# Automated Commit Feedback

Sonatype Lifecycle provides policy violation information in your Source Control Management System. This lets developers find out about policy violations during the code development process.

The Automated Commit Feedback feature is enabled by default for all repository types: private, internal, and public.

This feature is configurable at the organization or application level and can either be inherited (default), enabled (default for the root organization), or disabled.

## Managing Policy Evaluation Reports and SCM Commits

### Azure DevOps

In Azure DevOps, a build status can be attached to a commit when an IQ Policy Evaluation highlights violations. This is visible on individual commits, and the commit history.

|     |
| --- |
|  |

### Bitbucket Cloud

A build status can be attached to commits when an IQ Policy Evaluation highlights violations. Clicking the alert icon in the Builds column of a pull request displays a modal containing the IQ Policy Evaluation summary.

### Bitbucket Server (on-prem)

The UI does not display this modal. Commit status will still indicate pass/fail, but detailed summary information is only available via the Bitbucket Server REST API.

### Accessing Automated Commit Feedback on Bitbucket Server

To retrieve the same commit feedback information on Bitbucket Server or Data Center, use the REST API endpoint

```
GET /rest/build-status/1.0/commits/{commitId}
```

The response includes the IQ Policy Evaluation state, the description summarizing policy violations, and a URL linking to the IQ report — equivalent to the modal data available in Bitbucket Cloud.

### GitHub

As a GitHub Status, an IQ Policy Evaluation check runs whenever a Pull Request is created or updated. Like other status checks, it can be configured to just provide feedback or even block a PR from being merged when it detects vulnerable components or policy violations. Each policy evaluation has a link to the full IQ Policy Evaluation via the **Details** link to the right of the components affected summary counts.

|     |
| --- |
|  |

The IQ Policy Evaluation report can also be accessed from a commit itself by clicking the status icon then clicking the **Details** link to the right of the IQ Policy Evaluation component summary on the checks popup.

|     |
| --- |
|  |

### GitLab

An IQ Policy Evaluation step can be added to the GitLab pipeline to provide feedback or even block Merge Requests when it detects vulnerable components or policy violations. When violations are detected, the 'IQ Policy Evaluation' will link to the full scan report on IQ Server.

|     |
| --- |
|  |

## Viewing the Full Policy Evaluation Report

Selecting the details link opens the Policy Evaluation report where the developer will see the current version used and other vulnerable and non-vulnerable versions of that component.

This gives developers the information they need to quickly remediate vulnerable components.