Code review
PR Review
Goosy reviews every pull request or merge request on a connected repository for security issues and bugs. It posts a summary comment and sets a goosy/scan commit status that you can require before merging. On GitHub, it also comments on the changed lines.
When a review runs
- Goosy reviews draft pull requests too.
- Pushes to a branch without a pull request don't start a review. To scan a whole branch, use Deep Scan.
- New commits cancel a running review. Goosy then reviews the newest commit.
- Goosy doesn't review its own fix commits.
PR scan is on by default for each repository in a project. Turn it off per repository on the project's Repositories page. To review only the first version of each pull request, turn off Re-scan on PR update in Settings.
What you see on the pull request
Summary comment
One comment titled Goosy Security Scan counts the findings by severity and lists each one with its file and line, CWE, an explanation, the affected code, and a suggested fix as a diff when one is generated. On later commits Goosy updates this comment in place, so the thread holds one summary instead of a copy per commit.
Inline comments
On GitHub, each review posts up to 10 inline comments on lines the pull request adds. Each comment shows the severity, the issue and a suggested fix when one is generated. Goosy posts each finding once, including across later commits. If a finding is a false positive, reply to the comment or resolve it, then dismiss it in Goosy so it stays hidden (see Finding states).
The goosy/scan commit status
While the review runs, the head commit shows a pending goosy/scan status ("Goosy is scanning this PR…"). The status then passes or fails. By default it fails when the review reports a high or critical finding. With Block merge on Critical findings turned on, any critical finding fails it.
goosy/scan a required status check in your GitHub branch protection rules, or require a passing pipeline in GitLab, so a pull request can't merge until the status passes.What gets reported
- Severity threshold. By default, the review comments on high and critical findings. Lower findings are still recorded in the dashboard. Change the threshold with Minimum severity to comment in Settings, or per repository.
- Correctness bugs. The review also flags logic bugs that the change introduces.
- Code quality. Quality notes go in a collapsed section. They never count toward the totals or fail the status.
- What's skipped. The review skips documentation, comment-only files and your exclude paths. It also skips test and generated files unless you turn off Suppress test & generated files.
Fixes
Suggested fixes appear in the summary comment as diffs. To work through a pull request's findings, open it from Open PRs in the dashboard. Each generated fix counts toward your plan's monthly AI fixes.
Goosy commits to a pull request branch when you apply a fix. Generate a fix for one finding, click Autofix, and confirm with Yes, apply. Or use Fix all findings & push to PR to fix them all at once. Auto-push is opt-in per repository. When it is on, Goosy pushes eligible fixes without a click. It re-scans its own patch before each push.
Finding states
Usage
Each reviewed commit uses one PR review from your plan's monthly allowance. Re-running the review on the same commit doesn't use another. When the allowance runs out, Goosy stops reviewing new pull requests until it resets or you upgrade. See Plans & usage.