Question

A platform engineering team at a financial services company is enabling CodeQL default setup across 400 repositories in GitHub Enterprise Cloud. Compliance requires that all CodeQL analysis run on the company's own infrastructure inside a locked-down network segment, and that no analysis workloads execute on GitHub-hosted runners. An enterprise owner asks how to ensure the org-wide CodeQL rollout meets this requirement while still using the automatically managed default setup where possible. What should they do?

Accepted Answer

Register self-hosted runners (or a runner group) with the appropriate labels and assign them to the organizations, so that CodeQL default setup schedules its analysis jobs onto those self-hosted runners.

Answer

Enable CodeQL default setup unchanged, because default setup always executes on the enterprise's self-hosted runners when they are registered anywhere in the account.

Answer

Disable default setup entirely and require every repository to upload SARIF from an external CI system, since default setup cannot run on self-hosted infrastructure.

Answer

Configure an enterprise security policy that forces all GitHub-hosted runner traffic through the company's IP allow list, keeping CodeQL on GitHub-hosted runners but within the network segment.