GitHub App Integration
Scoped repository authorization that powers repository signals, pull-request analysis, and full remote Assurance scans — bound to your AI Systems.FULL REMOTE COVERAGE · Recommended developer path
What the GitHub App does
You authorize the HAIEC GitHub App only for the repositories you select. You never provide HAIEC with a personal GitHub token — repository access is granted through GitHub App installation credentials generated server-side and never returned to API callers.
- Establish scoped repository authorization through a GitHub App installation
- Collect repository governance signals (branch protection, CI/CD, security policy)
- Analyze pull-request changes and post findings/comments when enabled
- Authorize full remote HAIEC repository scans on demand
- Bind repository evidence to a specific AI System as a verified Source Asset
- Feed the canonical Assurance Evaluation — the same model the dashboard uses
Quick Start
- 1Install the HAIEC GitHub App from the GitHub Marketplace
- 2Select the repositories you want HAIEC to be able to analyze
- 3Return to HAIEC — the installation is linked to your organization automatically
- 4Select or create an AI System in the dashboard
- 5Connect the repository to that AI System as a
SOURCE_REPOSITORYasset - 6Verify the Source Asset — it moves to
CONNECTED + VERIFIED - 7Run Assurance — from the dashboard, the Assurance API, or your IDE
Developer & API use
Once a repository is connected and verified, a HAIEC API key can trigger the same remote scan from Cursor, a terminal, CI orchestration, or a server application — without any GitHub credential leaving your machine.
- 8Generate an Assurance API key (scopes: scan:create, scan:read, report:read, system:read, source:read)
- 9Configure your environment:
HAIEC_API_KEY,HAIEC_AI_SYSTEM_ID,HAIEC_SOURCE_ASSET_ID - 10
POST /api/v1/assurance/runswith the verifiedsourceAssetId— the server resolves the GitHub App installation and mints a short-lived credential - 11Poll the run, then open the Evaluation in the HAIEC Dashboard
Two distinct workflows
Pull-request analysis
Event-driven: when a pull request is opened or updated on a covered repository, HAIEC analyzes the changed files and can post findings/comments on the PR. This is a diff-scoped workflow — it does not run every analyzer on the whole repository.
Full remote Assurance
Explicitly initiated: a whole-repository HAIEC scan of a verified Source Asset, triggered from the dashboard or the Assurance API, feeding the canonical Assurance Evaluation, report, and Passport.
Access model — remote vs local
| Mode | Where source is accessed | What crosses the wire |
|---|---|---|
| Remote GitHub scan | HAIEC remote scanning infrastructure, via short-lived GitHub App installation credentials minted server-side | The authorized repository is read by the scanner. Credentials are never returned to API callers. |
| Local / CI scan | The customer's machine or CI runner | Only the qualified Evidence Bundle is submitted — hashes, paths, findings metadata, limitations. |
Local analyzer coverage is currently limited local coverage compared with the remote stack — missing analyzers are recorded as limitations, never as PASS. For maximum current static-analysis coverage, Connected GitHub is the recommended path.
Permissions
| Permission | Access | Purpose |
|---|---|---|
| Contents | Read | Repository source and configuration access required for authorized remote analysis, plus governance-signal collection |
| Pull Requests | Read & Write | Analyze PR context and post HAIEC findings/comments when enabled |
| Metadata | Read | Repository identity, configuration, and security evidence |
Boundaries
- The App has no write access to your code or branches — it cannot modify your repository contents.
- Installation credentials are short-lived, scoped to the authorized installation, minted server-side, and never returned to callers or logged.
- A repository URL alone is not an AI-System binding — only a verified Source Asset attached to your AI System is eligible for Assurance runs.
- Framework mapping is readiness evidence, not certification. Dispositions are bounded to evaluated scope and available evidence.
Trust Artifacts & Badges
After completing a compliance assessment, you receive a verifiable trust artifact with an embeddable badge.
[](https://www.haiec.com/artifact/SOC2-abc12345)