Private registries for Go CodeQL scans

CodeQL can now access private dependencies stored in private registries for Go projects. This makes your scans more comprehensive, helping to ensure you receive all important alerts regardless of where your dependencies are stored.

Previously, code scanning with the default setup was unable to fetch code for dependent packages stored in private registries. This could result in incomplete analysis. Now, organization administrators can configure access credentials for private registries at the organization level. This enhancement allows CodeQL scans in child repositories to retrieve all necessary dependencies, enabling comprehensive code analysis when using the default code scanning setup.

This feature is avaiable for GitHub Advanced Security customers on github.com.

To learn more, see our documentation about CodeQL and our documentation on the default code scanning setup.