Where is codeql-suppressions.yml typically stored?

• A. Under .github/code-scanning/ directory
• B. In the docs/ directory
• C. In the scripts/ directory
• D. In the repository root

Answer: (A)

Codeql-suppressions.yml is a suppression configuration file that GitHub Code Scanning reads to silence specific findings. It belongs in the repository’s GitHub automation area, typically under .github/code-scanning/. This placement matches how Code Scanning expects to find its configuration and ensures the suppression rules are applied when scans run on GitHub Actions. Placing it elsewhere, like in the docs/ directory or at the repository root, generally won’t be automatically recognized by the scanner, so the suppressions wouldn’t take effect unless you explicitly point the scanner to a different path.