How would you suppress a known false positive in Code Scanning?

• A. Ignore the alert and continue development.
• B. Delete the repository to fix the false positive.
• C. Disable Code Scanning for the repository.
• D. Use a suppression rule/file (.github/code-scanning/codeql-suppressions.yml) for the specific rule/path.

Answer: (D)

Suppressing a known false positive in Code Scanning is about using a suppression mechanism that tells the scanner to ignore that specific alert. The standard approach is to add a suppression rule in the repository at .github/code-scanning/codeql-suppressions.yml, targeting the particular rule (or query) and the path that triggers it. This keeps the scan results meaningful by removing items you’ve verified are safe, while still surfacing real issues in the rest of the code. Since the suppression file is version-controlled, teammates can see why the alert was ignored and it can be revisited later if the context changes. This far better preserves protection against new findings than simply ignoring the alert, deleting the repository, or turning off Code Scanning entirely. If you suppress, include a concise reason and, if possible, reference an issue or ticket so future maintainers understand the rationale.