Skip to content
BuildVouch
All guides

Repository edition · v1

Connect with GitHub

Open your application, choose Connection, then Connect with GitHub. An organisation owner makes this connection. Verify your authenticator in Security before starting.

1. Authorize GitHub. Install BuildVouch on only the repositories you want to connect. Return to the wizard and choose Authorize GitHub. Use the same browser tab and BuildVouch account throughout. 2. Choose a repository. The list includes non-archived repositories selected in the installation where your GitHub account has administrator permission. 3. Review settings. BuildVouch detects the default branch, framework markers, hosting configuration and workflow names. Unknown means the configuration could not establish an answer. Confirm the production domain separately in application settings; a configuration file is not evidence of a deployment. 4. Create the first report. Confirm the connection to fetch the source commit and first page of PR history. Open Changes & deployment to review what changed and import further pages. If the report fetch fails after connection, retry Sync GitHub and Import history from the application workspace.

The first report does not approve a release. Workflow names remain unmapped until an operator reviews what they actually test. Missing runtime, migration, security and deployment evidence stays Unknown or Unverified.

If setup cannot continue

  • One-time setup required: the platform operator needs to register and configure BuildVouch's GitHub App. This is not a password or DNS problem.
  • No repositories: install the app for the intended repositories and ensure your GitHub identity administers them. An organisation owner may need to approve installation.
  • Authorization expired: restart from Connection; intents expire after 15 minutes and cannot be reused.
  • Repository renamed, transferred or archived: review the change and reconnect. BuildVouch checks stable repository IDs.
  • GitHub unavailable: try again later. Existing evidence is retained with its timestamp.
  • Installation already bound: each GitHub installation belongs to one customer organisation in BuildVouch. Ask the operator to review transfers.

Disconnect

Use Disconnect after MFA in the wizard. BuildVouch stops resolving that connection and preserves its evidence and audit history. To remove GitHub's grant itself, uninstall BuildVouch in GitHub's Installed GitHub Apps settings. This release refreshes on explicit requests; it does not claim continuous webhook monitoring.

Basic GitHub history requires no code change in your app. A server/CI adapter adds runtime and migration reports later; follow the Application adapter guide. Never put credentials into a public SDK or browser component.