Pull request reviews

Inth posts the results of a scan as a review on the pull request. The review shows the risks that the pull request adds, so your team does not read old findings again on each change.

What the review shows

The first scan posts 1 summary review. Later scans edit that summary. A later scan posts a new review on the timeline only in these cases:

• The scan finds new risks. The new review lists only those findings and links to the summary.
• The pull request no longer adds risks. Inth approves the pull request and edits the summary.
• Inth approved the pull request before, and the scan finds risks. Inth posts a new summary.

Inth never asks for changes. It approves the pull request or leaves a comment.

The review shows a finding in full only when the pull request adds the risk or makes it worse. Risks that were in the changed files before the pull request do not show. The review gives their number and a link to the report.

A risk that the pull request adds can be outside the changed lines. The review lists it under Outside this diff.

When 1 problem shows up in more than 1 place, the review shows 1 item. The item lists the other places under it.

Some findings include a prompt under Fix with a coding agent. Paste the prompt into your AI agent to fix the finding.

Confirmed issues and review items

The review puts each finding in 1 of 2 groups:

• A confirmed issue is a risk that the cited code confirms. It shows a priority from Critical to Low.
• A review item is a possible risk that a person must check. It shows Needs review and its potential impact, from P0 to P3.

The check run passes when the scan shows no risks that the pull request adds. When the scan shows risks, the check is neutral. Findings do not fail the check. If the scan cannot finish, the check fails.

Fixed findings

Inth marks a finding fixed when its code changes and a scan no longer reports it. The fix can come from a later push to the same pull request or from another pull request that merges into the same base branch.

When Inth marks a finding fixed, it replies in the thread of the finding. The reply names the commit or pull request that fixed it. Inth resolves the thread when it marks every finding in the thread fixed. The summary review lists the fixed findings.

Inth marks a finding fixed only when the code it cited is gone. While that code stays, the thread stays open.

To dismiss a finding, see Comment commands.