01
Risk-aware triggers
Run on authentication, authorization, billing, tenant, upload, webhook, parser, networking, and release-branch changes.
Pull request security review
Catch security regressions while the author still remembers why the code changed.
Trigger a ZeroQuarry source review from GitHub Actions, focus the investigation on the diff and adjacent data flow, then route validated results into tickets or reviewable fix pull requests.
GitHub ActionsDelta-aware reviewNon-blocking to gated rollout
pull-request://focused-reviewprocessing
DIFF7 changed files
CONTEXTtenant billing path
BASELINElast completed scan
ZEROQUARRYChange-scoped security reviewInvestigate the code that moved while context is freshactive
CHECKreview complete
FINDING1 validated issue
PATCHproposal ready
one focused review consumes one security run
Capabilities
Making CI raise a useful security signal
The best PR security process flags consequential changes early, preserves the report outside ephemeral CI logs, and escalates only when the risk justifies deeper work.
02
Changed-code context
Use Git history to focus agents on the diff while allowing investigation into callers, sinks, and business boundaries around it.
03
Explicit scan notes
Tell ZeroQuarry what the change is meant to do, which boundary matters, and what failure would be consequential.
04
Adversarial review
Challenge critical or expensive claims before asking engineering to stop the line.
05
Progressive gating
Begin with visibility, then gate on the severity and confidence threshold your team has learned to operate.
06
Fix and retest
Open tickets or bot-created PRs, preserve CI controls, and verify the finding after merge.
How it runs
Trigger, investigate, validate, close
What happens between a pull request opening and its review being resolved.
Trigger
Dispatch a source scan with the repository URL, project identity, notes, and auto-delta enabled.
Investigate
Review changed files and follow nearby data flow into the product’s sensitive boundaries.
Validate
Confirm evidence and product context before the result becomes a merge or release decision.
Close
Route the fix, merge through normal controls, rescan, and record a verified retest.
Outcomes
Review that keeps pace with the pull requests
Faster feedback for authors, fewer gates people route around, and history that outlives CI logs.
Faster security feedback
Review a risky change before context is spread across later releases and unrelated refactors.
Fewer disruptive gates
Tune policy around validated findings instead of blocking on every model suggestion.
Persistent change history
Keep scans, findings, discussions, fixes, and retests with the product project instead of losing them in an individual CI run.
Evaluation FAQ
Questions about pull request scanning
Private repositories, duplicate triggers, and whether auto-fix branches should rescan.
Can ZeroQuarry scan private GitHub repositories?
Yes. Store a scoped Git credential in the account and reference its ID from the workflow. The generated workflow explains the setup.
What happens if the same scan is triggered twice?
Identical in-progress Git dispatches can be deduplicated, returning the existing scan so CI can follow it instead of starting duplicate work.
Should auto-fix branches trigger another scan?
Exclude the ZeroQuarryBot branch namespace from the scan trigger to avoid a feedback loop. The product and docs provide the branch filter.
Related workflows
Continuous security
Turn on review for one repository
Start non-blocking, learn the signal, then decide where to gate.