You need to ensure that all code in a GitHub repository is scanned for vulnerabilities. Which feature should you use?

CodeQL actions are the correct choice because they provide automated static code analysis to find security vulnerabilities and errors in your code. They integrate directly into your GitHub CI/CD pipeline, scanning code as it's committed or on a schedule. Dependabot alerts focus on vulnerable dependencies, not vulnerabilities within your own codebase. Branch protection rules enforce quality gates like required reviews or status checks, but don't perform code scanning themselves. The GitHub Advisory Database is a collection of known vulnerabilities in open-source projects, which Dependabot uses, but it's not a scanning tool for your custom code.