Docs

GitHub Integration

Connect GitHub for repository analysis, branch protection, and security scanning.

The GitHub integration serves two purposes: signing in (OAuth) and repository access (integration). These use different tokens and are configured separately.

#Understanding the Difference

Warning. This is the #1 source of confusion. Signing in with GitHub and connecting GitHub as an integration are two separate things. Signing in gives you a login session. Connecting GitHub gives Vergate access to your repositories.

#GitHub Sign-In (OAuth)

Clicking "Continue with GitHub" on the login page creates a login session via OAuth. This does NOT give Vergate access to your repositories. It only authenticates you.

#GitHub Integration (Repository Access)

Connecting GitHub from the Integrations page grants Vergate a separate access token with repository permissions. This token is used for security scanning — checking branch protection, secret scanning, Dependabot alerts, etc.

#Setting Up the Integration

  • 1

    Go to Integrations

    In your project dashboard, click Integrations in the sidebar.
  • 2

    Click Connect on GitHub

    Click the Connect button on the GitHub card.
  • 3

    Authorize the app

    GitHub will ask you to authorize Vergate. This grants repository access.
  • 4

    Verify the connection

    The card should show a green Connected status. Click Test Connection to verify.
    • Note. Vergate uses a single registered GitHub OAuth App per installation. When you authorize it, you're granting access to your repos — not creating a new OAuth App.

    #What It Scans

    Once connected, the security scan checks:

    Token validity — Is the access token still valid?
    Rate limits — How many API calls remain?
    Branch protection — Is the default branch protected?
    Secret scanning — Is GitHub secret scanning enabled?
    Dependabot — Are Dependabot alerts enabled?

    #Troubleshooting

    #"No access token found"

    This happens when a GitHub integration exists but holds no credentials — usually from connecting before the OAuth redirect completed. Remove the integration from the Integrations page and click Connect again, making sure you complete the GitHub authorization screen.

    #"redirect_uri is not associated with this application"

    The OAuth App's callback URL doesn't match. The integration callback URL is:

    {BACKEND_URL}/api/v1/github/callback

    (Sign-in uses a separate callback: {BACKEND_URL}/api/v1/auth/oauth/github/callback.) Check your BACKEND_URL env var and update the OAuth App settings in GitHub.

    #Connection shows "Unhealthy"

    The access token was revoked or expired. Remove the integration and reconnect it.