GitHub
Let Nebula work with repositories, pull requests, checks and security advisories, using a personal access token or the Nebula for GitHub app.
On this page
There are two ways to connect GitHub.
| Option | Best for | Authentication |
|---|---|---|
| GitHub | Reading repositories, code, issues and security advisories with your own permissions. | A fine-grained or classic personal access token. |
| Nebula for GitHub | Letting Nebula work on selected repositories as its own bot: code, pull requests, checks and CI. | A GitHub App installed on the repositories you choose. |
Connect with a token
- Create a fine-grained token in GitHub with read access to the repositories Nebula should see.
- In Settings, Integrations, choose GitHub and paste the token. It is stored encrypted and is write-only.
Nebula can then read public GHSA and CVE advisories and repository advisories with the token’s permissions.
Install Nebula for GitHub
- In Settings, Integrations, choose Nebula for GitHub.
- Install the app on the repositories it should access. It acts only with the permissions the installation grants.
- Check the installation’s status in Settings. Managing the app needs
integrations:manage.
From the CLI
breachline github installinstalls the GitHub agent in a repository.breachline pr <number>checks out a pull request branch and starts BreachLine on it.
Permissions and data handling
- Nebula sees only what the token or the app installation can see.
- Code Nebula reads is used to answer your request and is subject to the data handling described in the security guide.
Known limitations
- Catalog availability does not mean an account is connected; connect before asking Nebula to use GitHub.
- A token’s permissions limit what advisories and repositories are visible.