Skip to main content

Scan a Private Repository

Public repositories need nothing: paste the URL and scan. For a private repository GitHub needs your permission. The easiest way is to connect GitHub; a read-only token works too.

Easiest: connect GitHub

  1. Dashboard → Connected Projects → Connect New AI App.
  2. Under Private repository? Connect GitHub, click Connect GitHub.
  3. On GitHub, choose Only select repositories, pick the repositories to scan and click Install.
  4. Back in Zelsis, pick the repository from the list and start the scan. No token to copy.

Already installed the Zelsis app (in another browser or account)? Use Already installed the Zelsis app on GitHub? Link it to this account. To share more repositories later, use Add more repositories on GitHub.

The app gets read-only access to the code and metadata of the repositories you chose, nothing else. Remove it any time under GitHub → Settings → Applications → Installed GitHub Apps.

Alternative: a read-only token

1. Create a read-only token

Open GitHub's token page with our settings already filled in (name, 90-day expiry, read-only access to code):

Create a read-only token on GitHub

Under Repository access, pick Only select repositories, choose the repository you want to scan, then click Generate token. If the repository belongs to an organization, choose that organization as the Resource owner first (an admin may have to approve the token).

2. Paste it into Zelsis

  • New project: Dashboard → add a project → paste the repository URL and the token in the "GitHub access token" field.
  • Quick scan: paste the URL and start the scan. When Zelsis sees the repository is private it asks for the token.
  • CI release gate: the GitHub Action runs inside your repository, so it already has access. See CI Release Gate.

What Zelsis does with the token

  • It only has the read permission you chose; Zelsis cannot push, open pull requests or change settings with it.
  • It stays in your browser tab and is sent with the scan request to download the files. It is not saved in our database.
  • You can revoke it at any time under GitHub → Settings → Developer settings → Fine-grained tokens.

More about what is stored and for how long: Data Handling.

Troubleshooting

  • "Repository not found" with a token: the token does not include this repository. Edit the token on GitHub and add it under Repository access.
  • Organization repository: the token's resource owner must be the organization, and some organizations require an admin to approve new tokens.
  • Token expired: create a new one with the button above.