Skip to content
AppArch AppArch Docs

GitHub

GitHub is connected with a personal access token (fine-grained or classic). There is no OAuth or GitHub App option, and nothing is registered on GitHub’s side beyond the token itself.

AppArch talks to api.github.com, so only github.com is supported. GitHub Enterprise Server is not.

Connecting

Section titled “Connecting”
  1. On GitHub, open Settings → Developer settings → Personal access tokens and create a token.
  2. In AppArch, open Credentials → Add credential → GitHub, paste the token and save. The organisation or user name is optional.
  3. Connect projects from the repositories the token can see.

Permissions

Section titled “Permissions”
  • Classic token: the repo scope. A classic token without repo is refused when you save it. AppArch reads the scopes and the expiry date from GitHub before storing the token.
  • Fine-grained token: read access to the repositories you want to audit. Fine-grained tokens report no scopes, so the connection test decides whether it works. For ArchPilot to post comments the token also needs Pull requests: Read and write.

What it enables

Section titled “What it enables”
  • ArchPilot comments on pull requests.
  • ArchScan / ArchSecurity results from CI runs appear in the panel.

A token cannot receive webhooks, so AppArch learns about pull request changes by polling rather than from instant events.

Expiry

Section titled “Expiry”

The expiry date GitHub reports is shown on the credential. An expired token stops working; create a new token and add it as a new credential.

CI

Section titled “CI”

Add the runner to GitHub Actions - see Add the runner to CI.