Pull-request checks
When a pull request (or merge request) targets a tracked branch, Vulkro Cloud scans it and reports on the pull request. Nothing changes in your pipeline.
Set up: turn on scan on push so the git host tells Vulkro Cloud about pull requests, and give the token the write permissions. Works on GitHub, GitLab and Bitbucket, on every plan that includes Core.
Switches
In the repository's settings, under Quality Gate, the Pull Request Checks card has:
| Switch | Default | What it does |
|---|---|---|
| Commit Status | On | Pass or fail on the latest commit, from the repository's quality gate. |
| Pull Request Comment | On | One summary comment with the gate result and new issues, edited on later pushes. |
| Line Comments | Off | Comments on changed lines with new issues, up to the Line Comment Limit (20 by default). Updated, moved and resolved as the code changes. |
| Check Annotations | On | Bitbucket Code Insights, or GitHub check runs through the Vulkro GitHub App. |
| Fix Pull Requests | Off | Lets members open fix pull requests (below). |
Fix pull requests
From a dependency's or advisory's record, Open a Fix Pull Request raises the vulnerable package to the highest fixed version across its open advisories. Nothing opens on its own.
- One commit on a new branch
vulkro/fix-<package>-<version>, changing the manifest (and the lockfile where that can be done exactly). - npm, PyPI, Go and Maven, on GitHub, GitLab and Bitbucket.
- Needs write access to contents.
- After you merge, the next scan marks it Confirmed or Not fixed.
To report from your own pipeline instead, see CI.