Skip to Content
attest docs
Guides

Triggers and policies

Control when Attest runs.

Each connected repository starts with QA disabled. An administrator can select Disabled, Manual commands, or Automatic and manual.

Automatic runs

Eligible non-draft PRs can run automatically. Closed or merged PRs and PRs labeled qa:hold or qa:skip are excluded. The default quiet period is 90 seconds; an instance setting or repository override can change it. A new commit resets the deadline and supersedes older work.

Manual runs

An authorized user can post a new PR conversation comment containing exactly:

@<app-slug>[bot] qa this

Replace the placeholder with the actual App slug. The normal authorization requires write, maintain or admin access. Manual commands may run on drafts and held PRs; skip requires an explicit repository exception. Disabled policy blocks both modes. Manual triggering bypasses the quiet period, not preview verification, authorization or browser safety checks.

A new commit invalidates older work. See results for how to interpret the tested SHA.

On this page