Connect GitHub with the Octopoda GitHub App

Install the Octopoda GitHub App to scan repositories from the web app and check pull requests, choose which repositories it can read, and see its permissions.

The Octopoda GitHub App lets Octopoda read the repositories you choose, so you can scan them from the web app and check their pull requests. You sign in to Octopoda with GitHub either way; the app is what gives Octopoda access to code. Scans from the CLI upload code directly and do not need it.

​

Install the app

1. Start from Octopoda

   In app.octopoda.dev, select Install the GitHub App on the Overview or Repositories page. You can also install it from github.com/apps/octopoda-security.

2. Pick the account and repositories

   On GitHub, choose your personal account or an organization, then All repositories or Only select repositories. Installing on an organization needs an organization owner, or an owner’s approval.

3. Return to Octopoda

   GitHub sends you back to Octopoda, which shows the connection and the default pull request checks: Scan every pull request on, failing at High and above. The repositories appear on the Repositories page.

​

Change which repositories Octopoda can read

On the Repositories page, select Choose repositories on GitHub. Repositories you add appear in Octopoda shortly after you save on GitHub.

If you remove a repository, or uninstall the app, the repository shows Access removed on GitHub. Its past results are kept, and Restore access takes you back to GitHub.

​

Who can connect an installation

The person who installed the app on GitHub connects it to their Octopoda account. If someone else installed it, Octopoda asks you to have them connect it. To share repositories with teammates, connect the installation to a team account and invite them. See Teams and roles.

​

Permissions

Permission	Access	What Octopoda uses it for
Contents	Read	Reading the code of the repositories you choose, for scans.
Metadata	Read	Listing repositories and branches.
Checks	Write	Creating the pull request check and setting its result.
Pull requests	Write	Reading pull request details and posting the summary comment.
Email addresses	Read	Your email address, for the notifications you choose.

The app also has read access to deployments and issues, which Octopoda does not use.

Octopoda reads code only with short-lived, read-only tokens limited to the repository being scanned. See How Octopoda handles your code.