Question

A DevOps engineer maintains a CodeQL advanced-setup workflow for a large repository. Currently the workflow triggers only on a weekly schedule, and developers complain that vulnerabilities introduced in feature branches are not surfaced until long after merge. The team wants CodeQL to analyze code as it is proposed, blocking regressions before they reach the default branch, while keeping scheduled scans for baseline coverage. Which change to the workflow's trigger configuration best meets this goal?

Accepted Answer

Add a `pull_request` trigger targeting the default branch (in addition to the existing `schedule` trigger) so CodeQL analyzes proposed changes and results appear as PR check runs.

Answer

Replace the `schedule` trigger with a `workflow_dispatch` trigger so developers can manually run CodeQL on their branches before opening a pull request.

Answer

Add a `push` trigger for all branches and remove the `schedule` trigger, since push events already cover every commit developers make.

Answer

Configure a `repository_dispatch` trigger tied to an external CI webhook so the CI system decides when CodeQL should run.