Connect GitHub

Updated

Scalpels uses a GitHub App rather than asking you to paste an installation identifier or a long-lived personal access token.

Connect an account or organization

Open Team settings → GitHub.
Select Connect GitHub. A team Owner or Admin may do this.
On GitHub, choose the personal account or organization where products should be forked.
Choose the repositories the Scalpels App may reach and complete the installation.
GitHub returns you to Scalpels, which records the verified installation and account name.

The callback verifies that the GitHub user who completed the flow can reach the returned installation. The temporary GitHub user token used for that check is discarded rather than stored.

What the app can do

Scalpels uses the installation to:

create a product fork in the selected account or organization;
read repositories that the installation can reach, including the files needed to detect a client package;
create one branch and commit for a client-install change;
open or find the pull request for that branch.

Scalpels does not merge pull requests into your repositories. You review and merge them.

If a repository is not selected for the GitHub App, Scalpels treats its contents as unreadable rather than guessing that a package is absent. Use Manage app access on the GitHub settings screen to change the repository selection.

Disconnect

Selecting Disconnect removes the connection and cached installation token from Scalpels. Existing forks and fork records remain because the repositories still exist in your account.

Disconnecting in Scalpels does not uninstall the GitHub App. Follow Manage app access to GitHub's installation settings and uninstall or narrow the installation there when you want to revoke its access entirely.