Locating queries to add to a query suite
When creating a query suite, you first need to specify the locations of the queries that you want to select. You can define the location of one or more queries using:
A query instruction: Tells CodeQL to look for one or more specified .ql files:
- query: <path-to-query>
The argument must be one or more file paths, relative to the CodeQL pack containing the suite definition.

GitHub's Code scanning is a feature that analyzes the code in a GitHub repository to find security vulnerabilities and coding errors, providing alerts in the repository and offering tools to triage, prioritize, and fix issues. It acts as a Static Application Security Testing (SAST) tool, using engines like CodeQL to detect issues like SQL injection and Cross-Site Scripting (XSS), and can be triggered automatically on events like pushes and pull requests.

CodeQL databases contain queryable data extracted from a codebase, for a single language at a particular point in time. The database contains a full, hierarchical representation of the code, including a representation of the abstract syntax tree, the data flow graph, and the control flow graph.
Each language has its own unique database schema that defines the relations used to create a database. The schema provides an interface between the initial lexical analysis during the extraction process, and the actual complex analysis using CodeQL. The schema specifies, for instance, that there is a table for every language construct.
For each language, the CodeQL libraries define classes to provide a layer of abstraction over the database tables. This provides an object-oriented view of the data which makes it easier to write queries.

Code scanning merge protection prevents a pull request from merging into a protected branch if it contains security issues or if required code scanning tools are missing or incomplete. This feature, configured using GitHub Rulesets>>, acts as a safeguard, blocking merges until all code scanning alerts are addressed to a defined severity level and the analysis is complete.
Code Scanning Configuration: You configure code scanning tools (like CodeQL) in your repository to run automatically on pull requests using the pull_request: event trigger.
Incorrect:
[Not A]
workflow_dispatch is a GitHub Actions trigger that allows users to manually start a workflow on demand, offering flexibility for tasks like deployments or testing that don't need to run automatically on every code change. This trigger can be configured with custom inputs to provide different parameters for each manual run, giving users more control over when and how specific workflows are executed.