Re-running PR scans

Every pull request is scanned automatically when it opens and on every push. The scanners — dependencies (fremforge/dep-scan), SAST (fremforge/sast), licenses (fremforge/license-scan), container image (fremforge/image-scan), and signature verification (fremforge/cosign-verify) — post their results as commit statuses on the PR, which your branch-protection rules gate on.

Occasionally a PR’s scan statuses can go stale — for example after a transient platform hiccup left a status un-posted. You don’t need to push an empty commit (and sit through a full CI build) just to re-run the ~1-minute scanners. Re-run them directly instead.

Re-run the scanners for a PR

curl -sS -X POST \
  -H "Authorization: Bearer <token with findings:write>" \
  https://frem.sh/api/v1/orgs/<org>/repos/<repo>/pulls/<number>/rescan

Scope: findings:write.
Re-runs the scanners against the pull request’s current head commit and re-posts the fremforge/* commit statuses. The scanners typically complete in seconds.
Idempotent — safe to call repeatedly; results de-dup on repo + commit + scanner. It does not start a new CI build.
Honours your org’s scan policy (a scanner set to off for the org/repo is not run) exactly like the automatic on-push scan.

Success

{
  "repo_full_name": "acme/api",
  "pr_number": 42,
  "head_sha": "a1b2c3d4…",
  "scanners_enqueued": 5
}

Other responses

Status	Meaning
`404`	Pull request not found.
`409`	Nothing was re-run — the `detail` explains why (central PR scanning is not enabled for the org, the org is not covered, or the head commit could not be resolved).
`503`	PR scanning is not available on this instance.

When to use it

A PR is blocked on a scan status that never posted or looks stale.
You changed your org or repo scan policy and want to re-evaluate an open PR against the new policy without pushing a commit.

For the automatic scan behaviour and per-scanner detail, see Dependency scanning, SAST, License scanning, Image scanning, and Signature verification. Full request/response schema is in the API reference.

SIEM forwarding OpenSSF Scorecard