PR Gates

Block PRs that introduce new vulnerabilities. SAST + DAST + SCA + Secrets checks running before merge, with diff-aware logic so existing findings don't block.

Why diff-aware

A naive PR gate fails any PR with any finding above a threshold. That sounds reasonable until your repo has 50 pre-existing Medium findings — every PR now fails for things unrelated to it. Sectora's gate is diff-aware: it only fails on findings the PR introduced, not findings it inherited from main.

Baseline diff

Each gate compares the PR's scan to a baseline scan (default: latest scan on the target branch). A finding is "new" if its fingerprint doesn't appear in the baseline. Three outcomes:

  • new — exists in PR, not in baseline. Counts toward gate.
  • removed — in baseline, not in PR. The PR fixed it; surfaced in the comment as a win.
  • unchanged — in both. Not blocking.

GitHub Actions setup

# .github/workflows/sectora-pr-gate.yml
name: Sectora PR Gate
on:
  pull_request:
    branches: [main, develop]

permissions:
  contents: read
  pull-requests: write
  checks: write

jobs:
  gate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0   # required for diff baseline

      - name: Run Sectora PR gate
        uses: sectora/pr-gate-action@v1
        with:
          api-key: ${{ secrets.SECTORA_API_KEY }}
          scans: 'sast,sca,secrets'    # comma-list; add 'dast' if you have a staging URL
          fail-on:
            critical: 0
            high: 0
            medium: 5
          baseline: main

Branch protection wiring

For the gate to actually block merges, add it as a required check in branch protection:

  1. GitHub → Settings → Branches → Add rule
  2. Branch name pattern: main
  3. Check "Require status checks to pass before merging"
  4. Add "Sectora / gate" as required
  5. Save

Same idea works for GitLab merge request approval rules and Bitbucket merge checks.

PR comment

On every gate run, Sectora posts a comment summarizing:

  • New findings (with severity, file:line or URL, and verify-fix link)
  • Removed findings (PR-fix wins)
  • Overall gate status (pass/fail per check)
  • Verify-fix links — click to re-run the gate on the latest commit

The comment updates in-place on subsequent pushes — no spam.

Per-engine thresholds

Different engines have different signal-to-noise ratios. Recommended starting thresholds:

SAST:    critical=0, high=0, medium=5   (Sectora's FP filter is good)
DAST:    critical=0, high=0             (highest-signal but slow; gate Quick only)
SCA:     critical=0, high=0, kev_only=true (block KEV-listed only)
Secrets: any=0                          (zero tolerance for new secrets)

Bypass with reason

Sometimes a finding is unavoidable in the short term but the PR must merge. Bypass with a documented reason:

  1. PR description → add sectora-bypass: "reason explaining why"
  2. Bypass goes to the audit log + Slack #sec-reviews channel
  3. The bypassed finding still appears in the project, marked "PR-bypassed" — for follow-up

Bypass requires Admin or Security role; Members can request but not authorize.

GitLab + Bitbucket

Same logic, different YAML. Templates: .gitlab-ci.yml sample at github.com/sectora/templates; bitbucket-pipelines.yml sample at same location.

Performance

What's next