Question

A security lead at a fintech company wants CodeQL code scanning to block pull requests only when a newly introduced alert has a 'critical' or 'high' severity, while allowing lower-severity alerts to be merged after review. Developers should still see all alerts in the PR conversation. Which configuration best achieves this outcome?

Accepted Answer

Configure a code scanning merge protection rule (protected branch check) that fails the required status check only for alerts at or above the chosen severity threshold, keeping code scanning enabled so all alerts continue to surface in the PR.

Answer

Dismiss all low- and medium-severity alerts automatically with a workflow so only critical and high alerts remain visible and blocking on the PR.

Answer

Enable secret scanning push protection on the branch so that only high-severity code scanning results can prevent the push from completing.

Answer

Disable code scanning on feature branches and run CodeQL only on the default branch after merge, then open Dependabot alerts for anything critical.