Webhooks Pipeline Integration

You can configure source control systems to notify OX using a webhook on relevant events. Webhooks can be set up once for each group or project.

This method is useful for customers managing many repositories or using UI-driven CI/CD.

Webhook settings control how OX interacts with your source control system to report scan statuses and trigger scans automatically.

These settings define whether OX sends status updates, such as scan started/finished, back to the platform, and which branch events trigger scans.

To set webhooks:

1. Go to the Applications page and select the applications in which you want to apply pipeline scan.

2. Click the Pipeline Settings icon at the top.

3. In the Webhooks section of the Pipelines dialog, perform webhook configuration by source control platform, as follows:

   • For GitLab Webhooks integration, enable GitLab Commit Status and Merge Request Notes Reporting.

• For GitHub App integration, enable GitHub Checks.

Note: Merge Queue support is currently available as an Early Availability capability. Merge Queue events inherit the Pull Request configuration. Any policies, checks, and blocking behavior configured for pull requests are automatically applied to Merge Queue runs. To enable this capability, contact OX Support.

• For Bitbucket App integration, enable Bitbucket Code Insights and Build Status Reporting.

Setting	Description
Checks	Enable to publish pipeline scan results in the source control platform's native code review interface, allowing reviewers to see the scan status directly from the pull request or merge request.
Post Scan Summary	Enable posting a summary of each pipeline scan as a comment on the pull request or merge request. The summary includes the source and target branches, scan ID, total issues, blocking issues, scan status, and a link to the scan results in OX.
Show Success	Enable to post a scan summary even when no issues are found. When disabled, OX posts summaries only when the scan identifies issues.

Example of the post scan summary in the source control system:

1. Define which branches and events to monitor. You can use default options (e.g., main, protected) or patterns like release-*.

Setting	Description	Recommendation
Branch Event Types to Scan	Specifies the types of branch events (Push, Pull Request) that trigger scans.	Choose Pull Request for protected/default branches. Customize for others as needed.
Branch Filters (Name Patterns)	Define naming patterns for branches to include in scan events. You can use wildcard (*) to include multiple branches with similar naming.	Use this to scan custom branch types, e.g., release-* or feature-*.

1. Select SAVE.