Connect GitHub

The backend reads pull requests and code through a GitHub App that you create in your own organization. Its private key stays in your network; tokens are short-lived and read-only. Personal access tokens are not supported.

1. Create the App

GitHub → your organization → Settings → Developer settings → GitHub Apps → New GitHub App.

• Name: e.g. cotracer-yourcompany
• Homepage URL: anything, e.g. your internal wiki
• Webhook: uncheck Active — the backend needs no webhooks
• Repository permissions — all Read-only:
  • Contents
  • Pull requests
  • Metadata (selected automatically)
• Where can this GitHub App be installed? Only on this account

Create it, then note the App ID at the top of its settings page.

2. Generate a private key

On the App’s settings page: Private keys → Generate a private key. A .pem file downloads. Treat it like a password.

3. Install it

App settings → Install App → your organization → choose All repositories or the repositories Cotracer should see — the services you want analyzed and the ones that depend on them. Cross-repo impact is only found in repos the App can read.

4. Give the backend the credentials

Docker Compose — append to .env (the key goes on one line with \n escapes):

echo "GITHUB_APP_ID=123456" >> .env
printf 'GITHUB_APP_PRIVATE_KEY="%s"\n' "$(awk '{printf "%s\\n", $0}' app.pem)" >> .env

Kubernetes — add both to the cotracer-secrets Secret:

kubectl create secret generic cotracer-secrets ... \
  --from-literal=GITHUB_APP_ID=123456 \
  --from-file=GITHUB_APP_PRIVATE_KEY=app.pem

Then add a vcs section to cotracer.yaml (see Configure) with org set to your organization, and restart. Missing credentials stop the backend at startup; wrong ones (bad key, App not installed) surface as GitHub errors on the first analysis.

GitHub Enterprise Server works the same way; set vcs.url to https://<host>/api/v3.