> ## Documentation Index
> Fetch the complete documentation index at: https://docs.clarion.cantina.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# GitHub

> Connect GitHub so Clarion ingests repository security events, discovers your repos into the Brain, and lets agents open remediation pull requests.

GitHub is the integration behind Clarion's code and supply-chain coverage. Once connected, Clarion ingests repository security events, discovers your repositories into the [Brain](/learn/agents/brain), and gives agents the ability to investigate code and open remediation pull requests.

<Note>
  **Estimated time:** 5 minutes. You will need permission to install a GitHub App on your organization.
</Note>

## Prerequisites

* A **GitHub organization** where you can install applications
* A **Clarion workspace** with the GitHub integration page open

## Connect

1. In Clarion, open **Integrations** and find **GitHub** under Essentials.
2. Click **Connect** and complete the GitHub App installation.
3. Choose whether to grant access to **all repositories** or a selected subset.
4. Return to Clarion — the integration shows as connected once the installation callback lands.

### Commit identity

Under the integration's settings you can set the **name** and **email** Clarion uses when an agent authors a commit. Pick something that reads clearly in your history, e.g. `Clarion Agent <clarion@yourcompany.com>`.

<Tip>
  GitHub Enterprise Server is supported by setting a custom **Endpoint URL** on the integration.
</Tip>

## What Clarion ingests

Repository security events feed the **Code & Supply Chain** and **Dependabot Alerts** agents:

* Secret-scanning and code-scanning alerts
* Dependabot vulnerability alerts
* Branch-protection and ruleset changes
* Repository visibility changes
* Force pushes to default branches
* Organization owner additions
* Tag and release activity

## Repository discovery into the Brain

Clarion discovers your repositories as assets, along with the governance metadata that makes them judgeable: rulesets, workflows, open alert counts, org custom properties, and CODEOWNERS. Repositories correlate with cloud resources and observability services that reference them, so an alert on a service resolves to the repository that builds it.

Software bills of materials are captured per repository, which is what lets the Dependabot agent reason about reachability rather than just CVE presence.

## What agents can do

* Read repository contents, history, and pull requests during an investigation.
* Assess the blast radius of a code finding across the organization.
* Open a **remediation pull request**, push commits to it, and iterate until CI is green.
* Comment on and label issues and pull requests.

<Warning>
  Write actions are gated by your workspace's tool policy. An agent asks for approval before pushing or opening a PR unless you have explicitly allowed it.
</Warning>

## Related agents

<CardGroup cols={2}>
  <Card title="Code & Supply Chain" href="/learn/agents/our-agents">
    Repository integrity, CI/CD, and org governance.
  </Card>

  <Card title="Dependabot Alerts" href="/learn/agents/our-agents">
    Auto-fix PRs driven to green CI.
  </Card>
</CardGroup>

## Disconnect

Open **Integrations → GitHub** and click **Disconnect**, then uninstall the Clarion app from your GitHub organization. Agents lose the GitHub tools, and skills referencing them surface the integration as missing until you reconnect.