GitHub
PlannedPlanned — not available yet. No GitHub connector exists today. This page describes the intended design, and details may change before anything ships.
Repository and dependency inventory from the repositories you choose.
The GitHub connector is intended to list the repositories a team chooses to share and to read their dependency manifests, such as composer.lock or package-lock.json. The result is an inventory of which repository depends on which package version, ready to be evaluated by a separate assessment service.
Planned capabilities
- Inventory of selected repositories with default branch and last push time
- Dependency manifests read from each repository's default branch
- Package versions normalized across ecosystems
- Hand-off of dependency evidence to the Composer / PHP parser
How it will work
The planned model is a GitHub App that an organization owner installs on selected repositories only. The app is intended to request read-only access to repository metadata and contents, so it can read manifests without being able to push.
Security and permissions
Access is limited to the repositories selected during installation, and is meant to be read-only. The app can be uninstalled from GitHub at any time. No personal access token or password is requested.
Use cases
Dependency inventory
A development team sees which repositories pin a given package version without cloning each one.
Agency code portfolio
An agency lists the client repositories it maintains, with the PHP dependencies each one declares.
Security evidence collection
Dependency versions are prepared as evidence for a separate security assessment.
Questions
- Is the GitHub connector available today?
- No. It is planned. GitHub sign-in on the TSmartConnect dashboard is a login option and is not this connector.
- Will it be able to change my code?
- The intended permissions are read-only. The planned app is not designed to push, open pull requests or change settings.
- Does it scan for vulnerabilities?
- No. It is planned to collect inventory. Evaluating that inventory is the role of a separate service, TSmart Security Cloud, which is also planned.
Interested in GitHub?
Connector order follows what customers actually run. Tell us what you would connect and how many sites, accounts or repositories are involved.