What is a SARIF rule in Code Scanning?

• A. An individual check or query result defined in the SARIF file
• B. A repository setting for enabling scanning
• C. A type of secret scanning rule
• D. A workflow file configuration

Answer: (A)

In Code Scanning, the SARIF file carries definitions of checks the analyzer performs. A rule is exactly that: one specific check or query that the tool can run. Each rule defines its id and descriptive text, along with severity and remediation guidance. When the scanner finds something, it creates a result that points to a ruleId, so GitHub can show every instance under the same rule and present consistent messaging. So this option correctly identifies a SARIF rule as an individual check or query definition in the SARIF file. It's not a repository setting, it's not a type of secret scanning rule, and it's not a workflow file configuration.