Skip to main content

PR Integration

squirex scan-pr scans only the metadata files changed in a pull request, filtering violations to lines present in the diff.

Command​

squirex scan-pr -d ./force-app --base main --sarif results.sarif

The --base flag specifies the target branch. SquireX runs git diff internally to determine changed files and line ranges.

Why Diff-Scoped?​

A full squirex scan on every commit produces noise from pre-existing violations in unchanged files. scan-pr surfaces only new violations introduced by the current branch — making PR annotations actionable and focused.

With GitHub Advanced Security​

Combined with the SARIF upload action, violations appear as inline PR annotations:

- name: Run PR Scan
  run: squirex scan-pr -d ./force-app --base ${{ github.base_ref }} --sarif results.sarif || true

- name: Upload SARIF
  uses: github/codeql-action/upload-sarif@v4
  with:
    sarif_file: results.sarif

See the full workflow →

With the GitHub App​

The SquireX - AI Agent Security GitHub App (install) scans pull requests without a workflow. It reports a check run named SquireX AI Agent Security and a PR comment headed SquireX AI Agent Security Scan Report.

:::caution Renamed check Before October 2026 the check run was called SquireX Agentforce Security. If a branch protection rule or ruleset requires the old name, update it to SquireX AI Agent Security, or pull requests will wait on a check that never reports. Existing PR comments with the old heading are updated in place. :::

Code-scanning alerts uploaded by the App keep the tool name SquireX Agentforce Capability Scanner, so alerts from earlier scans stay grouped with new ones.