Customize code scanning default setup at scale
GitHub now allows applying a custom CodeQL configuration file to code scanning default setup via the new github-codeql-config-file repository property. This lets organizations control how CodeQL scans for security vulnerabilities across one or many repositories without maintaining GitHub Actions workflow files in each repo. Settings from the config file are merged with built-in defaults, preserving threat models and model packs selected in the UI. Organization owners can enforce a central config or allow per-repo overrides. A new flexible syntax for referencing config files from other repositories is also introduced, along with support for private registries via Git Source instead of token management. The feature is generally available on github.com and will ship with GitHub Enterprise Server 3.23.
