– [Use Code Scanning with CodeQL] What does code scanning do?

Code scanning is a static analysis security testing (SAST) feature within GitHub that analyzes the code in a repository to find security vulnerabilities and coding errors. It uses engines, most notably CodeQL, to run queries against a database representation of the code. The results are displayed as alerts in the repository's "Security" tab, allowing developers to triage and fix potential issues before they reach production. This process is typically automated to run on events like pushes or pull requests.

A. Code scanning finds and reports vulnerabilities; it does not automatically contact maintainers to request the creation of security advisories. This is a separate, manual action taken by repository maintainers.

B. Code scanning runs as a check on pull requests or after a push, it does not function as a pre-receive hook to block the push itself. It can prevent a merge, but not the initial push.

D. This describes secret scanning, a distinct GitHub Advanced Security feature that searches a repository's history for exposed credentials like tokens and private keys, not code vulnerabilities.

1. GitHub Docs

"About code scanning." This document states

"Code scanning is a feature that you use to analyze the code in a GitHub repository to find security vulnerabilities and coding errors... The results are shown as code scanning alerts in your repository." This directly supports option C as the primary function.

2. GitHub Docs

"About secret scanning." This source clarifies the function described in option D: "GitHub scans repositories for known types of secrets

to prevent fraudulent use of secrets that were committed accidentally." This distinguishes it from code scanning.

3. GitHub Docs

"About GitHub Security Advisories for repositories." This page details the manual process for creating security advisories

stating

"Repository maintainers can create a security advisory to privately discuss and fix a vulnerability in their repository." This confirms that the action in option A is a separate

non-automated process.

4. GitHub Docs

"Configuring code scanning." The documentation on triggering code scanning shows it is configured to run on events like on: push or on: pullrequest within a GitHub Actions workflow

which is a post-commit/post-push mechanism

invalidating the pre-receive hook claim in option B.