Which component runs the CodeQL queries during Code Scanning?

Which component runs the CodeQL queries during Code Scanning?

• A. The GitHub API service
• B. An external security scanning service integrated via API
• C. The CodeQL-based workflow
• D. The local developer's IDE plugin

Answer: (C)

Code Scanning executes the CodeQL queries through the CodeQL-based workflow. In GitHub, this workflow runs inside GitHub Actions, setting up the CodeQL environment, building a database of the code, and then running the CodeQL queries across the supported languages. The results are produced in a format GitHub can surface (SARIF) in the Security tab. This workflow is the mechanism that actually performs the analysis, rather than the GitHub API service, an external scanning service, or a local IDE plugin, which operate outside the Code Scanning pipeline.

Code Scanning executes the CodeQL queries through the CodeQL-based workflow. In GitHub, this workflow runs inside GitHub Actions, setting up the CodeQL environment, building a database of the code, and then running the CodeQL queries across the supported languages. The results are produced in a format GitHub can surface (SARIF) in the Security tab. This workflow is the mechanism that actually performs the analysis, rather than the GitHub API service, an external scanning service, or a local IDE plugin, which operate outside the Code Scanning pipeline.