Context
Sign off a branch, and let the scans do the rest
Certification exists so that "somebody read this" is a thing the product can hold, and so that a coverage figure means work that is genuinely outstanding rather than every branch that has ever existed.
What to do
-
Open any finding on the branch you reviewed. Certifying is done from a finding because that is where the repository, the branch and the commit are already in front of you, which is how a review stops being recorded against the wrong branch.
-
Scroll to the card at the foot of the page. Write what you read, what you checked for, and why you are satisfied. It is required, and twenty characters is the floor: somebody is going to rely on this without being able to ask you.
-
Set an expiry. It is required as well, because a review with no end date is a claim that nothing will ever change.
-
Save. The badge appears on every finding on that branch and on the Repositories page, and it turns amber the moment anybody pushes, whether or not the push produced a finding.
-
Leave the quiet branches alone. A completed scan signs off the branches it found nothing to read on, in its own words, marked as a machine's work. You do not need to click anything for those and you should not.
-
Check the coverage figure on the dashboard. It is a share of branches, so it moves when work is done rather than when a filter is changed.
Worth knowing
A certification hides nothing and is never a filter. If a certified branch starts producing criticals, every one of them is reported, next to a badge saying the review no longer covers what is there.
Other guides
Install the editor plugin on Windows
VS Code, Cursor, IntelliJ and Eclipse, from your own server rather than a marketplace.
ReadInstall the editor plugin on macOS or Linux
The same three files, with the paths and the package manager that platform uses.
ReadExclude one credential everywhere it appears
The same test key committed to nine repositories, set aside once.
Read