Why GitHub matters

GitHub is the main input for the platform. Without it you won’t get repository readiness scores, delivery metrics, or webhook-driven updates. Every workspace needs at least one GitHub App installation.

Once connected, the platform can list repos your app can see, queue readiness scans, and pick up PR and review activity.

Who can install the app

You need to be a GitHub org owner, or have permission to install apps on the org. Linking the install in the platform requires a workspace admin. If that’s not you, send this page to whoever administers GitHub and ask them to run the install. You’ll see the connection turn green when they’re done.

Connect during onboarding

Most teams use Connect GitHub (read-only) (the primary path):

1. Open the Integrations step in onboarding.
2. Click Connect GitHub (or Continue if setup is already in progress).
3. In the dialog, review the Permissions at connect panel, then click Connect GitHub (read-only).
4. On GitHub, pick your company organization and which repos to grant (all repos or a subset).
5. Click Install.
6. You’ll land back in the platform with a confirmation showing the org and repository count.

Read access is enough for onboarding, readiness scans, and insights. Write access is not requested at install.

Already installed on GitHub?

If the AI Driven SDLC GitHub App is already installed on your organization, expand Already installed on GitHub? and click Use existing install, sign in to GitHub, and pick the organization from the list — no reinstall needed.

Connect later

Settings → Integrations → Connect next to GitHub. Same flow as above.

If you started install but didn’t finish, the GitHub card shows Continue until setup completes or expires.

Add a second organization to an already-connected workspace

A workspace can have more than one GitHub App installation. Use this when GitHub already shows Connected and you need another organization, not more repositories on the org that is already listed.

You must be a workspace admin. You also need permission to install apps on the new organization (or an owner of that org must approve the request). Access on the first org is not enough.

1. Open Settings → Integrations → Connect next to GitHub.
2. Confirm the dialog shows Connected and the existing organization under Granted repositories.
3. In the footer, click Install on GitHub.
4. On GitHub, pick the new organization, not the one already linked.
5. Grant All repositories or only the repos this workspace should ingest.
6. Click Install. You should land back in the platform with a second organization row under Granted repositories.

If the AI Driven SDLC GitHub App is already installed on the new org, click Already installed? Link organization instead, sign in to GitHub, and pick that org. No reinstall needed. You can link several orgs in one session, then click Done adding organizations.

If GitHub shows Pending, an owner of the new org must approve the app under GitHub → Settings → Applications → Pending requests. Then return to the dialog and click Check status, or run Install on GitHub again.

If the new org’s repos do not appear immediately, use Refresh in the Connect GitHub dialog.

One GitHub organization can be linked to only one workspace. If the new org is already connected elsewhere, disconnect it there first.

Change which repos are included

This adds or removes repositories on an organization that is already linked. To connect a different GitHub organization, use Add a second organization.

The app only sees repos you granted at install time. In the Connect GitHub dialog, use the search box under Granted repositories to find a repo by name or language. To add or remove repos:

1. In the Connect GitHub dialog, click Manage next to the organization (or on GitHub: that org → Settings → GitHub Apps). Manage · Needs approval is the same control: an owner can accept extra Insights permissions on that page as well as change repos.
2. Configure on the AI Driven SDLC Insights app.
3. Adjust repository access and save.

Changes usually show up in the platform within a few minutes. If the list is stale, click Refresh in the Connect GitHub dialog.

Eligible vs ineligible repos

The granted-repository list shows which repos are eligible for sync and readiness analysis. Ineligible repos are skipped (for example archived repos, repos beyond the workspace cap, or repos over the size limit). Repos with an unsupported stack warning may still analyze with limited coverage — that bucket is separate from hard ineligibility.

Use the summary counts and filter chips above the repo list to focus on a specific bucket instead of scrolling every row.

What we actually read

The Insights app is read-only. New installs see this full list on GitHub. Existing installs may show Manage · Needs approval when the app adds a permission.

Core is enough for scans, Agentic Foundation, and PR metrics. Optional is only for security and financial Insights. Finish optional setup per account in Insights metrics setup.

Permission	Level	When	Used for
Repository contents	Read	Core	Clone and analyze code (including .github/workflows) for readiness scans; release cadence
Pull requests	Read	Core	PR and review metrics
Metadata	Read	Core	Repository list and webhooks
Organization members	Read	Core	Contributor mapping (org installs)
Actions	Read	Optional	CI metrics, environment drift, Actions cache inventory
Dependabot alerts	Read	Optional	Dependabot backlog and vulnerability MTTR
Secret scanning alerts	Read	Optional	Secret scanning metrics
Deployments	Read	Optional	Environment drift
Organization Administration	Read	Optional	Actions billable minutes (org)
GitHub Copilot Business	Read	Optional	Copilot seat utilization (org; Copilot Business/Enterprise)

Scans download a tarball snapshot of each repo’s file tree, run the rubric against it, and discard the copy. Webhooks tell us about PRs, reviews, and CI events. We don’t keep a copy of your source code sitting in a database.

Communication is HTTPS end-to-end with the GitHub App’s signed credentials.

Insights metrics setup (optional)

Core connect is enough for scans and Agentic Foundation. Security and financial Insights metrics need extra work on each connected GitHub account.

Where to look in the dialog

1. Optional Insights metrics setup (yellow panel at the top): workspace summary of what is still missing, including per-account Dependabot and secret scanning status. No GitHub links. Use Check again here after you change something on GitHub.
2. Each row under Granted repositories: chips if that account still needs work (Permissions: needs approval, Code security: off, Copilot plan, Billing). Expand the row (chevron, or click a chip). Setup links apply to that account only.

Personal accounts get Code security settings. Copilot and Billing links appear on organizations only.

App permissions

When an optional permission from the table above is not granted yet, that row shows Manage · Needs approval. A GitHub organization owner (or the personal-account owner) accepts the request on that installation page. The same Insights app covers GitHub Actions CI: you do not install a second app. See GitHub Actions.

Code security products

Reading alert APIs is not enough. GitHub must have the products enabled.

Organizations: Settings → Advanced Security → Configurations (not Global settings). Apply the GitHub-recommended configuration, or a custom one with Dependabot alerts and Secret scanning, to the repos you care about. Private-repo secret scanning usually needs GitHub Secret Protection / Code Security licensing.

Personal accounts: Settings → Code security, then the same product toggles.

In the dialog: the yellow panel names each account with the long status (Not enabled, Partially enabled, Cannot read (permissions or plan), Unknown). The collapsed row uses a short chip (Code security: off, partial, can’t read, unknown). Expand that account and use Setup: Open Configurations (org) or Open Code security (personal). If the status is Cannot read, use Manage · Needs approval first, or check licensing. If it is Unknown, use Check again.

Plans (organizations only)

These are not App grants. The yellow panel names which orgs still need them. Expand that org and use Setup:

• Copilot Business or Enterprise: View Copilot setup guide. Purchase under Billing & Licensing, then Settings → Copilot → Access to assign seats (the Copilot sidebar item appears after the plan exists). Copilot seat utilization in SDLC Insights is still Coming soon; the dialog lists this so the Insights app can read seats when that metric ships.
• Enhanced billing: Open Billing & Licensing (Actions billable minutes).
• Secret Protection / Code Security (or legacy GHAS): private-repo secret scanning via Open Configurations.

If metrics stay empty

Symptom	Likely cause
Dependabot backlog / vuln MTTR empty	Dependabot alerts off on the org or repo, or Insights Dependabot permission not approved
Secret scanning empty	Secret scanning off, or the plan does not include it for private repos
Only some repos show data	Those repos were not granted to the App, or security features are off on the others

Write access for automated fixes

Automated fix PRs require a second GitHub App, AI Driven SDLC Automations, with write access so the platform can push a branch and open a pull request for you to review and merge. Nothing is merged automatically.

At connect you only install the AI Driven SDLC Insights app (read-only). When you are ready for automated fixes:

1. Open Integrations → Connect GitHub and find the organization row, or click Enable automated fixes on an issue in Agentic Foundation.
2. Install AI Driven SDLC Automations on that organization when GitHub prompts you (a GitHub organization owner may need to approve the install).
3. Return to the platform. Automated fixes show as enabled for that org. Click Fix it to queue a background job.

Disable automated fixes turns the feature off for this workspace only; it does not uninstall Automations from GitHub. Disconnect removes the org from the workspace and may uninstall both apps.

If your security team prefers read-only installs, you can use scans and the AI Resolution Hub without ever installing Automations.

If the connection breaks

Uninstalling the app or revoking access shows a warning in Settings → Integrations. Hit Reconnect and walk through install again.

Common issues

Don’t see my organization in the list: The account picker only shows orgs where the app is already installed. If your company org isn’t listed, use Install on GitHub instead: you’ll select the org on GitHub during install. GitHub org names sometimes differ slightly from your workspace name. If GitHub is already Connected and you need a different org, follow Add a second organization.

Setup incomplete or expired sign-in: If you closed the browser mid-install or the link expired, open Connect GitHub again. The dialog shows a recovery message with Install on GitHub again. If you completed GitHub sign-in but didn’t pick an org, click Continue on the GitHub card to return to the organization picker.

Repos missing after connect: Check the app is installed on the right org and that those repos were included in the access list (not just “selected repos” without the one you expect).

Status shows Error: The app was probably removed on GitHub. Reinstall from Integrations.

Waiting for admin approval: If your organization requires admin approval for new GitHub Apps, the card shows Pending until an org owner approves the request in GitHub → Settings → Applications → Pending requests.

No scan after a day: Scans queue automatically (~24h). You can also kick one off manually from Agentic Foundation.