Security and pull request checks
Documentation Index
Fetch the complete documentation index at: https://docs.sourcery.ai/llms.txt
Use this file to discover all available pages before exploring further.
Security scanning can block a pull request from merging. It uses the single Sourcery review check. When a review finds a security problem in the diff, it posts a blocking comment that fails that check. The scheduled security scan is separate and reports to the dashboard.
Where the scheduled scan reports
Section titled “Where the scheduled scan reports”The scheduled security scan runs against your default branch and reports to the dashboard. It runs on the branch and has no pull request or commit to report to. It posts to the dashboard, and branch protection cannot require it.
Security findings in a review
Section titled “Security findings in a review”The blocking comment is part of the normal review, and the check it fails is the same Sourcery review check every review reports. The check stays failed while a blocking security comment is unresolved.
When a pull request fixes a finding
Section titled “When a pull request fixes a finding”When a pull request removes code that a scan previously flagged, Sourcery marks the finding solved and lists the resolved findings on the pull request, each linked to its dashboard entry. This is part of security scanning and runs only when scanning is enabled on the repository.
Requiring the check
Section titled “Requiring the check”If you want a blocking finding to stop the merge, require the Sourcery review check in your GitHub branch protection rules. That one check covers blocking security findings alongside everything else a review can block on. See anatomy of a review for when the check passes and fails.