Skip to main content
GitHub is the integration behind Clarion’s code and supply-chain coverage. Once connected, Clarion ingests repository security events, discovers your repositories into the Brain, and gives agents the ability to investigate code and open remediation pull requests.
Estimated time: 5 minutes. You will need permission to install a GitHub App on your organization.

​
Prerequisites

  • A GitHub organization where you can install applications
  • A Clarion workspace with the GitHub integration page open

​
Connect

  1. In Clarion, open Integrations and find GitHub under Essentials.
  2. Click Connect and complete the GitHub App installation.
  3. Choose whether to grant access to all repositories or a selected subset.
  4. Return to Clarion — the integration shows as connected once the installation callback lands.

​
Commit identity

Under the integration’s settings you can set the name and email Clarion uses when an agent authors a commit. Pick something that reads clearly in your history, e.g. Clarion Agent <clarion@yourcompany.com>.
GitHub Enterprise Server is supported by setting a custom Endpoint URL on the integration.

​
What Clarion ingests

Repository security events feed the Code & Supply Chain and Dependabot Alerts agents:
  • Secret-scanning and code-scanning alerts
  • Dependabot vulnerability alerts
  • Branch-protection and ruleset changes
  • Repository visibility changes
  • Force pushes to default branches
  • Organization owner additions
  • Tag and release activity

​
Repository discovery into the Brain

Clarion discovers your repositories as assets, along with the governance metadata that makes them judgeable: rulesets, workflows, open alert counts, org custom properties, and CODEOWNERS. Repositories correlate with cloud resources and observability services that reference them, so an alert on a service resolves to the repository that builds it. Software bills of materials are captured per repository, which is what lets the Dependabot agent reason about reachability rather than just CVE presence.

​
People discovery into the Brain

Clarion also discovers the members of each connected organization as identity assets, carrying their GitHub handle, display name, and org role. A member whose address GitHub exposes joins the same person as their Okta, Slack, or Teams account, so an alert naming a GitHub login resolves to a whole human rather than a handle. Reading the roster needs a permission Clarion did not originally ask for, so GitHub holds it until one of your organization owners approves the request under Settings → GitHub Apps → Clarion. Until someone does, repository discovery is unaffected and the Brain’s Sources card notes that the roster was not readable. GitHub only exposes member email addresses for organizations on Enterprise Cloud that have verified their domains and accepted the Corporate Terms of Service. On any other plan GitHub returns no addresses at all, so members are still inventoried — handle, name, role — but not joined to their accounts in other tools.

​
What agents can do

  • Read repository contents, history, and pull requests during an investigation.
  • Assess the blast radius of a code finding across the organization.
  • Open a remediation pull request, push commits to it, and iterate until CI is green.
  • Comment on and label issues and pull requests.
Write actions are gated by your workspace’s tool policy. An agent asks for approval before pushing or opening a PR unless you have explicitly allowed it.

Code & Supply Chain

Repository integrity, CI/CD, and org governance.

Dependabot Alerts

Auto-fix PRs driven to green CI.

​
Disconnect

Open Integrations → GitHub and click Disconnect, then uninstall the Clarion app from your GitHub organization. Agents lose the GitHub tools, and skills referencing them surface the integration as missing until you reconnect.