Security and pull request checks

Security scanning can block a pull request from merging. It does this through the single Sourcery review check rather than a security check of its own: when a review finds a security problem in the diff, it posts a blocking comment that fails that check. The scheduled security scan is separate and reports to the dashboard.

Where the scheduled scan reports

The scheduled security scan runs against your default branch and reports to the dashboard. It is tied to the branch rather than a pull request or commit, so it posts to the dashboard and cannot be required in branch protection.

Security findings in a review

The blocking comment is part of the normal review, and the check it fails is the same Sourcery review check every review reports. The check stays failed while a blocking security comment is unresolved.

When a pull request fixes a finding

The reverse also shows up on the pull request. When a pull request removes code that a scan previously flagged, Sourcery marks the finding solved and lists the findings the pull request resolves, each linked to its entry in the dashboard, so a reviewer sees the security impact of the change in context. This is part of security scanning, so it runs when scanning is enabled on the repository.

Requiring the check

If you want a blocking finding to stop the merge, require the Sourcery review check in your GitHub branch protection rules. That one check covers blocking security findings alongside everything else a review can block on. See anatomy of a review for how the check moves between its states.