Connect GitHub or GitLab, select repository branches, and operate provider access safely.
Connect a code provider when you are ready for BIMP to scan selected repositories and create reviewable remediation pull or merge requests.
Supportability matrix
Section titled “Supportability matrix”| Provider | Connection | Repository discovery | Remediation |
|---|---|---|---|
| GitHub | BIMP GitHub App installation | Yes | Pull requests |
| GitLab | Group path and group access token | Yes | Merge requests |
Other code providers are not currently available through the product.
For the integration architecture, token security, exact provider permissions, and provider-side revocation steps, see Integration Permissions.
Connect GitHub
Section titled “Connect GitHub”Open Settings → Integrations → Code providers, choose Connect GitHub, and complete the GitHub App installation.
In GitHub, select the account and the repositories the installation may access. GitHub remains the source of truth for that installation scope. BIMP records the installation identity and uses short-lived installation credentials rather than asking you to store a personal access token.
After GitHub returns to BIMP, confirm that the expected account appears as an active connection.
Recover a GitHub connection
Section titled “Recover a GitHub connection”If the callback reports missing or expired state, confirm the active BIMP organization and start the installation again. If repositories are missing, update the GitHub App repository selection, then reload repository discovery.
If the GitHub App is unavailable in BIMP, the environment administrator must configure it before an organization can connect.
Connect GitLab
Section titled “Connect GitLab”Open Settings → Integrations → Code providers, choose Connect GitLab, then enter:
- the GitLab group path;
- a group access token with the access required for discovery and remediation; and
- an optional webhook signing token.
BIMP validates the group token before saving it and encrypts stored provider secrets. Configure the displayed webhook URL in GitLab when provider events are required.
Use Check token to confirm an existing connection. If the check fails, replace or renew the GitLab token with the required group access, then connect the group again as directed by the product.
Select repositories and branches
Section titled “Select repositories and branches”Open Repositories, choose Add repositories, and select a provider connection. Repository visibility appears beside the name. Open a repository row to load and select its branches.
Provider access determines which repositories BIMP can offer. BIMP then tracks only the repositories and branches you select.
Assign the repository’s team and routine after adding it. Those assignments apply at repository level while each tracked branch retains separate scan and remediation context.
Rescan repositories
Section titled “Rescan repositories”Use Rescan on the provider connection to queue scans for its active tracked repositories. The connection page also shows provider rate-limit state when it is available.
If the provider is rate-limited, wait until the displayed reset or backoff time before retrying. Repeated retries do not restore provider quota.
Add and remove repositories with the API
Section titled “Add and remove repositories with the API”The runtime OpenAPI contract exposes organization-scoped operations for:
- listing provider connections;
- listing available repositories and branches;
- adding tracked repositories;
- removing tracked repositories; and
- requesting a connection scan.
GitHub installation and GitLab connection completion are separate provider-specific flows. Use their documented endpoints and never put provider tokens in repository files or build logs.
BIMP does not currently promise automatic onboarding whenever a new provider repository is created. Automation can periodically discover available repositories and add an explicitly approved set through the API.
For a complete discovery, creation, assignment, and verification workflow with
curl, see Automate Repository Setup.
Disconnect a provider
Section titled “Disconnect a provider”Remove tracked repositories that depend on the connection, then choose Disconnect.
For GitHub, BIMP also attempts to uninstall the GitHub App installation. If that provider-side action fails, the connection remains so you can retry safely. For GitLab, BIMP removes the stored connection and secret settings after dependent repositories are cleared.
If disconnection is blocked, review the message and remove the listed repository dependencies before trying again.