Connect GitHub

RevoSecure reads a repository's dependencies read-only: GitHub's dependency graph first, lockfiles when the dependency graph isn't available, and optionally Dependabot alerts. Each workspace uses its own GitHub App, so customers see your app's name when they install it.

1. Create your workspace's GitHub App (once)

Owners and admins, in Settings → Integrations → GitHub:

1. Under Create GitHub App, choose the app's name (customers see it; at most 34 characters) and its owner: an organisation you own (recommended, it outlives anyone's personal account) or your personal account.
2. Click Create on GitHub and confirm Create GitHub App on GitHub. The app asks only for read-only Metadata, Contents and Dependabot alerts permissions.
3. You come back to Settings with the card showing Ready.

Already have an app? Enter an existing app's details manually shows the URLs to set on it. Secrets are stored encrypted and never shown again.

2. Connect a customer

1. Open the customer's Code & apps and choose Connect GitHub → Install on GitHub.
2. Choose the customer's organisation and repositories, and install.
3. GitHub asks you to authorise RevoSecure. RevoSecure monitors the repositories you can access in that installation, so connect as an organisation owner to cover them all.

Every repository the connection can see is added and scanned within minutes.

Sending the link to the customer's GitHub admin

If you forward the installation link, the customer's admin first sees a page showing your verified email address and must approve it. Verify your own email first, or the link only works in your own signed-in browser. You get a notification when they approve.

New repositories

Repositories the organisation adds later aren't monitored until someone who can access them connects again (the same Connect GitHub flow). Repositories removed from the installation are switched off automatically.

Alternative: a fine-grained access token

Use this before your GitHub App is set up, or when a customer prefers a token.

1. In GitHub, Settings → Developer settings → Personal access tokens → Fine-grained tokens → Generate new token.
2. Resource owner: the customer's organisation (an owner may have to approve the request).
3. Repository access: all repositories, or only those to monitor.
4. Permissions: Contents: Read-only and Metadata: Read-only; optionally Dependabot alerts: Read-only. Nothing else.
5. In RevoSecure, Connect GitHub → Use a fine-grained access token instead, paste the token and enter the organisation.

The token is checked before it's saved, stored encrypted and never shown again.

When a connection needs attention

If a token expires, the app is uninstalled, or your workspace's GitHub App is replaced or removed, the connection shows Needs attention with the reason. Connect again.

Disconnect

Disconnect removes the connection's repositories, components and vulnerabilities from RevoSecure. It doesn't uninstall your GitHub App from the organisation: an organisation owner removes it in GitHub under Settings → GitHub Apps.