Question

A platform engineering team runs GitHub Enterprise Server 3.11 on-premises and is planning to enable code scanning with the default CodeQL setup across all repositories in an organization. During planning, a security manager notes that on GitHub Enterprise Cloud the same default setup 'just works' after clicking enable, but on their Server instance the team must complete an additional infrastructure step before default setup will function. Which prerequisite is unique to enabling CodeQL default setup on GitHub Enterprise Server (as opposed to Enterprise Cloud)?

Accepted Answer

GitHub Actions must be enabled and configured with available self-hosted runners on the Server instance before default setup can run scans.

Answer

A GitHub Advanced Security license must be purchased separately, which is not required on Enterprise Cloud.

Answer

The dependency graph must be manually enabled per repository, whereas Enterprise Cloud enables it automatically for default setup.

Answer

Push protection for secret scanning must be enabled first because CodeQL default setup depends on it.