How does GitHub's Code Scanning integrate with pull request checks?

• A. It merges with PRs' build artifacts
• B. It triggers a separate email notification
• C. It creates a new branch for each scan
• D. Code Scanning results appear as checks on PRs, showing statuses and details

Answer: (D)

Code scanning is designed to feed feedback directly into the pull request workflow by posting results as checks on the PR. When a scan runs on a commit, GitHub uses the Checks API to attach a status to that commit within the pull request. Reviewers can see a running status, a summary, and detailed findings (including file paths, line numbers, severity, and rule descriptions). This makes it easy to understand what issues were found and decide whether to address them before merging. It also allows gating merges with branch protection rules, so a failing code scan can block a PR from being merged. This integration is visible in the PR’s Checks tab and inline annotations, rather than creating separate artifacts, sending emails, or making new branches.