--- title: Scheduled code scanning skips inactive repositories description: Weekly scheduled scans for code scanning default setup and GitHub Code Quality now only begin once a push or pull request triggers an analysis, instead of... canonical: https://daily.dev/posts/scheduled-code-scanning-skips-inactive-repositories-dmprkmmnz twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Scheduled code scanning skips inactive repositories | daily.dev og:description: Weekly scheduled scans for code scanning default setup and GitHub Code Quality now only begin once a push or pull request triggers an analysis, instead of... og:url: https://daily.dev/posts/scheduled-code-scanning-skips-inactive-repositories-dmprkmmnz og:image: https://api.daily.dev/og/posts/dmPRkmmnz.png og:image:alt: Scheduled code scanning skips inactive repositories og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Scheduled code scanning skips inactive repositories **[GitHub Changelog](https://daily.dev/sources/github_updates)** · 2 min read · 0 upvotes · 0 comments ## Summary Weekly scheduled scans for code scanning default setup and GitHub Code Quality now only begin once a push or pull request triggers an analysis, instead of counting any scan type (including the initial validation scan or language-change scans) as recent activity. Previously, enabling default setup or rolling out a security configuration across many repositories could make dormant repos appear active for up to six months, causing unexpected weekly scans. The initial validation scan still runs immediately, but activity for ongoing scheduling is now based on analysis history tied to actual pushes or pull requests, not prior Git activity. No configuration changes are required. This behavior applies now to GitHub Enterprise Cloud and will come to GitHub Enterprise Server 3.24. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why is GitHub code scanning running weekly scheduled scans on repositories that have no recent development activity? Previously, GitHub counted any scan, including the one-time validation scan run when default setup is first enabled and scans triggered by detected language changes, as recent activity, which could make a dormant repository appear active for up to six months and trigger unwanted weekly scheduled scans. Now, weekly scheduled scanning only starts after a push or pull request triggers an actual analysis, so inactive repositories are skipped. _daily.dev keeps developers rolling out security configurations across repos aware of behavior changes like this._ ### Does enabling GitHub code scanning default setup still immediately populate findings? Yes, enabling default setup still runs an initial validation scan right away and populates findings immediately. However, that initial scan no longer counts toward determining whether a repository is active for weekly scheduled scanning purposes going forward, which is now based solely on analysis triggered by a push or pull request. _Teams rolling out security configurations at scale can track changes like this via daily.dev._ ### When will the new code scanning activity detection behavior be available on GitHub Enterprise Server? The updated behavior, where weekly scheduled scans only start after a push or pull request triggers analysis, applies to GitHub Enterprise Cloud now and will be supported in GitHub Enterprise Server 3.24. No configuration change is required to get this behavior once it is available. _daily.dev helps GitHub Enterprise admins stay current on changes affecting code scanning rollouts._ ## Similar posts on daily.dev - [Periodic code scanning of inactive repositories](https://daily.dev/posts/periodic-code-scanning-of-inactive-repositories-r3bkbe1ok) · GitHub Changelog · 1 upvotes · 0 comments - [Code scanning AI Scan no longer requires CodeQL default setup](https://daily.dev/posts/code-scanning-ai-scan-no-longer-requires-codeql-default-setup-pkewbrezx) · GitHub Changelog · 0 upvotes · 0 comments - [Code scanning default setup bypasses GitHub Actions policy blocks](https://daily.dev/posts/code-scanning-default-setup-bypasses-github-actions-policy-blocks-u1ifu5vej) · GitHub Changelog · 0 upvotes · 0 comments - [6 security settings every GitHub maintainer should enable this week](https://daily.dev/posts/6-security-settings-every-github-maintainer-should-enable-this-week-k2jeluiaw) · GitHub Blog · 0 upvotes · 0 comments --- Tags: [#github](https://daily.dev/tags/github), [#cicd](https://daily.dev/tags/cicd), [#code-scanning](https://daily.dev/tags/code-scanning) [View this post on daily.dev](https://daily.dev/posts/scheduled-code-scanning-skips-inactive-repositories-dmprkmmnz) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Scheduled code scanning skips inactive repositories","url":"https://daily.dev/posts/scheduled-code-scanning-skips-inactive-repositories-dmprkmmnz","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/scheduled-code-scanning-skips-inactive-repositories-dmprkmmnz"},"datePublished":"2026-10-01T17:02:05.595Z","dateModified":"2026-10-01T17:10:54.550Z","description":"Weekly scheduled scans for code scanning default setup and GitHub Code Quality now only begin once a push or pull request triggers an analysis, instead of...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/068b514f40955beefe2a782acefd989e?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/068b514f40955beefe2a782acefd989e?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"GitHub Changelog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"GitHub Changelog","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/15004b7835da4d89b02b115871f0f6dc","url":"https://daily.dev/sources/github_updates"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/scheduled-code-scanning-skips-inactive-repositories-dmprkmmnz","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"github,cicd,code-scanning","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"GitHub Changelog","item":"https://daily.dev/sources/github_updates"},{"@type":"ListItem","position":3,"name":"Scheduled code scanning skips inactive repositories"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/scheduled-code-scanning-skips-inactive-repositories-dmprkmmnz#faq","mainEntity":[{"@type":"Question","name":"Why is GitHub code scanning running weekly scheduled scans on repositories that have no recent development activity?","acceptedAnswer":{"@type":"Answer","text":"Previously, GitHub counted any scan, including the one-time validation scan run when default setup is first enabled and scans triggered by detected language changes, as recent activity, which could make a dormant repository appear active for up to six months and trigger unwanted weekly scheduled scans. Now, weekly scheduled scanning only starts after a push or pull request triggers an actual analysis, so inactive repositories are skipped. daily.dev keeps developers rolling out security configurations across repos aware of behavior changes like this."}},{"@type":"Question","name":"Does enabling GitHub code scanning default setup still immediately populate findings?","acceptedAnswer":{"@type":"Answer","text":"Yes, enabling default setup still runs an initial validation scan right away and populates findings immediately. However, that initial scan no longer counts toward determining whether a repository is active for weekly scheduled scanning purposes going forward, which is now based solely on analysis triggered by a push or pull request. Teams rolling out security configurations at scale can track changes like this via daily.dev."}},{"@type":"Question","name":"When will the new code scanning activity detection behavior be available on GitHub Enterprise Server?","acceptedAnswer":{"@type":"Answer","text":"The updated behavior, where weekly scheduled scans only start after a push or pull request triggers analysis, applies to GitHub Enterprise Cloud now and will be supported in GitHub Enterprise Server 3.24. No configuration change is required to get this behavior once it is available. daily.dev helps GitHub Enterprise admins stay current on changes affecting code scanning rollouts."}}]} ```