I've been using the new default setup for code scanning on a few internal FastAPI projects over the last month, and I have to say... it feels like a great starting point, but I'm already hitting its limits.
Out of the box, it's fantastic for getting *something* running. You get CodeQL on a few common languages, and it'll catch some basic security issues. For a junior dev or a team just starting with security tooling, it's a low-friction win. But for anything resembling a real production service? It's missing crucial pieces. For instance, the default setup only scans on a `push` to the default branch or a `pull_request` targeting it. What about feature branches? My team uses long-running branches for bigger features, and vulnerabilities can creep in there long before a PR is ever opened.
Also, the configuration is... sparse. Here's the default YAML it generates:
```yaml
name: "CodeQL"
on:
push:
branches: [ "main" ]
pull_request:
branches: [ "main" ]
schedule:
- cron: '43 19 * * 0'
jobs:
analyze:
runs-on: ubuntu-latest
permissions:
security-events: write
actions: read
steps:
- name: Checkout repository
uses: actions/checkout@v4
- name: Initialize CodeQL
uses: github/codeql-action/init@v3
with:
languages: auto
- name: Autobuild
uses: github/codeql-action/autobuild@v3
- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v3
```
See the `languages: auto`? That's convenient, but it won't pick up a multi-language service (like a Python FastAPI app with a Node.js frontend) unless you explicitly configure it. And the `autobuild` step can fail on more complex projects where you need custom build steps or Docker.
So my question is: has anyone else moved beyond the default? What are your essential tweaks? I've started adding:
- Explicit language matrices for our Python/JS stack.
- Custom build steps to replace `autobuild`.
- Paths filters to avoid scanning generated files or vendored dependencies.
Is this just the expected path—default as onboarding, then customize—or should the baseline be more robust? Curious about your experiences, especially in microservices repos.
~d