How to require security review before merging

BattleTest posts findings as a PR comment and sets a commit status check, but does not block merges by default. To make the security review a required gate:

​

Add the required status check in GitHub

After this, a PR is blocked from merging when:

• the review hasn’t completed yet, or
• the review encountered an internal error (failure), or
• the review completed with a risk score of 40 or higher — the “request changes” verdict (action_required).

PRs whose risk score is below 40 (clean, or only a low-severity / likely false-positive finding) pass as success and merge normally. This means requiring the check gates the PRs that warrant changes without blocking on trivial findings. See Risk score for what drives the score.

​

Adjust the blocking threshold

The check blocks at risk score 40 and above, matching the verdict shown in the PR comment. A configurable per-repo threshold (for example, block only on CRITICAL findings) is on the roadmap — contact wale@battletest.dev if you need a custom threshold today. If you want the review visible but never blocking, simply don’t add it as a required status check — the comment and check still appear on every PR.

​

Require review on all branches

By default, BattleTest only reviews PRs targeting your default branch. To require the check on feature branches:

​

Re-trigger a review that didn’t run

If a PR was opened before the GitHub App was installed, or if the webhook delivery failed, the review won’t have run. Re-trigger it by:

• Pushing any new commit to the PR branch, or
• Closing and reopening the PR