We listened to your feedback and released new versions (v4) of actions/upload-artifact and actions/download-artifact. While this version of the actions to upload and download artifacts includes up to 10x performance improvements and several new features, there are also key differences from previous versions that may require updates to your workflows.
Default setup now includes scheduled scans and supports all languages covered by CodeQL
We’ve added new improvements to default setup, including automatically scheduling scans on repositories and support for all CodeQL covered languages.
This year, we’ve made a number of improvements focused on simplifying the enablement process for code scanning. We started back in January with the release of default setup, which allows you to automatically enable code scanning on a repository in just a few clicks.
We then gave you the ability to rapidly scale code scanning through multi-repository enablement, allowing you to use default setup on groups of repositories or your entire organization at once. Now, we’re giving you even more flexibility in how you can use default setup, whether it’s at the org level or just on your own personal repository.
Default setup will now automatically set up scheduled scans, and we’ve expanded language coverage to all CodeQL supported languages.
Scheduled scans have always been a feature of code scanning, allowing scans to be run automatically on a fixed schedule. This helps continuously keep your repositories secure by helping you find and fix any new vulnerabilities that are introduced on a regular cadence. Default setup will now automatically schedule scans on a weekly basis, ensuring you’re seeing accurate and up-to-date alerts on your repositories.
This will ensure that default setup uses the best configuration for your repository, no matter what language(s) you’re using. With auto-deselecting you’ll have peace of mind, knowing that default setup can troubleshoot itself if any issues are encountered during the setup process. Default setup will also automatically evolve its configuration to include any new languages you add to your repository. If the new language fails, the previous configuration will be resumed, without you having to prompt it.
GitHub is committed to helping build safer and more secure software without compromising on the developer experience. To learn more or enable GitHub’s security features in repositories, check out the getting started guide.