Github Actions Step 2: Detect Vulnerabilities not blocking CodeQL check

[Chinzillla]

Summary

I was testing the CodeQL Exercise, and the expected output in Step 2: Detect Vulnerabilities in a Pull Request was not similar

Instead, CodeQL check passed and only Copilot was able to detect the vulnerability

Is this a feature intended because the vulnerability did not hit the threshold to block CodeQL from passing?

Also is this something I can contribute to?

How to reproduce

1. Follow Step 2: Detect Vulnerabilities in Pull Request
2. Observe CodeQL passing check and Copilot capturing vulnerability

Please include screenshots.

Additional context

Referenced to Pull Request:
Chinzillla/skills-introduction-to-codeql#2

[Chinzillla]

Found the resolution:

Copilot is taking priority over CodeQL Security check. Disabling copilot security review reenables CodeQL Scan

[chriswblake]

Hello @Chinzillla, I just did a test run of this exercise and it worked as expected, although with slightly different visuals. Based on the how the results are now shared to the PR, I suspect the above was from some kind of transition of the security scanning results working along with Copilot to provide recommended solutions.

I have created PR #70 to update images and fix some wording.

[Chinzillla]

Thanks Chris,

I had turned off Copilot as a test and CodeQL was able to detect the SQL vulnerability and fail the check.

I still think its weird that it passes checks if copilot takes priority and when its disabled it fails check properly.