A developer wants to configure a code generation agent to automatically evaluate its own output for security vulnerabilities before it marks a pull request as ready for review. The evaluation should detect issues like SQL injection, hardcoded secrets, and insecure dependencies without requiring manual human review at this stage. Which GitHub tool should be configured to provide this automated evaluation signal?
Select an answer to reveal the explanation.
Short Explanation
Unit tests find logic bugs; security scanners find security bugs. You want GitHub Advanced Security with CodeQL as a required status check, because it gives you an automated, machine-readable security gate on the agent's pull requests. If it flags SQL injection, secrets, or bad dependencies, the agent shouldn't mark the PR ready.
Full Explanation
GitHub Advanced Security (GHAS) includes code scanning powered by CodeQL, which performs static analysis to identify security vulnerabilities including injection flaws, hardcoded secrets (via secret scanning), and insecure dependency versions (via Dependabot). When configured as a required status check on a branch protection rule, code scanning runs automatically on every pull request and blocks the PR from being merged (or marked ready for review) if high-severity alerts are found.
This makes GitHub Advanced Security with CodeQL the correct tool for automated security evaluation of agent-generated code. The agent can be configured to check the status check result before promoting the PR to 'ready for review,' using the scanning result as a machine-readable evaluation signal.
Why the other options fail: - The GitHub Actions workflow that runs unit tests on the agent's code changes tests functional correctness — whether the code does what it's supposed to do. Unit tests do not detect SQL injection, hardcoded secrets, or insecure dependencies. These are different evaluation concerns requiring a different tool. - GitHub Copilot code review configured to comment on pull requests after they are opened runs after the PR is opened and provides natural-language review comments. It is a qualitative, human-readable signal that requires interpretation. It is not a machine-readable pass/fail security gate and cannot block a PR from being marked ready. - GitHub branch protection rules requiring two human approvals before merging are a human review gate, not an automated security evaluation. They add human oversight but don't provide the automated security scanning signal the question requires. They also operate at merge time, not at the 'ready for review' stage.
For automated security evaluation as an agent evaluation signal, GitHub Advanced Security code scanning is the purpose-built GitHub tool.