VOOZH about

URL: https://docs.datadoghq.com/security/code_security/dev_tool_int/pull_request_comments/

⇱ Pull Request Comments

For AI agents: A markdown version of this page is available at https://docs.datadoghq.com/security/code_security/dev_tool_int/pull_request_comments.md. A documentation index is available at /llms.txt.
This product is not supported for your selected Datadog site. ().

Overview

Code Security posts comments directly on pull requests (PRs) in your source code management (SCM) system when vulnerabilities are detected on enabled repositories. This help you see and fix issues in context before merging code. The comments are diff-aware, meaning they only flag new issues introduced on lines modified in the PR.

There are two types of PR comments:

  • Inline comment: Flags an individual Code Security finding on specific lines of code and suggests a remediation (if available).

  • Summary comment: Combines all findings from Datadog into a single comment. This comment appears only if your PR contains issues requiring attention. After those findings are addressed, the comment is automatically edited to confirm that your PR is now clear.

You can configure PR comments at the organization or repository level in Repository Settings, with the following controls:

  • Enabling/disabling PR comments by scan type (SAST, static SCA, Secrets, IaC)
  • Setting severity thresholds for each scan type
  • Excluding findings from test files or dev/test dependencies
  • Filtering out findings identified as false positives by Bits AI

Learn more about PR comments across Datadog.

Note: PR comments are not PR checks. To set up checks, see PR Gates.

Prerequisites

  • You must have the Datadog source code integration for your provider enabled. PR comments are supported for GitHub, GitLab, and Azure DevOps repositories.
  • Your repositories must have the relevant Code Security product(s) enabled. To enable Code Security in-app, navigate to the Code Security Settings page.
PR comments are not supported for pull requests in public repositories, or on pull requests targeting a destination branch in a different repository from the source branch (that is, forked repositories trying to merge into the main repository).

Set up pull request comments

Follow the steps below based on your source code management provider.

If you are using Datadog-hosted scanning, enable the toggle for your desired scan type (for example, Static Code Analysis (SAST)) after completing the GitHub setup steps. If you are using GitHub Actions to run your scans, trigger the action on push for comments to appear once the GitHub setup is complete.

Connect your GitHub account(s) to Datadog

For setup instructions, read the Datadog GitHub source code integration documentation.

Create or update a GitHub App

If you already have a GitHub App connected to Datadog, update it. Otherwise, create a new GitHub App.

The permissions you grant to the GitHub App determine which GitHub integration features are available for setup.

Create and install a GitHub App

  1. In Datadog, navigate to Integrations > GitHub Applications > Add New GitHub Application.

  2. Fill out any required details, such as the GitHub organization name.

  3. Under Select Features, check the Code Security: Pull Request Review Comments box.

  4. Under Edit Permissions, verify that the Pull Requests permission is set to Read & Write.

  5. Click Create App in GitHub.

  6. Enter a name for your app, and submit it.

  7. Click Install GitHub App.

  8. Choose which repositories the app should be installed into, then click Install & Authorize.

Update an existing GitHub App

  1. In Datadog, navigate to Integrations > GitHub Applications, and search for the GitHub App you want to use for Code Security.

  2. On the Features tab, look at the Code Security: Pull Request Comments section to determine whether your GitHub App needs additional permissions. If so, click Update permissions in GitHub to edit the app settings.

  3. Under Repository permissions, set the Pull Requests access to Read and write.

  4. Under the Subscribe to events heading, check the Pull request box.

See the GitLab Source Code setup instructions to connect GitLab repositories to Datadog.

See the Azure source code setup instructions to connect Azure DevOps repositories to Datadog.

Configuration options

Before enabling PR comments, ensure that at least one Code Security scan capability is enabled in the repository. Even if PR comments are configured at the organization level, they are only added in repositories where a supported scan type (for example, SAST, SCA, or IaC) is active. Repositories without any enabled scan types will not receive PR comments.

PR comments can be configured at the organization level or at the repository level:

  • Organization level: Settings apply to all repositories in the organization that have at least one scan capability enabled.
  • Repository level: Settings override the organization defaults for the selected repository.

When configuring PR comments, you can:

  • Enable or disable comments for specific scan types (SAST, SCA, IaC).
  • Set minimum severity thresholds to control when comments appear.
  • Exclude comments for findings in test files or dev/test dependencies to avoid noise from low-priority issues.
  • Filter out findings identified as false positives by Bits AI.

Configure PR comments at the organization level

  1. In Datadog, navigate to Security > Code Security > Settings.
  2. In Repository Settings, click Global PR Comment Configuration.
  3. Configure the settings:
    • Enable PR comments for all scan types and severities: Enable this to apply PR comments across all types and severities.
    • Enable for Static Analysis (SAST): Toggle this option to enable PR comments for SAST. If enabled, specify a minimum severity threshold. Additionally, select Exclude PR comments if violations are detected in test files to prevent comments on issues found in test files. Select Filter out findings identified as false positives by Bits AI to exclude findings that Bits AI has identified as false positives.
    • Enable for Software Composition Analysis (SCA): Toggle this option to enable PR comments for SCA. If enabled, specify a minimum severity threshold. Additionally, select Exclude PR comments if violations are detected in test or dev dependencies to prevent comments on issues found in dependencies existing only in development or test environments.
    • Enable for Infrastructure-as-Code (IaC): Toggle this option to enable PR comments for IaC. If enabled, specify a minimum severity threshold.
  4. Click Save.

Configure PR comments at the repository level

  1. In Datadog, navigate to Security > Code Security > Settings.
  2. In Repository Settings, select a repository from the list.
  3. Configure the settings:
    • Enable PR comments for all scan types and severities: Enable this to apply PR comments across all types and severities.
    • Enable for Static Analysis (SAST): Toggle this option to enable PR comments for SAST. If enabled, specify a minimum severity threshold. Additionally, select Exclude PR comments if violations are detected in test files to prevent comments on issues found in test files. Select Filter out findings identified as false positives by Bits AI to exclude findings that Bits AI has identified as false positives.
    • Enable for Software Composition Analysis (SCA): Toggle this option to enable PR comments for SCA. If enabled, specify a minimum severity threshold. Additionally, select Exclude PR comments if violations are detected in test or dev dependencies to prevent comments on issues found in dependencies existing only in development or test environments.
    • Enable for Infrastructure-as-Code (IaC): Toggle this option to enable PR comments for IaC. If enabled, specify a minimum severity threshold.
    • Block all comments in this repository: Enable this to disable all comments for this repository, overriding global settings.
  4. Click Save Configuration.