DevOps & Code

Connect GitHub

Reads repositories, pull requests, GitHub Actions, security alerts, and repo artifact signals to compute Delivery Health, Technical Debt, IT Modernization, Lifecycle Risk, and Security Readiness from real data.

What you'll need

A GitHub personal access token. Fine-grained (recommended — the only PAT type with a genuinely narrow repository grant): Read-only on Contents, Metadata, Pull requests, and Actions, plus Organization read. For Copilot adoption: Organization Copilot Metrics (read) and GitHub Copilot Business (read) — these are org-admin scopes; without them GitHub still syncs, and Adoption stays Not measured. Classic tokens work too (repo, read:org, read:user, and manage_billing:copilot for Copilot Metrics); the classic repo scope has no narrow tier — it carries write capability. Never grant admin permissions.

Credential

Personal access token (fine-grained, read-only)

Requested scopes

Contents (read), Metadata (read), Pull requests (read), Actions (read), Organization (read), Organization Copilot Metrics (read) — org-admin or custom role with View organization Copilot metrics, GitHub Copilot Business (read) — Copilot seat assignments

Powers

Delivery Health, Technical Debt, IT Modernization, Lifecycle Risk, Security Readiness, AI ROI (adoption)

What it pulls

Org/user, repositories, branches & protection, commits, pull requests (open age, merged, review & cycle time), issues, releases, Actions workflows/runs (failures, duration), deployments where available, contributors, stale repos, repo file-tree signals for containers/IaC/platform artifacts, runtime version files, Dependabot/code-scanning/secret-scanning alerts. When the org grants Copilot Metrics (org-admin), org-level Copilot usage for the trailing 28-day window (active/engaged users, suggestions/acceptances) and Copilot seat assignments. Copilot billing seats and plan when the token can read them (best-effort; 403/404 skipped).

Step-by-step setup

1
Open the token page
Use the “Create a fine-grained GitHub token →” link above, or go straight to github.com/settings/personal-access-tokens/new. Hunting for it by hand is easy to get lost in: Developer settings is the LAST item at the bottom of GitHub's Settings sidebar (below Moderation), and the word “token” does not appear on the Account page at all — then it's Developer settings → Personal access tokens → Fine-grained tokens.
2
Choose read-only permissions
Fine-grained (recommended): grant Read-only on Contents, Metadata, Pull requests, and Actions, plus Organization → read:org. For Copilot adoption (optional, org-admin): Organization Copilot Metrics (read) and GitHub Copilot Business (read). If you use a classic token instead (repo, read:org, read:user, manage_billing:copilot for Copilot), be aware the classic repo scope has no read-only tier — it grants write capability even though ShipReady only ever issues read requests, so prefer fine-grained and set a short expiration. Never grant admin.
3
Set repository access + expiration
Fine-grained tokens: pick which repositories ShipReady can read (or all). Set an expiration (e.g. 90 days).
4
Generate and copy the token
Click Generate token and copy it now — GitHub shows it once (ghp_… classic, github_pat_… fine-grained).
5
Paste it above and connect
Drop the token into the field and click Connect GitHub. We validate it live (confirming repo + read:org access), encrypt it at rest, and run the first sync.

Create a fine-grained GitHub token → Connect in the app

Live-verified

Runs in production continuously: real installations sync repositories, pull requests, Actions and security alerts on every scheduled run, and those reads are what the live ShipReady Score is computed from.

Fully implemented and verified end-to-end. Copilot Metrics is an optional GitHub capability (org-admin scopes), mocked-fetch tested, awaiting a live org run.