Ctrlk
Book a demoOX Security
For the complete documentation index, see llms.txt. This page is also available as Markdown.

GitHub App

OX Security supports pipeline scanning using the GitHub App, which uses GitHub webhooks to trigger scans.

This approach does not require modifying CI/CD configurations or adding the OX CLI to pipeline jobs. Instead, OX listens for GitHub events and initiates scans automatically.

OX detects pull requests and push events directly from GitHub. Based on the event, OX identifies the modified files and performs a scan.

The scan runs outside your pipeline and reports results in the OX UI. No CLI or container is needed inside your GitHub workflow.

GitHub Merge Queue support

Note:

  • This capability is currently in Early Access (EA) and is not generally available. To request access, please contact OX technical support.

GitHub Merge Queue is a GitHub capability that validates pull requests in a temporary merge queue before they are merged into a protected branch. Instead of merging pull requests individually, GitHub creates a temporary combined branch and runs the required checks against that state.

OX can scan Merge Queue events when using GitHub App pipeline integration.

If you use a self-hosted GitHub App, configure the app to allow OX to receive Merge Queue events. Set the Merge queues repository permission to Read-only and subscribe to the Merge group event. For configuration instructions, see Self-hosted GitHub App.

Merge Queue scans use the same pipeline configuration that is defined for pull request events. No additional configuration is required in OX. Any policies, checks, and blocking behavior configured for pull requests are automatically applied to Merge Queue runs. If a blocking OX policy fails, GitHub prevents the queued changes from being merged until the issues are resolved.

After the capability is enabled, OX automatically analyzes Merge Queue runs and displays the results on the Pipeline Summary page.

Prerequisites

Required Configuration

OX initiates scans using webhook data from GitHub. You do not need to add variables or modify settings. You just need to make sure that webhooks are enabled.

Block pull request merges based on OX scan results

You can configure GitHub branch protection rules to prevent pull requests from being merged when OX detects issues that match your blocking policies.

When OX scans a pull request, it reports the scan result to GitHub as the ox-security/scan status check. If the scan finds blocking issues, the status check fails, and GitHub can prevent the merge.

To require OX scans before merging:

  1. In GitHub, open the repository and select Settings > Branches.

  1. Create a new branch protection rule or edit an existing rule for the target branch (for example, main).

  2. Under Protect matching branches, select Require status checks to pass before merging.

  3. (Optional) Select Require branches to be up to date before merging.

  4. In the required status checks list, add ox-security/scan.

  5. Save the rule.

After the rule is configured, pull requests cannot be merged until the ox-security/scan check completes successfully. If OX finds issues that match your blocking policies, the check fails and GitHub blocks the merge until the issues are resolved.

Note

The ox-security/scan status check appears after OX has processed pull requests for the repository.

Last updated