A developer wants to configure a code generation agent to automatically evaluate its own output for security vulnerabilities before it marks a pull request as ready for review. The evaluation should detect issues like SQL injection, hardcoded secrets, and insecure dependencies without requiring manual human review at this stage. Which GitHub tool should be configured to provide this automated evaluation signal?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Unit tests find logic bugs; security scanners find security bugs — and those are different jobs. GitHub Advanced Security with CodeQL is the native GitHub tool for automated security vulnerability scanning. Configured as a required status check, it runs automatically on every PR and blocks the agent from marking the PR ready if security issues are detected — exactly the automated evaluation gate the question describes.
Full explanation below image
Full Explanation
GitHub Advanced Security (GHAS) includes code scanning powered by CodeQL, which performs static analysis to identify security vulnerabilities including injection flaws, hardcoded secrets (via secret scanning), and insecure dependency versions (via Dependabot). When configured as a required status check on a branch protection rule, code scanning runs automatically on every pull request and blocks the PR from being merged (or marked ready for review) if high-severity alerts are found.
This makes GHAS with CodeQL the correct tool for automated security evaluation of agent-generated code. The agent can be configured to check the status check result before promoting the PR to 'ready for review,' using the scanning result as a machine-readable evaluation signal.
Why the other options fail: - Option A (GitHub Actions unit tests) tests functional correctness — whether the code does what it's supposed to do. Unit tests do not detect SQL injection, hardcoded secrets, or insecure dependencies. These are different evaluation concerns requiring a different tool. - Option C (GitHub Copilot code review) runs after the PR is opened and provides natural-language review comments. It is a qualitative, human-readable signal that requires interpretation. It is not a machine-readable pass/fail security gate and cannot block a PR from being marked ready. - Option D (branch protection with human approvals) is a human review gate, not an automated security evaluation. It adds human oversight but doesn't provide the automated security scanning signal the question requires. It also operates at merge time, not at the 'ready for review' stage.
For automated security evaluation as an agent evaluation signal, GitHub Advanced Security code scanning is the purpose-built GitHub tool.