Analyze PR checks results

PR checks results

After you submit a pull request to fix vulnerabilities, PR Checks detects issues with a severity level that meets or exceeds your configured threshold and provides a report. Examine the report status and result to decide whether to merge the pull request.

You can change the default severity threshold either at the Integration level, or at the Project level.

Result status

Check the status of the PR Checks results in the integrated SCM to identify security issues that need to be addressed before merging a pull request.

The following status indicators can appear for your Snyk PR checks in the integrated SCM:

Result status	Description
Success/Passed	No issues were discovered and the manifest file was not changed.
Pending	The PR Checks are still running.
Failed/Issues found	Security issues were identified in the pull request. In this scenario, you need to manually set the result status to Passed.
Error	Out-of-sync package.json and package.lock files, failure to find or to read the manifest file.
Canceled	The test limit has been reached.

For false positive or false negative results, see Troubleshooting PR Checks.

Example: fix dependency issues with PR checks

Consider the following end-to-end scenario, including specific actions such as triggering a Fix PR and marking a Failed result as Passed. You can take these actions in relation to the information provided by the PR Checks. This example shows taking the steps for a GitHub integration as follows:

1. Trigger a fix for an individual dependency to remediate that version's vulnerabilities.

2. Open a Fix PR to open a pull request in GitHub.

3. Analyze PR Checks results and set status to merge the pull request.

Before you begin, check the Prerequisites for automated PR Checks to make sure you have Snyk configured and the role defined.

Trigger a fix for an individual dependency

1. Log in to the Snyk Web UI.

2. Navigate to Projects.

3. Expand the target containing your Project.

4. Click a Project name to open it and select package.json to check for open-source and licensing issues.

5. In the Issues tab, find the dependency or specific vulnerability and, if a fix is available, click the Upgrade to X.X.X button at the bottom of the card and select Fix this vulnerability. For example, the jsonwebtoken can be upgraded from version 0.4.0 to version 5.0.0, fixing a number of vulnerabilities.

Updating a dependency to remediate the Authentication Bypass issue and others found in version 5.0.0.

1. (Optional) Select Fix these vulnerabilities at the top of the page to fix all dependency vulnerabilities with one pull request.

Open a Fix PR

Confirm your selected issue and click Open a Fix PR to open a pull request in the GitHub integration.

Triggering a Fix PR for an individual issue in the dependencies project

Analyze PR checks result and set status

1. (Optional) Examine the pull request generated by Snyk Bot in the Conversation tab in GitHub.

2. Find the conversation card showing the PR Checks results. For this example, the result is set to Failed and is manually changed to Passed.

Issues that have previously been ignored via the Snyk Web UI in the associated Open Source or code analysis Project are not flagged in these checks. This reflects ignored issues across feature branch PRs.

PR Checks card in the Conversations tab, GitHub

1. Expand list of files that have been checked for this issue.

2. (Optional) Click View test page to examine the issue details. You can get a complete picture of the vulnerability by clicking Show more detail for technical security information and remediation options. To return to the main issue page, click Project.

Overview of PR Checks result

1. Mark as successful in SCM to change the result status and merge the pull request with failed security issues.

Marking PR Checks result as successful

Marking a vulnerability as successful does not ignore the issue but only allows the security checks for the PR to pass in this current branch. If the issue is not fixed, it shows up in future commits and PR Checks after you merge it with the target branch.

The issue is marked as Passed and shows up as Skipped in the PR Checks card in GitHub.

SCM integrations

GitLab

Snyk sets the status on a merge request's latest pipeline based on scan results and the project's CI/CD configuration for merged results, merge requests, and branch pipelines. This feature blocks merge requests with security issues when the "Pipelines must succeed" setting is enabled.

Troubleshooting PR checks

Troubleshooting PR Checks has more information on how to troubleshoot PR checks or how to restart them.