How do you enable and configure Code Scanning in a GitHub repository?

• A. Not possible; Code Scanning runs automatically with no configuration.
• B. Add a CodeQL-based workflow under .github/workflows (or enable via Security settings); ensure it runs on pushes and pull requests and outputs SARIF.
• C. You must install a separate scanning service outside GitHub.
• D. Enable by using a Code Scanning button in the UI and specifying languages; ensure it runs on pushes and pull requests and outputs SARIF.

Answer: (D)

Code Scanning is enabled by using the UI button for Code Scanning and choosing which languages to scan. This approach configures the built-in CodeQL analysis to run on pushes and on pull requests, and it outputs results in SARIF format that GitHub uses to surface alerts in the Security tab. It’s the easiest and most integrated way to turn on scanning quickly, because GitHub handles the workflow setup behind the scenes and wires the scanners to the chosen languages. While you can also set up a CodeQL workflow manually or enable scanning via the Security settings, starting from the UI button gives you a ready-to-run configuration with the correct triggers and SARIF output right away.