GitHub repository access
Connect personal and organization installations for scoped reviews and human-approved pull requests.
Veriom uses one GitHub App for account authorization, source selection, audits, and approved remediation. A workspace can connect multiple personal and organization installations, and each installation keeps its own repository boundary.
Connect
- Sign in to Veriom and choose a workspace.
- Select Connect GitHub.
- Choose a personal or organization account.
- Select the projects Veriom may review.
- Finish in the GitHub window. The workspace updates without losing your current page.
The callback verifies the actor, account, installation, and accessible repositories before associating the connection with a workspace. Temporary GitHub user authorization is discarded after verification. A GitHub installation can belong to only one Veriom workspace, preventing cross-tenant reuse.
Access by operation
The App has the capability to read source and publish pull requests, but each operation receives a short-lived token narrowed to what it needs:
| Operation | Effective access |
|---|---|
| Sign in and connect | identify the actor and verify the installation |
| Run an audit | metadata read and contents read for one selected project |
| Publish remediation | contents write and pull requests write for one selected project |
| Modify workflow files | workflows write, requested only when an approved patch touches .github/workflows/ |
Write access is never used during an audit. Publishing remediation still requires an Analyst, Admin, or Owner to approve the proposal. Veriom never merges automatically.
Manage the connection
The Integrations page shows every connected account, account type, project count, installation status, and a direct management link. The Repositories page groups projects by provider and account, supports server-side account or project search, and uses cursor pagination so even large organization inventories remain manageable without merging their access boundaries. If the App is suspended, removed, or loses required permissions, new work is blocked while historical reviews remain available.
Prefer least privilege
Veriom supports selected-project and all-project installations. Choose only the repositories the workspace is expected to review whenever that boundary is practical.
Protect merges with architecture evidence
Add the deterministic merge check to audit the exact pull-request commit and publish the workspace architecture gate as a GitHub job result. The workflow needs only repository contents read; GitHub publishes the check without giving Veriom or an agent write access to the repository.
If code also lives in GitLab or Bitbucket, use the read-only repository provider connections. Their project inventory and exact-revision audits share the same explicit selection and evidence contract, but their credentials are never reused for remediation writes.
Reports and remediation
Canonical report JSON, approval, deterministic exports, patch proposals, static rescans, and human-controlled GitHub pull requests.
GitLab and Bitbucket repositories
Connect read-only GitLab or Bitbucket account boundaries, discover projects, and explicitly choose which exact revisions Veriom may audit.