Turn on pull request scans
Lighthouse scans every pull request on GitHub and reports the result as a check.
A pull request scan reviews the changes in a pull request and reports the result on GitHub as a check named Lighthouse Security Scan. Nobody installs anything locally. Once a repository is in Lighthouse, its pull requests are scanned.
Requirements
- GitHub is connected, and the app can access the repository.
- The repository is added to Lighthouse.
With the default settings, every pull request is scanned when it opens and each time new commits are pushed.
What happens
- You open a pull request or push to one.
- The Lighthouse Security Scan check appears and shows as in progress.
- Lighthouse reviews the changes against the target branch.
- The check fails if a finding reaches the repository's blocking policy, and passes otherwise.
- If comments are on, Lighthouse posts a summary comment.
Each finding is also pinned to its line in GitHub's Files changed tab. In Lighthouse, the scan is listed under Scans (filter: Pull requests) and filed under the pull request's branch.
Settings
Open the repository and go to Settings › Scan policy › Pull request scans.
| Setting | Default | Effect |
|---|---|---|
| Scan automatically | On | Scan when a pull request opens or gets new commits. When off, a pull request is scanned only when someone re-runs the check. |
| Scan draft pull requests | Off | Also scan drafts. |
| Scan depth | Max | How thorough the scan is. See Scan depth. |
| Block a merge when there is | Critical | The severity that fails the check. See Blocking policy. |
| Pull requests with merge conflicts | Hold | Hold the scan, or scan anyway. See Merge conflicts. |
| Comment with findings | On | Post a summary comment on the pull request. |
| Archive branch when closed | On | Hide the branch in Lighthouse after the pull request is merged or closed. |
Make the check required
A failed check stops a merge only if GitHub requires it. To enforce your blocking policy on merges, add the Lighthouse check to your branch protection rules or rulesets as a required status check.
The check name includes the target branch, such as Lighthouse Security Scan (main). Pull requests into different branches get separate results.
Cost
Each pull request scan uses credits. Max uses more than Normal. If your team runs out, the check completes as neutral with an explanation and doesn't block the merge.