Static analysis runs on pull requests where the language supports it
A reviewer catches what a reader notices. A static analyzer catches the injection and memory classes a reader skims past, and on GitHub the default setup is a repository setting rather than a workflow to maintain.
Observable check
where the repository contains source in a language a static analyzer supports, a static analysis workflow runs on pull requests to the default branch and its result is a required check. A repository holding no source in a supported language falls outside this rule rather than failing it.
Where this comes from
Last read against these sources on 2026-07-28.
Scorecard SAST requires static analysis on pull requests and names CodeQL.