– [Configure and Use Code Scanning] What is required to trigger code scanning on a specified branch?

GitHub code scanning is implemented as a GitHub Actions workflow. For a workflow to execute in response to an event on a specific branch (e.g., a push or pullrequest), the YAML workflow file that defines the job and its triggers must be present in the .github/workflows directory of that branch. When an event occurs, GitHub checks the commit SHA associated with that event for a relevant workflow file. If the file does not exist in that branch's context, GitHub Actions has no instructions to run the code scan.

A. The repository must be private.

Code scanning is available for free on all public repositories and is not restricted to private ones.

B. Secret scanning must be enabled on the repository.

Secret scanning and code scanning are independent features of GitHub Advanced Security; one is not a prerequisite for the other.

C. Developers must actively maintain the repository.

Workflows are triggered by specific, configured events (like a push), not by a general state of "active maintenance."

1. GitHub Docs, "Configuring default setup for code scanning." This document states, "When you set up default setup for code scanning, GitHub Actions creates a workflow file in your repository... For a workflow to run, its workflow file must be in the branch that the event occurred in." This directly confirms that the workflow file must exist in the target branch.

2. GitHub Docs, "Events that trigger workflows." Under the section "Choosing the workflow file," it explains: "When an event occurs on your repository, GitHub will identify the workflow files that are in the Git ref (branch or tag) associated with that event." This reinforces that the workflow's existence in the specific branch is the determining factor for it to be triggered.

3. GitHub Docs, "About GitHub Advanced Security." This page clarifies the availability of features: "GitHub Advanced Security features are enabled for all public repositories on GitHub.com." This directly refutes the claim that a repository must be private.