GitHub access and permissions
What Evermach's GitHub App can access, the permissions it uses, and what it never does in your repositories.
Connect GitHub
An Admin connects the Evermach GitHub App from Evermach. On GitHub you then choose whether the app can see all of your repositories or only the ones you select. Each Evermach project is linked to one repository and branch.
Evermach works with repositories on GitHub.com. GitHub Enterprise Server, GitLab, and Bitbucket aren't supported yet.
Permissions Evermach uses
| Permission | Access | Why |
|---|---|---|
| Contents | Read and write | Read your code for analysis and builds. Write only to push the branches Evermach creates. |
| Pull requests | Read and write | Open pull requests and link the pull requests of a broken-down Request into a stack. |
| Issues | Write | Create a GitHub issue from a Request, when you choose to. |
| Administration | Write | Only to create a new repository during project setup, for organization installations. |
| Metadata | Read | Required by GitHub for every app. |
Evermach listens for push events: when your default branch changes, it refreshes the project's codebase overview. GitHub shows the app's exact permission set on the install screen before you approve it.
How access is scoped
- Every job uses a short-lived GitHub token. Evermach requests the narrowest scope the job needs: read-only access to the one repository for analysis, security scans, and the build and review sandboxes.
- A token that can push is created only when a finished branch is pushed, outside the sandboxes, and is never given to the AI models.
- Builds and reviews run in isolated sandboxes with no access to Evermach's own network.
What Evermach never does
- Merge a pull request.
- Push to your default branch, or to any branch it didn't create.
- Delete a branch.
- Deploy your code.
When a Request is built again, Evermach updates its own branch, and only if that branch still points at the commit Evermach last pushed. If someone else has pushed to it, Evermach stops instead of overwriting their work.
Branch names
| Branch | Created for |
|---|---|
feat/ACME-42-fix-annual-checkout | A build of Request 42 in a project whose key is ACME. |
security/… | A fix for a finding from a security scan. |
Disconnect
Removing GitHub in Evermach deletes Evermach's link to your installation. To revoke the app's access on GitHub too, uninstall it from your GitHub account or organization settings, under installed GitHub Apps.
Questions about anything here? Email help@disruptica.com or book a demo.