> For the complete documentation index, see [llms.txt](https://copilot-docs.bugbase.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://copilot-docs.bugbase.ai/enterprise/how-to-trigger-a-code-assessment.md).

# How to Trigger a Code Assessment

Connect GitHub repositories and run a Code Assessment.

Code Assessment reviews source available through the Pentest Copilot GitHub App. It does not include unpushed local changes.

## 1. Connect GitHub

Open **Settings -> Integrations -> GitHub** and install or connect the Pentest Copilot GitHub App.

During installation:

* choose the account or organization that owns the repositories;
* grant access to all repositories or the required selected repositories;
* return to Pentest Copilot and confirm the connection.

{% content-ref url="/pages/cSYGK9VOV5u61rz8tVT0" %}
[Configure GitHub for Code Assessment](/enterprise/how-to-trigger-a-code-assessment/configure-github-for-code-assessment.md)
{% endcontent-ref %}

## 2. Select Repositories and Targets

Open **Modules -> Code Assessment -> Run Assessment**.

Select one or more repositories. Each selected row has its own **Assessment target** dropdown:

* start typing to rank live branches, open pull requests, and recent commits;
* select the default branch when no special target is needed;
* enter an exact branch, tag, `#PR`, PR number, or commit SHA and press Enter when it is not in the suggestions.

If live GitHub targets cannot be loaded, exact target entry remains available.

<figure><img src="https://232193438-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FwolEZzMm5QD9NoFKutSj%2Fuploads%2Fgit-blob-5761660783e105af4b951be8692b10f480589c5f%2Frun-assessment-code-targets.jpg?alt=media" alt="Code Assessment repository target dropdown with live branches, pull requests, and commits"><figcaption><p>Assessment targets are selected per repository.</p></figcaption></figure>

{% hint style="warning" %}
The selected branch, PR, tag, or commit must exist in GitHub. Local unpushed changes are not scanned.
{% endhint %}

## 3. Configure Scan Settings

Choose the checks required for the run, including source-code paths, dependency risk, secrets, authorization/business logic, and AI inventory where available.

{% content-ref url="/pages/jCO3SrYhFV3I1FvxB9FK" %}
[Configure Scan Settings for Code Assessment](/enterprise/how-to-trigger-a-code-assessment/configure-scan-settings-for-code-assessment.md)
{% endcontent-ref %}

## 4. Configure Automation

Automation is saved per selected repository.

* **Allow manual and scheduled branch runs** permits runs started from this wizard and schedules.
* **Run on future pull requests** assesses the latest PR commit when supported GitHub events arrive.
* **Run on future push** assesses pushed commits that match the optional branch regular expressions.

You can run now, schedule a run, or save automation without starting a branch run.

## 5. Review and Submit

Confirm repositories, exact assessment targets, enabled checks, auto-fix behavior, and automation.

* **Start run** starts the selected branch/PR/commit assessment.
* **Schedule run** creates the configured schedule.
* **Save automation** stores repository event rules without starting a run.

## Monitor and Review

* **Activity -> Activity** shows pending, running, completed, failed, and cancelled runs.
* **Code Assessment -> Statistics** summarizes findings.
* **Code Assessment -> Attack Paths** contains validated findings and remediation.
* **Code Assessment -> SBOM** contains inventory verification and SPDX, CycloneDX, and AI-BOM exports.

## Common Blocks

| Problem                       | Check                                                                                   |
| ----------------------------- | --------------------------------------------------------------------------------------- |
| Repository is missing         | Confirm it is included in the GitHub App installation.                                  |
| Live targets cannot be loaded | Refresh the dropdown or enter the exact branch, tag, PR, or SHA.                        |
| PR scan did not run           | Confirm PR automation was saved before the event and the App can access the repository. |
| Push scan did not run         | Confirm push automation is enabled and the branch matches the configured regex.         |
| Auto-fix did not create a PR  | Confirm the finding is validated, fixable, and the repository uses Auto PR mode.        |