PR protection for .NET dependency changes.
Install the Rorix GitHub App, select repositories, and get NuGet supply-chain checks directly on pull requests. Rorix scans the real dependency graph, evaluates policy, and updates one focused PR comment.
Install GitHub AppSelected repos become protected projects
GitHub owns repository selection. Rorix owns scan depth, policy, and remediation context.
Install the app
Start from Rorix, authorize the GitHub App, and select the repositories you want protected.
Rorix syncs projects
Selected repos become Rorix projects up to your plan limit. Overflow repos remain visible until capacity is available.
PRs get checked
Dependency file changes trigger base/head scans, policy evaluation, one Check Run, and one deduped PR comment.
Grade B · 42 packages · 1 new high advisory · policy failed
Rorix found new dependency risk
One comment is updated per PR. No duplicate bot noise on every push.
Built for NuGet-heavy teams
The app path uses the same scanner as the dashboard and CLI, but adds GitHub-native checks and comments.
.NET graph resolution
Scans .csproj, solution, central package management, packages.config, nuget.config, global.json, and deps.json inputs.
New risk detection
Highlights new critical and high advisories introduced by the pull request instead of burying teams in baseline noise.
Policy enforcement
Applies .rorix.yml from the head ref for severity, score, license, and typosquat gates.
CI fallback
Teams that need workflow-level control can still use the Rorix GitHub Action and SARIF upload path.
Use the app for product-native protection. Keep the Action for CI ownership.
The GitHub App is the recommended default: install once, select repos, and get checks without editing workflow files.
The GitHub Action remains useful when teams need custom runners, explicit SARIF upload, branch-specific gates, or workflow-level ownership of security jobs.