# Connect GitHub.

Install the Perfloop GitHub App on the repos you choose. Perfloop reads your code and opens pull requests for approved changes. You review and merge them.

Updated 18 September 2026.

## Access you need

- contents · read & write Reads code from the repos you select. Write access is needed for an approved publication branch. The proxy binds each push to the recorded repository, branch, and commit. Selected code can enter model context through OpenAI or Vertex AI. Commonplane does not use it to train models.
- pull requests · read & write Perfloop can open and update an approved PR, comment, submit comment-only reviews, reply to review comments, and request reviewers. It cannot merge, approve, request changes, close a PR, or change draft state.
- checks · issues · statuses · read Reads CI conclusions, commit status, and PR conversation. GitHub exposes ordinary PR comments through its issue-comment permission.
- administration · read Reads the selected repository's GitHub Actions setting before publishing changes that could run GitHub Actions. It cannot change repository settings.
- metadata · read Mandatory for every GitHub App. Reads repo names and metadata.

Not requested: Actions, secrets, members, deployments, or organization-level permissions. The proxy asks GitHub for only the repository permissions needed by each request. Installation tokens expire within one hour. The App private key stays in Secret Manager and the proxy; no sandbox holds it.

## Setup

### 1 · select your repos

From Perfloop Setup, install the GitHub App. Choose **Only select repositories** and select the repos you want to connect. You can change this list later in the app's installation settings.

### 2 · check branch protection

In each repo, check the rules for your default branch. Require a pull request and review before merge. Keep your existing CI checks required.

### 3 · review the installation

Open **Settings → GitHub Apps → Perfloop** in GitHub to check the selected repos and permissions. Your organization's audit log records the app's activity.

## Remove access

Uninstall the app, or remove repositories from the installation. GitHub then blocks access to those resources. This does not delete records or artifacts already stored by Perfloop; request tenant deletion for that data.

Security questions: [security@perfloop.ai](mailto:security@perfloop.ai?subject=GitHub%20connection%20review)