Scan Source

GitHub Integration

Scan enabled repositories available to the GitHub connection; review separate PR, conversation and GHCR coverage.

Connect GitHub View Setup Guide

Key Features

Repository targets discovered from the GitHub App installation or configured access token
Enabled repository branches and commit history, subject to scan limits
Pull request event checks when the GitHub App webhook is configured
Issue, PR conversation and wiki checks where permissions and content allow
Separate GHCR image source when package access is available

Requirements

1Permission to connect GitHub and grant access to the intended repositories
2Enabled repository scan targets in Cremit Platform
3Separate Issues read approval for private issue content, if needed
4Package read access and a supported token for private GHCR images, if needed

Step-by-step setup guide

Review the steps needed to configure this integration.

What does connecting GitHub cover?

A GitHub App installation can be granted all repositories or selected repositories. Cremit discovers the repositories available to that installation and scans only targets enabled in the scan source. A newly created repository is not proof of coverage: check the installation access, the auto-enable setting, its target status and its latest completed scan. A separate access-token connection can have a different repository scope.

The repository worker examines branch commits, with work and time limits. Large repositories can use a default-branch-only API path. Do not read “commit history” as a guarantee that every branch, file or earlier commit was inspected in one job. Review completed, incomplete, skipped and failed work for the specific target.

PRs, issues and other text have separate boundaries

With the GitHub App webhook configured, opened, updated and reopened pull requests can enter a separate PR check. This check reports findings; do not assume that every push was blocked. Scheduled conversation scanning can inspect PR descriptions, discussion, review comments and wikis when accessible. Private issue bodies and comments need Issues read permission; without it the issue stream may be skipped while other streams still run. Check stream-level access and scan results before calling the repository fully covered.

GHCR images need their own access

GitHub Packages container images use a companion scan source. Its discovery and private image access can require a user token with package-read permission in addition to the GitHub App installation. Check that image targets were actually discovered and scanned; connecting a code repository alone does not establish GHCR coverage. The image scanner reads supported image layers without running containers.

Connect and verify one repository

Choose the repositories when installing the GitHub App, then create or inspect the GitHub scan source in Cremit Platform. Enable the intended targets and verify the latest scan status. For a safe functional check, use a harmless nonworking fixture in a test repository, wait for the relevant scan or PR check, then review the finding and its source location. Do not use a real credential as a test. If an issue, wiki or package is in scope, verify that surface separately and check permission or skip results.

Investigate a finding

A source location and pattern match do not prove that a key is still valid or that its author owns the service. Review issuer status for supported types, available AWS or GCP access context, the current service owner and the affected workload. The owner replaces or revokes an exposed key at the issuer and reviews copies and activity; removing a commit or PR comment alone does not invalidate it.