Update a code scanning default setup configuration

PATCH

/repos/{owner}/{repo}/code-scanning/default-setup

Updates a code scanning default setup configuration.

OAuth app tokens and personal access tokens (classic) need the repo scope to use this endpoint with private or public repositories, or the public_repo scope to use this endpoint with only public repositories.

API method documentation

Parameters

Path Parameters

owner

required

string

The account owner of the repository. The name is not case sensitive.

repo

required

string

The name of the repository without the .git extension. The name is not case sensitive.

Request Body^required

Media typeapplication/json

Configuration for code scanning default setup.

object

state

The desired state of code scanning default setup.

string

Allowed values: configured not-configured

runner_type

Runner type to be used.

string

Allowed values: standard labeled

runner_label

Runner label to be used if the runner type is labeled.

string

nullable

query_suite

CodeQL query suite to be used.

string

Allowed values: default extended

threat_model

Threat model to be used for code scanning analysis. Use remote to analyze only network sources and remote_and_local to include local sources like filesystem access, command-line arguments, database reads, environment variable and standard input.

string

Allowed values: remote remote_and_local

languages

CodeQL languages to be analyzed.

Array<string>

Allowed values: actions c-cpp csharp go java-kotlin javascript-typescript python ruby swift

Examples

Exampledefault

{
  "state": "configured",
  "threat_model": "remote_and_local"
}

Responses

200

Response

Media typeapplication/json

Empty Object

An object without any properties.

object

Examples

Exampledefault

null

202

Response

Media typeapplication/json

You can use run_url to track the status of the run. This includes a property status and conclusion. You should not rely on this always being an actions workflow run object.

object

run_id

ID of the corresponding run.

integer

run_url

URL of the corresponding run.

string

Examples

Exampledefault

{
  "run_id": 42,
  "run_url": "https://api.github.com/repos/octoorg/octocat/actions/runs/42"
}

403

Response if the repository is archived or if GitHub Advanced Security is not enabled for this repository

Media typeapplication/json

Basic Error

Basic Error

object

message

string

documentation_url

string

url

string

status

string

Example^generated

{
  "message": "example",
  "documentation_url": "example",
  "url": "example",
  "status": "example"
}

404

Resource not found

Media typeapplication/json

Basic Error

Basic Error

object

message

string

documentation_url

string

url

string

status

string

Example^generated

{
  "message": "example",
  "documentation_url": "example",
  "url": "example",
  "status": "example"
}

409

Response if there is already a validation run in progress with a different default setup configuration

Media typeapplication/json

Basic Error

Basic Error

object

message

string

documentation_url

string

url

string

status

string

Example^generated

{
  "message": "example",
  "documentation_url": "example",
  "url": "example",
  "status": "example"
}

422

Response if the configuration change cannot be made because the repository is not in the required state

Media typeapplication/json

Basic Error

Basic Error

object

message

string

documentation_url

string

url

string

status

string

Example^generated

{
  "message": "example",
  "documentation_url": "example",
  "url": "example",
  "status": "example"
}

503

Service unavailable

Media typeapplication/json

object

code

string

message

string

documentation_url

string

Example^generated

{
  "code": "example",
  "message": "example",
  "documentation_url": "example"
}