Repository scope
Which repositories count as your organisation's, how scans, the GitHub App and forge connections put them there, the Repositories list and its filters, and where the Software Factory narrows scope further.
There is no list of repositories you must keep up to date. A repository is in your organisation’s scope because something ties it to you.
How a repository becomes yours
| Source | How | Kind |
|---|---|---|
| A scan | Any vulnetix scan or upload records the git remote it ran in. The repository is named by its owner/name full name on the forge. |
org |
| The GitHub App | An installation on your tenant covers the repository, either because the installation is on All repositories or because the repository is in its selection | org |
| A forge connection | A GHES, Gitea, Forgejo or GitLab connection lists the repository. Its name is host/owner/name. |
org |
| A dependency | The repository is the upstream source of a package you depend on | dependency |
A scan run in a directory with no git remote has no repository name and does not appear here.
The GitHub App
Install the Vulnetix GitHub App from Configuration › Integrations (/resolve/integrations). On GitHub, choose All repositories or Only select repositories: that selection is the repository list the App can see. Change it on GitHub at any time; the installation_repositories webhook updates Vulnetix.
An installation started on GitHub instead of from Integrations needs a signed-in owner to claim it within 10 minutes (POST /v1/integrations/github/claim). An installation is never bound by matching an account name. See Integrations.
Check what the App can reach with GET /v1/integrations/github/repos/status?repo=acme/payments&repo=acme/ledger, up to 20 repo values. This route takes the console session only, not an API key. Each answer is {repo, installed, installationId, ownedByTenant, private, canWriteIssues, installUrl, source}. installUrl opens the App’s install page for that account so you can add the repository; source is unknown when GitHub could not be asked.
The Repositories list
Inventory › Repositories (/resolve/repositories). GET /v1/repositories:
| Parameter | Values |
|---|---|
page, perPage |
perPage default 50, maximum 100 |
q |
name search |
host |
forge host, for example github.com |
kind |
org, dependency, all |
signal |
comma list of malware, vulns, findings, archived, enriching, clear. Any other value is 400. |
sort, dir |
name, vulns, lastscan; asc or desc |
| Signal | Meaning |
|---|---|
malware |
The repository is flagged malicious |
vulns |
It has open vulnerabilities |
findings |
It has open findings other than vulnerabilities |
archived |
It is archived on the forge |
enriching |
Forge metadata is still being fetched |
clear |
No malware, no vulnerabilities, no open findings |
Per-repository detail takes ?fullName=owner/name: /v1/repositories/detail, /facets, /scanner-results, /findings, /dependencies, /package-managers, /malware, /firewall-logs. /v1/repositories/names is a cheap name list; /v1/repositories/search also returns connected repositories never scanned.
POST /v1/repositories/resolve turns a typed reference into a stored repository, fetching it from the public forge when Vulnetix has never seen it. Campaign scopes use it, so a typo is refused rather than saved.
Narrower scopes
Some features act on a subset:
| Feature | Its scope |
|---|---|
| Software Factory | Only managed organisations: installations or forge accounts switched on, and within them the repositories of interest (any_signal, scanned_or_pix or watched_only), with archived and SBOM-only dependency repositories excluded unless switched on. See Managed scope. |
| Campaigns | The repositories named in the campaign’s scope. See Scope and done criteria. |
| Suppressions | A rule with a repository applies to it alone; without one, to every repository. |