GH-500 · Question #62
Where can you use CodeQL analysis for code scanning? Each answer presents part of the solution. (Choose two.)
The correct answer is B. in an external continuous integration (CI) system C. in a workflow. CodeQL analysis can be used in two places: (B) an external CI system by installing the CodeQL CLI and uploading SARIF results to GitHub, and (C) a GitHub Actions workflow using the github/codeql-action. Third-party Git repositories (A) are not supported - CodeQL code scanning…
Question
Where can you use CodeQL analysis for code scanning? Each answer presents part of the solution. (Choose two.)
Options
- Ain a third-party Git repository
- Bin an external continuous integration (CI) system
- Cin a workflow
- Din the Files changed tab of the pull request
How the community answered
(33 responses)- A3% (1)
- B91% (30)
- D6% (2)
Explanation
CodeQL analysis can be used in two places: (B) an external CI system by installing the CodeQL CLI and uploading SARIF results to GitHub, and (C) a GitHub Actions workflow using the github/codeql-action. Third-party Git repositories (A) are not supported - CodeQL code scanning requires the results to be associated with a GitHub repository. The Files changed tab (D) shows pull request diffs but is not a location where CodeQL analysis runs - results surface as PR checks and alerts, not directly in that tab.
Topics
Community Discussion
No community discussion yet for this question.