GitHub App

Private preview notice: public GitHub App installation is closed until the production credentials, webhook delivery, and pull-request smoke test pass. The workflow below documents the release candidate used with selected design partners.

After public release, the Rorix GitHub App will protect selected repositories without requiring workflow files. It will sync GitHub-selected repositories into Rorix projects, scan default branches, and add pull request checks when dependency files change.

Required GitHub Permissions

The V1 app uses a minimal read-first permission set:

| Permission | Access | Purpose | | --- | --- | --- | | Metadata | Read | Identify selected repositories | | Contents | Read | Fetch dependency manifests at branch and PR refs | | Pull requests | Read | List changed files and PR metadata | | Checks | Write | Create and update the Rorix Supply Chain check | | Issues | Write | Create or update one PR summary comment |

Scanning uses read access to repository contents. The gated automatic security PR feature additionally requires Contents: Read and write and Pull requests: Read and write. Existing installations must approve the added permissions and sync before a project can opt in. Checks and Issues permissions stay as listed above.

Install Flow

The install flow is currently available only to manually onboarded design partners. Public setup instructions will replace this section after the production smoke test passes.

Selected repositories become active Rorix projects while your org has project capacity. Repositories over the plan limit remain visible as pending activation.

Pull Request Checks

When a pull request is opened, synchronized, reopened, or marked ready for review, Rorix:

• Lists changed files in the PR
• Skips with a passing check if no supported dependency files changed
• Scans the base and head SHAs when dependency files changed
• Compares new vulnerabilities and packages
• Evaluates .rorix.yml from the PR head
• Fails the check on policy violations or new critical/high advisories
• Updates one PR comment instead of creating duplicates

Dependency files include .csproj, .sln, packages.config, Directory.Packages.props, nuget.config, global.json, .deps.json, packages.lock.json, package.json, package-lock.json, npm-shrinkwrap.json, and pnpm-lock.yaml.

Default Branch Scans

For enrolled preview repositories, pushes to the default branch trigger a project scan with the GitHub App installation token. Results update the project dashboard and the app check run for that commit.

Scheduled Reminders and Security Fixes

When activated by your Rorix administrator, Settings → Slack connects the existing Rorix Slack app and selects a channel for daily or eight-hour open vulnerability reminders. Enable repository monitoring to include a project. Digests repeat unsuppressed findings, flag stale coverage and link to existing fix PRs.

Project settings → Automatic security pull requests opts a repository into one regular PR per owning dependency. Rorix resolves NuGet, npm or pnpm dependencies in an isolated sandbox, updates supported manifests and lockfiles, and checks that targeted advisories are removed without introducing new advisories or violating repository policy. Major upgrades are labeled. Review and repository CI are required before merging; Rorix never merges automatically. Queued jobs, blocked upgrades and failures appear in project settings.

GitHub App vs GitHub Actions

After public distribution, use the GitHub App when you want repository protection without maintaining workflow files. The public GitHub Actions integration is intended for custom runners, explicit SARIF upload, branch-specific workflow logic, or CI-owned security gates.