What are triggers in a CodeQL workflow used for?

• A. Defining the output file paths
• B. Setting environment variables
• C. Managing codeql packs
• D. Defining when the analysis runs (e.g., on push, PRs)

Answer: (D)

Triggers control when the CodeQL analysis runs by responding to repository events. In a GitHub Actions workflow, the on field defines events like pushes, pull requests, schedules, or manual dispatch, and that determines when the CodeQL scan is executed. This lets you run security checks at the right times—every PR to review changes, on pushes to main for automatic checks, or on a scheduled basis for nightly scans. The triggers themselves don’t decide output locations, environment variables, or how CodeQL packs are managed; those aspects are handled by the workflow steps and configuration.