Cloud audits need to read your code, so the connection is a GitHub App you install on the repositories you choose, and it asks for the narrowest set of permissions that makes an audit possible.
Installing
Open Projects in your account
Personal repositories live under Projects. A team’s live under that workspace’s Projects.
Choose Connect GitHub
You are sent to GitHub to install the Iris Code App.
Pick the repositories
Select individual repositories rather than granting access to everything, unless you genuinely want every repository auditable. You can change the selection on GitHub at any time.
Import a repository
Back in Iris Code, choose a repository to import. One audit is queued immediately, pinned to the current head of the default branch.
What the App can read
Three read-only repository permissions, and nothing else:
There is no write permission of any kind. Iris Code cannot push, comment, open a PR, change a setting, or alter a branch. It cannot read your issues, actions, secrets or members.
What it subscribes to
- Push - only for the default branch. A push to any other branch is ignored outright, so feature-branch work never triggers a cloud audit
- Pull request - opened, reopened, and synchronised (a new commit pushed to the branch)
- Installation and Installation repositories - so that removing access, suspending the App, or deselecting a repository stops audits straight away
Deselecting a repository on GitHub, suspending the App, or uninstalling it all revoke Iris Code’s access immediately. Queued audits for that repository are cancelled and are not counted against your allowance.
What leaves your machine, and what leaves GitHub
For a cloud audit, source is fetched from GitHub by the scanner, analysed, and discarded. What is stored is the report: scores, finding counts, severities, file paths, and the dependency list.
This is a real difference from the editor, where analysis happens locally and nothing is uploaded. If you would rather no source was ever fetched, do not connect a repository - the editor and the CLI work exactly as before.
Reconnecting
Reconnecting a repository you had disconnected starts fresh: its previous cloud reports were deleted at disconnect and are not recoverable. Audit history for a repository that merely lost access, through a revoked App or a deselection, is preserved and picks up where it left off once access returns.
Troubleshooting
A repository shows ‘allowance used’
The workspace has spent its scan allowance for the period. Automatic audits resume on their own when it resets. The GitHub connection itself is fine. See Scan allowances.
A repository shows the connection needs attention
Iris Code’s access to that repository ended: it was deselected on GitHub, the App was suspended or uninstalled, or the repository was renamed or moved. Reconnect from GitHub and audits resume, with history intact.
Pushes are not triggering audits
Check three things, in order. That the push was to the default branch, since other branches are ignored. That Audit merges is on for that repository. And that the repository is not paused, which stops every automatic audit while leaving manual ones available.
An audit has been queued for a long time
An audit that no scanner has claimed for fifteen minutes is reported as stalled rather than as slow, because nothing is running it. Cancel it to free the commit for another attempt; a cancelled audit is not counted against your allowance. 
