CodeQL "Advanced Security must be enabled" on a private repo in CI

By Daniel Zoghalchali·Latchkey

Code scanning is free on public repositories, but on private or internal repositories it requires GitHub Advanced Security to be enabled. Without it, the upload is rejected regardless of token permissions.

What this error means

On a private repo the CodeQL upload fails with "Advanced Security must be enabled for this repository to use code scanning" or a 403 referencing GitHub Advanced Security.

Error: Advanced Security must be enabled for this repository to use code scanning.
(403) GitHub Advanced Security is not enabled for this repository.

Common causes

GHAS is not enabled on a private repository

Code scanning on private/internal repos needs GitHub Advanced Security; the feature is off in repo or org settings.

No available GHAS license seat

The org has GHAS but no free committer seat, so the feature cannot be enabled for this repo.

How to fix it

Enable Advanced Security

1. Open the repository Settings > Code security and analysis.
2. Enable GitHub Advanced Security (and Code scanning).
3. Confirm an available GHAS seat, then re-run the workflow.

Verify licensing at the org level

If enablement is blocked, confirm the org has GHAS licenses and a free committer seat before retrying the upload.

How to prevent it

• Enable GHAS on private repos before adding code scanning workflows.
• Track GHAS seat usage so uploads are not blocked by licensing.
• Keep code scanning enabled in org security defaults where required.

Frequently asked questions

Related guides

References

• GitHub Actions documentation