Skip to content
Merulan

GitHub setup

What an operator supplies to connect the GitHub Source, and the verification the provider requires.

Connecting GitHub installs the Merulan GitHub App on the chosen account. Nango holds the credential, and Merulan holds a handle to it. An operator who holds the material below connects in one pass.

Prerequisites

GitHub refuses the connection until every item holds.

  • A GitHub account or organization where an operator may install an application.
  • A repository selection made during installation, because the GitHub Source refuses an installation with no repository chosen.

Credentials

GitHub stores the credential under the brokered custody the registry declares, so Merulan never shows the secret again once the connection is saved.

  • No secret is typed into Merulan. The Connect session returns a connection handle, and Merulan stores the handle rather than the token.

Scopes

GitHub requests the scopes the registry declares, and a grant missing one of them fails the first collection read.

  • metadata:read
  • contents:write
  • pull_requests:write
  • issues:write
  • checks:write
  • statuses:read
  • actions:read
  • deployments:write

GitHub grants these permissions to the installation, so a narrower installation narrows the Source with it.

Verification

Broker-registered application governs the GitHub connection. GitHub admits the installed application, and the installation itself is the object an administrator audits or revokes.

  • Connect and map a Source runs the connect ceremony and binds collections once the credential is in hand.
  • Integrations lists every Source that carries a setup page, with its ceremony and verification posture.