Triage from GitHub
Anyone with write access to a repository can triage the issues Dam Secure raises on a pull request by replying to its inline comments on GitHub. No Dam Secure account is needed. The triage is recorded against the GitHub account that replied, and the pull request's check updates to match.
Commands
Reply to a Dam Secure inline comment with one of:
| Reply | Result |
|---|---|
/fixed | Marks the sub-issue Fixed |
/ack | Marks the sub-issue Confirmed |
/dismiss [reason] | Dismisses the sub-issue, with an optional reason |
Dismissals work the same way as in the app, and are remembered across rescans. If a command can't be applied, Dam Secure replies with the reason.
Enable it
While Block PRs with findings is on, triage from PR replies is always on. A developer must be able to clear a block without a Dam Secure account, so Dam Secure posts a comment to reply to on every blocking issue, whatever your comment settings (see Clearing a blocked pull request). Settings → Repos → Triage from PR replies shows as on and can't be turned off until blocking is off.
While blocking is off, it is optional. An organisation admin can turn it on or off in Settings → Repos → Triage from PR replies. It then needs:
- Post PR comments with findings turned on.
- A Comment format that includes inline comments.
Settings lists these under the toggle and shows any changes needed before saving.
Replying never bypasses permissions: only people with write access to the repository can triage, whether or not blocking is on.
Clearing a blocked pull request
If Block PRs with findings is on, Dam Secure posts an inline comment for each blocking sub-issue, on its line, or on its file when the line is outside the diff hunks, up to 50 at a time, whatever the inline comment settings. As you triage them, the next blocking sub-issues get theirs. Reply to each one to clear the block.
A blocking sub-issue that has no comment yet keeps blocking until it is triaged, and the check summary says so. That happens while 50 others are waiting for triage, or when posting failed; Dam Secure retries a failed post. Triage it in the Dam Secure app.
A sub-issue with no file and line to comment on can't be triaged from GitHub, so it doesn't block the pull request. The check summary lists it as Not blocking; review it in the Dam Secure app.
Limits
- Inline comments are posted on their line, or on their file when the line is outside the diff hunks. Blocking sub-issues each get a comment, up to 50 at a time. Other sub-issues get comments only while the pull request has fewer than 20. Triage the rest in the Dam Secure app.
- Edited replies are not reprocessed.