Permissions
For ScanU comments in pull requests, grant these job permissions:
contents: readfor checkout.pull-requests: writeandissues: writeso the action can create/update a PR comment.
Typical workflow behavior
- pull_request: create run, poll status, publish summary comment, fail job if diffs found and
fail_on_diff=true. - push to main: run in
baseline-onlymode when you intentionally want to refresh baselines.