GitHub: Get a code scanning default setup configuration

← Code scanning operations · Get started

Operation github.code_scanning_get_default_setup

Provider route: GET /repos/{owner}/{repo}/code-scanning/default-setup. Alter supplies the connection’s credentials and routing.

Call through Alter

Install @alter-ai/sdk @alter-ai/github with npm, or alter-sdk-github with pip. Supply your connected customer’s grant ID and the arguments described below.

import { App } from "@alter-ai/sdk";
import { GitHubIntegration } from "@alter-ai/github";

async function execute(input: Parameters<GitHubIntegration["codeScanning"]["codeScanningGetDefaultSetup"]>[0]) {
  const app = new App({ apiKey: process.env.ALTER_API_KEY! });
  try {
    const provider = new GitHubIntegration(app, { grantId: process.env.PROVIDER_GRANT_ID! });
    const call = await provider.codeScanning.codeScanningGetDefaultSetup(input);
    const result = await call.wait();
    return result.bodyJson();
  } finally {
    await app.close();
  }
}

import os
from alter_sdk import App
from alter_sdk_github import GitHubIntegration

async def execute(arguments):
    async with App(api_key=os.environ["ALTER_API_KEY"]) as app:
        provider = GitHubIntegration(app, {"grant_id": os.environ["PROVIDER_GRANT_ID"]})
        call = await provider.code_scanning.code_scanning_get_default_setup(arguments)
        result = await call.wait()
        return result.body_json()

Input

Field	Type	Presence	Description and constraints
$	object	Root	Additional keys: not allowed
path	object	Required within parent	Additional keys: not allowed
path.owner	string	Required within parent
path.repo	string	Required within parent

Response

Response media type: application/json. The table describes the pinned successful response. Referenced models link to their complete fields.

Field	Type	Presence	Description and constraints
$	Model	Root	Expand Get a code scanning default setup configuration — response body

Referenced models: Get a code scanning default setup configuration — response body

Schemas

Get a code scanning default setup configuration — response body

Field	Type	Presence	Description and constraints
$	object	Root	Configuration for code scanning default setup.
languages	array	Optional	Languages to be analyzed.
languages[]	string	Each item	Known values: actions, c-cpp, csharp, go, java-kotlin, javascript-typescript, python, ruby, swift
query_suite	string	Optional	CodeQL query suite to be used. Known values: default, extended
runner_label	JSON	Optional
runner_label (anyOf 1)	string	Alternative	Runner label to be used if the runner type is labeled.
runner_label (anyOf 2)	null	Alternative
runner_type	JSON	Optional
runner_type (anyOf 1)	string	Alternative	Runner type to be used. Known values: standard, labeled
runner_type (anyOf 2)	null	Alternative
schedule	JSON	Optional
schedule (anyOf 1)	string	Alternative	The frequency of the periodic analysis. Known values: weekly
schedule (anyOf 2)	null	Alternative
state	string	Optional	Code scanning default setup has been configured or not. Known values: configured, not-configured
threat_model	string	Optional	Threat model to be used for code scanning analysis. Use `remote` to analyze only network sources and `remote_and_local` to include local sources like filesystem access, command-line arguments, database reads, environment variable and standard input. Known values: remote, remote_and_local
updated_at	JSON	Optional
updated_at (anyOf 1)	string	Alternative	Timestamp of latest configuration update. Format: date-time
updated_at (anyOf 2)	null	Alternative

Policy, approvals and errors

SDK function policy ID: github.code_scanning_get_default_setup. Catalog operation: code-scanning/get-default-setup. Rules can name either ID; function rules distinguish managed calls and conservatively cover raw calls sharing the route. Existing grant permissions and policy rules apply. wait() returns an immediate result or waits for a required approval; it never approves the request itself. Persist the approval ID to resume after a restart.

Provider errors retain their response; JSON decoding raises ProviderAPIError for provider failures. ManagedOperationError identifies contract/input/retention errors. See error handling and provider-specific behavior. Sensitive input may be refused before approval storage. A decoding error never resubmits a write.

Pinned headers: {"X-GitHub-Api-Version": "2026-03-10", "User-Agent": "Alter", "Accept": "application/vnd.github+json"}

Official provider source