Azure DevOps PR annotations is not showing for github adavanced security

Question

After enabling GitHub advanced security the analysis results are getting posted on Advanced security plane but no PR annotations are posted for Pull requests. Is any additional settings required in pipeline or settings ?

Answer 1

Hi ahd

Could you please follow the below steps to resolve this issue:

1. Ensure the workflow includes the pull request trigger:

      on:
        pull_request:
          branches:
            - main
   

   If this trigger is missing, GitHub won’t annotate PRs.
2. Go to your Repository -> Security -> Code scanning alerts -> Click on setup code scanning -> select codeql analysis. This ensures CodeQL runs whenever a PR is created.
3. Add the following permissions to your workflow, this allows CodeQL to post annotations on PRs.

      permissions:
        contents: read
        security-events: write
   

Hope this helps!

Please Let me know if you have any queries.