How pull request scanning works
How Socket for GitHub scans dependency changes in pull requests and reports the results.
Socket for GitHub scans a pull request when it's opened or reopened and when new commits are pushed to it. Socket checks the changes to supported manifest and lockfiles in the pull request and reports the results on the pull request.
The pull request check
The check appears in GitHub as Socket Security: Pull Request Alerts. Its result follows the alert actions in your security policy:
- Alerts set to Block fail the check.
- Alerts set to Warn are reported on the pull request, and the check still passes.
- Alerts set to Monitor or Ignore aren't shown on the pull request.
| Result | What it means |
|---|---|
| Success | No alerts set to Block were found in the dependency changes. |
| Failure | At least one alert set to Block was found in the dependency changes. |
| Neutral | Socket couldn't read every dependency file in the pull request, so the results may be incomplete. |
To block merges when the check fails, see Enable branch protection.
Pull request comments
Socket comments on the pull request with a dependency overview and with the alerts it found. To ignore an alert from the pull request, see Ignoring pull request alerts.
Project reports
Socket also posts a Socket Security: Project Report check with a full scan of the dependencies at that commit. Reports on your default branch keep the Alerts and Dependencies pages in your Socket dashboard up to date.
Configure scanning
Use socket.yml to choose which paths Socket scans, when pull request alerts run, and which checks and comments Socket posts.
Updated 19 days ago