GitHub App: scans on push and pull request
The GitHub App scans a repository when code is pushed to its default branch or a pull request is opened or updated, and posts the result on the pull request as a check named DVSentry security scan. On GitHub this replaces a CI step. For GitLab and Bitbucket use push webhooks; for Azure Repos and Jenkins use CI pipelines.
While the App is not available, the page says "not configured".
Connect repositories (Admin)
Quick path: Repository Security → GitHub App.
- Choose Install the GitHub App and install it on GitHub for the repositories you want. GitHub sends you back and DVSentry links the installation to your organization (it checks your own GitHub authorization shows that installation).
- The page lists the repositories the installation can reach, read live from GitHub (up to 1,000). Pick one and choose Connect: DVSentry saves and connects it and shows its newest commit. It starts no scan, and push and pull request scans stay off until you turn them on in Settings. A connected repository offers Refresh commit in the picker and Scan now in its row.
Detailed path: Settings → Repository Automation: for each repository choose the installation, push and/or pull request scans, and the scanners. Recent GitHub events lists every delivery with its report and check result.
No token is needed: for each clone DVSentry mints a one-repository contents: read installation token, and a separate checks: write token posts the check. Neither is stored, and the scanners never see them.
What runs
- Pushes to the default branch and pull requests (opened, synchronized, reopened, ready for review) start an incremental scan of the head commit. Other branches and branch deletions are ignored. Merging a pull request is a push to the default branch, so it is scanned.
- Pull requests from forks are not scanned (recorded as skipped with the reason).
- Every scan runs as the member who linked the repository and keeps every safety limit, but App scans do not use the monthly scan quota (fair use). If that member leaves, events are skipped until another Admin relinks.
- Deliveries are queued every 15 seconds, at most 5 per pass, so a burst of pushes drains gradually.
The check
| Conclusion | When |
|---|---|
success | No policy violations |
failure | Your policies find violations in findings new since the repository's baseline for that environment (no baseline: every finding counts) |
neutral | No violations but some scanners did not finish, or the scan failed, timed out or assessed nothing |
cancelled | The scan was cancelled |
Up to 50 annotations name each finding's file, line, title, severity and rule. Finding descriptions are never sent to GitHub. Make the check required in your branch protection rules to block merges on failure.
Images from GitHub Container Registry
With the App's optional Packages: read permission, container image scans can pull from GHCR.
Trust model
Webhooks are verified with X-Hub-Signature-256 over the raw body before parsing; the organization comes from the installation id and the repository from GitHub's numeric id among that installation's links, never from a name in the payload. Deliveries are deduplicated by X-GitHub-Delivery; no clone happens in the webhook request. Uninstalling or suspending the App on GitHub revokes it in DVSentry.
The separate DVSentry Fix App for fix pull requests is described in Fixing findings.
Something missing or unclear? Tell us with Feedback in the app.