Just spent an hour on a call with a GitHub rep who finally admitted something useful: you can (and should) run CodeQL on a schedule, not just on push or PR.
Everyone defaults to the push/PR triggers because that's what the docs highlight. But if your team isn't pushing daily to certain branches, you're blind. A scheduled scan catches dormant code that got missed or new rules added to your security pack.
Here's the kicker: setting it up. You edit your workflow YAML, swap out the `on: push` line for a schedule event. Cron syntax.
```yaml
on:
schedule:
- cron: '0 23 * * 0' # Runs at 23:00 UTC every Sunday
```
Why bother?
- Catches vulnerabilities introduced by dependency updates that happened outside a PR.
- Validates your main branch state *after* a bunch of PRs have merged.
- Gives you a consistent security posture report for compliance, without relying on dev activity.
Downside? It costs more compute minutes. But missing a critical CVE because no one pushed to `prod` this week costs more.
- No fluff.