# Connect GitHub

Install the CISAPP GitHub app, link repositories to applications, enable Dependabot and import its alerts into findings.

> **Access:** organization administrator. **Beta** feature; the connector must be enabled on your platform.

## Prerequisites

- Be an organization administrator in CISAPP.
- Be able to install a GitHub app on the target GitHub account or organization (organization owner, or owner of the personal account).
- If GitHub shows an approval request, a GitHub organization owner must approve it.

## Install the app

1. Open **My company → Connectors**, then **Connect** on the GitHub card. A panel sums up the steps and the requested access; click **Continue to GitHub**.
2. On GitHub, choose the account or organization, then **All repositories** or a selection.
3. Authorize the app when GitHub asks: this proves your GitHub account can access the installation.
4. You return to the connector record in CISAPP with the repository list.

The installation link expires after 30 minutes and works once: if something fails, click **Connect** again.

## Link repositories to applications

In the **Repositories** tab, use **Link to an application** to attach a repository to one of your organization’s [applications](https://docs.cisapp.eu/en/registers/applications); the **Application** column shows the link. **Unlink** removes the link without changing anything on GitHub. The repository then appears in the application’s **Code and DevSecOps** tab.

To add or remove repositories, use **Manage on GitHub** and change the selection: CISAPP is notified automatically. **Synchronize** forces an immediate update.

## Enable Dependabot and import alerts

A repository’s **Dependabot** switch enables vulnerability alerts and automated security fixes on GitHub, **and** imports the repository’s open alerts into CISAPP findings. Turning it off stops automated fixes and the import: the repository’s findings are resolved (alerts stay enabled on GitHub).

- The **Open alerts** column of the **Repositories** tab shows alert counts by severity.
- The **Alerts** tab shows totals by severity, the **Imported repositories** and the last sync date; **View findings** opens the findings list filtered on GitHub Dependabot.
- An alert fixed or dismissed on GitHub is resolved automatically in CISAPP.

Existing installations must accept the new **Dependabot alerts** permission on GitHub (GitHub sends a request to the installation owner).

## Common issues

| Message | What to do |
| --- | --- |
| GitHub connector is not configured | The connector is not available on your platform yet: contact support. |
| GitHub installation could not be authorized | Expired link or GitHub account without access to the installation: restart with the right account. |
| Installation already linked to another organization | A GitHub installation can serve a single CISAPP organization. |
| No synchronized repository | Check the repository selection on GitHub, then **Synchronize**. |
| Last synchronization incomplete | The message lists the failing repositories: most often the Dependabot alerts permission was not accepted on GitHub. |

## Disconnect

**Disconnect** deletes the connection, synchronized repositories and their links, and resolves GitHub findings; applications are not changed. Uninstalling the app on GitHub has the same effect. Then uninstall the app from **Manage on GitHub** if you no longer use it.

## Expected result

Selected repositories appear in CISAPP, are linked to the right applications, Dependabot is active where you asked for it and its alerts appear in findings.

See also: [Configure connectors](https://docs.cisapp.eu/en/organization/connectors).