Pull request workflow

Shift-left context

Pull request feedback blocks a malicious package before it reaches CI, deployment, and runtime. This is the primary shift-left enforcement point for teams without the IDE extension.

Receive malicious package feedback in a pull request

When a pull request introduces or newly references a malicious package, the PR scan detects it and adds a comment. The comment presents the finding with the package name and version, the Malware ID linked to its OSV advisory, the CRITICAL severity, and the advisory summary, together with the required action to remove the package. The comment body is assembled from the finding data, so the exact wording follows the malicious package finding summary and description.

If the governing policy is configured to block, the pull request status is set to fail.