An organisation has been running code scanning default setup on a repository for several months. A new requirement means they must run two internal CodeQL query packs and observe a custom build for one language, neither of which default setup supports. A platform engineer commits a CodeQL advanced setup workflow to the repository to gain that control. Before relying on it, they need to know how the existing default setup and the new committed workflow will interact. What is the correct expectation?
- ABoth run concurrently, so the repository receives two independent CodeQL analyses per trigger and the engineer must reconcile duplicate alerts manually.
- BEnabling advanced setup disables default setup for the repository, so the committed workflow becomes the active code scanning configuration and default setup stops running. Correct
- CThe committed workflow is ignored until an administrator first deletes default setup in the repository security settings, otherwise the workflow file has no effect at all.
- DDefault setup takes precedence and silently overrides the committed workflow, so the custom query packs never run until default setup is unsupported for the language.
Why A is wrong: Default setup and advanced setup are mutually exclusive for a repository, so they do not both run and produce duplicate alerts; this misconception leads teams to expect doubled scanning that never occurs.
Why B is correct: Default setup and advanced setup cannot both be active on the same repository; configuring advanced setup turns default setup off, so the committed workflow becomes the sole code scanning configuration and gives the engineer the custom packs and build control they need.
Why C is wrong: Committing and enabling an advanced setup workflow itself moves the repository to advanced setup and disables default setup; there is no separate mandatory delete-first step that renders the committed workflow inert until performed.
Why D is wrong: Default setup does not override a committed advanced setup workflow; the relationship is the reverse, since adopting advanced setup is what disables default setup, so the custom packs would in fact run.