Skip to main content
Dot gov

The .gov means it’s official.
Federal government websites often end in .gov or .mil. Before sharing sensitive information, make sure you’re on a federal government site.

Https

The site is secure.
The https:// ensures that you are connecting to the official website and that any information you provide is encrypted and transmitted securely.

Requesting Policy Exemption

How do I request to exempt my repository from this requirement?

If your repository does not contain production code, or you have been instructed by OIS Software Assurance that your repository does not need to be included in this Code Scanning mandate, you may self-service exempt your repository from this mandate.

If you have a valid business justification for exempting your repository from the Code Scanning Requirements, you may do this by following the steps below:

  • Navigate to your repo and select the “Settings” tab
  • Select the “Custom Properties” section in the left-hand navigation
  • Select “Edit” in the top right corner of the page

On this page there are two options, one to exempt yourself from the CodeQL policy and one to exempt yourself from the Required Pull Request policy.

Exempting yourself from the CodeQL policy

  • To exempt yourself from the CodeQL policy, set the “code_scanning_codeql_policy_exempt” property to true.
  • If you’ve set the property to true, you must also provide a brief justification in the “code_scanning_codeql_policy_exempt_reason” field.

Exempting yourself from the Required Pull Request policy

  • To exempt yourself from the Required Pull Request policy, set the “required_pull_request_policy_exempt” property to true.
  • If you’ve set the property to true, you must also provide a brief justification in the “required_pull_request_policy_exempt_reason” field.

Auditing Exemptions

All exemptions are reported out on a monthly basis to VA leadership, and as such, teams should consider their exemptions and justifications carefully. If you unsure of whether your exemption justification is valid or not, please open a ticket in GitHub User Requests

All exemptions will be audited to ensure that they are valid. If your exemption is found to be invalid, it will be removed and you will be notified.