CodeQL scans on pull requests for JavaScript, TypeScript, Java, Ruby, and Python are now up to 20% faster. This is powered by our new incremental analysis, which only analyzes new or changed code.

During our private beta and internal testing across more than 8000 repositories, significant speed improvements were observed across all supported languages. JavaScript and TypeScript experienced the highest average reduction in overall scan times, with the most impacted scans being 58% faster. In future updates, we will support additional languages not yet covered by incremental analysis in this release.

Incremental analysis does not change which alerts are reported in GitHub, nor how they are reported. So, for the vast majority of users, everything will look the same as it looks today, but faster.

This new technology does change how data is processed and reported by different components in the analysis pipeline:

  • The CodeQL GitHub Action will now only report new alerts found within the changed code (the diff range). Previously, the CodeQL Action returned all the alerts found in the entire codebase, and only relevant findings were reported in the pull request. If you have a special custom use of the CodeQL Action, you should be aware of this change.
  • When retrieving CodeQL results for a pull request using the code scanning API (using the pr query parameter), it only returns new alerts in the code that was changed in the PR. All other ways of engaging with that API remain unchanged.

This behavior applies to all CodeQL scans performed during a pull request, regardless of whether the language currently has incremental analysis support.

Incremental analysis is now available and enabled by default on github.com and will be coming to CodeQL CLI users at a later date. On GitHub Enterprise Server this feature will be available starting with version 3.19.

This release marks the first stage of our broader initiative to make CodeQL scanning faster and more efficient, providing developers with quicker feedback while maintaining the robust security checks that teams rely on.