GitHub Advanced Security step configuration

Scan code repositories with GitHub Advanced Security (GHAS).

The GitHub Advanced Security (GHAS) step in Harness STO enables you to scan your code repositories from the following GHAS products:

• CodeQL (SAST): Identify code vulnerabilities. Supported in Orchestration, Extraction, and Ingestion.

• Dependabot (SCA): Detect vulnerable open-source dependencies. Supported in Orchestration, Extraction, and Ingestion.

• Secret Scanning: Detect exposed secrets such as API keys and tokens. Supported in Extraction and Ingestion.

• To run scans as a non-root user, you can use custom STO scan images and pipelines. See Configure your pipeline to use STO images from private registry.

• STO supports multiple workflows for loading self-signed certificates. See Run STO scans with custom SSL certificates.

GitHub Advanced Security step settings

The recommended workflow is to add a GitHub Advanced Security step to a Security or Build stage and configure it as described below.

Scan

Scan Mode

• Orchestration: Executes the scan, normalizes, and deduplicates results. Supported for CodeQL and Dependabot.

  • To comply with GitHub’s licensing requirements, orchestration scans are uploaded to GitHub and then imported into STO.

  • Orchestration mode currently supports Python (pip) and JavaScript/TypeScript (npm or yarn). Extraction mode supports all languages available in GHAS.

• Extraction: Pulls existing results from GitHub APIs (CodeQL, Dependabot, Secret Scanning).

• Ingestion: Ingests SARIF files from previously run GHAS scans.

Scan Configuration

The GitHub Advanced Security step supports the following configurations:

• CodeQL

• Dependabot

• Secret Scanning

CodeQL

You can use CodeQL to perform Static Application Security Testing (SAST). For details about CodeQL itself, see the CodeQL documentation.

Here are a few important points to note when using CodeQL with Orchestration mode:

• The repository must be configured with Advanced setup for CodeQL analysis. To do this, go to your repository settings, click on Advanced Security, then go to Code scanning section and select Advanced setup for CodeQL analysis. If you're using default setup, you must switch to Advanced setup before running scans with Orchestration scan mode.

For Extraction mode, CodeQL works with both Default and Advanced setup.

The CodeQL scan configuration using the Orchestration scan mode requires a minimum of 2Gi of RAM. You can set this in the Additional Configuration section of your step.

---

Dependabot

You can use Dependabot for dependency (SCA) scans. For more information, see the Dependabot documentation.

Prerequisites for Dependabot scans:

• Dependabot alerts must be enabled. To check this, go to your repository settings, select Advanced Security, then click on Enable for Dependabot alerts.

• Dependabot with Orchestration mode requires a Docker-in-Docker (DinD) background step. When you configure this step, set the Entrypoint to dockerd-entrypoint.sh instead of dockerd. For setup instructions, go to Configure Docker-in-Docker (DinD) for your pipeline.

---

Secret Scanning

You can use Secret Scanning to detect exposed secrets such as API keys, tokens, or other sensitive values in your repositories. For more details about this feature, see the Secret Scanning documentation.

Prerequisites for Secret Scanning:

• Secret protection must be enabled. To enable this, go to your repository settings, click on Advanced Security, then click on Enable for Secret Protection.

Target

Type

Target and variant detection

Name

Variant

Workspace

Ingestion File

Authentication

Access Token

Use a GitHub fine-grained Personal Access Token (PAT) with the following repository permissions:

Scan Mode	Permission	Level
Orchestration (CodeQL, Dependabot)	Code scanning alerts	Read & Write
	Dependabot alerts	Read & Write
	Secret scanning alerts	Read & Write
Extraction (CodeQL, Dependabot, Secret Scanning)	Code scanning alerts	Read-only
	Dependabot alerts	Read-only
	Secret scanning alerts	Read-only

Make sure Repository access is set to All repositories or Only selected repositories.

Log Level

Fail on Severity

Additional Configuration

Advanced Settings

Proxy settings