Pull Request Scanning
Pull request scans are initiated by events triggered by version control systems such as GitHub, GitLab Bitbucket and Azure Repos, or via webhooks. These scans are run on default or non-default branches containing open Pull Requests (PR) or Merge Requests (MR) from your integrated repositories. The scan results are based on the default Enforcement thresholds or custom configurations.
Pull request scans run automatically on the default branch of your repositories. To scan non-default branches, manual configuration is required. For more on non-default branch scans, refer to Non-default branch scans.
Configure Pull Request Scans
Configure PR scan settings using the Comment Bot Enforcement threshold.
Before you begin, configure branch protection rules in your Version Control System (VCS) to fail builds if a step fails.
In Application Security select Projects > Action menu.
Select Enforcement from the menu.
In a code category, drag the Comments bot threshold rule arrow to your required severity.
The 'hard-fail level' sets the threshold for failing a pull request (PR) scan conducted by Prisma Cloud. When the severity of a finding is at or above this threshold, the PR scan will fail, and PR comments will be added. This ensures that any identified issues meeting or exceeding the specified severity threshold will result in a failed PR scan and the addition of comments to the PR. For more information on Enforcement, refer to Enforcement.
Select Save.
Manage Pull Request Scan Results
You can manage pull request scan results within the pull request itself or through the Prisma Cloud Console.
On the Pull Request
Errors detected by a PR scan triggered by changes to a resource are displayed as a PR comment within the pull request. Details of the error and suggested remediation can be viewed by clicking the arrow in the comment.
SCA PR comments are for any vulnerability in a modified package manager file. Secrets PR comments are only for new or modified lines of code that include a secret finding.
During pull request (PR) scans, Prisma Cloud reviews all modified resources within the PR. However, due to constraints in many version control systems (VCS), comments can only be added to modified lines. Despite this limitation, the scanner accurately identifies the relevant lines for each comment. It’s important to note that scan results are not filtered on a line-by-line basis, so results for other lines in the same resource may also be provided, even if only one line was changed. This approach is particularly valuable for customers who already have existing Infrastructure as Code (IaC) with identified issues. By identifying these issues during pull requests when changes are made, Prisma Cloud can expedite the resolution of older issues. While this may introduce additional notifications, it ensures that issues within actively modified resources are not overlooked.
On the Prisma Cloud Console
In addition, you can view results of a pull request scan on the Prisma Cloud console: In Application Security, select Projects and click the VCS Pull Requests tab.
For more information on managing scan results, including fixing or suppressing issues detected during a scan, refer to Monitor and Manage Code Build Issues
Last updated
Was this helpful?