GitHub Advanced Security for GitHub and Azure DevOps
Configure GitHub Advanced Security for both GitHub and Azure DevOps
GHAS is three capabilities, and the exam expects you to name them:
| Capability | Detects |
|---|---|
| Code scanning (CodeQL) | Vulnerable patterns in your own code |
| Secret scanning | Credentials committed to the repository |
| Dependency review | Vulnerable or non-compliant dependencies introduced by a pull request |
Two products, one feature set
GitHub Advanced Security for Azure DevOps brings the same three capabilities to Azure Repos. It is enabled per repository and its findings appear in the Azure DevOps Advanced Security tab rather than in GitHub.
The reason this exists — and the reason the objective names both — is that many organisations keep code in Azure Repos while wanting GitHub's scanning engines. You do not have to migrate to GitHub to use CodeQL.
Code scanning setup
| Setup | What it is | Use when |
|---|---|---|
| Default setup | GitHub configures and runs CodeQL for you; no workflow file | Standard projects; fastest to enable |
| Advanced setup | Generates a workflow file you own and edit | Custom build steps, compiled languages needing a specific build, container scanning, non-default query suites |
Reach for advanced setup only when default cannot express what you need — a maintained workflow file is a maintenance burden that default setup avoids entirely.
Secret scanning and push protection
Secret scanning alerts on credentials already present. Push protection rejects the push that would introduce one. Enable both: the first covers history and third-party patterns, the second prevents new occurrences.
Primary sources