Feature - Control the Disable button based on the administrative rights

[tangirala-aditya]

Hi All,
We enabled the Code scanning CodeQL tool on our github repository and we see the code alerts populated for every pull request.
We see dismiss option for each such alert in the PR. We are looking for a way to control who can dismiss these alerts on a PR. For example repo admins or PR reviewers. Can someone help me if this option is available in Github code scanning.

Note: FYI, We see the remove button on each alert when logged in as administrator. But, we are looking for controlling dismiss option.

[dorothymitchell]

There's currently no functionality to control who can dismiss code scanning alerts. This is on our backlog for future prioritization, but it not yet scheduled.

I think this is duplicated by this feedback issue https://github.com/github/customer-feedback/issues/4122 so I will close this issue - please reopen if this is incorrect. If this becomes prioritized, I'll post an update to the feedback issue https://github.com/github/customer-feedback/issues/4122

[WallaceChen123]

Hi @dorothymitchell , the link https://github.com/github/customer-feedback/issues/4122 is not available anymore, may I know if this feature has been implemented or not? Thanks in advance.

[dorothymitchell]

Hi @WallaceChen123 the issue https://github.com/github/customer-feedback/issues/4122 still works for me, it is in the customer-feedback repo if you don't have access there. The feature has not been implemented but we're aware of the feedback for all security products (e.g. secret scanning too)

[WallaceChen123]

Hi @dorothymitchell thanks for your response, BTW, our team started to utilize CodeQL recently and I have two questions about CodeQL as below:

1. Can I set any configurations to make the CodeQL only display alerts with specified severities(e.g. include Error, exclude Warning and Note) in pull requests?
2. Can I create a customized alert rule?

Thank you in advance!