Which format does Code Scanning use to report results, and what is its purpose?

• A. JSON; used for internal processing only.
• B. XML; used to report results to external security dashboards.
• C. SARIF; enables standardized reporting of static analysis results and integrates with GitHub's alert UI.
• D. YAML; used only to configure scanning.

Answer: (C)

Code Scanning reports results using SARIF, the Static Analysis Results Interoperability Format. This standard describes static analysis findings in a consistent JSON structure, including the location in code, the rule that fired, severity, and message. The purpose is to enable standardized reporting across tools and to integrate seamlessly with GitHub's alert UI, so results from different analyzers can be viewed and managed in one place. Other formats like plain JSON, XML, or YAML don’t provide the same cross-tool interoperability and display capabilities: JSON alone isn’t a full interoperability schema, XML isn’t the supported reporting format for the UI, and YAML is mainly for configuration, not result reporting.