A team wants to automatically generate objective evaluation signals for a GitHub Copilot agent that produces code changes. Which GitHub-native tools can provide automated scanning signals without requiring human review for each PR?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Think of CodeQL, secret scanning, and dependency review as three independent quality inspectors who run automatically on every PR — no human scheduling required. They give you objective, repeatable signals about the code the agent produced, without anyone having to manually look at each change.
Full explanation below image
Full Explanation
Automated scanning tools provide objective, programmatically generated evaluation signals that can be used to assess the quality of agent-produced code changes at scale.
Why B is correct: - CodeQL: Static analysis tool that identifies security vulnerabilities and code quality issues in agent-produced code. A high CodeQL alert count signals the agent is introducing problematic patterns. - Secret scanning: Detects hardcoded credentials, API keys, and tokens in code changes. Flags from secret scanning indicate the agent is producing dangerous code. - Dependency review: Analyzes dependency changes for known vulnerabilities. If the agent updates dependencies, this tool flags unsafe versions. All three generate machine-readable signals that can be incorporated into evaluation pipelines.
Why A is wrong: GitHub Discussions and Projects boards are collaboration and project management tools. They do not perform automated code analysis or generate evaluation signals.
Why C is wrong: GitHub Releases and Pages are distribution and documentation tools. They have no code analysis capability and generate no evaluation signals about code quality.
Why D is wrong: GitHub Sponsors and Marketplace are commercial and distribution features. They are entirely unrelated to code quality evaluation.