Skip to main content

​
Overview

The GitHub integration monitors repository security, branch protection, dependency updates and organization settings, so code security compliance tasks are satisfied with continuous evidence. Comp AI ships two GitHub integrations:
  • GitHub App (recommended) — you install the Comp AI GitHub App and pick which repositories to share. The App has fine-grained, read-only permissions.
  • GitHub — the original OAuth App integration. GitHub’s OAuth Apps have no read-only scope for private repositories, so this one requests the broad repo scope, which also grants write access.
Both run the same checks; only the way the token is obtained differs. Existing GitHub (OAuth) connections keep working, so switching to the App is optional.

​
Connect

​
GitHub App

  1. Go to Integrations and open GitHub App
  2. Click Connect and authorize the Comp AI app on GitHub
  3. If the App is not installed yet, GitHub shows the install screen — choose the organization and select the repositories to share
  4. GitHub returns you to Comp AI with the connection active

​
GitHub (OAuth)

  1. Go to Integrations and open GitHub
  2. Click Connect and authorize with a GitHub account that can see the repositories you want monitored (requested scopes: read:org, repo, read:user)
Self-hosting Comp AI? Both integrations need your own GitHub credentials — see Self-hosting OAuth.

​
Configuration Options

Open Settings on the integration and configure:
  • Repositories to monitor (required) — the checks run against this list. Values are owner/repo, optionally with branches: acme/api:main, or acme/api:main,release. Without a branch, main is assumed. Only repositories owned by a GitHub organization are listed — personal repositories are not.
  • Recent PR window (days) — default 180. How far back the branch protection check looks when deciding whether pull requests are recent.
  • Fail on open alerts at severity — default High or above. The Dependabot check fails when the repository has open alerts at or above this severity; alerts below it are informational.

​
Before any repository is selected

While the list is empty the message you get depends on which check you look at:
  • Branch Protection Enabled and 2FA Enforcement fail with No repositories configured
  • Code Scanning and Sanitized Inputs fail with No repositories selected
  • Dependabot Security Updates Enabled does not stop — with an empty list it falls back to every repository in every organization the connection can see, so it reports findings for repositories you never selected
Select at least one repository and all five checks run against that list only.

​
What Comp AI Collects

​
Code Security evidence

  • Branch Protection Enabled — the selected branches have protection rules configured
  • Code Scanning — CodeQL (default setup or a custom workflow) or a third-party SARIF uploader is configured
  • Sanitized Inputs — a supported input-validation library is in use (JS/TS, Python or PHP), including monorepo subdirectories
  • 2FA Enforcement — every member of the organizations that own the selected repositories has two-factor authentication enabled

​
Dependency Management evidence

  • Dependabot Security Updates Enabled — Dependabot security updates are enabled and open alerts stay under your severity threshold
Checks run daily and after you change settings, and each one maps to a compliance task that is completed automatically while the check passes.

​
Verify It Works

Checks run on their own, and the manual re-run lives on the task the check feeds — not on the integration page.
  1. Open the GitHub integration in Comp AI and find the Evidence tasks section
  2. Click Open on one of those tasks
  3. In the task’s App Automations card, click Run on a GitHub check
  4. The check expands to show the run and the passing or failing evidence it collected

​
Troubleshooting

Could not access repository "owner/repo" — the connection cannot see that repository. On the GitHub App, re-open the App’s installation on GitHub and add the repository to the selected list. On the OAuth integration, confirm the authorizing user has access to it, then reconnect. An organization’s repositories are missing from the picker — organizations that enforce SAML SSO are skipped until your GitHub session is authorized for them. Authorize the organization on GitHub, then reload the settings.

​
References