The basic setup doesn't allow scanning on PRs coming from external forks: https://github.com/github/codeql/issues/19698#issuecomment-3657789784.