Git on Cloud

​

When to Use It

• You want the fastest setup path
• You cannot deploy a satellite in your environment

​

Prerequisites

• Repositories must be reachable from Resolve cloud
• For GitHub managed auth: GitHub access to install/authorize Resolve
• For GHE (BYO GitHub App) auth: a GitHub App you own on the target GitHub instance, App ID, installation ID, and private key (PEM). See App for GitHub → Bring Your Own GitHub App for app creation steps and required permissions.
• For token auth: provider username + token with required repo permissions

​

Setup

​

Option 1: GitHub Managed Auth (Recommended)

1. Open Git Integrations
2. Create a Cloud Git connection
3. Select GitHub auth
4. Complete the GitHub authorization/install flow
5. Select repositories
6. Verify health check and repository listing

​

Option 2: Bring Your Own GitHub App (GHE)

1. Create the GitHub App on your GitHub instance and install it on the target organization. See App for GitHub → Bring Your Own GitHub App for the full walkthrough; it covers github.com, GHE Cloud, and GHE Server.
2. Capture:
   • API base URL (e.g. https://api.github.com for github.com, or https://ghe.your-company.com/api/v3 for GHE Server)
   • App ID
   • Installation ID (from the install URL, e.g. .../settings/installations/<id>)
   • Private key (PEM)
3. Open Git Integrations and create a Cloud Git connection
4. Select GHE auth and fill in the four fields above
5. Save and verify health check and repository listing

​

Option 3: Token Auth

1. Create a provider PAT with the required scopes. See Creating access tokens for step-by-step token setup for each provider (GitHub, GitLab, and others).
2. Open Git Integrations
3. Create a Cloud Git connection
4. Select Token auth
5. Provide:
   • connection name
   • username
   • token
   • repository HTTPS URLs
   
6. Verify health check and repository listing

​

Connection Schemas

​

GitHub Auth Example

{
  "connection": {
    "authConfigs": {
      "githubApp": {
        "type": "github"
      }
    }
  }
}

​

GHE (BYO GitHub App) Example

{
  "connection": {
    "authConfigs": {
      "myGheApp": {
        "type": "ghe",
        "ghe": {
          "baseUrl": "https://ghe.your-company.com/api/v3",
          "appId": "12345",
          "installationId": "67890"
        }
      }
    },
    "gheAuthCredentials": {
      "myGheApp": {
        "privateKey": "-----BEGIN RSA PRIVATE KEY-----\n...\n-----END RSA PRIVATE KEY-----\n"
      }
    }
  }
}

​

Token Auth Example

{
  "connection": {
    "authConfigs": {
      "prodGithubToken": {
        "type": "token",
        "tokenAuthRemoteURLs": [
          "https://github.com/org/repo-a.git",
          "https://github.com/org/repo-b.git"
        ]
      }
    },
    "tokenAuthCredentials": {
      "prodGithubToken": {
        "username": "your-username",
        "token": "your-token"
      }
    }
  }
}

​

Optional Fields

{
  "connection": {
    "disableWrites": true,
    "disabledSubcommands": ["config", "remote"]
  }
}

• disableWrites
  • Set to true to force read-only mode for this integration.
  • Blocks write/remediation tools.
  • If omitted, default behavior is computed from auth type (github or ghe auth -> writes enabled by default, token-only -> read-only by default).
• disabledSubcommands
  • Blocks specific git <subcommand> operations even when other git tools are available.
  • Example: ["config", "remote"] prevents running git config and git remote.
  • Useful as a hardening control to restrict subcommands you don’t want resolve to run in your repositories.

​

Writes, PRs, and Tool Access

• Read-only repository operations are always available (clone/fetch/search/read/history).
• Write/remediation behavior is controlled by disableWrites.
• If disableWrites is omitted:
  • defaults to false when a github or ghe auth config exists
  • defaults to true for token-only config
• Reading PR data and querying GitHub Actions / PR check status works with any auth that targets GitHub repos and carries the right scopes:
  • github and ghe auth, provided the GitHub App has the recommended permissions
  • token auth, when the repos are hosted on GitHub and the token grants the equivalent scopes (e.g. fine-grained PAT with Actions: Read, Pull requests: Read, Checks: Read, Contents: Read, Metadata: Read)

​

FAQ