Connect GitHub

Depos reads your repositories through a GitHub App. Connecting it is a one-time step for an organization admin.

Install the app

1. Open Settings → GitHub and click Connect GitHub.
2. On GitHub, pick the organization or account to install on.
3. Choose All repositories or Only select repositories. This choice is the limit of what Depos can see; you can change it later on GitHub.
4. GitHub sends you back to Depos. The connection is checked — the person installing must own the installation — and the repository list is loaded.

The app asks only for read access to repository contents and pull requests, plus write access to checks so it can report on pull requests. It never writes to your code.

Add repositories

Connecting does not scan anything by itself. Open Repositories, click Add repositories, tick the ones Depos should read and click Add. Each one you add is scanned at once.

A scan reads the default branch: the manifests of the supported ecosystems and the notes files under .depos/ (.pacmon/ in older repositories). When it finishes, the repository's packages show up on the Dependencies page and on Home.

From then on a push to its default branch scans it again, and its pull requests can be checked. See Repositories and scans.

What to do next

• Look at the packages in use on Dependencies.
• Write notes for the packages that need one.
• Set a policy for an ecosystem and decide what is allowed.

Who can do what

Every member of the organization can read everything in Depos. Changing anything — connecting GitHub, adding repositories, scanning, writing notes, editing the allowlist or the policy — needs an organization admin. See Organizations and members.