GITHUB INTEGRATION

GitHub Integration

CodeScan can scan any GitHub repository and open a Pull Request with AI-generated security fixes — directly from the web UI or CLI. No GitHub App approval, no webhooks, no local clone required. All you need is a GitHub Personal Access Token.

⎇Scan any repo

Fetch files directly from the GitHub API, run the full 5-step AI pipeline on them, and see findings in the same dashboard as local scans.

⚡Auto-fix & open PR

Apply AI fixes to vulnerable files and commit them to a new branch. CodeScan opens the Pull Request for you with a full diff and review checklist.

🔒Private repo support

Works with private repos using a GitHub PAT with repo scope. The token is used only for the current session and never stored.

⬡Full pipeline, same UI

GitHub files go through secret scanning, dependency scanning, CVE enrichment, regression diff, and CodescanBot — exactly like uploaded files.

Step 1 — Create a GitHub Personal Access Token

A GitHub PAT is required to fetch private repos and to create Pull Requests. For public repos you can try without a token, but you will hit GitHub's 60 req/hour unauthenticated rate limit quickly.

Create a fine-grained token (recommended)

Go to github.com → Settings → Developer settings → Personal access tokens → Fine-grained tokens
Click Generate new token
Set expiry (90 days recommended)
Under Repository access, select the repos you want CodeScan to access
Under Permissions → Repository permissions, grant:
- Contents — Read (to fetch files) and Write (to commit fixes)
- Pull requests — Write (to open the fix PR)
Copy the token — it starts with github_pat_

Classic token (broader access)

Go to github.com → Settings → Developer settings → Personal access tokens → Tokens (classic)
Click Generate new token (classic)
Select the repo scope (includes Contents + Pull requests)
Copy the token — it starts with ghp_

Security note: CodeScan never stores your GitHub token. It is used only for the API calls in your current session and is not logged or persisted anywhere.

Step 2a — Scan from the web UI

In the Scanner, click the ⎇ GITHUB REPO tab in the left sidebar (next to ⬆ UPLOAD FILES).

Scanning a repo

Enter the repo in the first field: owner/repo or the full GitHub URL
Paste your GitHub token in the second field (optional for public repos)
Click ⎇ Fetch & Scan
Files are fetched (up to 60 scannable files) and immediately run through the full AI pipeline
Results appear in the same Code Findings, Dependencies, and Secrets tabs as local scans

Creating a Fix PR

After scanning, apply fixes using ⚡ Apply AI Fix on individual findings or ask CodescanBot ⚡ Apply fix
Once at least one file has been patched, the ⎇ Create Fix PR on GitHub (N files) button appears
Click it — a modal opens to configure the branch name and PR title
Click ⎇ Create PR — CodeScan creates the branch, commits all patched files, and opens the PR
The PR URL appears in the sidebar — click it to review the diff on GitHub before merging

Accepted repo formats

owner/repo
https://github.com/owner/repo
https://github.com/owner/repo.git
https://github.com/owner/repo/tree/main

Step 2b — Scan from the CLI

The codescan github subcommand has two modes: scan (read-only) and fix (scan + patch + PR).

`codescan github scan`

Fetches files from the repo, runs them through the full AI pipeline, and prints a colour-coded report. Read-only — nothing is written to GitHub.

# Public repo (no token needed, but rate-limited)
codescan github scan owner/repo

# Private repo
codescan github scan owner/repo --token ghp_xxx

# Scan a specific branch
codescan github scan owner/repo --token ghp_xxx --branch develop

# Show per-file finding details
codescan github scan owner/repo --token ghp_xxx --verbose

# Save JSON report
codescan github scan owner/repo --token ghp_xxx --output report.json

# Fetch more than 60 files (default)
codescan github scan owner/repo --token ghp_xxx --max-files 120

Scan output example

◈ CodeScan → GitHub: acme/api-server

✔ 42 file(s) fetched from acme/api-server@main

✔ CLEAN  src/utils.ts
✖ VULN   src/auth.ts — 2 issue(s)
✔ CLEAN  src/routes/users.ts
✖ VULN   src/db/queries.ts — 1 issue(s)
...

────────────────────────────────────────────────────────────
GITHUB SCAN SUMMARY — acme/api-server
────────────────────────────────────────────────────────────
  CRITICAL : 1
  HIGH     : 2
  Total    : 3

  → Run "codescan github fix acme/api-server" to apply fixes and open a PR.

`codescan github fix`

The full automated flow: fetch files → scan for vulnerabilities → apply AI fixes → create a branch → commit each patch → open a Pull Request. Requires write access (token with Contents write + Pull requests write).

# Fix high+ findings and open PR
codescan github fix owner/repo --token ghp_xxx

# Dry run — see what would be fixed without writing anything
codescan github fix owner/repo --token ghp_xxx --dry-run

# Fix only critical findings
codescan github fix owner/repo --token ghp_xxx --severity critical

# Custom branch name and PR title
codescan github fix owner/repo --token ghp_xxx \
  --pr-branch fix/security-patches-q2 \
  --pr-title "Security: fix SQL injection and XSS vulnerabilities"

# Scan a non-default branch
codescan github fix owner/repo --token ghp_xxx --branch staging

Fix command flags

Flag	Default	Description
--token <ghp_...>	GITHUB_TOKEN	GitHub PAT with Contents + Pull requests write access
--branch <name>	default branch	Base branch to scan and fix from
--severity <level>	high	Minimum severity to fix: critical \| high \| medium \| low
--max-files <n>	60	Maximum files to fetch and scan
--dry-run	false	Preview what would change without writing to GitHub
--pr-branch <name>	codescan/security-fixes-YYYYMMDD	Name for the new fix branch
--pr-title <text>	auto-generated	Pull request title
-u, --url <url>	codesscan.com	Override CodeScan API base URL

Using GITHUB_TOKEN env var

Set the token as an environment variable so you don't have to repeat it every command:

export GITHUB_TOKEN=ghp_your_token_here

# Token is now read automatically
codescan github scan owner/repo
codescan github fix owner/repo --severity critical

How it works

File tree fetch

CodeScan calls the GitHub API to get a recursive file tree for the repo. It filters to supported source file extensions (TypeScript, Python, Go, Java, Ruby, Rust, etc.) and skips ignored directories (node_modules, dist, build, .git).

Content fetch

Up to 60 files are fetched in parallel batches of 20 concurrent requests. Files over 100 KB are skipped. Content is base64-decoded from the GitHub API response.

AI pipeline

Each file runs through the same 5-step pipeline as local scans: Scan → Investigate → Revalidate → Enrich → Export. Secret scanning and dependency scanning also run if manifest files are present.

Fix generation

For the fix command, each file with auto-fixable findings is sent to the AI fix engine. The minimal patch is generated in context of the full file.

Branch + commits

A new branch is created from the base branch SHA. Each patched file is committed individually using the GitHub Contents API (requires the existing blob SHA for each file).

Pull Request

A PR is opened from the fix branch to the base branch. The body lists every patched file and includes a review checklist. No human interaction needed.

What the Pull Request looks like

🔒 [CodeScan] Security fixes — 3 file(s) patched

codescan/security-fixes-20260514 → main

## 🔒 CodeScan Security Fixes

This PR was automatically generated by CodeScan — AI-powered security scanner.

Files patched (3)
• src/auth.ts
• src/db/queries.ts
• src/api/upload.ts

How to review
1. Check the diff for each file — only the vulnerable lines were changed.
2. Run your test suite to verify nothing broke.
3. Merge when satisfied.

Automating with GitHub Actions

Run CodeScan on every push and automatically open a fix PR when critical vulnerabilities are found:

# .github/workflows/codescan-autofix.yml
name: CodeScan Auto-Fix

on:
  schedule:
    - cron: "0 3 * * 1"   # every Monday at 03:00 UTC
  workflow_dispatch:        # allow manual trigger

jobs:
  autofix:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write

    steps:
      - uses: actions/checkout@v4

      - name: Install CodeScan CLI
        run: npm install -g codescan-flowlog

      - name: Scan and open fix PR for critical findings
        run: |
          codescan github fix ${{ github.repository }} \
            --severity critical \
            --pr-branch "codescan/auto-fix-$(date +%Y%m%d)"
        env:
          CODESCAN_TOKEN: ${{ secrets.CODESCAN_TOKEN }}
          GITHUB_TOKEN:   ${{ secrets.GITHUB_TOKEN }}

Add CODESCAN_TOKEN to your repo secrets (your CodeScan access token from ~/.codescan/config.json). GITHUB_TOKEN is provided automatically by Actions.

Limits & rate limits

Limit	Value	Notes
Files per scan	60 (default)	Increase with --max-files up to 200
Max file size	100 KB	Larger files are silently skipped
GitHub API (no token)	60 req/hour	Use a token to raise this to 5000/hour
GitHub API (with token)	5000 req/hour	Each file fetch uses 1 request
Files fixed per PR	20	Safety cap — run fix again to continue
CodeScan scan quota	Plan limit	Each file scanned counts against monthly allowance

Quick reference

# ── Setup ─────────────────────────────────────────────────────────────
export GITHUB_TOKEN=ghp_your_token

# ── Scan (read-only) ───────────────────────────────────────────────────
codescan github scan owner/repo                    # scan default branch
codescan github scan owner/repo --branch develop  # scan specific branch
codescan github scan owner/repo --verbose          # show all findings
codescan github scan owner/repo --output r.json   # save JSON report

# ── Fix + PR ───────────────────────────────────────────────────────────
codescan github fix owner/repo                     # fix high+ and open PR
codescan github fix owner/repo --dry-run           # preview without writing
codescan github fix owner/repo --severity critical # critical only
codescan github fix owner/repo \
  --pr-branch fix/security \
  --pr-title "Security patches Q2 2026"

# ── Web UI shortcut ────────────────────────────────────────────────────
# Open codesscan.com/scan → ⎇ GITHUB REPO tab → enter repo + token