Which GitHub Actions event trigger is recommended for CodeQL analysis to scan code on every PR?
Select an answer to reveal the explanation.
Short Explanation and Infographic
The CodeQL starter workflow scans on both PRs and pushes to default — catching issues before merge AND keeping baseline results current.
Full explanation below image
Full Explanation
GitHub's default CodeQL starter workflow triggers on: pull_request (to catch new vulnerabilities before merge), on: push to the default branch (to keep the baseline analysis current and detect issues merged directly), and on: schedule (weekly) for periodic full scans. Using only push misses PR scanning. Manual dispatch alone provides no continuous protection. The combination of pull_request and push events provides the best coverage: PRs are gated, and the default branch is continuously analyzed. Results appear in the Security tab under Code scanning alerts.