Connect GitHub
A read-only GitHub App lets Averil see your repositories, owners, alerts and settings, and read code when an investigation needs it.
What Averil uses it for
- Finding who owns each repository from CODEOWNERS and team membership.
- Checking two-factor, branch protection, secret scanning and push protection.
- Working your Dependabot, secret scanning and code scanning alerts.
- Scanning the added lines of each push for secrets.
- Reading a file or recent commits when an investigation asks.
- Watching for repositories made public, branch protection turned off and new OAuth apps.
Read access
The Averil GitHub App asks only for read permissions. The broker signs short-lived installation tokens, so no long-lived key is shared with you or stored in core.
| Permission | Access | Used for |
|---|---|---|
| Metadata (repository) | Read | Repositories, visibility, default branch |
| Contents (repository) | Read | CODEOWNERS, reading code for investigations, recent commits, push diffs for the secret scanner |
| Administration (repository) | Read | Branch protection and repository security settings |
| Dependabot alerts | Read | Open Dependabot alerts |
| Code scanning alerts | Read | Open code scanning alerts |
| Secret scanning alerts | Read | Open alerts, always requested without secret values |
| Secrets | Read | Actions secret names, never values |
| Administration (organization) | Read | Two-factor requirement, and the audit log on Enterprise Cloud |
| Members (organization) | Read | Members, members without two-factor, members of teams CODEOWNERS names |
| Personal access tokens (organization) | Read | Fine-grained tokens with access to the organization, metadata only |
Events it subscribes to: Repository, Branch protection rule, Member, Organization, Secret scanning alert, Code scanning alert, Dependabot alert and Push.
Write access
Fixes use a second, separate GitHub App that only the executor holds. You install it only if you want Averil to carry out fixes you approve. Each approved step gets its own token, limited to one repository, and the token is revoked when the step ends.
| Action | GitHub permission | Verified by | Reversible |
|---|---|---|---|
| Require pull requests with one approval on the default branch | Administration: write | Reading branch protection back | Yes |
| Turn on secret scanning and push protection | Administration: write | Reading repository settings back | Yes |
How to connect
- 1An organization owner opens the install link we send during onboarding.
- 2Choose all repositories or only some. Averil sees only what you install it on.
- 3Tell us your organization login. Averil reads only that organization.
- 4Optional: install the responder App on the repositories you want Averil to be able to fix.
How to revoke
In your organization's settings, open GitHub Apps, choose Averil (and the responder App, if installed) and uninstall it. Installation tokens stop working right away. Averil marks the integration as access revoked and keeps the evidence it already has.
What's next
Opening pull requests with proven fixes comes with the night shift. It adds Pull requests: read and the Pull request event to the read App, and Contents: write and Pull requests: write to the responder App. Pushes that create a new branch are not scanned for secrets yet.
Stuck? Email averil@averil.ai or ask me in Slack.