(William Scott, after completing his graduation in computer science, joined an IT company as a DevSecOps engineer. His team leader has asked him to use GitHub Code Scanning for evaluating the source code in his organization’s GitHub repository to detect security issues and coding errors. How can William set up coding scanning in GitHub repository?)

GitHub Code Scanning is a native feature designed to analyze code within a GitHub repository to find security vulnerabilities and coding errors. This feature is powered by CodeQL, GitHub's advanced semantic code analysis engine. To set up code scanning, a user configures a GitHub Actions workflow that runs the CodeQL analysis. This process involves creating a .github/workflows/codeql-analysis.yml file that defines the triggers and languages to be scanned, effectively integrating CodeQL into the CI/CD pipeline.

A. Gauntlt is a security testing framework used for behavior-driven development, but it is not the underlying engine for GitHub's native Code Scanning feature.
B. GitMiner is a tool designed to mine and analyze data from Git repositories for patterns, not for performing static application security testing (SAST) like CodeQL.
C. OWASP ZAP is a popular open-source dynamic application security testing (DAST) tool for finding vulnerabilities in running web applications, not a static analysis engine for source code.

- GitHub. (n.d.). About code scanning. GitHub Docs. Retrieved from https://docs.github.com/en/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning. (See the section "About CodeQL").

- GitHub. (n.d.). Configuring code scanning for a repository. GitHub Docs. Retrieved from https://docs.github.com/en/code-security/code-scanning/configuring-code-scanning/configuring-code-scanning-for-a-repository. (See the section "Setting up code scanning with CodeQL").