Connect GitHub

Install the CISAPP GitHub app, link repositories to applications, enable Dependabot and import its alerts into findings.

Access: organization administrator. Beta feature; the connector must be enabled on your platform.

Prerequisites

• Be an organization administrator in CISAPP.
• Be able to install a GitHub app on the target GitHub account or organization (organization owner, or owner of the personal account).
• If GitHub shows an approval request, a GitHub organization owner must approve it.

Install the app

1. Open My company → Connectors, then Connect on the GitHub card. A panel sums up the steps and the requested access; click Continue to GitHub.
2. On GitHub, choose the account or organization, then All repositories or a selection.
3. Authorize the app when GitHub asks: this proves your GitHub account can access the installation.
4. You return to the connector record in CISAPP with the repository list.

The installation link expires after 30 minutes and works once: if something fails, click Connect again.

Link repositories to applications

In the Repositories tab, use Link to an application to attach a repository to one of your organization’s applications; the Application column shows the link. Unlink removes the link without changing anything on GitHub. The repository then appears in the application’s Code and DevSecOps tab.

To add or remove repositories, use Manage on GitHub and change the selection: CISAPP is notified automatically. Synchronize forces an immediate update.

Enable Dependabot and import alerts

A repository’s Dependabot switch enables vulnerability alerts and automated security fixes on GitHub, and imports the repository’s open alerts into CISAPP findings. Turning it off stops automated fixes and the import: the repository’s findings are resolved (alerts stay enabled on GitHub).

• The Open alerts column of the Repositories tab shows alert counts by severity.
• The Alerts tab shows totals by severity, the Imported repositories and the last sync date; View findings opens the findings list filtered on GitHub Dependabot.
• An alert fixed or dismissed on GitHub is resolved automatically in CISAPP.

Existing installations must accept the new Dependabot alerts permission on GitHub (GitHub sends a request to the installation owner).

Common issues

Message	What to do
GitHub connector is not configured	The connector is not available on your platform yet: contact support.
GitHub installation could not be authorized	Expired link or GitHub account without access to the installation: restart with the right account.
Installation already linked to another organization	A GitHub installation can serve a single CISAPP organization.
No synchronized repository	Check the repository selection on GitHub, then Synchronize.
Last synchronization incomplete	The message lists the failing repositories: most often the Dependabot alerts permission was not accepted on GitHub.

Disconnect

Disconnect deletes the connection, synchronized repositories and their links, and resolves GitHub findings; applications are not changed. Uninstalling the app on GitHub has the same effect. Then uninstall the app from Manage on GitHub if you no longer use it.

Expected result

Selected repositories appear in CISAPP, are linked to the right applications, Dependabot is active where you asked for it and its alerts appear in findings.

See also: Configure connectors.