PR protection under launch validation.
The workflow scans dependency manifests, evaluates policy, and updates one focused PR comment. Public installation remains closed until the production App and webhook smoke test pass.
Request preview accessSelected repos become protected projects
GitHub owns repository selection. Rorix owns scan depth, policy, and remediation context.
Join the private preview
Public installation opens after the production App and webhook smoke test passes. Design partners are onboarded manually until then.
Rorix syncs projects
Selected repos become Rorix projects up to your plan limit. Overflow repos remain visible until capacity is available.
PRs get checked
Dependency file changes trigger base/head scans, policy evaluation, one Check Run, and one deduped PR comment.
Grade B · 42 packages · 1 new high advisory · policy failed
Rorix found new dependency risk
One comment is updated per PR. No duplicate bot noise on every push.
Built for NuGet and npm teams
The app path uses the same scanner as the dashboard and CLI, but adds GitHub-native checks and comments.
NuGet and npm discovery
Scans .NET project formats plus package.json, package-lock.json, and npm-shrinkwrap.json inputs.
New risk detection
Highlights new critical and high advisories introduced by the pull request instead of burying teams in baseline noise.
Policy enforcement
Applies .rorix.yml from the head ref for severity, score, license, and typosquat gates.
CI fallback
The public GitHub Action supports workflow-owned scans and explicit SARIF upload while the GitHub App remains in private preview.
Use the app for product-native protection. Keep the Action for CI ownership.
After public release, the GitHub App will be the recommended default: install once, select repos, and get checks without editing workflow files.
The GitHub Action will remain useful when teams need custom runners, explicit SARIF upload, branch-specific gates, or workflow-level ownership. Its public v1 tag is still a launch gate.