CodeQL, the engine behind GitHub code scanning, supports C and C++, C#, Go, Java and Kotlin, JavaScript and TypeScript, Python, Ruby, Rust, Swift and GitHub Actions workflows. The GitHub documentation says it does not support languages outside that list, and names PHP and Scala as examples.
What CodeQL is
CodeQL treats code as data. It builds a database that represents your codebase, runs queries against it, and shows results as code scanning alerts. GitHub describes it as supporting both compiled and interpreted languages.
The supported list
- C and C++
- C#
- Go
- Java and Kotlin (one combined setup option)
- JavaScript and TypeScript (one combined setup option)
- Python
- Ruby
- Rust
- Swift
- GitHub Actions workflows
What about languages not listed
A repository in PHP, Scala or another unlisted language gets no CodeQL results, and a clean code scanning tab then says nothing about that code. You have three practical options.
- Add a third party scanner that outputs SARIF and upload its results to code scanning.
- Use another feature. GitHub lists an AI Scan feature that scans during pull request review for languages and frameworks CodeQL does not cover. It is listed under the Code Security product.
- Run a different static analyzer in your CI and gate on its results separately.
How to audit your own coverage
- List every repository and its main languages.
- Mark which are in the supported list.
- For unlisted ones, record which other scanner covers them, or note the gap.
- Revisit when you add a new service in a new language.
Mixed repositories deserve attention. A Java service with a PHP admin tool is only half covered, and the half left out is often the older, less reviewed code.
A worked example
Say you run a checkout service in Java, an admin portal in PHP, a data job in Python and Terraform for infrastructure. CodeQL covers the Java and Python code. The PHP portal returns nothing, and the Terraform files are not in the supported list either. A quick inventory like this turns a vague worry into a short list of owners: someone picks a SARIF producing scanner for PHP, and someone picks an infrastructure checker for the Terraform. Write the result into your security runbook so the next reviewer does not assume code scanning covers everything.
Availability reminder
Code scanning is available for public repositories by default. For private repositories it requires GitHub Code Security, and it uses Actions minutes. Confirm your plan before assuming coverage.
Where a dedicated scanner fits
If your estate has many languages, or code on more than one host, a separate scanner can fill gaps. Safeguard offers SBOM and dependency scanning across ecosystems and a free scan at gold.safeguard.sh/scan.
Quick check
Does CodeQL scan PHP?
No. The GitHub documentation says it does not support languages outside its list and names PHP as an example.
If code scanning shows no alerts, is the repo clean?
Not necessarily. It may mean the code is in a language CodeQL does not analyze, or that the scan is not set up.
Sources
Last reviewed: 19 October 2026.
