Pull-request checks
Pull-request checks are on the Business plan and up.
When a pull request (or merge request) targets a tracked branch, Vulkro Cloud scans it and reports back on the pull request itself. You do not add anything to your CI pipeline: the git host tells Vulkro Cloud about the pull request through the repository's webhook, so set up scan on push first.
Pull-request checks work on GitHub, GitLab and Bitbucket. The access token needs the write permissions listed in Connect repositories.
What you can turn on
Each repository has a Pull Request Checks card in its settings, under Quality Gate. Each item is a separate switch:
| Switch | Default | What it does |
|---|---|---|
| Commit Status | On | Sets a pass or fail status on the pull request's latest commit, from the repository's quality gate. |
| Pull Request Comment | On | Posts one summary comment: the gate result and the new issues. Later pushes edit the same comment instead of adding another. |
| Line Comments | Off | Comments on the changed lines where new issues are. The Line Comment Limit is 20 by default (5, 10, 20, 30 or 50). Comments are updated on later pushes, resolved when the issue is gone, and moved when the line moves. Issues over the limit are listed in the summary comment. |
| Check Annotations | On | On Bitbucket, adds a Code Insights report with the issues on their lines. Not offered on GitLab. |
| Fix Pull Requests | Off | Lets members open fix pull requests for vulnerable packages (below). |
With an access token on GitHub, Vulkro Cloud reports with the commit status, the summary comment and line comments. Check runs and check annotations on GitHub are not available with an access token.
Fix pull requests
Fix pull requests are opt-in per repository and off by default. Turn on Fix Pull Requests for a repository to make them available.
When you ask, Vulkro Cloud opens a pull request that raises a vulnerable package to its fixed version. Your team reviews and merges it; the next scan confirms it.
- You ask from the dependency's or the advisory's record (Open a Fix Pull Request). Nothing is opened on its own.
- It raises the package to the highest fixed version among the package's open advisories.
- The pull request changes the manifest, and the lockfile only where that
can be done exactly. It is one commit on a new branch named
vulkro/fix-<package>-<version>, made through the git host's API. - Supported ecosystems: npm, PyPI, Go and Maven, on GitHub, GitLab and Bitbucket.
- The token needs write access to the repository contents (on GitHub: Contents, Read and write).
After it is merged, the next scan marks the fix Confirmed or Not fixed.
Without Vulkro Cloud
To report on pull requests from your own pipeline instead, run the scanner in CI: see CI/CD integration and the GitHub Action.