Analyse du code

Enterprise Cloud

Enterprise Server 3.10

Enterprise Server 3.11

Enterprise Server 3.6

Enterprise Server 3.7

Enterprise Server 3.8

Enterprise Server 3.9

Free, Pro, & Team

GitHub AE

REST API

Toute la documentation GitHub est open source. Vous voyez quelque chose qui n’est pas correct ou qui n’est pas clair ? Envoyez une demande de tirage.

Aidez-nous à rendre ces documents formidables !

Actions

Entrez un terme de recherche pour le trouver dans la documentation GitHub.

Analyse du code - GitHub AE Docs

Utilisez l’API REST pour récupérer et mettre à jour les alertes code scanning d’un dépôt.

Démarrage rapide

Comparaison des API de GitHub

Ressources disponibles dans l’API REST

Rate limits

Types de médias

Authentification

Sécurisation des informations d’identification de l’API

Résolution des problèmes

Libraries

Types d’événement de problème

Types d’événements GitHub

Points de terminaison pour les jetons d’installation d’application GitHub

Points de terminaison pour les jetons d’utilisateur d’application GitHub

Autorisations pour les applications GitHub

Vue d’ensemble

Utilisation de l’API

Écrire des scripts avec JavaScript

Script avec Ruby

Découvrir les ressources pour un utilisateur

Livraison de déploiements

Rendu des données sous forme de graphes

Utilisation des commentaires

Pagination

Création d’un serveur CI

Bonnes pratiques

Bien démarrer - Base de données Git

Bien démarrer - Vérifications

Chiffrer des secrets

Guides

Artifacts

Autorisations

Secrets

Groupes d’exécuteurs auto-hébergés

Exécuteurs auto-hébergés

Travaux de workflow

Workflow runs

Workflows

Événements

Flux

Notifications

Attribution d’étoiles

Visionnage

Activité

Applications GitHub

Installations

Autorisations OAuth

Webhooks

Applications

Branches

Branches protégées

Exécutions de vérifications

Suites de vérifications

Vérifications

Codes of conduct

Collaborateurs

Invitations

Commits

Commentaires de commit

États de validation

Clés de déploiement

Stratégies de branche de déploiement

Déploiements

Environnements

États des déploiements

Emojis

Statistiques d’administration

Annonce

Journal d’audit

Webhooks globaux

Licence

Organisations

Environnements de pré-réception

Utilisateurs

Administration d’entreprise

Gists

Commentaires

Objets blob

Références

Étiquettes

Arborescences

Base de données Git

Gitignore

Problèmes

Personnes responsables

Étapes majeures

Durée

Licences

Markdown

Statistiques

Mesures

Migrations

Membres

Collaborateurs externes

Pages

Boards

Cartes

Colonnes

Project boards

Tirages

Commentaires d’évaluation

Passer en revue les demandes

Révisions

Limite du taux

Réactions

Publications

Ressources de mise en production

Liens automatiques

Contenu

Fourches

Git LFS

Référentiels

Rechercher

Analyse de secrets

Teams

Commentaires de discussion

Discussions

Groupes externes

Abonnés

Clés GPG

Clés SSH Git

API REST

https://web.archive.org/web/20231124065118/https://api.github.com/repos/octocat/Hello-World/contents/{+path}

Hello-World

Arbitrary file write during zip extraction

js/zipslip

CodeQL

Lists code scanning alerts for the default branch for all eligible repositories in an organization. Eligible repositories are repositories that are owned by organizations that you own or for which you are a security manager. For more information, see "<a href="https://docs.github.com/github-ae@latest/organizations/managing-peoples-access-to-your-organization-with-roles/managing-security-managers-in-your-organization">Managing security managers in your organization</a>."
To use this endpoint, you must be an owner or security manager for the organization, and you must use an access token with the <code>repo</code> scope or <code>security_events</code> scope.
For public repositories, you may instead use the <code>public_repo</code> scope.

The organization name. The name is not case sensitive.

The name of a code scanning tool. Only results by this tool will be listed. You can specify the tool by using either <code>tool_name</code> or <code>tool_guid</code>, but not both.

tool_name

The name of the tool used to generate the code scanning analysis.

The GUID of a code scanning tool. Only results by this tool will be listed. Note that some code scanning tools may not include a GUID in their analysis data. You can specify the tool by using either <code>tool_guid</code> or <code>tool_name</code>, but not both.

tool_guid

The GUID of the tool used to generate the code scanning analysis, if provided in the uploaded SARIF data.

A cursor, as given in the <a href="https://docs.github.com/github-ae@latest/rest/guides/using-pagination-in-the-rest-api#using-link-headers">Link header</a>. If specified, the query only searches for results before this cursor.

before

A cursor, as given in the <a href="https://docs.github.com/github-ae@latest/rest/guides/using-pagination-in-the-rest-api#using-link-headers">Link header</a>. If specified, the query only searches for results after this cursor.

after

Page number of the results to fetch.

page

The number of results per page (max 100).

per_page

The direction to sort the results by.

direction

If specified, only code scanning alerts with this state will be returned.

state

The property by which to sort the results.

sort

If specified, only code scanning alerts with this severity will be returned.

severity

List code scanning alerts for an organization

Lists code scanning alerts.
To use this endpoint, you must use an access token with the <code>security_events</code> scope or, for alerts from public repositories only, an access token with the <code>public_repo</code> scope.
The response includes a <code>most_recent_instance</code> object.
This provides details of the most recent instance of this alert
for the default branch (or for the specified Git reference if you used <code>ref</code> in the request).

The account owner of the repository. The name is not case sensitive.

owner

The name of the repository without the <code>.git</code> extension. The name is not case sensitive.

repo

The Git reference for the results you want to list. The <code>ref</code> for a branch can be formatted either as <code>refs/heads/&#x3C;branch name></code> or simply <code>&#x3C;branch name></code>. To reference a pull request use <code>refs/pull/&#x3C;number>/merge</code>.

The Git reference, formatted as `refs/pull/<number>/merge`, `refs/pull/<number>/head`,
`refs/heads/<branch name>` or simply `<branch name>`.

Response if GitHub Advanced Security is not enabled for this repository

List code scanning alerts for a repository

This path depends on a user-provided value.

Arbitrary file write during zip extraction ("Zip Slip")

Extracting files from a malicious zip archive without validating that the destination file path is within the destination directory can cause files outside the destination directory to be overwritten.

The time that the alert was created in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.

The time that the alert was dismissed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.

**Required when the state is dismissed.** The reason for dismissing or closing the alert.

The REST API URL for fetching the list of instances for an alert.

Gets a single code scanning alert. You must use an access token with the <code>security_events</code> scope to use this endpoint with private repos, the <code>public_repo</code> scope also grants permission to read security events on public repos only.

The number that identifies an alert. You can find this at the end of the URL for a code scanning alert within GitHub, and in the <code>number</code> field in the response from the <code>GET /repos/{owner}/{repo}/code-scanning/alerts</code> operation.

alert_number

Get a code scanning alert

Sets the state of the code scanning alert. You must provide <code>dismissed_reason</code> when you set the state to <code>dismissed</code>.

Required when the state is dismissed. The reason for dismissing or closing the alert.

dismissed_reason

Updates the status of a single code scanning alert. You must use an access token with the <code>security_events</code> scope to use this endpoint. GitHub Apps must have the <code>security_events</code> write permission to use this endpoint.

Response if the repository is archived or if GitHub Advanced Security is not enabled for this repository

Update a code scanning alert

This suffix check is missing a length comparison to correctly handle lastIndexOf returning -1.

Lists all instances of the specified code scanning alert.
You must use an access token with the <code>security_events</code> scope to use this endpoint with private repos,
the <code>public_repo</code> scope also grants permission to read security events on public repos only.

List instances of a code scanning alert

Python Security Analysis

Lists the details of all code scanning analyses for a repository,
starting with the most recent.
The response is paginated and you can use the <code>page</code> and <code>per_page</code> parameters
to list the analyses you're interested in.
By default 30 analyses are listed per page.
The <code>rules_count</code> field in the response give the number of rules
that were run in the analysis.
For very old analyses this data is not available,
and <code>0</code> is returned in this field.
You must use an access token with the <code>security_events</code> scope to use this endpoint with private repos,
the <code>public_repo</code> scope also grants permission to read security events on public repos only.
Deprecation notice:
The <code>tool_name</code> field is deprecated and will, in future, not be included in the response for this endpoint. The example response reflects this change. The tool name can now be found inside the <code>tool</code> field.

The Git reference for the analyses you want to list. The <code>ref</code> for a branch can be formatted either as <code>refs/heads/&#x3C;branch name></code> or simply <code>&#x3C;branch name></code>. To reference a pull request use <code>refs/pull/&#x3C;number>/merge</code>.