Skip to main content
This feature is only available on Chainloop’s platform paid plans.
Repository Integration connects a Chainloop organization to a source-code provider so Chainloop can list your repositories, onboard projects and workflows from them, and act on their pull/merge requests. This page is the entry point; it links out to the detailed setup, permissions, and attestation guides.
Only GitHub and GitLab are supported. Other providers (e.g. Bitbucket) are not available.

​
What you get, tier by tier

The integration’s capabilities are layered — they are not all enabled the moment you connect. Connecting alone scans nothing. See Built-in Scanners for run modes and what each scan does, and Connect GitHub & GitLab for the hands-on connect flow.

​
GitHub vs. GitLab

The two providers are genuinely asymmetric. The essentials:

​
Configuration

Configuration splits by audience, not by product edition:
On both Chainloop Cloud and self-hosted instances, an org admin connects the provider from Integrations, then links repositories to projects and picks a delivery mode. This is the same flow everywhere.See Connect GitHub & GitLab.

​
Must-knows

Connecting alone scans nothing. You must link a repository to a project and choose Managed delivery mode for any workflow to run.
  • PR feedback is gated. The AI-trace summary comment only appears when there are AI coding sessions/traces (or a pr-validation run). PR quality checks only run once at least one scan has Run in PRs enabled — you don’t create the pr-validation workflow yourself, Chainloop provisions it on the project’s first pull request. See Scanning in Pull Requests.
  • GitLab connections are org-wide and token-backed. Every Chainloop org member operates through the access token registered for the connection, so use a group or service-account token (not a personal one) to avoid tying access to an individual. Visible projects are those the token can reach at Developer level or above. You can register multiple connections per org.
  • On-prem has a GitHub operator prerequisite. Until an operator creates the GitHub App and sets its Helm values, the GitHub connect flow does not appear. GitLab has no such step.
  • Built-in templates are hidden in the on-prem UI. Self-hosted installs don’t surface Chainloop’s built-in workflow templates in the UI. You can manage custom, org-scoped templates via the CLI (chainloop apply -f), but only in Manual delivery mode.

Connect GitHub & GitLab

The hands-on connect flow.

Built-in Scanners

Run modes, and the tool behind each built-in scan.

GitHub App (self-hosted)

Create the app and set Helm values.

GitHub permissions

Exact scopes the Chainloop GitHub App requests.

GitHub keyless attestation

Attest from GitHub Actions via OIDC.

GitLab keyless attestation

Attest from GitLab CI via OIDC.

Integrations catalog

All Chainloop integrations.