GitHub

What the connector does

The TechWatchAlert GitHub App reads the lockfiles, manifests and SBOMs in your repositories and keeps the project stack up to date on every push to the default branch. It only requests read permissions, and no repository is read until an administrator enables it.

What comes into TechWatchAlert

• Components and their versions, read from supported lockfiles and manifests (package-lock.json, poetry.lock, go.mod, composer.lock, pom.xml, Cargo.lock…)
• CycloneDX or SPDX SBOMs versioned in the repository
• Additionally, the dependency graph GitHub maintains for the repository, exact versions only
• The source file path of each component, shown on the stack
• Additions, upgrades and removals: only the components contributed by this repository are updated

Setup

1. Click “Connect GitHub” and install the GitHub App on your account or organization
2. Choose “Only select repositories” to limit access to the repositories you want to monitor
3. Back in TechWatchAlert, turn on “Track this repository” for each repository you want
4. Not an organization owner? Send the installation request: the screen tracks its approval