Question

You are configuring the default CodeQL workflow for a repository that receives frequent pull requests to the `main` branch. The security team wants alerts raised as early as possible on incoming changes, but they are also concerned about newly disclosed CodeQL query updates surfacing vulnerabilities in code that hasn't changed in weeks. The repository has a limited GitHub Actions minutes budget, so running a full analysis on every push to every feature branch is undesirable. Which combination of triggers in the CodeQL workflow best satisfies these requirements?

Accepted Answer

Trigger on `pull_request` targeting `main` plus a `schedule` (cron) that runs periodic full scans.

Answer

Trigger only on `push` to every branch so all commits are scanned immediately.

Answer

Trigger only on `workflow_dispatch` so the team runs scans manually when they judge it necessary.

Answer

Trigger on `push` to `main` only, with no scheduled runs, to conserve Actions minutes.