A monorepo is analysed by two scanners: CodeQL for application code and a separate infrastructure-as-code scanner. Both upload SARIF for the same commit, but the second upload appears to overwrite the first so only one tool's alerts remain visible. What SARIF upload practice keeps both sets of results as distinct, co-existing code scanning alerts?
- AGive each tool's upload a distinct category value so code scanning tracks the two analyses separately for that commit and ref. Correct
- BUpload both SARIF files in a single combined run so code scanning merges the two tools into one result set.
- CSchedule the two scanners on different days so their uploads never target the same commit and cannot collide.
- DSet a unique runAutomationDetails id on each tool's check run so the Security tab keeps them on separate pages.
Why A is correct: Code scanning identifies an analysis by the combination of tool, ref, and the category supplied at upload. Assigning each scanner a unique category means a new upload only refreshes the matching analysis, so both tools' alerts persist side by side instead of one overwriting the other.
Why B is wrong: Combining unrelated tools into one upload does not preserve their separation and is not how code scanning distinguishes analyses. It is tempting as a way to keep everything together, but without distinct categories one analysis still replaces the other.
Why C is wrong: Staggering schedules avoids same-commit uploads but defeats the goal of having both tools' current results on the latest commit. It is a workaround that sacrifices coverage rather than the supported way to keep concurrent analyses distinct.
Why D is wrong: While SARIF does carry automation details, code scanning keys analyses on the upload category rather than on a hand-set check run page, and the example wrongly ties this to check runs. Relying on a check run id instead of a category does not stop one analysis replacing another.