> ## Documentation Index > Fetch the complete documentation index at: https://docs.sazabi.com/llms.txt > Use this file to discover all available pages before exploring further. # GitHub > Connect GitHub so the Sazabi agent can search your code during investigations, and optionally review new pull requests. ## Supported capabilities Sandbox CLIManual log sourceCore integration * **Sandbox CLI**: [GitHub](https://docs.sazabi.com/catalogs/sandbox-clis/github.md) — Give the Sazabi agent the GitHub CLI (gh) in its sandbox to interact with GitHub repositories, pull requests, and issues. * **Manual log source**: [GitHub Audit Log](https://docs.sazabi.com/catalogs/log-sources/send-to-an-endpoint/github-audit-log.md) — Stream your GitHub Enterprise Cloud audit log, including Git events, to Sazabi through GitHub's Splunk audit log streaming target. * **Core integration**: [GitHub](https://docs.sazabi.com/catalogs/integrations/github.md#core-integration) — Connect GitHub so the Sazabi agent can search your code during investigations, and optionally review new pull requests. Each connection method has its own setup and permissions. Connecting one method does not enable the others. ## Core integration ## About Connecting GitHub gives the Sazabi agent read access to the repositories you select, so it can cross-reference a stack trace with the actual source, see recent changes, and understand pull request context while investigating. GitHub is a **forge** integration; it can also open pull requests and, optionally, review new ones. The agent can: * Search and read source files in your connected repositories. * Correlate errors with recent code changes and pull requests. * Open pull requests with a proposed fix. * Optionally review new pull requests with inline comments (see [Set up automated code review](https://docs.sazabi.com/guides/build/automated-code-review.md)). ## Prerequisites * A GitHub account that can install a GitHub App on the repositories you want to connect. * Organization admin access in Sazabi. ## Set up in the dashboard **Step 1** ### Open the GitHub integration In the dashboard, go to [**Settings > Integrations > GitHub**](https://app.sazabi.com/settings/integrations/github). **Step 2** ### Install the Sazabi GitHub App Start the connection and authorize the Sazabi GitHub App on GitHub. You choose which repositories to grant access to — all repositories or a specific set. GitHub redirects you back to Sazabi when the install completes. **Step 3** ### Map repositories to a project Back in Sazabi, associate the connected repositories with the project where the agent should use them. Code search for a project reads from the repositories mapped to it. You can change repository access later on GitHub under **Applications > Installed GitHub Apps > Sazabi**. ## Set up with the CLI You can also start the GitHub connection with the [Sazabi CLI](https://docs.sazabi.com/reference/cli.md) (installed and authenticated — see [CLI reference](https://docs.sazabi.com/reference/cli/integrations.md)). GitHub connects through a browser flow — the CLI has no `--credentials` for it. Run: ```bash theme={"system"} sazabi integrations connect github ``` The command opens the Sazabi GitHub App install in your browser (sign in to the dashboard as the same user), then waits for the install to complete. `--json` changes only the output: the command still opens the browser and waits for the flow to finish, then prints the resulting connection as JSON: ```bash theme={"system"} sazabi integrations connect github --json ``` If the install needs approval from a GitHub organization admin, the connection appears once they approve — no need to rerun the command. After connecting, map repositories to a project — from the dashboard, or with the CLI: `sazabi repos list` shows the repositories available to the project and `sazabi repos add ` links them for code search. ```bash theme={"system"} sazabi repos list sazabi repos add acme/api acme/web ``` If some repositories in one `repos add` are no longer available, Sazabi links the others and the command lists the ones it couldn't link; run it again after `sazabi repos list` to retry. The API reports each requested link in `results`. Run `sazabi integrations list` to confirm the connection. ## Code search Once GitHub is connected and repositories are mapped to a project, the Sazabi agent searches and reads those repositories to trace an error to the exact file and line during an investigation — cross-referencing a stack trace with the source that produced it. See [Agent tools](https://docs.sazabi.com/guides/investigate/agent-tools.md#your-code). ## Automated code review > [!WARNING] > > **Limited release** > > Automated code review is currently in limited release and is not yet enabled for every organization. [Contact support](https://docs.sazabi.com/guides/administer/support.md) to request access. Sazabi can review pull requests on GitHub with inline comments and a verdict. Enable it with the per-project master switch under [**Settings > Code**](https://app.sazabi.com/settings/code-search), then turn on this integration's own review toggle; request a review on demand by commenting `@Sazabi review` on a pull request. See [Set up automated code review](https://docs.sazabi.com/guides/build/automated-code-review.md) for the full behavior — re-review on new commits, the on-demand request, and agent-opened pull requests. ## Ask the agent from a pull request GitHub is also an **agent surface** — a place you can start an agent thread and read its response without leaving GitHub. Mention **@Sazabi** in a pull request comment with any request (for example, "why did this test start failing?" or "summarize the risk in this change"), and the agent investigates using your connected repositories and project data, then replies in the same comment thread. Keep mentioning it in that thread to continue the conversation. This is separate from automated code review, which runs on its own — here you drive the questions. ## Connected account You can also connect your personal GitHub account under [**Settings > Connected accounts**](https://app.sazabi.com/settings/connected-accounts) so the agent acts as you at GitHub. When you have a personal connection Sazabi uses it first and falls back to this organization integration otherwise. See [Connected accounts](https://docs.sazabi.com/guides/administer/connected-accounts.md). ## Permissions The Sazabi GitHub App asks for the access below. You approve it when you install the app, and an organization owner can review it any time in the organization's **GitHub Apps** settings on GitHub. **Required** * **Contents** (read and write): search and read code, and push the branch for a pull request the agent opens. * **Pull requests** (read and write): open pull requests and read their review comments. * **Metadata** (read): list repositories, branches, and commits. **Optional** Sazabi works without these. When one is missing, the agent skips that source and the connection still shows connected. * **Dependabot alerts** (read): lets the agent see whether a vulnerable dependency in your repository already has a Dependabot alert, which manifest pulls it in, and which version fixes it. The agent uses this when an investigation involves a CVE or a flagged package. * **Code scanning alerts** (read): lets the agent read findings such as CodeQL results for the code involved in a security issue. * **Secret scanning alerts** (read): lets the agent see that a credential was detected in your code. It reads the alert's type, file, and line, never the secret itself, and it never writes a secret value into an issue, message, or log. Rotate any exposed credential on GitHub and resolve the alert there. The agent only reads alerts. It cannot dismiss, reopen, or comment on one. Each alert type also has to be turned on for the repository on GitHub (Dependabot alerts, code scanning, secret scanning). For a repository that doesn't use one, the agent finds no data for it. When Sazabi adds an optional permission to the app, GitHub asks the organization's owners to approve the change. Nothing changes for your organization until an owner accepts. The request appears in the organization's **GitHub Apps** settings on GitHub, and GitHub emails the owners. ## Verify Open [**Settings > Integrations > GitHub**](https://app.sazabi.com/settings/integrations/github) and confirm the connection reads **connected** and lists the repositories you selected. Then, in a thread in the mapped project, ask the agent to find a symbol or file you know exists in a connected repository — it should return the file. If code search returns nothing, confirm the repository is both installed on GitHub and mapped to the project. ## Troubleshooting **Connection shows needs attention** — The GitHub App installation may have been removed or its permissions changed on GitHub. Reconnect from [**Settings > Integrations > GitHub**](https://app.sazabi.com/settings/integrations/github). **Agent can't find code it should see** — Confirm the repository is mapped to the project you are working in; code search is scoped to a project's mapped repositories. **Pull request review isn't running** — Review is a separate opt-in; see [Set up automated code review](https://docs.sazabi.com/guides/build/automated-code-review.md). ## Further reading > [card] [Set up automated code review](https://docs.sazabi.com/guides/build/automated-code-review.md) > > Have Sazabi review new pull requests. > [card] [Code search](https://docs.sazabi.com/guides/investigate/agent-tools.md) > > How the agent searches your connected code. > [card] [Integrations](https://docs.sazabi.com/catalogs/integrations.md) > > Browse the full integration catalog. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.