What is a CodeQL workflow file and what are its key sections?

• A. A JSON file that lists results
• B. A YAML file in .github/workflows that defines triggers, setup steps, CodeQL analysis, and output of results
• C. A shell script to run queries
• D. A Markdown document describing queries

Answer: (B)

A CodeQL workflow file is a YAML-based GitHub Actions workflow that tells GitHub how to run CodeQL analyses as part of your CI/CD. It lives in the repository at .github/workflows and defines when the analysis runs, what steps to take, and how to handle the results. The file’s main parts include the triggers that start the workflow (for example, pushes or pull requests), the jobs that run (often a codeql-analysis job), and the steps inside those jobs (checking out the code, initializing CodeQL with the languages you want to analyze, running the actual analysis, and uploading the SARIF results so GitHub can display alerts in the Security tab). This configuration is what connects CodeQL to your project’s workflow, enabling automated scanning and reporting rather than being a standalone script or a document.