog post, the company said code scanning default setup can now use a repository property named github-codeql-config-file to apply a custom CodeQL configuration file.

The practical effect is that security teams can keep default setup's managed behavior while adding organization-specific rules. GitHub says the merged configuration can add queries, exclude paths, or set threat models, while preserving threat models and CodeQL model packs that were already selected in the default setup interface. That matters for large engineering organizations because default setup is often easier to roll out than fully custom GitHub Actions workflows, but until now it offered less centralized control.

Why it matters

Application security programs often struggle with two competing needs: standardization from central security teams and flexibility for individual repositories. GitHub's approach uses repository properties, which can have organization-wide defaults. Organization owners can decide whether repositories are allowed to override those settings, giving teams a path to enforce one scanning baseline everywhere or let high-context service teams tune analysis when needed.

The update also adds a more flexible way to reference configuration files that live in another repository. GitHub says only the repository name is required; when a ref and file path are omitted, the reference falls back to a default configuration file path on the main branch of a repository in the same organization as the repository being analyzed. For private repositories, organizations can grant default setup access by configuring a Git Source private registry rather than managing tokens in individual workflows.

The feature is generally available on github.com, according to GitHub, and is planned for GitHub Enterprise Server 3.23. For security leads, the release is less about a new scanner than about reducing the operational work required to keep scanning consistent. A central CodeQL configuration can help organizations add newly relevant queries or exclude noisy generated paths once, then apply that decision across many projects.

Developers should still treat rollout as a policy change, not a checkbox. Centralized CodeQL configuration can improve coverage, but repositories with unusual build systems, generated code, or language-specific needs may require testing before a broad organization default is enforced.

Sources

• github.blog

Cover photo by Tima Miroshnichenko on Pexels, used under the Pexels License.