What is the difference between scheduled versus triggered events in code scanning?

Configuration complexity is not the distinguishing characteristic between scheduled and triggered events; both are defined in GitHub Actions workflow YAML files with comparable ease.

Scheduled events use a cron expression in the workflow YAML to run code scanning at fixed time intervals (e.g., nightly or weekly), regardless of developer activity, while triggered events fire automatically in response to code events such as push or pull_request, integrating scans directly into the development workflow.

Triggered events do not inherently run less frequently than scheduled events; a busy repository with many pushes per day will trigger scans far more often than a nightly scheduled scan.

Scheduled events are not restricted to administrators; any user with write access who can create or modify GitHub Actions workflow files can configure a scheduled code scanning workflow.