syntaqxA pull request has one Dependency review comment, changed in place, and the review can be run again on demand. Every head move posted the review's summary as a new comment, so catching flagon-io/g1t#39 up with main left a second, identical one beside the first. The security service now finds g1t's own comment on the pull request (written by g1t, starting with the review's heading, so pull requests from before this are found too) and edits it through work's edit_comment when the review says something new, leaves it alone when it says the same, and adds one only for a review with dependency changes to show and none there yet. A head whose lockfile changes are the ones already reviewed is not reviewed again: the review row keeps a key of each lockfile's added and removed lines (not where they sit, which moves when the base is merged in) and the policy, and a push with the same key, such as g1t's catch-up merge commit, takes the earlier result as it is, setting the same status on the new head with no OSV query and no comment. A comparison that is truncated or leaves a lockfile's lines out has no key and is reviewed. Since advisories are published every day, the review can be made again: rerun_dependency_review (security RPC; API POST /repos/{owner}/{name}/pulls/{number}/dependency-review/rerun, MCP security rerun_dependency_review, security:write, the Write role, on an open pull request) reviews the head again, sets the status and changes the same comment; the pull request's checks show Re-run dependency review beside g1t's Dependency review status, and the Security checks page has Re-run. The supply chain guide and the MCP reference say so; the OpenAPI document, its example and the CLI's operation table are regenerated.8e64619History
