Question

A security engineer maintains a repository where two separate CodeQL analysis workflows run against the same branch: one performs a fast, targeted scan on every pull request, and another runs a deeper, extended-query scan on a nightly schedule. Both workflows upload SARIF results to GitHub code scanning. After enabling the nightly workflow, the engineer notices that the nightly results are overwriting the pull request scan results, causing alerts to appear and disappear inconsistently. What is the correct way to ensure both sets of results are tracked independently without overwriting each other?

Accepted Answer

Set a distinct `category` value for each analysis when uploading SARIF, so GitHub tracks each configuration's results separately.

Answer

Configure both workflows to run on the same trigger so their SARIF uploads are merged into a single result set.

Answer

Add a `ref` parameter override to the nightly workflow so it uploads results to a different branch.

Answer

Disable the pull request workflow and rely solely on the nightly extended scan to avoid duplicate alerts.