Triggers and policies
Control when Attest runs.
Each connected repository starts with QA disabled. An administrator can select Disabled, Manual commands, or Automatic and manual.
Automatic runs
Eligible non-draft PRs can run automatically. Closed or merged PRs and PRs labeled qa:hold or qa:skip are excluded. The default quiet period is 90 seconds; an instance setting or repository override can change it. A new commit resets the deadline and supersedes older work.
Manual runs
An authorized user can post a new PR conversation comment containing exactly:
@<app-slug>[bot] qa thisReplace the placeholder with the actual App slug. The normal authorization requires write, maintain or admin access. Manual commands may run on drafts and held PRs; skip requires an explicit repository exception. Disabled policy blocks both modes. Manual triggering bypasses the quiet period, not preview verification, authorization or browser safety checks.
A new commit invalidates older work. See results for how to interpret the tested SHA.

attest