Skip to content

Create Api Signed-off-by: Huỳnh Thương <252359928+Huynhthuongg@users.noreply.github.com>#4

Open
Huỳnh Thương (Huynhthuongg) wants to merge 41 commits into
codex/giai-thich-ma-goc-cho-nguoi-moi-qyi3exfrom
main
Open

Create Api Signed-off-by: Huỳnh Thương <252359928+Huynhthuongg@users.noreply.github.com>#4
Huỳnh Thương (Huynhthuongg) wants to merge 41 commits into
codex/giai-thich-ma-goc-cho-nguoi-moi-qyi3exfrom
main

Conversation

@Huynhthuongg

Copy link
Copy Markdown
Member

No description provided.

…e README (#1)

### Motivation

- Provide a polished static landing page to present the Bixbott
ecosystem and architecture.
- Consolidate a clear project overview and module layout in `README.md`
to help contributors and visitors discover the project structure.
- Ship a lightweight, responsive front-end that can be opened directly
or served as static assets for demo/marketing use.

### Description

- Added `index.html` which implements a Vietnamese-language landing page
with hero, ecosystem, architecture, roadmap, and contact sections.
- Added `styles.css` containing a responsive, modern UI theme with
copper accents, animated background orbs, glass cards, layout system,
and reveal animation styles.
- Added `script.js` which implements scroll-reveal behavior using
`IntersectionObserver` and per-item delay handling via `data-delay`.
- Updated `README.md` to document the Bixbott ecosystem, list the new
static site files (`index.html`, `styles.css`, `script.js`), and provide
brief usage instructions.

### Testing

- No automated tests are configured or run for these static front-end
assets.
- Changes are limited to static files and documentation so no existing
unit tests were impacted.

------
[Codex
Task](https://chatgpt.com/codex/cloud/tasks/task_e_6a366ceafa94832d9c77ed8a5152921c)

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Adds a static, responsive landing page for Bixbott with scroll-reveal
animations and updates the README with an ecosystem overview and quick
usage.

- **New Features**
- `index.html`: Vietnamese landing page with hero, ecosystem,
architecture, roadmap, and contact sections.
- `styles.css`: Responsive theme with copper accents, glass cards,
animated background orbs, and reveal animation styles (reduced-motion
supported).
- `script.js`: Scroll-reveal via `IntersectionObserver` with per-item
delays using `data-delay`.
- README: Adds ecosystem tree, lists new static files, and shows how to
open/serve the page.

<sup>Written for commit 0c86085.
Summary will update on new commits.</sup>

<a
href="https://cubic.dev/pr/Huynhthuongg/ORGANIZATION/pull/1?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="Review in cubic"
src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>

<!-- End of auto-generated description by cubic. -->
Signed-off-by: Huỳnh Thương <252359928+Huynhthuongg@users.noreply.github.com>
Signed-off-by: Huỳnh Thương <252359928+Huynhthuongg@users.noreply.github.com>
Signed-off-by: Huỳnh Thương <252359928+Huynhthuongg@users.noreply.github.com>
Signed-off-by: Huỳnh Thương <252359928+Huynhthuongg@users.noreply.github.com>
Signed-off-by: Huỳnh Thương <252359928+Huynhthuongg@users.noreply.github.com>
Signed-off-by: Huỳnh Thương <252359928+Huynhthuongg@users.noreply.github.com>
Signed-off-by: Huỳnh Thương <252359928+Huynhthuongg@users.noreply.github.com>
@github-advanced-security

Copy link
Copy Markdown

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

  • The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
  • Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
  • You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

Signed-off-by: Huỳnh Thương <252359928+Huynhthuongg@users.noreply.github.com>
Signed-off-by: Huỳnh Thương <252359928+Huynhthuongg@users.noreply.github.com>
Signed-off-by: Huỳnh Thương <252359928+Huynhthuongg@users.noreply.github.com>
Signed-off-by: Huỳnh Thương <252359928+Huynhthuongg@users.noreply.github.com>
Signed-off-by: Huỳnh Thương <252359928+Huynhthuongg@users.noreply.github.com>
Comment thread styles.css
Comment thread styles.css
Comment thread styles.css
Comment thread styles.css
Comment thread script.js
Comment thread script.js
Comment thread script.js

@github-advanced-security github-advanced-security AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Csslint (reported by Codacy) found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.

Signed-off-by: Huỳnh Thương <252359928+Huynhthuongg@users.noreply.github.com> (#5)
@Huynhthuongg Huỳnh Thương (Huynhthuongg) added bug Something isn't working documentation Improvements or additions to documentation duplicate This issue or pull request already exists enhancement New feature or request help wanted Extra attention is needed good first issue Good for newcomers invalid This doesn't seem right question Further information is requested wontfix This will not be worked on labels Jun 20, 2026
@Huynhthuongg

Copy link
Copy Markdown
Member Author
            Git installation

Normally you can just do "make" followed by "make install", and that
will install the git programs in your own ~/bin/ directory. If you want
to do a global install, you can do

    $ make prefix=/usr all doc info ;# as yourself
    # make prefix=/usr install install-doc install-html install-info ;# as root

(or prefix=/usr/local, of course). Just like any program suite
that uses $prefix, the built results have some paths encoded,
which are derived from $prefix, so "make all; make prefix=/usr
install" would not work.

The beginning of the Makefile documents many variables that affect the way
git is built. You can override them either from the command line, or in a
config.mak file.

Alternatively you can use autoconf generated ./configure script to
set up install paths (via config.mak.autogen), so you can write instead

    $ make configure ;# as yourself
    $ ./configure --prefix=/usr ;# as yourself
    $ make all doc ;# as yourself
    # make install install-doc install-html;# as root

If you're willing to trade off (much) longer build time for a later
faster git you can also do a profile feedback build with

    $ make prefix=/usr profile
    # make prefix=/usr PROFILE=BUILD install

This will run the complete test suite as training workload and then
rebuild git with the generated profile feedback. This results in a git
which is a few percent faster on CPU intensive workloads. This
may be a good tradeoff for distribution packagers.

Alternatively you can run profile feedback only with the git benchmark
suite. This runs significantly faster than the full test suite, but
has less coverage:

    $ make prefix=/usr profile-fast
    # make prefix=/usr PROFILE=BUILD install

Or if you just want to install a profile-optimized version of git into
your home directory, you could run:

    $ make profile-install

or
$ make profile-fast-install

As a caveat: a profile-optimized build takes a lot longer since the
git tree must be built twice, and in order for the profiling
measurements to work properly, ccache must be disabled and the test
suite has to be run using only a single CPU. In addition, the profile
feedback build stage currently generates a lot of additional compiler
warnings.

Issues of note:

  • Ancient versions of GNU Interactive Tools (pre-4.9.2) installed a
    program "git", whose name conflicts with this program. But with
    version 4.9.2, after long hiatus without active maintenance (since
    around 1997), it changed its name to gnuit and the name conflict is no
    longer a problem.

    NOTE: When compiled with backward compatibility option, the GNU
    Interactive Tools package still can install "git", but you can build it
    with --disable-transition option to avoid this.

  • You can use git after building but without installing if you want
    to test drive it. Simply run git found in bin-wrappers directory
    in the build directory, or prepend that directory to your $PATH.
    This however is less efficient than running an installed git, as
    you always need an extra fork+exec to run any git subcommand.

    It is still possible to use git without installing by setting a few
    environment variables, which was the way this was done
    traditionally. But using git found in bin-wrappers directory in
    the build directory is far simpler. As a historical reference, the
    old way went like this:

     GIT_EXEC_PATH=`pwd`
     PATH=`pwd`:$PATH
     GITPERLLIB=`pwd`/perl/build/lib
     export GIT_EXEC_PATH PATH GITPERLLIB
    
  • By default (unless NO_PERL is provided) Git will ship various perl
    scripts. However, for simplicity it doesn't use the
    ExtUtils::MakeMaker toolchain to decide where to place the perl
    libraries. Depending on the system this can result in the perl
    libraries not being where you'd like them if they're expected to be
    used by things other than Git itself.

    Manually supplying a perllibdir prefix should fix this, if this is
    a problem you care about, e.g.:

    prefix=/usr perllibdir=/usr/$(/usr/bin/perl -MConfig -wle 'print substr $Config{installsitelib}, 1 + length $Config{siteprefixexp}')
    

    Will result in e.g. perllibdir=/usr/share/perl/5.26.1 on Debian,
    perllibdir=/usr/share/perl5 (which we'd use by default) on CentOS.

  • Unless NO_PERL is provided Git will ship various perl libraries it
    needs. Distributors of Git will usually want to set
    NO_PERL_CPAN_FALLBACKS if NO_PERL is not provided to use their own
    copies of the CPAN modules Git needs.

  • Git is reasonably self-sufficient, but does depend on a few external
    programs and libraries. Git can be used without most of them by adding
    the appropriate "NO_=YesPlease" to the make command line or
    config.mak file.

     - "zlib", the compression library. Git won't build without it.
    
     - "ssh" is used to push and pull over the net.
    
     - A POSIX-compliant shell is required to run some scripts needed
       for everyday use (e.g. "bisect", "request-pull").
    
     - "Perl" version 5.26.0 or later is needed to use some of the
       features (e.g. sending patches using "git send-email",
       interacting with svn repositories with "git svn").  If you can
       live without these, use NO_PERL.  Note that recent releases of
       Redhat/Fedora are reported to ship Perl binary package with some
       core modules stripped away (see https://lwn.net/Articles/477234/),
       so you might need to install additional packages other than Perl
       itself, e.g. Digest::MD5, File::Spec, File::Temp, Net::Domain,
       Net::SMTP, and Time::HiRes.
    
     - "libcurl" library is used for fetching and pushing
       repositories over http:// or https://, as well as by
       git-imap-send. If you do not need that functionality,
       use NO_CURL to build without it.
    
       Git requires version "7.61.0" or later of "libcurl" to build
       without NO_CURL. This version requirement may be bumped in
       the future.
    
     - "expat" library; git-http-push uses it for remote lock
       management over DAV.  Similar to "curl" above, this is optional
       (with NO_EXPAT).
    
     - "wish", the Tcl/Tk windowing shell is used in gitk to show the
       history graphically, and in git-gui.  If you don't want gitk or
       git-gui, you can use NO_TCLTK.
    
     - A gettext library is used by default for localizing Git. The
       primary target is GNU libintl, but the Solaris gettext
       implementation also works.
    
       We need a gettext.h on the system for C code, gettext.sh (or
       Solaris gettext(1)) for shell scripts, and libintl-perl for Perl
       programs.
    
       Set NO_GETTEXT to disable localization support and make Git only
       use English. Under autoconf the configure script will do this
       automatically if it can't find libintl on the system.
    
     - Python version 2.7 or later is needed to use the git-p4 interface
       to Perforce.
    
  • Some platform specific issues are dealt with Makefile rules,
    but depending on your specific installation, you may not
    have all the libraries/tools needed, or you may have
    necessary libraries at unusual locations. Please look at the
    top of the Makefile to see what can be adjusted for your needs.
    You can place local settings in config.mak and the Makefile
    will include them. Note that config.mak is not distributed;
    the name is reserved for local settings.

  • To build and install documentation suite, you need to have
    the asciidoc/xmlto toolchain. Because not many people are
    inclined to install the tools, the default build target
    ("make all") does not build them.

    "make doc" builds documentation in man and html formats; there are
    also "make man", "make html" and "make info". Note that "make html"
    requires asciidoc, but not xmlto. "make man" (and thus make doc)
    requires both.

    "make install-doc" installs documentation in man format only; there
    are also "make install-man", "make install-html" and "make
    install-info".

    Building and installing the info file additionally requires
    makeinfo and docbook2X. Version 0.8.3 is known to work.

    Building and installing the pdf file additionally requires
    dblatex. Version >= 0.2.7 is known to work.

    All formats require at least asciidoc 8.4.1. Alternatively, you can
    use Asciidoctor (requires Ruby) by passing USE_ASCIIDOCTOR=YesPlease
    to make. You need at least Asciidoctor version 1.5.

    There are also "make quick-install-doc", "make quick-install-man"
    and "make quick-install-html" which install preformatted man pages
    and html documentation. To use these build targets, you need to
    clone two separate git-htmldocs and git-manpages repositories next
    to the clone of git itself.

    The minimum supported version of docbook-xsl is 1.74.

    Users attempting to build the documentation on Cygwin may need to ensure
    that the /etc/xml/catalog file looks something like this:

This can be achieved with the following two xmlcatalog commands:

xmlcatalog --noout
--add rewriteURI
http://docbook.sourceforge.net/release/xsl/current
/usr/share/sgml/docbook/xsl-stylesheets
/etc/xml/catalog

xmlcatalog --noout
--add rewriteURI
http://www.oasis-open.org/docbook/xml/4.5/xsl/current
/usr/share/sgml/docbook/xml-dtd-4.5
/etc/xml/catalog

@Bixbott bixbott (Bixbott) locked and limited conversation to collaborators Jun 20, 2026
@Bixbott bixbott (Bixbott) unlocked this conversation Jun 20, 2026
@Huynhthuongg

Copy link
Copy Markdown
Member Author
            Git installation

Normally you can just do "make" followed by "make install", and that
will install the git programs in your own ~/bin/ directory. If you want
to do a global install, you can do

    $ make prefix=/usr all doc info ;# as yourself
    # make prefix=/usr install install-doc install-html install-info ;# as root

(or prefix=/usr/local, of course). Just like any program suite
that uses $prefix, the built results have some paths encoded,
which are derived from $prefix, so "make all; make prefix=/usr
install" would not work.

The beginning of the Makefile documents many variables that affect the way
git is built. You can override them either from the command line, or in a
config.mak file.

Alternatively you can use autoconf generated ./configure script to
set up install paths (via config.mak.autogen), so you can write instead

    $ make configure ;# as yourself
    $ ./configure --prefix=/usr ;# as yourself
    $ make all doc ;# as yourself
    # make install install-doc install-html;# as root

If you're willing to trade off (much) longer build time for a later
faster git you can also do a profile feedback build with

    $ make prefix=/usr profile
    # make prefix=/usr PROFILE=BUILD install

This will run the complete test suite as training workload and then
rebuild git with the generated profile feedback. This results in a git
which is a few percent faster on CPU intensive workloads. This
may be a good tradeoff for distribution packagers.

Alternatively you can run profile feedback only with the git benchmark
suite. This runs significantly faster than the full test suite, but
has less coverage:

    $ make prefix=/usr profile-fast
    # make prefix=/usr PROFILE=BUILD install

Or if you just want to install a profile-optimized version of git into
your home directory, you could run:

    $ make profile-install

or
$ make profile-fast-install

As a caveat: a profile-optimized build takes a lot longer since the
git tree must be built twice, and in order for the profiling
measurements to work properly, ccache must be disabled and the test
suite has to be run using only a single CPU. In addition, the profile
feedback build stage currently generates a lot of additional compiler
warnings.

Issues of note:

  • Ancient versions of GNU Interactive Tools (pre-4.9.2) installed a
    program "git", whose name conflicts with this program. But with
    version 4.9.2, after long hiatus without active maintenance (since
    around 1997), it changed its name to gnuit and the name conflict is no
    longer a problem.

    NOTE: When compiled with backward compatibility option, the GNU
    Interactive Tools package still can install "git", but you can build it
    with --disable-transition option to avoid this.

  • You can use git after building but without installing if you want
    to test drive it. Simply run git found in bin-wrappers directory
    in the build directory, or prepend that directory to your $PATH.
    This however is less efficient than running an installed git, as
    you always need an extra fork+exec to run any git subcommand.

    It is still possible to use git without installing by setting a few
    environment variables, which was the way this was done
    traditionally. But using git found in bin-wrappers directory in
    the build directory is far simpler. As a historical reference, the
    old way went like this:

     GIT_EXEC_PATH=`pwd`
     PATH=`pwd`:$PATH
     GITPERLLIB=`pwd`/perl/build/lib
     export GIT_EXEC_PATH PATH GITPERLLIB
    
  • By default (unless NO_PERL is provided) Git will ship various perl
    scripts. However, for simplicity it doesn't use the
    ExtUtils::MakeMaker toolchain to decide where to place the perl
    libraries. Depending on the system this can result in the perl
    libraries not being where you'd like them if they're expected to be
    used by things other than Git itself.

    Manually supplying a perllibdir prefix should fix this, if this is
    a problem you care about, e.g.:

    prefix=/usr perllibdir=/usr/$(/usr/bin/perl -MConfig -wle 'print substr $Config{installsitelib}, 1 + length $Config{siteprefixexp}')
    

    Will result in e.g. perllibdir=/usr/share/perl/5.26.1 on Debian,
    perllibdir=/usr/share/perl5 (which we'd use by default) on CentOS.

  • Unless NO_PERL is provided Git will ship various perl libraries it
    needs. Distributors of Git will usually want to set
    NO_PERL_CPAN_FALLBACKS if NO_PERL is not provided to use their own
    copies of the CPAN modules Git needs.

  • Git is reasonably self-sufficient, but does depend on a few external
    programs and libraries. Git can be used without most of them by adding
    the appropriate "NO_=YesPlease" to the make command line or
    config.mak file.

     - "zlib", the compression library. Git won't build without it.
    
     - "ssh" is used to push and pull over the net.
    
     - A POSIX-compliant shell is required to run some scripts needed
       for everyday use (e.g. "bisect", "request-pull").
    
     - "Perl" version 5.26.0 or later is needed to use some of the
       features (e.g. sending patches using "git send-email",
       interacting with svn repositories with "git svn").  If you can
       live without these, use NO_PERL.  Note that recent releases of
       Redhat/Fedora are reported to ship Perl binary package with some
       core modules stripped away (see https://lwn.net/Articles/477234/),
       so you might need to install additional packages other than Perl
       itself, e.g. Digest::MD5, File::Spec, File::Temp, Net::Domain,
       Net::SMTP, and Time::HiRes.
    
     - "libcurl" library is used for fetching and pushing
       repositories over http:// or https://, as well as by
       git-imap-send. If you do not need that functionality,
       use NO_CURL to build without it.
    
       Git requires version "7.61.0" or later of "libcurl" to build
       without NO_CURL. This version requirement may be bumped in
       the future.
    
     - "expat" library; git-http-push uses it for remote lock
       management over DAV.  Similar to "curl" above, this is optional
       (with NO_EXPAT).
    
     - "wish", the Tcl/Tk windowing shell is used in gitk to show the
       history graphically, and in git-gui.  If you don't want gitk or
       git-gui, you can use NO_TCLTK.
    
     - A gettext library is used by default for localizing Git. The
       primary target is GNU libintl, but the Solaris gettext
       implementation also works.
    
       We need a gettext.h on the system for C code, gettext.sh (or
       Solaris gettext(1)) for shell scripts, and libintl-perl for Perl
       programs.
    
       Set NO_GETTEXT to disable localization support and make Git only
       use English. Under autoconf the configure script will do this
       automatically if it can't find libintl on the system.
    
     - Python version 2.7 or later is needed to use the git-p4 interface
       to Perforce.
    
  • Some platform specific issues are dealt with Makefile rules,
    but depending on your specific installation, you may not
    have all the libraries/tools needed, or you may have
    necessary libraries at unusual locations. Please look at the
    top of the Makefile to see what can be adjusted for your needs.
    You can place local settings in config.mak and the Makefile
    will include them. Note that config.mak is not distributed;
    the name is reserved for local settings.

  • To build and install documentation suite, you need to have
    the asciidoc/xmlto toolchain. Because not many people are
    inclined to install the tools, the default build target
    ("make all") does not build them.

    "make doc" builds documentation in man and html formats; there are
    also "make man", "make html" and "make info". Note that "make html"
    requires asciidoc, but not xmlto. "make man" (and thus make doc)
    requires both.

    "make install-doc" installs documentation in man format only; there
    are also "make install-man", "make install-html" and "make
    install-info".

    Building and installing the info file additionally requires
    makeinfo and docbook2X. Version 0.8.3 is known to work.

    Building and installing the pdf file additionally requires
    dblatex. Version >= 0.2.7 is known to work.

    All formats require at least asciidoc 8.4.1. Alternatively, you can
    use Asciidoctor (requires Ruby) by passing USE_ASCIIDOCTOR=YesPlease
    to make. You need at least Asciidoctor version 1.5.

    There are also "make quick-install-doc", "make quick-install-man"
    and "make quick-install-html" which install preformatted man pages
    and html documentation. To use these build targets, you need to
    clone two separate git-htmldocs and git-manpages repositories next
    to the clone of git itself.

    The minimum supported version of docbook-xsl is 1.74.

    Users attempting to build the documentation on Cygwin may need to ensure
    that the /etc/xml/catalog file looks something like this:

This can be achieved with the following two xmlcatalog commands:

xmlcatalog --noout
--add rewriteURI
http://docbook.sourceforge.net/release/xsl/current
/usr/share/sgml/docbook/xsl-stylesheets
/etc/xml/catalog

xmlcatalog --noout
--add rewriteURI
http://www.oasis-open.org/docbook/xml/4.5/xsl/current
/usr/share/sgml/docbook/xml-dtd-4.5
/etc/xml/catalog

This was linked to issues Jun 20, 2026
Signed-off-by: Huỳnh Thương <252359928+Huynhthuongg@users.noreply.github.com> (#21)
Signed-off-by: Huỳnh Thương <252359928+Huynhthuongg@users.noreply.github.com>
# Code scanning

You can use code scanning to find security vulnerabilities and errors in the code for your project on GitHub.

Code scanning is a feature that you use to analyze the code in a GitHub repository to find security vulnerabilities and coding errors. Any problems identified by the analysis are shown in your repository.

You can use code scanning to find, triage, and prioritize fixes for existing problems in your code. Code scanning also prevents developers from introducing new problems. You can schedule scans for specific days and times, or trigger scans when a specific event occurs in the repository, such as a push.

If code scanning finds a potential vulnerability or error in your code, GitHub displays an alert in the repository. After you fix the code that triggered the alert, GitHub closes the alert. For more information, see [Resolving code scanning alerts](/en/code-security/code-scanning/managing-code-scanning-alerts/resolving-code-scanning-alerts).

GitHub Copilot Autofix will suggest fixes for alerts from code scanning analysis, allowing developers to prevent and reduce vulnerabilities with less effort. For more information, see [Application card: GitHub security and quality AI features](/en/code-security/code-scanning/managing-code-scanning-alerts/responsible-use-autofix-code-scanning).

To monitor results from code scanning across your repositories or your organization, you can use webhooks and the code scanning API. For information about the webhooks for code scanning, see
[Webhook events and payloads](/en/webhooks-and-events/webhooks/webhook-events-and-payloads#code_scanning_alert). For information about API endpoints, see [REST API endpoints for code scanning](/en/rest/code-scanning/code-scanning).

Code scanning uses GitHub Actions, with each workflow run consuming GitHub Actions minutes. If you want to use code scanning on private repositories, you need a GitHub Code Security license. For more information, see [GitHub Actions billing](/en/billing/managing-billing-for-github-actions/about-billing-for-github-actions). For information about how you can try GitHub Enterprise with GitHub Advanced Security for free, see [Setting up a trial of GitHub Enterprise Cloud](/en/enterprise-cloud@latest/admin/overview/setting-up-a-trial-of-github-enterprise-cloud) and [Setting up a trial of GitHub Advanced Security](/en/enterprise-cloud@latest/billing/managing-billing-for-your-products/managing-billing-for-github-advanced-security/setting-up-a-trial-of-github-advanced-security#setting-up-your-trial-of-github-advanced-security) in the GitHub Enterprise Cloud documentation.

If you want to assess your organization's exposure to vulnerabilities before purchasing a license, you can run a free code security risk assessment. See [Code security risk assessment](/en/code-security/concepts/code-scanning/code-security-risk-assessment).

To get started with code scanning, see [Configuring default setup for code scanning](/en/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning).

## About tools for code scanning

You can configure code scanning to use the CodeQL product maintained by GitHub or a third-party code scanning tool.

### About CodeQL analysis

CodeQL is the code analysis engine developed by GitHub to automate security checks. You can analyze your code using CodeQL and display the results as code scanning alerts. For more information about CodeQL, see [Code scanning with CodeQL](/en/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning-with-codeql).

### About third-party code scanning tools

Code scanning is interoperable with third-party code scanning tools that output Static Analysis Results Interchange Format (SARIF) data. SARIF is an open standard. For more information, see [SARIF support for code scanning](/en/code-security/code-scanning/integrating-with-code-scanning/sarif-support-for-code-scanning).

You can run third-party analysis tools within GitHub using actions or within an external CI system. For more information, see [Configuring advanced setup for code scanning](/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/configuring-advanced-setup-for-code-scanning#configuring-code-scanning-using-third-party-actions) or [Uploading a SARIF file to GitHub](/en/code-security/code-scanning/integrating-with-code-scanning/uploading-a-sarif-file-to-github).

## About the tool status page

The tool status page shows useful information about all of your code scanning tools. If code scanning is not working as you'd expect, the tool status page is a good starting point for debugging problems. For more information, see [Use the tool status page for code scanning](/en/code-security/code-scanning/managing-your-code-scanning-configuration/about-the-tool-status-page).
# Code scanning

You can use code scanning to find security vulnerabilities and errors in
the code for your project on GitHub.

Code scanning is a feature that you use to analyze the code in a GitHub
repository to find security vulnerabilities and coding errors. Any
problems identified by the analysis are shown in your repository.

You can use code scanning to find, triage, and prioritize fixes for
existing problems in your code. Code scanning also prevents developers
from introducing new problems. You can schedule scans for specific days
and times, or trigger scans when a specific event occurs in the
repository, such as a push.

If code scanning finds a potential vulnerability or error in your code,
GitHub displays an alert in the repository. After you fix the code that
triggered the alert, GitHub closes the alert. For more information, see
[Resolving code scanning
alerts](/en/code-security/code-scanning/managing-code-scanning-alerts/resolving-code-scanning-alerts).

GitHub Copilot Autofix will suggest fixes for alerts from code scanning
analysis, allowing developers to prevent and reduce vulnerabilities with
less effort. For more information, see [Application card: GitHub
security and quality AI
features](/en/code-security/code-scanning/managing-code-scanning-alerts/responsible-use-autofix-code-scanning).

To monitor results from code scanning across your repositories or your
organization, you can use webhooks and the code scanning API. For
information about the webhooks for code scanning, see [Webhook events
and
payloads](/en/webhooks-and-events/webhooks/webhook-events-and-payloads#code_scanning_alert).
For information about API endpoints, see [REST API endpoints for code
scanning](/en/rest/code-scanning/code-scanning).

Code scanning uses GitHub Actions, with each workflow run consuming
GitHub Actions minutes. If you want to use code scanning on private
repositories, you need a GitHub Code Security license. For more
information, see [GitHub Actions
billing](/en/billing/managing-billing-for-github-actions/about-billing-for-github-actions).
For information about how you can try GitHub Enterprise with GitHub
Advanced Security for free, see [Setting up a trial of GitHub Enterprise
Cloud](/en/enterprise-cloud@latest/admin/overview/setting-up-a-trial-of-github-enterprise-cloud)
and [Setting up a trial of GitHub Advanced
Security](/en/enterprise-cloud@latest/billing/managing-billing-for-your-products/managing-billing-for-github-advanced-security/setting-up-a-trial-of-github-advanced-security#setting-up-your-trial-of-github-advanced-security)
in the GitHub Enterprise Cloud documentation.

If you want to assess your organization's exposure to vulnerabilities
before purchasing a license, you can run a free code security risk
assessment. See [Code security risk
assessment](/en/code-security/concepts/code-scanning/code-security-risk-assessment).

To get started with code scanning, see [Configuring default setup for
code
scanning](/en/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning).

## About tools for code scanning

You can configure code scanning to use the CodeQL product maintained by
GitHub or a third-party code scanning tool.

### About CodeQL analysis

CodeQL is the code analysis engine developed by GitHub to automate
security checks. You can analyze your code using CodeQL and display the
results as code scanning alerts. For more information about CodeQL, see
[Code scanning with
CodeQL](/en/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning-with-codeql).

### About third-party code scanning tools

Code scanning is interoperable with third-party code scanning tools that
output Static Analysis Results Interchange Format (SARIF) data. SARIF is
an open standard. For more information, see [SARIF support for code
scanning](/en/code-security/code-scanning/integrating-with-code-scanning/sarif-support-for-code-scanning).

You can run third-party analysis tools within GitHub using actions or
within an external CI system. For more information, see [Configuring
advanced setup for code
scanning](/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/configuring-advanced-setup-for-code-scanning#configuring-code-scanning-using-third-party-actions)
or [Uploading a SARIF file to
GitHub](/en/code-security/code-scanning/integrating-with-code-scanning/uploading-a-sarif-file-to-github).

## About the tool status page

The tool status page shows useful information about all of your code
scanning tools. If code scanning is not working as you'd expect, the
tool status page is a good starting point for debugging problems. For
more information, see [Use the tool status page for code
scanning](/en/code-security/code-scanning/managing-your-code-scanning-configuration/about-the-tool-status-page).
# Code scanning

You can use code scanning to find security vulnerabilities and errors in
the code for your project on GitHub.

Code scanning is a feature that you use to analyze the code in a GitHub
repository to find security vulnerabilities and coding errors. Any
problems identified by the analysis are shown in your repository.

You can use code scanning to find, triage, and prioritize fixes for
existing problems in your code. Code scanning also prevents developers
from introducing new problems. You can schedule scans for specific days
and times, or trigger scans when a specific event occurs in the
repository, such as a push.

If code scanning finds a potential vulnerability or error in your code,
GitHub displays an alert in the repository. After you fix the code that
triggered the alert, GitHub closes the alert. For more information, see
[Resolving code scanning

alerts](/en/code-security/code-scanning/managing-code-scanning-alerts/resolving-code-scanning-alerts).

GitHub Copilot Autofix will suggest fixes for alerts from code scanning
analysis, allowing developers to prevent and reduce vulnerabilities with
less effort. For more information, see [Application card: GitHub
security and quality AI

features](/en/code-security/code-scanning/managing-code-scanning-alerts/responsible-use-autofix-code-scanning).

To monitor results from code scanning across your repositories or your
organization, you can use webhooks and the code scanning API. For
information about the webhooks for code scanning, see [Webhook events
and

payloads](/en/webhooks-and-events/webhooks/webhook-events-and-payloads#code_scanning_alert).
For information about API endpoints, see [REST API endpoints for code
scanning](/en/rest/code-scanning/code-scanning).

Code scanning uses GitHub Actions, with each workflow run consuming
GitHub Actions minutes. If you want to use code scanning on private
repositories, you need a GitHub Code Security license. For more
information, see [GitHub Actions

billing](/en/billing/managing-billing-for-github-actions/about-billing-for-github-actions).
For information about how you can try GitHub Enterprise with GitHub
Advanced Security for free, see [Setting up a trial of GitHub Enterprise
Cloud](/en/enterprise-cloud@latest/admin/overview/setting-up-a-trial-of-github-enterprise-cloud)
and [Setting up a trial of GitHub Advanced

Security](/en/enterprise-cloud@latest/billing/managing-billing-for-your-products/managing-billing-for-github-advanced-security/setting-up-a-trial-of-github-advanced-security#setting-up-your-trial-of-github-advanced-security)
in the GitHub Enterprise Cloud documentation.

If you want to assess your organization's exposure to vulnerabilities
before purchasing a license, you can run a free code security risk
assessment. See [Code security risk

assessment](/en/code-security/concepts/code-scanning/code-security-risk-assessment).

To get started with code scanning, see [Configuring default setup for
code

scanning](/en/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning).

## About tools for code scanning

You can configure code scanning to use the CodeQL product maintained by
GitHub or a third-party code scanning tool.

### About CodeQL analysis

CodeQL is the code analysis engine developed by GitHub to automate
security checks. You can analyze your code using CodeQL and display the
results as code scanning alerts. For more information about CodeQL, see
[Code scanning with

CodeQL](/en/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning-with-codeql).

### About third-party code scanning tools

Code scanning is interoperable with third-party code scanning tools that
output Static Analysis Results Interchange Format (SARIF) data. SARIF is
an open standard. For more information, see [SARIF support for code
scanning](/en/code-security/code-scanning/integrating-with-code-scanning/sarif-support-for-code-scanning).

You can run third-party analysis tools within GitHub using actions or
within an external CI system. For more information, see [Configuring
advanced setup for code

scanning](/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/configuring-advanced-setup-for-code-scanning#configuring-code-scanning-using-third-party-actions)
or [Uploading a SARIF file to

GitHub](/en/code-security/code-scanning/integrating-with-code-scanning/uploading-a-sarif-file-to-github).

## About the tool status page

The tool status page shows useful information about all of your code
scanning tools. If code scanning is not working as you'd expect, the
tool status page is a good starting point for debugging problems. For
more information, see [Use the tool status page for code
scanning](/en/code-security/code-scanning/managing-your-code-scanning-configuration/about-the-tool-status-page).
Signed-off-by: Huỳnh Thương <252359928+Huynhthuongg@users.noreply.github.com>
Signed-off-by: Huỳnh Thương <252359928+Huynhthuongg@users.noreply.github.com> (#25)
Signed-off-by: Huỳnh Thương <252359928+Huynhthuongg@users.noreply.github.com> (#25) (#27)
Signed-off-by: Huỳnh Thương <252359928+Huynhthuongg@users.noreply.github.com> (#25) (#27) (#28)
Signed-off-by: Huỳnh Thương <252359928+Huynhthuongg@users.noreply.github.com>
Signed-off-by: Huỳnh Thương <252359928+Huynhthuongg@users.noreply.github.com>
Signed-off-by: Huỳnh Thương <252359928+Huynhthuongg@users.noreply.github.com>
Signed-off-by: Huỳnh Thương <252359928+Huynhthuongg@users.noreply.github.com>
Signed-off-by: Huỳnh Thương <252359928+Huynhthuongg@users.noreply.github.com> (#25) (#27) (#28) (#30)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working codex documentation Improvements or additions to documentation duplicate This issue or pull request already exists enhancement New feature or request good first issue Good for newcomers help wanted Extra attention is needed invalid This doesn't seem right question Further information is requested wontfix This will not be worked on

Projects

None yet

2 participants