> ## Documentation Index
> Fetch the complete documentation index at: https://semgrep-ee9d73d8-sci-webhook.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Enable Azure pull request comments

<Note>
  **YOUR DEPLOYMENT JOURNEY**

  * You have gained the necessary [resource access and permissions](/deployment/checklist) required for deployment.
  * You have [created a Semgrep account and organization](/deployment/create-account-and-orgs).
  * You have [connected your source code manager](/deployment/connect-scm).
  * Optionally, you have [set up SSO](/deployment/sso).
  * You have successfully added a [Semgrep job](/deployment/add-semgrep-to-ci) to your CI workflow with [diff-aware scanning](/deployment/customize-ci-jobs/#set-up-diff-aware-scans).
</Note>

Semgrep can create **pull request (PR) comments** in your Azure DevOps repository. These comments provide a description of the issue detected by Semgrep and may offer possible solutions. These comments are a means for security teams, or any team responsible for creating standards, to help their fellow developers write safe and standards-compliant code.

## Conditions for PR comment creation

PR comments appear for the following types of scans under these conditions:

| Type of scan                               | Product name               | Trigger condition                                                                                                                                                                                                                                                    | How to set up                                                                                                                                                                                                                                                                                                                                               |
| :----------------------------------------- | :------------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Static application security testing (SAST) | Semgrep Code               | A comment appears when Semgrep generates a finding for a rule included in a [remediation policy](/semgrep-appsec-platform/unified-policies/overview) configured to leave PR or MR comments. This lets you customize which findings generate comments for developers. | Complete the steps in the following sections:<br /> 1. [Confirm your Semgrep account's connection and access to your source code manager](#confirm-your-semgrep-accounts-connection).<br /><br /> 2. Configure pull request comments.                                                                                                                       |
| Software composition analysis (SCA)        | Semgrep Supply Chain (SSC) | A comment appears based on the conditions you explicitly set in a [remediation policy](/semgrep-appsec-platform/unified-policies/overview) or when Semgrep detects a [license violation](/semgrep-supply-chain/license-compliance).                                  | To receive Supply Chain comments, complete the steps in [Confirm account connection and access](#confirm-your-semgrep-accounts-connection) and [set up a policy](/semgrep-supply-chain/policies). <br /><br /> To receive license violation comments, [enable dependency search](/semgrep-supply-chain/dependency-search#enable-and-use-dependency-search). |
| Secrets                                    | Semgrep Secrets            | A comment appears when Semgrep generates a finding for a rule included in a [remediation policy](/semgrep-appsec-platform/unified-policies/overview) configured to leave PR or MR comments.                                                                          | Complete the steps in the following sections:<br /> 1. [Confirm your Semgrep account's connection and access to your source code manager](#confirm-your-semgrep-accounts-connection).<br /><br /> 2. Configure pull request comments.                                                                                                                       |

## Set up PR comments

<Steps>
  <Step title="Ensure that you meet the prerequisites">
    Semgrep currently supports repositories hosted by Azure DevOps Cloud.

    In addition to finishing the previous steps in your deployment journey, it is recommended to have completed a **full scan** on your **default branch** for the repository in which you want to receive comments.
  </Step>

  <Step title="Confirm your Semgrep account's connection">
    PR comments are enabled by default for users who have connected their Azure DevOps project to Semgrep AppSec Platform. Confirm that you have the correct connection and access:

    <Steps>
      <Step>
        In your Semgrep AppSec Platform account, click **Settings > Source code managers**.
      </Step>

      <Step>
        Check that an entry for your Azure DevOps project exists and is correct.
      </Step>
    </Steps>

    You can also allow developers to triage Semgrep findings without leaving Azure DevOps by responding to the PR comments authored by Semgrep. To turn this feature on, you must update your source code manager (SCM) connection to use a personal access token that meets the following requirements, because Semgrep requires webhooks for the triage through PR comments feature:

    * Has the role set to **Owner** or **Project Collection Admin**
    * Has the **Scopes** set to grant **Full access**.

    To update your connection between Semgrep and Azure DevOps:

    <Steps>
      <Step>
        Log in to Azure DevOps using an account assigned either the **Owner** or **Project Collection Administrator** role for your organization.
      </Step>

      <Step>
        [Create an access token](https://learn.microsoft.com/en-us/azure/devops/organizations/accounts/use-personal-access-tokens-to-authenticate?view=azure-devops\&tabs=Windows#create-a-pat). When selecting the **Scopes** for the token, ensure that you select **Full access**.
      </Step>

      <Step>
        Return to Semgrep and [<Icon icon="external-link" iconType="solid" /> sign in](https://semgrep.dev/login).
      </Step>

      <Step>
        Go to **<Icon icon="gear" iconType="solid" /> Settings > Source code managers**, and find your Azure DevOps connection.
      </Step>

      <Step>
        Click **Update access token**.
      </Step>

      <Step>
        In the **Update access token** dialog that appears, provide the token you created. Click **Update** to save and proceed.
      </Step>

      <Step>
        Toggle the **Incoming webhooks** setting on.
      </Step>
    </Steps>

    Once you have PR comments fully configured, you can update the token provided to Semgrep to a more restrictive one. The scopes you must assign to the token include:

    * `Project and Team (Read & write)`
    * `Pull Request Threads (Read & write)`
  </Step>

  <Step title="Set up the configuration file">
    The logic to determine whether Semgrep runs a full scan or a diff-aware scan on a pull request is defined in the `azure-pipelines.yaml` file.

    For PR comments and accurate diff-aware scan analysis to work, you must set two environment variables: `SEMGREP_PR_ID`, which identifies the pull request, and `SEMGREP_BASELINE_REF`, which defines the repository's default branch used as the comparison baseline, such as `main` or `master`. Specifying the default branch helps Semgrep understand the differences between the current branch and the main line of development and to generate meaningful results and PR comments.

    <Accordion title="Click to see a sample workflow file">
      ```bash theme={null}
      pool:
      vmImage: ubuntu-latest
      variables:
      - group: Semgrep_Variables

      steps:
      - checkout: self
      clean: true
      fetchDepth: 20
      persistCredentials: true
      # Replace master with the repository default branch if different.
      - script: |
          python -m pip install --upgrade pipx
          pipx install semgrep
          if [ $(Build.SourceBranchName) = "master" ]; then
              echo "Semgrep full scan"
              semgrep ci
          elif [ $(System.PullRequest.PullRequestId) -ge 0 ]; then
              echo "Semgrep diff scan"
              export SEMGREP_PR_ID=$(System.PullRequest.PullRequestId)
              export SEMGREP_BASELINE_REF='origin/master'
              git fetch origin master:origin/master
              semgrep ci
          fi
      env:
          SEMGREP_APP_TOKEN: $(SEMGREP_APP_TOKEN)
      ```
    </Accordion>
  </Step>

  <Step title="Configure pull request comments">
    Once you have set up the connection between Semgrep and Azure DevOps, you can [create a remediation policy](/semgrep-appsec-platform/unified-policies/get-started#create-a-remediation-policy) that lets you define the conditions under which Semgrep leaves a pull request comment. This customization enables you to:

    * Manage the amount of PR comments your developers receive.
    * Ensure that only rules that meet your criteria, such as high severity or high confidence rules, produce comments visible to developers, reducing noise.

    <Note>
      **Note**: If you are using **Azure Pipelines** to run Semgrep, set `SEMGREP_PR_ID` and `SEMGREP_BASELINE_REF` in your pipeline as described in [Set up the configuration file](#set-up-the-configuration-file).
    </Note>
  </Step>
</Steps>

## Optional features

### Customize PR comments

You can customize the comments Semgrep leaves on your PR. Custom comments allow you to direct your teams to the resources they need to handle the vulnerabilities Semgrep identifies in their code.

To provide custom PR comments:

<Steps>
  <Step>
    Sign in to [ Semgrep AppSec Platform](https://semgrep.dev/login?).
  </Step>

  <Step>
    Navigate to **Settings > General > Global**.
  </Step>

  <Step>
    Go to the **Custom PR/MR comments footers** section.
  </Step>

  <Step>
    Provide a custom comment for each Semgrep product whose findings you want to generate a PR comment. Semgrep supports HTML, Markdown, and plaintext links in your message.
  </Step>

  <Step>
    Click **Save changes**.
  </Step>
</Steps>

### Enable Rule-defined fix in Azure repositories

[Autofix](/writing-rules/rule-defined-fix) is a Semgrep feature in which rules contain suggested fixes to resolve findings.

To enable **Rule-defined fix** for all projects in your Semgrep AppSec Platform organization, follow these steps:

<Steps>
  <Step>
    In Semgrep AppSec Platform, go to **Settings > General > Code**.
  </Step>

  <Step>
    Click the **Autofix <Icon icon="toggle-large-on" iconType="solid" />** toggle to enable this feature.
  </Step>
</Steps>

## Next steps

You've finished setting up a core deployment of Semgrep 🎉.

* Explore recommended tasks after deployment in [<Icon icon="file-text" iconType="solid" /> Beyond core deployment](/deployment/beyond-core-deployment).

## Additional references

<CardGroup>
  <Card title="Why am I not receiving PR or MR comments?" icon="file-text" href="/kb/semgrep-appsec-platform/missing-pr-comments" horizontal />

  <Card title="Why did the comments on a PR or MR not appear inline?" icon="file-text" href="/kb/semgrep-appsec-platform/inline-pr-comments" horizontal />
</CardGroup>