Monitor environments and scan jobs

Outcome

You will know where to watch every environment build and security scan you have started, how to read each state, and how to recognize a run that needs your action or has failed. There are two vantage points: the account-wide Jobs page (/jobs) and the per-repository tabs on Attack surface.

Who can do it

• Any signed-in user can open Jobs. The list is scoped to your account: runs you started, runs on repositories in a GitHub namespace you own, and runs on repositories an organization owner granted you.
• Repository pages require view access to that repository (customers see their own; members see granted repositories).
• Site admins see every run across the fleet.

Before you begin

• At least one environment build or hunt has been launched — see Prepare a repository environment and Run a security scan.

Steps

Watch everything from the Jobs page

1. Click Jobs in the top navigation. Runs are grouped by state — Running, Confirmed, Needs Review, Inconclusive, Failed, Stopped — with stat tiles (Running, Confirmed · today, Findings · YTD, Worst CVSS · 30d) at the top.

2. Narrow the list with the search box (“Search by run, env, CVE, or CWE…”), the status chips (Active, All, Running, Confirmed, Needs Review, Inconclusive, Failed), and the kind filter next to the search box, which separates hunts from harness build jobs.
3. Hover a row and click Open to drill into the run. The hover actions also offer Archive and Delete for runs you own.

Read a live hunt

1. A running hunt's page shows the amber banner “run in progress — live feed below polls every 1.5s” and a live strip with the current phase, duration, tokens, and findings so far.

2. Phase pills track progress: phase 1 · discovery, phase 2 · validate, phase 3 · impact — and, when remediation stages run later, defend · patch eval/gen and revalidate · ground truth.

Read a harness build job

1. Opening a build job shows a violet banner pointing you to the build pipeline — Open plan view → (or Continue planning → when the build is waiting for your input). The pipeline page tracks Recon → Plan review → Harness build → Result.

Watch one repository

1. Open the repository from Attack surface. The Build jobs tab lists every harness build (columns: Job, Env, Ref, Status, Sessions, Outputs), and the Environments & hunts tab shows each environment with its hunts and their statuses.
2. On the Attack surface landing page, the Needs your decision panel aggregates everything waiting on you — paused build plans (Review & approve plan), findings to review, and pull-request states.

State reference

• Build jobs: running → action required (paused at plan review) → ready, or failed / cancelled (a reason is shown on the row when the build records one).
• Environments: building → ready; failed when the build could not produce a runnable harness.
• Hunts: queued / running (with phase pills) → confirmed, needs review, no_findings, unconfirmed, or failed / incomplete / stopped.

Verify

• Your most recent launch appears in the correct Jobs group, and its status matches what the repository page shows for the same run.
• For a live run, the run page's live feed timestamp advances and the phase pill changes as stages complete.
• A finished build appears as an environment with the ready badge on its repository's Environments & hunts tab.

Troubleshooting

A run you expected is missing from Jobs

The Jobs list only shows runs tied to your account — your own launches, your owned namespace, or repositories granted to you. If a teammate launched the run on a repository you have no grant for, ask the organization owner for access (Assign repository access and roles).

A build sits in “action required”

It is paused at the plan-review gate and will never proceed on its own. Open it and click Review & approve plan (also offered in the Needs your decision panel), then Approve & build on the plan page. Hunts can't run until the harness is built.

A build failed

The Build jobs row shows failed plus a short reason.

Read the reason, open the job for the build console, correct the cause (bad ref, inaccessible repository, unbuildable revision), and start a new scan — see the troubleshooting section of Prepare a repository environment.

A run shows “running” but nothing is happening

Check the run page: if the live feed has produced no new events for a long time, the run may have lost its worker. Relaunch it; if the same run wedges repeatedly, see Troubleshooting.

Archive or Delete is refused with “refused: job still active”

Runs cannot be archived or deleted while still active. Wait for the run to finish (or fail), then retry. Archiving is reversible; delete is permanent and asks you to type the job id to confirm.

An environment name link asks you to log in or returns “not found”

Environment detail pages are currently operator-only. Use the repository's Environments & hunts tab and the Jobs page for everything — status, hunts, findings, and outputs are all reachable there.

Next steps

Automate the cadence so there is always something fresh to monitor: Schedule recurring scans. When a hunt lands findings, continue with Understand findings.