Developer feedback
Inspect current uncommitted and staged changes inside Visual Studio Code before they enter the review queue.
CI/CD code security
Move code review earlier—without hiding what is production-ready.
Developers can scan current Git changes in Visual Studio Code today. Teams can also trigger a full-repository analysis from GitHub Actions with pull-request and commit metadata. Native diff-scoped CI analysis, PR comments, GitHub checks, and merge gates are the next delivery stage.
How the workflow fits together
Code changes
Staged, unstaged, or PR event
Analysis
Local diff or CI full-repo beta
Dashboard report
Evidence and remediation
VS Code analyses current Git changes locally. The GitHub Action beta stores PR metadata and starts a full-repository managed analysis.
Capability status
| Workflow | Scope | Status | What teams get |
|---|---|---|---|
| VS Code: Scan Current Changes | Current Git diff, locally | Available | Fast local heuristic findings before commit |
| GitHub Action trigger | Full repository at the selected ref | Beta | Dashboard report tied to PR, base, head, and event metadata |
| Native PR review and policy gate | Changed files with baseline comparison | Planned | Checks, annotations, comments, severity policy, and merge decision |
Traceable CI runs
Use a bearer-authenticated GitHub Action endpoint that records repository, ref, commit, event, and pull-request context.
Controlled rollout
Pilot the existing full-repository CI trigger now, then enable diff scoping and merge policy only after the integration is complete.
What reaches the developer
The report carries evidence, affected flow, recommended change, and validation guidance. The example shows the output model; GitHub-native annotations and policy conclusions are part of the planned PR stage.
ILLUSTRATIVE OUTPUT
HIGHAUTHORIZATION · HIGH CONFIDENCE
Project lookup is not scoped to the authenticated organisation
A route queries a project by user-controlled ID without including the current organisation in the database predicate. An authenticated user could request another tenant's project if an identifier is discovered.
41 const project = await db.project.findUnique({
42 where: { id: params.projectId }
43 })
Recommended change
Scope the query by project ID and authenticated organisation ID, then return the same not-found response for inaccessible records.
Validation
Add a cross-tenant integration test and verify direct object requests cannot disclose record existence.
Pilot the workflow without overstating the gate
Start with local current-change checks and CI-triggered full analysis. Use the dashboard report as advisory feedback while the diff-scoped GitHub Check integration is completed.
- 01Connect
Configure the repository, approved event, and protected Action credential.
- 02Observe
Run analysis on selected PRs and compare findings with the team’s existing review process.
- 03Tune
Agree severity, confidence, ownership, baseline, and exception rules before enforcement.
- 04Enforce later
Enable a merge policy only after native checks and reliable diff scoping are live.