> ## Documentation Index
> Fetch the complete documentation index at: https://www.trycomp.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# GitHub

> Connect GitHub to automate code security evidence in Comp AI

## Overview

The GitHub integration monitors repository security, branch protection, dependency updates and organization settings, so code security compliance tasks are satisfied with continuous evidence.

Comp AI ships two GitHub integrations:

* **GitHub App** (recommended) — you install the Comp AI GitHub App and pick which repositories to share. The App has fine-grained, **read-only** permissions.
* **GitHub** — the original OAuth App integration. GitHub's OAuth Apps have no read-only scope for private repositories, so this one requests the broad `repo` scope, which also grants write access.

Both run the same checks; only the way the token is obtained differs. Existing GitHub (OAuth) connections keep working, so switching to the App is optional.

## Connect

### GitHub App

1. Go to **Integrations** and open **GitHub App**
2. Click **Connect** and authorize the Comp AI app on GitHub
3. If the App is not installed yet, GitHub shows the install screen — choose the organization and select the repositories to share
4. GitHub returns you to Comp AI with the connection active

### GitHub (OAuth)

1. Go to **Integrations** and open **GitHub**
2. Click **Connect** and authorize with a GitHub account that can see the repositories you want monitored (requested scopes: `read:org`, `repo`, `read:user`)

Self-hosting Comp AI? Both integrations need your own GitHub credentials — see [Self-hosting OAuth](/docs/integrations/oauth-setup).

## Configuration Options

Open **Settings** on the integration and configure:

* **Repositories to monitor** (required) — the checks run against this list. Values are `owner/repo`, optionally with branches: `acme/api:main`, or `acme/api:main,release`. Without a branch, `main` is assumed. Only repositories owned by a GitHub **organization** are listed — personal repositories are not.
* **Recent PR window (days)** — default `180`. How far back the branch protection check looks when deciding whether pull requests are recent.
* **Fail on open alerts at severity** — default `High or above`. The Dependabot check fails when the repository has open alerts at or above this severity; alerts below it are informational.

### Before any repository is selected

While the list is empty the message you get depends on which check you look at:

* **Branch Protection Enabled** and **2FA Enforcement** fail with **No repositories configured**
* **Code Scanning** and **Sanitized Inputs** fail with **No repositories selected**
* **Dependabot Security Updates Enabled** does not stop — with an empty list it falls back to every repository in every organization the connection can see, so it reports findings for repositories you never selected

Select at least one repository and all five checks run against that list only.

## What Comp AI Collects

### Code Security evidence

* **Branch Protection Enabled** — the selected branches have protection rules configured
* **Code Scanning** — CodeQL (default setup or a custom workflow) or a third-party SARIF uploader is configured
* **Sanitized Inputs** — a supported input-validation library is in use (JS/TS, Python or PHP), including monorepo subdirectories
* **2FA Enforcement** — every member of the organizations that own the selected repositories has two-factor authentication enabled

### Dependency Management evidence

* **Dependabot Security Updates Enabled** — Dependabot security updates are enabled and open alerts stay under your severity threshold

Checks run daily and after you change settings, and each one maps to a compliance task that is completed automatically while the check passes.

## Verify It Works

Checks run on their own, and the manual re-run lives on the task the check feeds — not on the integration page.

1. Open the GitHub integration in Comp AI and find the **Evidence tasks** section
2. Click **Open** on one of those tasks
3. In the task's **App Automations** card, click **Run** on a GitHub check
4. The check expands to show the run and the passing or failing evidence it collected

## Troubleshooting

**`Could not access repository "owner/repo"`** — the connection cannot see that repository. On the GitHub App, re-open the App's installation on GitHub and add the repository to the selected list. On the OAuth integration, confirm the authorizing user has access to it, then reconnect.

**An organization's repositories are missing from the picker** — organizations that enforce SAML SSO are skipped until your GitHub session is authorized for them. Authorize the organization on GitHub, then reload the settings.

## References

* GitHub REST API: [https://docs.github.com/en/rest](https://docs.github.com/en/rest)
* [Self-hosting OAuth](/docs/integrations/oauth-setup)