> For the complete documentation index, see [llms.txt](https://copilot-docs.bugbase.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://copilot-docs.bugbase.ai/enterprise/how-to-trigger-a-code-assessment.md).

# How to Trigger a Code Assessment

Code Assessment reviews source repositories connected through the Pentest Copilot GitHub App. It helps security and engineering teams find vulnerable code paths, risky dependencies, leaked secrets, authorization issues, business-logic weaknesses, and software/AI inventory gaps before code reaches production.

{% hint style="info" %}
Code Assessment scans code available in GitHub. It does not scan unpushed local changes on a developer workstation.
{% endhint %}

## Code Assessment Flow

1. Connect the GitHub App.
2. Select or connect repositories.
3. Configure repository scan settings.
4. Choose manual, scheduled, pull request, or push-triggered scans.
5. Review findings, fix pull requests, SBOM exports, and AI-BOM exports.

## 1. Connect the GitHub App

Open **Settings -> Integrations -> GitHub** or **Modules -> Code Assessment** and start the GitHub connection flow.

{% content-ref url="/pages/cSYGK9VOV5u61rz8tVT0" %}
[Configure GitHub for Code Assessment](/enterprise/how-to-trigger-a-code-assessment/configure-github-for-code-assessment.md)
{% endcontent-ref %}

During the GitHub installation:

* choose the GitHub organization or account that owns the repositories;
* grant access to all repositories or selected repositories;
* confirm the installation and return to Pentest Copilot.

If the GitHub App was already installed, confirm that the required repositories are included in the installation's repository access list.

{% hint style="info" %}
You only need to install the GitHub App from Pentest Copilot. No separate GitHub App setup is required.
{% endhint %}

## 2. Select Repositories

Open **Modules -> Code Assessment**.

The repository table shows GitHub repositories that Pentest Copilot can access. Select one or more repositories to include in the run.

The **Branch** column shows the repository's default branch. If you start a manual run without entering a branch or commit, Pentest Copilot scans that default branch.

You can also connect a repository to a domain from the GitHub integration screen. Domain-connected repositories allow external findings on that domain to be patched against the matching source repositories.

{% hint style="warning" %}
Manual runs use the code currently available in GitHub. If a developer has local changes that are not pushed, those changes are not included.
{% endhint %}

## 3. Configure Scan Settings

Click the settings icon for a repository to open **Scan settings**.

Use scan settings to decide:

* which checks should run;
* whether GitHub pull requests or pushes should trigger automatic scans;
* which branches push scans should watch;
* what should happen when Pentest Copilot confirms a finding that can be fixed automatically.

{% content-ref url="/pages/jCO3SrYhFV3I1FvxB9FK" %}
[Configure Scan Settings for Code Assessment](/enterprise/how-to-trigger-a-code-assessment/configure-scan-settings-for-code-assessment.md)
{% endcontent-ref %}

## 4. Run or Schedule the Assessment

After selecting repositories, click **Run Code Assessment**.

Before launch, review the selected repositories and choose a branch or commit if you want to scan something other than the default branch.

| Run type                              | What gets scanned                                                                                     |
| ------------------------------------- | ----------------------------------------------------------------------------------------------------- |
| **Manual run with no branch entered** | The repository default branch shown in the table.                                                     |
| **Manual run with a branch entered**  | The named branch in GitHub.                                                                           |
| **Manual run with a commit entered**  | That exact Git commit.                                                                                |
| **Scheduled run**                     | The saved run configuration at the time the schedule was created.                                     |
| **Pull request automation**           | The latest commit on the pull request.                                                                |
| **Push automation**                   | The commit that was pushed, if push scans are enabled and the branch matches the repository settings. |

Use **Schedule** when the same repositories should be assessed on a recurring cadence.

## 5. Monitor the Run

Open **Activity -> Activity** to follow the module status.

The Activity page shows whether the assessment is pending, running, completed, failed, cancelled, or scheduled. If a run fails, start here before judging coverage.

{% content-ref url="/pages/QJ9ahgjtOWQNnN87Ivzs" %}
[Activity](/enterprise/activity.md)
{% endcontent-ref %}

## 6. Review Results

After assessment completes:

* open **Modules -> Code Assessment -> Statistics** for aggregate severity, category, and trend views;
* open **Modules -> Code Assessment -> Attack Paths** for validated findings and remediation guidance;
* open a finding detail page to review evidence, AI reasoning, affected files, fix guidance, status, and retest controls;
* open **Modules -> Code Assessment -> SBOM** to review inventory verification and download SPDX, CycloneDX, and AI-BOM exports.

{% content-ref url="/pages/yIa5DS9u5uSEnjRhi5DZ" %}
[Analysing Scan Results](/enterprise/analysing-scan-results.md)
{% endcontent-ref %}

## Common Blocks

| Block                                | What to check                                                                                                                                              |
| ------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------- |
| GitHub App is not connected          | Open **Settings -> Integrations -> GitHub** and complete the GitHub App installation.                                                                      |
| Repository is missing                | Confirm the repository is included in the GitHub App installation's repository access list.                                                                |
| Unsure which branch was scanned      | Check whether the run used a manual branch or commit, the repository default branch, pull request automation, or push automation.                          |
| Pull request scan did not run        | Confirm **Scan every pull request** is enabled for that repository and that the pull request was opened, reopened, or updated after the setting was saved. |
| Push scan did not run                | Confirm **Scan pushes** is enabled and the pushed branch matches the branch filters. With no filter, only the default branch is scanned.                   |
| Auto-fix did not open a pull request | Confirm the finding is validated, fixable, and the repository is configured for **Auto PR**.                                                               |
| Inventory exports are unavailable    | Confirm the assessment completed far enough to build the inventory, then open **Modules -> Code Assessment -> SBOM**.                                      |