Overview

Code Analysis can automatically flag violations in pull requests on GitHub. To configure the GitHub integration to include Code Analysis features, see the setup instructions.

During code reviews on GitHub, the integration checks for Static Analysis violations in pull requests for repos that have at least one ruleset applied. Violations are flagged with a review comment on the relevant line of code.

The comment includes the name, ID, severity, category, and description of the Static Analysis violation. Certain violations also include suggested changes that can be applied directly in the GitHub UI.

Set up Code Analysis for GitHub pull requests

Enable Code Analysis on Datadog

To use Datadog Code Analysis, add the appropriate configuration files to your repository, as described in the setup instructions.

Configure a GitHub App

To use Code Analysis on GitHub, you can do one of the following:

• Create a GitHub App in Datadog.
• Update an existing GitHub App, if you have already created one in Datadog.

The permissions you grant to the GitHub App determine which GitHub integration features are available for setup.

Create and install a GitHub App

1. In Datadog, navigate to Integrations > GitHub Applications > Add New GitHub Application.
2. Fill out any required details, such as the GitHub organization name.
3. Under Select Features, check the Code Analysis: Pull Request Review Comments box.
4. Under Edit Permissions, verify that the Pull Requests permission is set to Read & Write.
5. Click Create App in GitHub.
6. Enter a name for your app, and submit it.
7. Click Install GitHub App.
8. Choose which repositories the app should be installed into, then click Install & Authorize.

Update an existing GitHub App

1. In Datadog, navigate to Integrations > GitHub Applications, and search for the GitHub App you want to use for Code Analysis.

2. On the Features tab, look at the Code Analysis: Pull Request Comments section to determine whether your GitHub App needs additional permissions. If so, click Update permissions in GitHub to edit the app settings.
3. Under Repository permissions, set the Pull Requests access to Read and write.

4. Under the Subscribe to events heading, check the Pull request box.

Enable Code Analysis PR comments for your repositories

1. In Datadog, navigate to CI Settings > Code Analysis Settings.
2. Click the toggle switch next to a given repository to enable GitHub Comments. In the example below, comments are enabled for the demo-static-analysis-gates repository.

Note: If you are using GitHub Actions to run your scans, trigger the action on push in order for comments to appear.

Further Reading

Additional helpful documentation, links, and articles:

Learn about the GitHub integrationDOCUMENTATION Learn about Code AnalysisDOCUMENTATION