The GitHub App

The M1rror GitHub App connects your repositories. You choose which repositories it can see when you install it on GitHub, and you can change that later in GitHub's settings.

Set it up

1. Install the app

   Select Install GitHub App in Code mode or in Settings › Integrations. GitHub asks which account and which repositories to install it on. Once one account is connected, the button reads Add another GitHub account.

2. Return to M1rror

   GitHub sends you back to M1rror, which links only the installations you have access to. If something went wrong, M1rror says so and you can try again.

3. Connect a repository to a project

   In Code mode, select Connect a repository, pick one and tell M1rror which branch holds your app. See Scan your repository.

What the app does

Capability	What happens
Scans	M1rror clones the repository with a short-lived, read-only token limited to that repository, and reads it without running it.
Pull request checks	M1rror checks the lines a pull request adds and reports a verdict. See pull request checks.
Draft pull requests	For an authorised build, M1rror pushes a branch named m1rror/v<release>-<run> and opens a draft pull request with evidence.
Coverage	M1rror reads the changed files of pull requests linked to an approved release, with a read-only token for that one repository. See Coverage.
Updates on push	When the default or tracked branch moves, M1rror fetches it and scans it for drift, unless you turned that off. See stay in sync after a merge.
Revert pull requests	On request, M1rror reverts a merged implementation on a branch named m1rror/revert-<branch> and opens a draft pull request.

M1rror never pushes to your default branch, never force-pushes and never approves or merges a pull request.

Permissions it asks for

• Metadata (read) and Contents (read) for scans.
• Contents (read and write), Pull requests (read and write) and Deployments (read), to push build branches and open draft pull requests.
• Checks (read and write), so check results appear as a check run named M1rror design check. Without it, results arrive as a single pull request comment.

The app also receives pull request and push events from the repositories you chose. Push events need no permission beyond Contents.

Every token M1rror asks GitHub for is limited to one repository and to the permissions that one task needs, even when the app was granted more. M1rror never needs administration, Actions, workflows, secrets, issues or any organisation permission.

Remove access

Uninstall the app, or remove repositories from it, in your GitHub account's settings under installed GitHub Apps. M1rror can no longer read those repositories once access is removed.