From eb6dc6be71b0136aa4105b315f8d2759d39cc753 Mon Sep 17 00:00:00 2001
From: GSServita <giacomo.sorbi@servita.com>
Date: Thu, 23 Jul 2026 16:29:53 +0100
Subject: [PATCH] QVAC-22747 infra: add weekly schedule to CodeScan caller

The canonical CodeScan baseline currently runs on push/PR only, so the
QVAC-19056 commitment to a weekly scan is unmet. Add a scheduled cron
(staggered per repo across the fleet) alongside the existing
push / pull_request / workflow_dispatch triggers. No other change.
---
 .github/workflows/security-baseline.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/security-baseline.yml b/.github/workflows/security-baseline.yml
index 4b7895019..335bb805c 100644
--- a/.github/workflows/security-baseline.yml
+++ b/.github/workflows/security-baseline.yml
@@ -16,6 +16,9 @@ on:
     branches:
       - master
   pull_request:
+  schedule:
+    # Weekly full scan (QVAC-19056 rollout). Staggered per repo across weekdays.
+    - cron: "0 7 * * 0"
   workflow_dispatch:
 
 permissions: