GitHub Peer Reviewer Assistant
Last updated: Oct 26, 2026
Available only for cloud-hosted GitHub repositories. GitHub Enterprise Server (on-premises) is not supported.
You connect GitHub one time for each organization, in the SCM connections screen. Then you select the groups that get their pull requests reviewed.
Role required: Organization Manager. On GitHub, you must be an owner of the organization that owns the repositories. On a personal account, you must be the owner of the account. If you are a member and not an owner, GitHub does not install the app: it emails your request to the owners of the organization, and the platform shows that it is waiting for their approval. The connection is not created until an owner approves it.
A GitHub account connects to one Fluid Attacks organization. Connect the account from the organization that owns the groups that you want to review.
Pull request review is available to groups with an active Essential or Advanced plan.
1. Open the SCM connections screen
- In your organization, go to Integrations.
- Open the SCM connections tab.
- Click Connect SCM.
2. Select the provider
The Choose your provider window opens. Click the GitHub card.
3. Examine the permissions of the app
The Prepare the connection window explains the Fluid Attacks GitHub App. The app asks GitHub for these permissions:
| Permission | Why the app needs it |
|---|---|
| Read access to code and metadata | To read the code that the assistant examines |
| Read and write access to checks and pull requests | To publish the check and the summary comment |
| Read access to repository and organization settings | The assistant does not use it. GitHub asks for it now so that the posture checks that come next do not ask you again |
Click Configure GitHub.
4. Install the Fluid Attacks GitHub App
GitHub shows its installation screen. Do these steps:
- Select the GitHub account or organization for the app.
- Select All repositories or Only select repositories.
- Click Install & Authorize.
A repository outside the installation sends no event. If the assistant does not review a repository, examine the installation of the app on GitHub first.
GitHub sends you back to the platform. A Connection established message confirms the installation.
A Connection refused message means that the platform cannot verify the installation. Install the app again.
5. Select the groups that get reviewed
The connection card has a Pull request review section. This section has one toggle for each group in the organization.
- Turn on the toggle of each group that you want to review.
- For each group, click Add repositories.
- Choose the repositories and select up to one branch for each one.
The window also asks for the exclusions and the Health Check of each repository. Refer to Add a new Git repository.
The assistant reviews each pull request of those repositories. The branch that the pull request targets does not change this.
The assistant does not review a group with its toggle off, and GitHub shows no result. Refer to Which pull requests the assistant reviews for all the conditions that a pull request must obey.
6. Verify that the connection operates
- Open or update a pull request in one of the repositories that you added.
- Make sure that the check Peer Reviewer Assistant reports on the commit.
- Make sure that a summary comment appears in the conversation.
The Checks tab shows the check below the Fluid Attacks Platform app:
Which pull requests the assistant reviews
The assistant reviews a pull request only when all these conditions are true. If one condition is false, GitHub shows no result.
| Condition | Where you set it |
|---|---|
| The repository is inside the installation of the app | On GitHub, when you install or edit the app |
| The group has pull request review on | Integrations, SCM connections, Pull request review |
| The repository is a Git root of that group | Scope section of the group |
| That root is Active | Scope section of the group |
| The group has an active Essential or Advanced plan | Group information |
The assistant reviews each pull request of a repository that you registered on the platform. The branch that the pull request targets does not change this.
An inactive root does not permit the review. If you deactivate a root, the assistant stops the review of the pull requests of that repository in that group.
The Scope section of the group lists the Git roots and their state:
Block the merges that disobey your policy
To make the check necessary, you must have admin access to the repository on GitHub.
The check alone does not block a merge. To block a merge, you must make the check necessary in GitHub:
- Open a pull request and let the Peer Reviewer Assistant check report one time. GitHub shows a check in the branch protection only after the check reports.
- In the protection rule or the ruleset of the target branch, select Peer Reviewer Assistant as a required status check.
- In a ruleset, attach the check to the Fluid Attacks Platform app. Thus no other app can report the check in its place.
GitHub explains the two mechanisms in its own documentation:
- Require status checks to pass before merging, for a ruleset.
- About protected branches, for a branch protection rule.
A necessary check also blocks the merge when the scan does not end. The Incomplete result reports a failure, because Fluid Attacks cannot tell you that the change is safe. Push a new commit, or ask for a re-run of the check.
Manage the connection
The connection card has these controls:
| Control | What it does |
|---|---|
| Status | Shows Connected or Suspended |
| Verify again | Examines the installation of the app again. If the app is not there, the platform removes the connection |
| Manage on GitHub | Opens the installation settings of the app on GitHub |
| Review permissions on GitHub | Appears when an administrator must approve new permissions. The permissions of the past continue to operate |
| Disconnect | Removes the Fluid Attacks app from the account |
If you rename the account on GitHub, the connection, its credential and Manage on GitHub change to the new name. If the card still shows the old name, click Verify again. The repositories that you added before the rename keep their old URL. Do not add them again with the new URL.
When an owner suspends the app on GitHub, the status is Suspended. The assistant does not review pull requests, and the platform does not turn on the review of a group. Reactivate the app on GitHub, then click Verify again.
The buttons are at the end of the card:
Disconnect removes the app from the account. The assistant stops the review of pull requests. The toggles of the groups go off. If you connect again, you must select the groups again. If GitHub cannot remove the app, the platform reports the failure and keeps the connection, so examine the status before you conclude that the connection is gone.
The repositories that you added through this connection use its credential to clone. After you disconnect, the platform can no longer clone them, and their next clone fails. Give those repositories another credential before you disconnect.
Related information
There are also guides to integrate with GitLab and Azure DevOps.
Peer Reviewer Assistant
What the Peer Reviewer Assistant does in a pull request: the review of the lines that the change adds, the summary comment, the status check, the severity threshold, the exclusions, the exceptions, and the record in the platform.
GitLab Peer Reviewer Assistant
Set up the Fluid Attacks Peer Reviewer Assistant for GitLab to get automated vulnerability scanning and comments on merge requests.