Pull request scanning
Automatic PR scans with Foo Guard Security GitHub Checks and policy enforcement.
Overview
Pull request scans analyze the head commit for supported agent configuration changes and publish the Foo Guard Security GitHub Check with a policy-driven pass or fail conclusion.
This is Foo Guard's native CI enforcement path for Team workspaces — no workflow file required.
What happens on a PR
1. Foo Guard receives a pull request webhook (opened, synchronize, or reopened) 2. The head commit is scanned for .fooguard.yml and supported agent configuration files 3. Deterministic security rules evaluate the configuration 4. Organization and repository policy are applied 5. An Foo Guard Security check is published with success or failure
When policy fails, the check shows Failed. Configure branch protection to block merges.
Check output
The check summary includes grade, score, policy status, effective thresholds, top findings, and a link to the full scan in Foo Guard.
See GitHub Checks for conclusion details and example output.
Fork pull requests
Fork pull requests whose head repository is outside the installation scope are skipped because installation tokens cannot safely access fork-owned content.
Pro / CLI alternative
Pro and Team API key holders can add a GitHub Action workflow for PR enforcement without the Team GitHub App.