CodeQL should run on pull requests to avoid post-merge surprises. Signed-off-by: Kazuyoshi Kato <katokazu@amazon.com>
Signed-off-by: Phil Estes <estesp@linux.vnet.ibm.com>
Signed-off-by: Justin Hutchings <jhutchings1@github.com> Signed-off-by: Phil Estes <estesp@linux.vnet.ibm.com>