CEFENSE
Get startedSign in

GitHub

Installing the GitHub App, choosing repositories, and getting organisation approval.

5 sections2 min read

GitHub is connected through a GitHub App. You choose which repositories it can see, and you can change that choice at any time from GitHub itself.

Install the app

  1. 1
    Open the repositories page

    Go to cefense.com/app and choose GitHub. If you are in a terminal, cf repo connect will offer to open the same page for you.

  2. 2
    Authorise Cefense

    GitHub asks you to sign in and authorise the app. This is the account-level connection: it lets Cefense list repositories, and nothing more.

  3. 3
    Choose repositories

    Install the app on all repositories, or pick a specific list. Picking a list is the safer default, and you can add more later without reinstalling.

  4. 4
    Connect one

    Back in Cefense, the repositories the app can see are listed. Connecting one queues its first scan.

From the terminal, once the app is installedbash
cf repo connect
cf repo connect acme/api
cf repo list

Organisation approval

For a repository owned by an organisation, GitHub may require an owner to approve the installation. If you are not an owner, the install turns into a request and stays pending until someone approves it. Until then the repository will not appear in the list.

Changing which repositories are covered

Repository access lives on GitHub, not in Cefense. Change it under your GitHub settings, in the installed applications section, and the new list appears in Cefense on the next look.

Scanning on push

A repository set to scan on push is scanned when a commit lands on its default branch. That is delivered by the app, so nothing needs to be configured in your repository and no workflow file is required. See Scan triggers.

Troubleshooting

cf repo connect says the repository is not available

The GitHub App was never granted access to it. Add it from the app's configuration on GitHub, then run the command again.

The connection expired

Reconnect from the workspace repositories page. The CLI will tell you when this is the problem rather than failing generically.

A pull request was not opened

Check that the app still has write access to that repository, and that the fix reached ready rather than failed. cf fix show <finding-id> says which.

Findings point at a branch I did not expect

Scans run against the default branch as GitHub has it. If you changed the default branch recently, the next scan follows the new one.

Have a correction or need help?

Email the docs team