(William Scott, after completing his graduation in computer science, joined an IT company as a DevSecOps engineer. His team leader has asked him to…

GitHub Code Scanning is a native feature designed to analyze code within a GitHub repository to find security vulnerabilities and coding errors. This feature is powered by CodeQL, GitHub's advanced semantic code analysis engine. To set up code scanning, a user configures a GitHub Actions workflow that runs the CodeQL analysis. This process involves creating a .github/workflows/codeql-analysis.yml file that defines the triggers and languages to be scanned, effectively integrating CodeQL into the CI/CD pipeline.

A. Gauntlt is a security testing framework used for behavior-driven development, but it is not the underlying engine for GitHub's native Code Scanning feature.

B. GitMiner is a tool designed to mine and analyze data from Git repositories for patterns, not for performing static application security testing (SAST) like CodeQL.

C. OWASP ZAP is a popular open-source dynamic application security testing (DAST) tool for finding vulnerabilities in running web applications, not a static analysis engine for source code.

- GitHub. (n.d.). About code scanning. GitHub Docs. Retrieved from https://docs.github.com/en/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning. (See the section "About CodeQL").

- GitHub. (n.d.). Configuring code scanning for a repository. GitHub Docs. Retrieved from https://docs.github.com/en/code-security/code-scanning/configuring-code-scanning/configuring-code-scanning-for-a-repository. (See the section "Setting up code scanning with CodeQL").