> For clean Markdown of this page, append .md to its URL. For the complete documentation index, see https://www.superagent.sh/llms.txt.


Install the Superagent GitHub Apps, select repositories, and run the first repository security job.

# Connect GitHub

Superagent gets GitHub access through GitHub Apps installed on the repositories you choose, not through a broad OAuth token. Install each app only on the repos Superagent should scan, test, or govern.

## The two apps

| App | What it enables |
| --- | --- |
| **Superagent Security** | PR security scans, supply chain scans, contributor trust, repository red-team reports, GitHub advisory ingestion |
| **Open CLA** | CLA checks on pull requests, contributor signing, per-repo CLA enforcement |

You can install one or both apps on the same repositories.

## Install an app

1. Sign in to the [Superagent dashboard](https://www.superagent.sh/app) and open [Integrations](https://www.superagent.sh/app/integrations).
2. Select the app that matches your workflow. GitHub opens the installation flow.
3. Install on the organization or account that owns your repositories.
4. Choose **Only select repositories** and pick the repos Superagent should access. Select all repositories only if you intentionally want every repo covered.
5. GitHub redirects you back to Superagent when the install completes.

After connecting:

- Open **Integrations** and confirm each app shows as connected.
- Open [Repository](https://www.superagent.sh/app/repository) and verify your repos appear with the expected capability badges: Security, CLA, or both.
- Open or update a pull request on a connected repo to see the first checks run.

You can change repository access later by reconfiguring the app in GitHub or from **Integrations**.

## Superagent Security

Install Superagent Security when you need:

- **Security scan** checks on pull requests, plus **Contributor trust** (on by default for public repos, off for private repos)
- **Superagent Supply Chain Scan** checks for changed dependencies
- [Repository red-team reports](https://www.superagent.sh/docs/security-workers/red-team/repositories) on connected repos, including private repo clone access for scans
- GitHub repository security advisories surfaced as [findings](https://www.superagent.sh/docs/concepts/findings-and-reports)

The app needs repository access for checks, pull request events, comments, and labels. Advisory triage uses `repository_advisory` webhook events and is on by default for public repositories only.

## Open CLA

Install Open CLA when you need:

- The **Contributor License Agreement** check on pull requests
- Contributor signing, in-app or via Dropbox Sign
- Per-repository CLA template assignment

Open CLA needs repository access for CLA file reads, pull request checks, and signing comments. Organization membership read access is required for corporate CLA coverage. See [Contributor Agreements](https://www.superagent.sh/docs/security-workers/contributor-agreements).

## Next steps

- [Configure your repositories](https://www.superagent.sh/docs/concepts/repositories)
- [Enable PR Security](https://www.superagent.sh/docs/security-workers/pr-security)
- [Set up Contributor Agreements](https://www.superagent.sh/docs/security-workers/contributor-agreements)

---
Source: https://www.superagent.sh/docs/connect/github
Index: https://www.superagent.sh/llms.txt