Connecting GitHub
inline needs access to your repositories to review pull requests and post its findings. There are two ways to grant it, and you can use whichever fits your organization.
# Option 1 — the GitHub App (recommended)
Installing the inline GitHub App into your organization is the cleanest path:
- Reviews and comments post under the inline bot’s own identity, so they’re clearly attributable and never tied to a person’s account.
- GitHub delivers pull-request events to inline automatically — no per-repo webhook setup.
- You control exactly which repositories the app can see from GitHub’s installation settings.
Install it from the Repositories page in the portal, choose the repos to grant, and you’re done. Enable the repos you want reviewed and open a PR.
# What the app can do
The app requests only the permissions its features need:
| Permission | Used for |
|---|---|
| Pull requests: write | Post reviews and inline comments. |
| Contents: write | Open auto-fix and remediation PRs. |
| Checks: write | The merge gate status check. |
| Issues: write | Respond to @inline comments. |
| Actions: read | CI/CD monitoring. |
| Security events: read | Ingest Dependabot / code-scanning / secret-scanning alerts. |
| Metadata: read | Basic repo information. |
Features you don’t use simply don’t exercise their permissions.
# Option 2 — OAuth connection
If you’d rather connect under a specific admin’s GitHub account — for a smaller setup, or where installing an org app isn’t an option — inline supports an OAuth connection from the portal. In this mode:
- Reviews post under the connected admin’s account.
- inline provisions the necessary repo webhooks for you when you enable a repository, since OAuth connections don’t get GitHub’s automatic app-event delivery.
- It needs repository and repo-webhook scopes, granted during the OAuth flow.
Start it from Repositories → Connect and authorize in the pop-up.
# Choosing
| GitHub App | OAuth | |
|---|---|---|
| Posts as | inline bot | The connecting admin |
| Event delivery | Automatic | inline provisions webhooks |
| Best for | Organizations, teams | Solo/admin setups, restricted orgs |
| Merge gate delivery | Check run | Commit status |
Both connect the same product with the same features — the differences are identity and how events arrive. Most teams should use the GitHub App.
# Enabling repositories
Connecting makes repositories visible; it doesn’t start reviews. Go to Repositories, and toggle each repo you want reviewed to enabled. From there, each repo can override the workspace defaults for severity, merge gate, and the optional modules — see review config.