While the following link is not directly addressing the content of your question, it ...well... still adresses the ...uh... content of your question:

https://software.codidact.com/posts/284871/284872

;-)

Wrt to your question, pay attention to the code-scanning workflow documentation: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#avoiding-unnecessary-scans-of-pull-requests

Quote: "on:pull_request:paths-ignore [...] set conditions that determine whether the actions in the workflow will run on a pull request. They don't determine what files will be analyzed when the actions are run. When a pull request contains any files that are not matched by on:pull_request:paths-ignore [...], the workflow runs the actions and scans all of the files changed in the pull request, including those matched by on:pull_request:paths-ignore [...], unless the files have been excluded. For information on how to exclude files from analysis, see 'Specifying directories to scan.'"

Follow the link(s) given in this documentation wrt to 'Specifying directories to scan' and pay utmost attention to what is written there both inside and outside the notes blocks...