To make GitHub code scanning block a pull request, create a branch ruleset, enable the Require code scanning results rule, add a tool such as CodeQL, and set alert thresholds. Pull requests that fail those thresholds cannot merge while the ruleset is enforced.
Steps in the GitHub UI
- Open the repository, go to Settings, then Rulesets.
- Choose New ruleset, then New branch ruleset.
- Name it. The default enforcement status is Disabled, so change it when you are ready.
- Under Branch protections, select Require code scanning results.
- Under Required tools and alert thresholds, add a tool such as CodeQL.
- Set both thresholds for each tool.
The same rule can be created through the REST API using the code_scanning rule type.
The two thresholds
| Threshold | Options |
|---|---|
| Alerts | None, Errors, Errors and Warnings, All |
| Security alerts | None, Critical, High or higher, Medium or higher, All |
The first covers general code quality alerts, the second covers security severity. Many teams set Alerts to Errors and Security alerts to High or higher, then tighten later. Decide with data: count how many open alerts you would have blocked last month before enforcing.
Use evaluate mode before you enforce
Start with the ruleset disabled or in a non enforcing state, review what would have failed, and talk to the developers affected. A gate that blocks on day one with a backlog of old alerts creates friction and workarounds. The goal is to stop new high severity issues, not to freeze all merging.
What the gate does not do
- It only blocks on tools you add. A scanner you forgot to list does not gate anything.
- Code scanning on private repositories requires a GitHub Code Security license, and runs on Actions minutes.
- It judges alerts, not reachability. A flagged alert may or may not be exploitable in your app.
- Languages CodeQL does not support are not scanned by CodeQL, so a green result says nothing about them.
Third party tools
Code scanning accepts results from other tools that output SARIF, an open standard. You can run them in Actions or an external CI system and upload the files. That lets you add another tool to the same required list.
Rollout checklist
- Confirm code scanning is running on the default branch.
- Read the open alerts and fix or dismiss with reasons.
- Create the ruleset in a non enforcing state.
- Review a week of pull requests.
- Enforce, and document how to request an exception.
Where a dedicated scanner fits
If you want one gate that applies to repositories on several hosts, or a policy that weighs reachability, a separate platform can add that. Safeguard supports policies and gates on pull requests, with a free scan at gold.safeguard.sh/scan.
Try it yourself
Click through it at your own pace, or open it full screen.
Watch how a pull request moves from checks running to blocked or allowed.
Quick check
Does the ruleset need CodeQL specifically?
No. You choose which scanner tools to require, and tools that upload SARIF can be added.
Is the default enforcement status on?
No. The default is Disabled until you change it.
Sources
Last reviewed: 19 October 2026.
