Connect a repository
Connect GitHub, GitLab, or Bitbucket repositories to a Veriom workspace, or upload a repository as a ZIP file.
This page is for a workspace admin who wants Veriom to audit code. Veriom reads code from GitHub through its GitHub App, from GitLab and Bitbucket through a sign-in or a read-only token, or from a ZIP file you upload.
Before you start
- You have the Admin or Owner role in the workspace. A Developer can upload ZIP files but cannot connect providers.
- You are signed in to Veriom in your browser.
Connect GitHub
- In Veriom, open Integrations and select the Repositories tab.
- Click Add repositories. If the workspace already has a GitHub account, click Connect another GitHub account to add a second one.
- GitHub opens. Choose the account or organization, choose All repositories or Only select repositories, and install the App.
- GitHub sends you back to Veriom. Choose the repositories to add to the workspace.
The authorization link works once and expires after 10 minutes. If it expires, start again from step 2.
Veriom starts a first audit for each repository you add, then audits it on every push to its default branch.
GitHub permissions
| Feature | GitHub App permissions it needs |
|---|---|
| Audits | Metadata: read, Contents: read |
| Pull request checks | Pull requests: read, Checks: write |
| Fix pull requests (remediation) | Contents: write, Pull requests: write |
| Keyless CI setup pull request | Contents: write, Workflows: write, Pull requests: write |
Veriom never asks for organization administration.
Connect GitLab or Bitbucket
- Open Integrations, select the Repositories tab, and find Repository providers.
- Click Connect GitLab.com or Connect Bitbucket Cloud.
- For Bitbucket, enter your Bitbucket Workspace and click Continue to Bitbucket.
- Approve the access on GitLab or Bitbucket.
| Provider | Access Veriom asks for | Why |
|---|---|---|
| GitLab.com | api, read_repository | api lets Veriom create the project webhook that reports pushes and merge requests |
| Bitbucket Cloud | Account: read, Repositories: read, Webhooks: read and write | Webhooks report pushes and pull requests |
Veriom turns on up to 10 of the most recently active repositories, within your plan's repository limit. It schedules them and starts a first audit for each. To audit another repository, open Repository inventory and click Add to scope on it.
Use a token instead
Use a token for self-managed GitLab, or when you do not want to sign in through OAuth.
- In Repository providers, click Use a token.
- Choose the Provider, and enter a Connection name.
- For self-managed GitLab, set Provider API URL to your GitLab address. It defaults to
https://gitlab.com. - Paste a Read-only access token:
- GitLab: a token with
read_apiandread_repository; - Bitbucket: a repository access token with repository read permission.
- GitLab: a token with
- Click Connect provider.
Upload a ZIP file
Use this when Veriom cannot reach your repository host.
- Open Integrations, select the Repositories tab, and find Repository ZIP sources.
- Click Upload ZIP and choose the file.
Veriom checks the archive, then audits it.
| Limit | Value |
|---|---|
| File type | .zip only |
| Upload size | 1 GB |
| Unpacked size | 5 GB |
| Files in the archive | 250,000 |
| Kept for | 30 days |
Archives with symbolic links, absolute paths, or .. in a path are refused.
If something goes wrong
| What Veriom says | Fix |
|---|---|
| This one-time authorization expired or was already used. | Start the connection again |
| The GitHub App is missing a required permission. | Open the App's settings in GitHub, accept the requested permissions, then retry |
| The GitHub installation was cancelled. | Retry, or skip GitHub for now and upload a ZIP |
| This workspace is already connected to a different GitHub account. | Choose another workspace, or manage the existing connection |
| No repositories are available to this GitHub account. | In GitHub, give the App access to at least one repository |
| This GitHub account is already connected to another Veriom account. | Sign in to that Veriom account, or use another GitHub account |
See Troubleshooting for more codes.
Was this guide useful?
Your response stays in this browser unless you open a GitHub issue.Get started
Create an account, set up a workspace, connect a GitHub repository, and read your first audit. Takes about 10 minutes plus the audit itself.
Connect your team's tools
Connect Jira, Linear, Slack, Notion, Sentry and other tools so audits see your decisions, owners and incidents. Send audit results to Slack or Discord.