> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codethreat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Pull Request Integration

> Security scanning and feedback in your pull requests

CodeThreat integrates directly into your pull request workflow to provide security feedback before code is merged. Every PR triggers **deterministic scanning** (SAST, SCA, Secrets, IaC), **False Positive Elimination**, and **PR Review Agent** for complete security coverage.

## Pull Request Workflow

```mermaid theme={null}
sequenceDiagram
    participant Dev as Developer
    participant PR as Pull Request
    participant CT as CodeThreat
    participant DS as Deterministic Scan
    participant FP as FP Elimination
    participant PRR as PR Review Agent
    
    Dev->>PR: Create/Update PR
    PR->>CT: Webhook triggered
    CT->>DS: Scan changed files<br/>(SAST, SCA, Secrets, IaC)
    DS->>FP: SAST Results
    FP->>FP: Filter false positives
    CT->>PRR: Analyze PR changes
    FP->>PR: Post filtered violations
    PRR->>PR: Post security feedback
    PR->>Dev: Show results & comments
```

## Why PR Security Scanning?

<CardGroup cols={2}>
  <Card title="Shift Left" icon="arrow-left">
    Catch vulnerabilities during code review, not after deployment
  </Card>

  <Card title="Fast Feedback" icon="bolt">
    Get security insights in minutes, not days
  </Card>

  <Card title="Block Vulnerable Code" icon="shield-xmark">
    Prevent insecure code from reaching main branches
  </Card>

  <Card title="Developer-Friendly" icon="code">
    Security feedback in your existing workflow
  </Card>
</CardGroup>

## How It Works

<Steps>
  <Step title="PR Created">
    Developer creates or updates a pull request
  </Step>

  <Step title="Scan Triggered">
    CodeThreat automatically scans changed files with deterministic engines (SAST, SCA, Secrets, IaC)
  </Step>

  <Step title="Agentic Analysis">
    False Positive Elimination filters SAST results, PR Review Agent analyzes changes for security issues
  </Step>

  <Step title="Results Posted">
    * GitHub Check shows pass/fail
    * Summary comment with findings
    * Inline comments on vulnerable code
  </Step>

  <Step title="Developer Fixes">
    Developer addresses security feedback
  </Step>

  <Step title="Re-Scan">
    Updated PR is automatically re-scanned
  </Step>

  <Step title="Approval">
    Once checks pass, PR can be merged
  </Step>
</Steps>

## Enable PR Integration

[View PR Scanning setup →](/scanning/pr-scanning)

[Enable AI PR Reviews →](/ai/pr-reviews)

## What's Next?

<CardGroup cols={2}>
  <Card title="PR Scanning" icon="magnifying-glass" href="/scanning/pr-scanning">
    Set up PR security scanning
  </Card>

  <Card title="AI PR Reviews" icon="brain" href="/ai/pr-reviews">
    Enable intelligent AI analysis
  </Card>

  <Card title="Automated Scanning" icon="repeat" href="/scanning/automated-scanning">
    Configure automated triggers
  </Card>

  <Card title="GitHub Checks" icon="check" href="/pull-requests/github-checks">
    Understand PR status checks
  </Card>
</CardGroup>