GitHub: Create a Code QL variant analysis

← Code scanning operations · Get started

Operation github.code_scanning_create_variant_analysis

Provider route: POST /repos/{owner}/{repo}/code-scanning/codeql/variant-analyses. Alter supplies the connection’s credentials and routing.

Call through Alter

Install @alter-ai/sdk @alter-ai/github with npm, or alter-sdk-github with pip. Supply your connected customer’s grant ID and the arguments described below.

import { App } from "@alter-ai/sdk";
import { GitHubIntegration } from "@alter-ai/github";

async function execute(input: Parameters<GitHubIntegration["codeScanning"]["codeScanningCreateVariantAnalysis"]>[0]) {
  const app = new App({ apiKey: process.env.ALTER_API_KEY! });
  try {
    const provider = new GitHubIntegration(app, { grantId: process.env.PROVIDER_GRANT_ID! });
    const call = await provider.codeScanning.codeScanningCreateVariantAnalysis(input);
    const result = await call.wait();
    return result.bodyJson();
  } finally {
    await app.close();
  }
}

import os
from alter_sdk import App
from alter_sdk_github import GitHubIntegration

async def execute(arguments):
    async with App(api_key=os.environ["ALTER_API_KEY"]) as app:
        provider = GitHubIntegration(app, {"grant_id": os.environ["PROVIDER_GRANT_ID"]})
        call = await provider.code_scanning.code_scanning_create_variant_analysis(arguments)
        result = await call.wait()
        return result.body_json()

Input

Field	Type	Presence	Description and constraints
$	object	Root	Additional keys: not allowed
path	object	Required within parent	Additional keys: not allowed
path.owner	string	Required within parent
path.repo	string	Required within parent
body	object	Required within parent	Additional keys: not allowed
body.language	string	Required within parent	The language targeted by the CodeQL query One of: actions, cpp, csharp, go, java, javascript, python, ruby, rust, swift
body.query_pack	string	Required within parent	A Base64-encoded tarball containing a CodeQL query and all its dependencies
body.repositories	array	Optional	List of repository names (in the form `owner/repo-name`) to run the query against. Precisely one property from `repositories`, `repository_lists` and `repository_owners` is required.
body.repositories[]	string	Each item
body.repository_lists	array	Optional	List of repository lists to run the query against. Precisely one property from `repositories`, `repository_lists` and `repository_owners` is required. Maximum items: 1
body.repository_lists[]	string	Each item
body.repository_owners	array	Optional	List of organization or user names whose repositories the query should be run against. Precisely one property from `repositories`, `repository_lists` and `repository_owners` is required. Maximum items: 1
body.repository_owners[]	string	Each item
body (oneOf 1)	JSON	Alternative
body (oneOf 2)	JSON	Alternative
body (oneOf 3)	JSON	Alternative

Response

Response media type: application/json. The table describes the pinned successful response. Referenced models link to their complete fields.

Field	Type	Presence	Description and constraints
$	Model	Root	Expand Create a Code QL variant analysis — response body

Referenced models: Create a Code QL variant analysis — response body

Schemas

1 more schema is linked from the tables above, on the schema pages.

Create a Code QL variant analysis — response body

Field	Type	Presence	Description and constraints
$	object	Root	A run of a CodeQL query against one or more repositories.
actions_workflow_run_id	JSON	Optional
actions_workflow_run_id (anyOf 1)	integer	Alternative	The GitHub Actions workflow run used to execute this variant analysis. This is only available if the workflow run has started.
actions_workflow_run_id (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
actor	Model	Required within parent	Expand List users — response body — item
completed_at	JSON	Optional
completed_at (anyOf 1)	string	Alternative	The date and time at which the variant analysis was completed, in ISO 8601 format':' YYYY-MM-DDTHH:MM:SSZ. Will be null if the variant analysis has not yet completed or this information is not available. Format: date-time
completed_at (anyOf 2)	null	Alternative
controller_repo	Model	Required within parent	Expand List repositories for a user migration — response body — item
created_at	string	Optional	The date and time at which the variant analysis was created, in ISO 8601 format':' YYYY-MM-DDTHH:MM:SSZ. Format: date-time
failure_reason	string	Optional	The reason for a failure of the variant analysis. This is only available if the variant analysis has failed. Known values: no_repos_queried, actions_workflow_run_failed, internal_error
id	JSON	Required within parent
id (anyOf 1)	integer	Alternative	The ID of the variant analysis.
id (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
query_language	string	Required within parent	The language targeted by the CodeQL query Known values: actions, cpp, csharp, go, java, javascript, python, ruby, rust, swift
query_pack_url	string	Required within parent	The download url for the query pack.
scanned_repositories	array	Optional
scanned_repositories[]	object	Each item
scanned_repositories[].analysis_status	string	Required within parent	The new status of the CodeQL variant analysis repository task. Known values: pending, in_progress, succeeded, failed, canceled, timed_out
scanned_repositories[].artifact_size_in_bytes	JSON	Optional
scanned_repositories[].artifact_size_in_bytes (anyOf 1)	integer	Alternative	The size of the artifact. This is only available for successful analyses.
scanned_repositories[].artifact_size_in_bytes (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
scanned_repositories[].failure_message	string	Optional	The reason of the failure of this repo task. This is only available if the repository task has failed.
scanned_repositories[].repository	Model	Required within parent	Expand Create a Code QL variant analysis — response body — scanned repositories item repository
scanned_repositories[].result_count	JSON	Optional
scanned_repositories[].result_count (anyOf 1)	integer	Alternative	The number of results in the case of a successful analysis. This is only available for successful analyses.
scanned_repositories[].result_count (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
skipped_repositories	object	Optional	Information about repositories that were skipped from processing. This information is only available to the user that initiated the variant analysis.
skipped_repositories.access_mismatch_repos	Model	Required within parent	Expand Create a Code QL variant analysis — response body — skipped repositories over limit repos
skipped_repositories.no_codeql_db_repos	Model	Required within parent	Expand Create a Code QL variant analysis — response body — skipped repositories over limit repos
skipped_repositories.not_found_repos	object	Required within parent
skipped_repositories.not_found_repos.repository_count	JSON	Required within parent
skipped_repositories.not_found_repos.repository_count (anyOf 1)	integer	Alternative	The total number of repositories that were skipped for this reason.
skipped_repositories.not_found_repos.repository_count (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
skipped_repositories.not_found_repos.repository_full_names	array	Required within parent	A list of full repository names that were skipped. This list may not include all repositories that were skipped.
skipped_repositories.not_found_repos.repository_full_names[]	string	Each item
skipped_repositories.over_limit_repos	Model	Required within parent	Expand Create a Code QL variant analysis — response body — skipped repositories over limit repos
status	string	Required within parent	Known values: in_progress, succeeded, failed, cancelled
updated_at	string	Optional	The date and time at which the variant analysis was last updated, in ISO 8601 format':' YYYY-MM-DDTHH:MM:SSZ. Format: date-time

Referenced models: Create a Code QL variant analysis — response body — scanned repositories item repository, Create a Code QL variant analysis — response body — skipped repositories over limit repos, List repositories for a user migration — response body — item, List users — response body — item

Create a Code QL variant analysis — response body — scanned repositories item repository

Field	Type	Presence	Description and constraints
$	object	Root	Repository Identifier
full_name	string	Required within parent	The full, globally unique, name of the repository.
id	JSON	Required within parent
id (anyOf 1)	integer	Alternative	A unique identifier of the repository.
id (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
name	string	Required within parent	The name of the repository.
private	boolean	Required within parent	Whether the repository is private.
stargazers_count	JSON	Required within parent
stargazers_count (anyOf 1)	integer	Alternative
stargazers_count (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
updated_at	JSON	Required within parent
updated_at (anyOf 1)	string	Alternative	Format: date-time
updated_at (anyOf 2)	null	Alternative

Create a Code QL variant analysis — response body — skipped repositories over limit repos

Field	Type	Presence	Description and constraints
$	object	Root
repositories	array	Required within parent	A list of repositories that were skipped. This list may not include all repositories that were skipped. This is only available when the repository was found and the user has access to it.
repositories[]	Model	Each item	Expand Create a Code QL variant analysis — response body — scanned repositories item repository
repository_count	JSON	Required within parent
repository_count (anyOf 1)	integer	Alternative	The total number of repositories that were skipped for this reason.
repository_count (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$

Referenced models: Create a Code QL variant analysis — response body — scanned repositories item repository

List users — response body — item

Field	Type	Presence	Description and constraints
$	object	Root	A GitHub user.
avatar_url	string	Required within parent	Format: uri
email	JSON	Optional
email (anyOf 1)	string	Alternative
email (anyOf 2)	null	Alternative
events_url	string	Required within parent
followers_url	string	Required within parent	Format: uri
following_url	string	Required within parent
gists_url	string	Required within parent
gravatar_id	JSON	Required within parent
gravatar_id (anyOf 1)	string	Alternative
gravatar_id (anyOf 2)	null	Alternative
html_url	string	Required within parent	Format: uri
id	JSON	Required within parent
id (anyOf 1)	integer	Alternative	Format: int64
id (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
login	string	Required within parent
name	JSON	Optional
name (anyOf 1)	string	Alternative
name (anyOf 2)	null	Alternative
node_id	string	Required within parent
organizations_url	string	Required within parent	Format: uri
received_events_url	string	Required within parent	Format: uri
repos_url	string	Required within parent	Format: uri
site_admin	boolean	Required within parent
starred_at	string	Optional
starred_url	string	Required within parent
subscriptions_url	string	Required within parent	Format: uri
type	string	Required within parent
url	string	Required within parent	Format: uri
user_view_type	string	Optional

Policy, approvals and errors

SDK function policy ID: github.code_scanning_create_variant_analysis. Catalog operation: code-scanning/create-variant-analysis. Rules can name either ID; function rules distinguish managed calls and conservatively cover raw calls sharing the route. Existing grant permissions and policy rules apply. wait() returns an immediate result or waits for a required approval; it never approves the request itself. Persist the approval ID to resume after a restart.

Provider errors retain their response; JSON decoding raises ProviderAPIError for provider failures. ManagedOperationError identifies contract/input/retention errors. See error handling and provider-specific behavior. Sensitive input may be refused before approval storage. A decoding error never resubmits a write.

Pinned headers: {"X-GitHub-Api-Version": "2026-03-10", "User-Agent": "Alter", "Accept": "application/vnd.github+json"}

Official provider source