Which statement best describes the role of SARIF in Code Scanning?

• A. SARIF is the format used to report findings; GitHub ingests SARIF to display alerts
• B. SARIF is a binary artifact used for packaging
• C. SARIF is a UI theme for the Security tab
• D. SARIF is a deprecated reporting format

Answer: (A)

SARIF is a standardized JSON format for reporting static analysis results. In Code Scanning, tools generate findings and package them into a SARIF file, which GitHub ingests to display alerts in the Security tab. This approach lets different scanners contribute results in a common structure—location, rule, severity, and message—so GitHub can present a unified view of issues across multiple tools and repositories. The other options don’t fit because SARIF isn’t a binary packaging artifact, a UI theme, or a deprecated format.