Overview
Cysmiq can publish scan updates back to connected version control systems. These updates help developers see scan progress and final scan results from commits and pull requests. Use VCS Status & PR Decoration settings to control these updates at the workspace, organization, or repository level.Settings
The settings panel has four controls:
VCS status checks and PR decoration are enabled by default. The default blocking threshold is All severities, and the default comment option is All terminal results.
Where to configure settings
Owners and users with the relevant settings permission can configure VCS status behavior in these places:
Repository settings are available when the repository is enabled. If the repository itself is disabled, Cysmiq does not keep repository data up to date and does not publish provider statuses for that repository until scanning is re-enabled.
Inheritance
VCS status settings inherit from broader scopes until you set an override.
When a scope has its own setting, the UI shows it as an override. Use Reset overrides to return that scope to the inherited value.
The toggles, blocking threshold, and PR comment option all follow this inheritance model.
Provider behavior
Cysmiq uses the supported status mechanism for each connected provider.
The exact content of provider updates can change as scan reporting evolves. Use the settings page to control whether Cysmiq publishes those updates, not to configure the content of each provider message.
VCS status checks
Cysmiq can publish separate VCS status checks so scan execution, pull request assessment, and policy enforcement are visible independently. Provider UI names vary: GitHub groups check runs and commit statuses under status checks, GitLab shows commit statuses, and Bitbucket can show commit statuses as build statuses.
Assessment and policy statuses include an outcome summary. GitHub check runs can also show contributing pull request results and link to the relevant Cysmiq findings or scan view.
These statuses can have different outcomes on the same pull request. For example, the scan can complete while policy enforcement fails because a blocking policy violation exists. In the Cysmiq Scans view, the Result column summarizes related pull request, provider check, or scan outcomes. See Scan list view.
Security check blocking severity
Use Block security checks for findings at or above to decide which actionable finding severities block Cysmiq Scan and Cysmiq PR Assessment checks.
Actionable findings below the selected threshold appear as warnings and allow both checks to pass. Findings with an unknown severity remain blocking. Policy violations continue to use their configured policy enforcement and are not changed by this threshold.
PR comment visibility
When PR decoration is enabled, use Post PR comments for to choose which terminal pull request evaluations create comments.
Cysmiq waits for a terminal pull request evaluation before applying this setting. Turning off PR decoration disables comments regardless of the selected option.
What disabling affects
Disabling VCS status checks stops Cysmiq from publishing new status updates for the selected scope. If Cysmiq already created a provider status for an active scan, it may still publish a final close-out update so the provider view does not remain stuck in an in-progress state. Disabling PR decoration stops Cysmiq from publishing pull request decoration for scans in the selected scope. The repository Enable setting controls whether a repository scans at all. When a repository is disabled, Cysmiq blocks scanning and provider status publishing for that repository. Existing provider checks may remain unchanged until the repository is re-enabled and scanned again. These settings do not:- Disable repository scanning
- Delete existing scans, findings, or pull request comments
- Change vulnerability status or assignment
- Change VCS integration sync or repository access
- Hide scan results inside Cysmiq