One GitHub connection
Connect one Hyperoru GitHub App for sign-in, selected-project reviews, and human-approved pull requests.
Hyperoru uses one GitHub App for account authorization, source selection, audits, and approved remediation. The installation supports personal and organization accounts and always requires an explicit project selection.
Connect
- Sign in to Hyperoru and choose a workspace.
- Select Connect GitHub.
- Choose a personal or organization account.
- Select the projects Hyperoru may review.
- Return to Hyperoru and confirm the connection status.
The callback verifies the actor, account, installation, and selected-project permissions before associating the connection with a workspace. Temporary GitHub user authorization is discarded after verification.
Access by operation
The App has the capability to read source and publish pull requests, but each operation receives a short-lived token narrowed to what it needs:
| Operation | Effective access |
|---|---|
| Sign in and connect | identify the actor and verify the installation |
| Run an audit | metadata read and contents read for one selected project |
| Publish remediation | contents write and pull requests write for one selected project |
| Modify workflow files | workflows write, requested only when an approved patch touches .github/workflows/ |
Write access is never used during an audit. Publishing remediation still requires an Analyst, Admin, or Owner to approve the proposal. Hyperoru never merges automatically.
Manage the connection
The Integrations page shows the connected account, account type, project count, installation status, and a direct management link. If the App is suspended, removed, or loses required permissions, new work is blocked while historical reviews remain available.
Keep project selection explicit
Hyperoru accepts selected-project installations. Broad all-project access should be replaced with an explicit selection in GitHub.