Which component runs the CodeQL queries during Code Scanning?

Prepare for the GitHub Advanced Security Certification exam with our comprehensive quiz featuring detailed questions, hints, and explanations. Enhance your skills and ensure you're ready to pass!

Multiple Choice

Which component runs the CodeQL queries during Code Scanning?

Code Scanning executes the CodeQL queries through the CodeQL-based workflow. In GitHub, this workflow runs inside GitHub Actions, setting up the CodeQL environment, building a database of the code, and then running the CodeQL queries across the supported languages. The results are produced in a format GitHub can surface (SARIF) in the Security tab. This workflow is the mechanism that actually performs the analysis, rather than the GitHub API service, an external scanning service, or a local IDE plugin, which operate outside the Code Scanning pipeline.

Code Scanning executes the CodeQL queries through the CodeQL-based workflow. In GitHub, this workflow runs inside GitHub Actions, setting up the CodeQL environment, building a database of the code, and then running the CodeQL queries across the supported languages. The results are produced in a format GitHub can surface (SARIF) in the Security tab. This workflow is the mechanism that actually performs the analysis, rather than the GitHub API service, an external scanning service, or a local IDE plugin, which operate outside the Code Scanning pipeline.

More practice questions