Pull request checks
With pull request checks enabled, Oneleet scans each pull request that targets the repository’s target branch and reports the result as a GitHub check named Oneleet Code Security Scan. Findings that already exist on the target branch never fail the check, so enabling PR checks on a codebase with a backlog of findings won’t block anyone’s work.
| Scan outcome | Check result |
|---|---|
| No new findings | Pass |
| At least one new finding | Fail |
| No completed scan of the target branch yet | Neutral |
| The scan itself failed | Fail, with the error in the summary |
How “new” is decided
Section titled “How “new” is decided”The comparison baseline is the most recent scan of the repository’s target branch. When a pull request is scanned:
- Only the files the PR changes are examined, and only findings on lines the PR added (or in files it added) are considered.
- Findings are matched against the baseline even when your changes move code around, so shifting existing code to a different line doesn’t get flagged as a new finding.
- Findings you’ve resolved, suppressed, or ignored on the platform don’t count as new.
Whenever pull request checks are enabled, a push to the target branch also triggers a fresh scan, so the baseline keeps up with your code.
What developers see
Section titled “What developers see”A failing check summarizes the new findings by severity. Each finding appears as an annotation on the offending lines, visible in the PR’s Files changed and Checks tabs, with its severity, confidence, rule ID, and a link to remediation guidance.
To make a failing check pass, either fix the findings in the pull request (every new commit is rescanned), or merge and triage the findings on the Code Security page afterwards. You can also re-run the check from GitHub’s re-run button.
Turning it on
Section titled “Turning it on”Pull request checks are configured per repository:
- Make sure the repository is added to Code Security via the GitHub (Code) integration.
- Open Code security → Configure → Repositories, select the repository, and enable Automatically scan pull requests for new findings.
Until the repository’s first target-branch scan completes, PR checks report a neutral result, because there’s no baseline to compare against yet.
Notes on scope:
- Only pull requests targeting the repository’s configured target branch are scanned.
- Draft pull requests aren’t scanned until they’re marked ready for review.
- Pull request checks are currently available for GitHub repositories.
Blocking merges
Section titled “Blocking merges”The check reports pass or fail. Whether that blocks merging is up to your branch protection rules. To enforce it, add Oneleet Code Security Scan as a required status check in the repository’s GitHub branch protection or rulesets. Many teams run the check in report-only mode for a couple of weeks before making it required.