Which mechanism can be used to suppress a Code Scanning alert via CodeQL?

• A. The repository is archived
• B. Deleting the repository
• C. Disabling CI
• D. CodeQL suppression file

Answer: (D)

Suppressing a Code Scanning alert produced by CodeQL is achieved with a CodeQL suppression file placed in the repository. This file, typically named codeql-suppressions.yml, lists specific results to hide by tying them to the exact location and the rule that produced the alert, along with a justification. When the scanner runs, CodeQL reads this file and excludes the matched alerts from the results, allowing you to keep the scan results while silencing known false positives or accepted risks. This approach is targeted and version-controlled, so you can review and adjust suppressions over time. Archiving or deleting the repository or disabling CI won’t remove or silence a particular alert in the Code Scanning results, it simply affects access or future scans. Therefore, the suppression file is the mechanism you use to suppress a CodeQL alert.