Workflow

Pull request checks

Scanverra scans every pull request, comments with the critical and high issues it adds, and sets the scanverra/repo-scan status check. Issues already on the target branch never block a merge.

Needs a paid plan, a connected GitHub account and admin access to the repository, because Scanverra adds a webhook to it.

Set it up

1
Connect GitHub
On the Repo Scanner page, connect the GitHub account that has admin access to the repository.
2
Open pull request checks
Click the pull request icon next to the repository's Scan button.
3
Choose when to scan
Scan pull requests is on by default. Turn on Scan pushes to branches to also scan pushes to the branches you list, for example main, production. Then Turn on.
4
Require the check (optional)
In GitHub, open Settings, then Branches, add a rule for your main branch and require the status check scanverra/repo-scan. Pull requests that add critical or high issues then can't be merged.

What the check looks at

Each scan is compared with the latest scan of the pull request's target branch. Findings are matched by tool, rule and file (not line), so moving old code doesn't make it new. The status is failure only when the PR adds critical or high issues; it is error if the scan couldn't finish. Scanverra keeps one comment per PR and updates it on every push.

The pull request comment

### ❌ Scanverra: 2 new critical or high issues

Score 72/100 · quality gate passed · compared with the latest scan of `main`

| Severity | Issue |
| --- | --- |
| 🔴 critical | Hardcoded API key (`src/lib/payments.ts:12`) |
| 🟠 high | SQL query built from user input (`src/api/orders.ts:48`) |

5 critical or high issues were already on `main` and don't block this PR.

Open the full report. From there you can open a fix pull request for the issues Scanverra can fix.