Which events typically trigger a Code Scanning workflow?

• A. Only when issues are created.
• B. On push and pull requests.
• C. Manually via API.
• D. On a schedule.

Answer: (B)

Code Scanning workflows are designed to run as code changes flow through the repository. The most common triggers are events that reflect new or updated code: pushing commits to a branch and creating or updating pull requests. Scanning on push ensures every new commit is checked, catching issues early in the development process. Scanning on pull requests provides fast feedback during code review, allowing teams to address findings before merging into protected branches. Other options like triggering only when issues are created, manual API invocation, or scheduling don’t align with the typical workflow, as they either miss new changes or add steps outside the normal review and CI flow. Therefore, the typical triggers are on push and pull requests.