How pull request scanning works
How Socket for Origin scans dependency changes in pull requests and reports the results.
Socket scans a pull request when it's opened and when new commits are pushed to it. Socket compares the supported manifest and lockfiles on the target branch with Origin's proposed merge result, so the check reflects what merging would change. Socket reads only these files and doesn't need to build your project.
The pull request check
The check appears in Origin as Socket Security / Dependency scan. Its result follows the alert actions in your security policy, and the check only counts alerts that the pull request introduces:
- Alerts set to Block fail the check.
- Alerts set to Warn appear in the check summary and the pull request comment, and the check still passes.
- Alerts set to Monitor or Ignore aren't shown.
| Result | Title | What it means |
|---|---|---|
| Success | Dependency scan passed | The pull request introduces no alerts set to Block. |
| Failure | Blocking dependency alerts found | The pull request introduces at least one alert set to Block. |
| Neutral | No supported dependency files | The proposed merge has no supported manifest or lockfiles to scan. |
| Action required | Complete Socket setup | Socket is installed in Origin. Select the check to connect the workspace to your Socket organization. |
When a check needs attention, its summary explains what to do. You can rerun any check from Origin.
To block merges when the check fails, see Require the Socket check before merging.
Pull request comments
When a scan passes or fails, Socket comments on the pull request:
- Dependency overview: added and updated direct dependencies, with Supply Chain, Vulnerability, Quality, Maintenance, and License scores.
- Alerts: each alert set to Block or Warn, including alerts on transitive dependencies, with its severity, fix details when available, and links to the Socket report.
For other results, Socket posts the check title and summary as a comment. Socket updates its comments in place as the pull request changes.
Default branch
When you push to the default branch, Socket scans it and posts a Project Report check with a link to the report. These scans keep the Alerts and Dependencies pages in your Socket dashboard up to date. After you connect, Socket starts tracking a repository's default branch with the next push to that branch.
In the Socket dashboard
Origin repositories appear in Socket as origin-<owner>/<repository>, where <owner> is the Origin workspace that owns the repository. Pull request scans are listed with their pull request number, and default-branch scans drive the Alerts and Dependencies pages.
Updated 19 days ago