> For the complete documentation index, see [llms.txt](https://copilot-docs.bugbase.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://copilot-docs.bugbase.ai/enterprise/how-to-trigger-a-code-assessment/configure-github-for-code-assessment.md).

# Configure GitHub for Code Assessment

Code Assessment connects to GitHub through the Pentest Copilot GitHub App.

After the GitHub App is installed, Pentest Copilot can read selected repositories, create check results, comment on pull requests, create issues, and open fix pull requests when you enable those workflows.

## Before You Start

You need:

* access to Pentest Copilot with permission to manage integrations or run Code Assessment;
* GitHub permission to install a GitHub App on the target organization or account;
* approval for the repositories that will be scanned;
* for automatic pull request or push scans, the repository must be connected in Pentest Copilot and have scan settings saved.

{% hint style="warning" %}
Installing the GitHub App alone does not automatically scan every repository. Automatic scans only start for repositories that you connect and configure in Pentest Copilot.
{% endhint %}

## Connect the GitHub App

1. In Pentest Copilot, open **Settings -> Integrations -> GitHub** or **Modules -> Code Assessment**.
2. Click **Connect GitHub**.
3. GitHub opens the Pentest Copilot GitHub App installation page.
4. Choose the GitHub organization or account.
5. Select **All repositories** or **Only select repositories**.
6. Approve the installation.
7. Return to Pentest Copilot and confirm the integration shows as connected.

If a repository is missing, open the GitHub App installation settings in GitHub and add that repository to the App's repository access list.

## Use the Right Pentest Copilot Account

Always start the installation from **Connect GitHub** inside the Pentest Copilot account where you want the repositories to appear.

{% hint style="info" %}
If your organization uses more than one Pentest Copilot account or workspace, open the correct one before connecting GitHub.
{% endhint %}

## Connect Repositories in Pentest Copilot

After the App is installed, open **Settings -> Integrations -> GitHub** or **Modules -> Code Assessment**.

You can configure repositories in two ways:

| Repository setup                          | What it does                                          | Use when                                                                                                      |
| ----------------------------------------- | ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------------- |
| **Standalone Code Assessment repository** | Adds the repository as a Code Assessment target.      | You want source-code scans, scheduled scans, pull request scans, push scans, SBOM, AI-BOM, and code findings. |
| **Repository connected to a domain**      | Links a repository to an external application domain. | You want external findings on that domain to be patchable against the connected source repositories.          |

You can use both. A repository can be a direct Code Assessment target and also be connected to a domain.

## Enable Automatic Scans

Automatic scans are configured per repository from **Modules -> Code Assessment -> Scan settings**.

| Trigger          | Default | What is scanned                                                                                              |
| ---------------- | ------- | ------------------------------------------------------------------------------------------------------------ |
| **Pull request** | On      | The latest commit on the pull request.                                                                       |
| **Push**         | Off     | The commit that was pushed, only when push scans are enabled and the branch matches the repository settings. |

Pull request scans run when a pull request is opened, reopened, marked ready for review, or updated with new commits.

Push scans ignore tags and branch deletions. With no branch filter, push scans run only on the repository default branch. With branch filters, the pushed branch must match one of the saved regular expressions.

Examples:

| Branch filter | Matches                                                        |
| ------------- | -------------------------------------------------------------- |
| `main`        | Only `main`.                                                   |
| `release/.*`  | Branches such as `release/2026.07` and `release/hotfix`.       |
| `feature/.+`  | Feature branches with at least one character after `feature/`. |

## Common Blocks

| Block                                                                | What to check                                                                                                                                |
| -------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
| GitHub redirects to the App settings page instead of Pentest Copilot | Start the install again from **Connect GitHub** in Pentest Copilot. If it still does not return to Pentest Copilot, contact BugBase support. |
| Repository does not appear                                           | Confirm the App installation has access to that repository.                                                                                  |
| Pull request event did not start a scan                              | Confirm the repository is connected in Pentest Copilot and **Scan every pull request** is enabled for that repository.                       |
| Push event did not start a scan                                      | Confirm **Scan pushes** is enabled and the pushed branch matches the saved branch filters.                                                   |
| Repositories appear in the wrong Pentest Copilot account             | Disconnect GitHub and reconnect it from the account where you want to run Code Assessment.                                                   |