– [Use Code Scanning with CodeQL] Why should you dismiss a code scanning alert?

You should dismiss a code scanning alert when you determine that the finding does not represent a security risk that needs to be fixed. A common and valid reason for dismissal is when the identified vulnerability exists in code that is exclusively used for testing purposes and is not part of the production application. Dismissing the alert in this context correctly triages the finding as a non-actionable item, allowing the team to focus on genuine threats in production code.

A. If you fix the code, the alert will be automatically closed on the next scan of the branch. Manual dismissal is not the correct procedure.

B. Dismissing an existing alert is a reactive measure for a specific finding; it does not proactively prevent developers from introducing new problems.

D. An alert corresponding to a production error signifies a real risk. This type of alert should be prioritized and fixed, not dismissed.

1. GitHub Docs

"Managing code scanning alerts for your repository." This official documentation states

"You can dismiss an alert if you don't think it's a problem... Common reasons for dismissing an alert are that the code is not used in production

or that the alert is a false positive result." This directly supports dismissing alerts for code used only in testing.

2. Microsoft Learn

"Configure and manage code scanning in your repository

" Unit: "Manage code scanning alerts." This module

relevant to GitHub administration

explains the process of triaging alerts. It notes that when dismissing an alert

you can select a reason

such as "Used in tests

" which confirms this is an intended use case for the dismissal feature.

3. GitHub Docs

"About code scanning alerts." This document clarifies the lifecycle of an alert

explaining that when code is fixed

"the alert is closed" automatically after the branch is rescanned. This confirms that manual dismissal is incorrect for fixed code.