A team wants to automatically generate objective evaluation signals for a GitHub Copilot agent that produces code changes. Which GitHub-native tools can provide automated scanning signals without requiring human review for each PR?

Automated scanning tools provide objective, programmatically generated evaluation signals that can be used to assess the quality of agent-produced code changes at scale. CodeQL, secret scanning, and dependency review are correct because they are GitHub-native automated scanning tools that generate machine-readable signals without requiring human review for each pull request. CodeQL is a static analysis tool that identifies security vulnerabilities and code quality issues in agent-produced code; high CodeQL alert counts signal the agent is introducing problematic patterns. Secret scanning detects hardcoded credentials, API keys, and tokens in code changes; flags from secret scanning indicate the agent is producing dangerous code. Dependency review analyzes dependency changes for known vulnerabilities; if the agent updates dependencies, this tool flags unsafe versions. All three generate machine-readable signals that can be incorporated into evaluation pipelines. GitHub Discussions and GitHub Projects boards are wrong because they are collaboration and project management tools. They do not perform automated code analysis or generate evaluation signals. GitHub Releases and GitHub Pages are wrong because they are distribution and documentation tools. They have no code analysis capability and generate no evaluation signals about code quality. GitHub Sponsors and Marketplace listings are wrong because they are commercial and distribution features. They are entirely unrelated to code quality evaluation.