Connect GitHub

Connect GitHub when you want source scans, generated docs, and a launch gate on pull requests.

Install

1. Signed in, open /connect. That is New Project with the GitHub install callout. Public Check stays on /check.
2. Or open the project → Connect GitHub.
3. Install the Invince GitHub App and pick the repository.

Start from that Invince button so GitHub returns a signed state. Installing from github.com/apps/invincedev or Redirect on update omits state. Invince then asks which workspace should own the install instead of showing Missing installation_id or state.

A GitHub repository can only be connected to one Invince project at a time. Disconnect it there first if you need to move it.

Access

Default access:

• Contents: read
• Metadata: read
• Pull requests: read
• Checks: write (so the launch gate can post Ready / Fix first / Do not launch)
• Actions: write (so Invince can dispatch invince-launch-qa.yml and start Playwright, Cypress, Selenium, or Robot on GitHub-hosted runners)

Invince does not push or merge your code. Opening pull requests is off unless you grant contents write on GitHub and turn that on in project settings.

Existing apps created before Actions: write must add that permission in GitHub App settings and accept the request on the installation. Checks: write posts the launch-gate check run. Neither permission is contents write or a screenshot of the live site vs the PR.

If install returns Could not verify the GitHub installation, the App JWT failed. GITHUB_APP_ID must be the numeric App ID from GitHub → App settings (InvinceDev is 4973861, not the Iv1. / Iv23. client id). GITHUB_APP_PRIVATE_KEY must be that app's PEM (quoted YAML \n is fine). Leave Request user authorization (OAuth) during installation off. Start Connect GitHub from Invince when you can so state is signed; the setup URL still recovers if GitHub omits it.

Disconnect

Uninstall the app from GitHub → Settings → Applications, or disconnect it from the project. Access stops immediately.

Sync

If the repo HEAD has not moved in the last 24 hours, Sync reuses the last completed scan. Check Again on a finding, and a new commit, still run for real.

Releases

Subscribe the GitHub App to Release events (Settings → Permissions & events). Publishing a GitHub Release stores that tag on the project Releases page, with a compare link to the previous GitHub tag. SDK release strings still create rows too. This is not a Cloud Run deploy hook.