What is the role of CodeQL scanning within pull request workflows?

• A. It analyzes tests to measure coverage.
• B. It scans PRs to detect new vulnerabilities introduced by changes, enabling early remediation before merge.
• C. It replaces unit tests.
• D. It enforces coding style guidelines.

Answer: (B)

In pull request workflows, CodeQL scanning is used to surface new security vulnerabilities introduced by the changes in a PR, so you can fix them before merging. It runs security-focused queries against the codebase and highlights issues that arise from the added or modified code, presenting alerts in the code scanning results and within the PR view. This enables early remediation and reduces risk in the main branch.

This isn’t about measuring test coverage or replacing unit tests—those focus on verifying whether the code behaves as intended. It also isn’t about enforcing coding style guidelines, which is the job of linters and formatters. CodeQL scanning complements testing and style checks by focusing on security findings from the changes themselves.