01
1. Install the App
- Open the public App page on GitHub and pick the org. Grant access to all repos you want gated (you can refine later).
- The webhook handshake lands in the background; the install token is minted per-org via the App's private key.
- Verify the install row exists in /settings/integrations — installation_id and target login are populated.
02
2. Drop the manifest
- Add .doesitdefend.yml at each gated repo root: target.endpoint (your chat URL), template (openai_chat / anthropic_messages / simple_json), watched paths.
- Open a PR that touches a watched path. The App receives pull_request, runs the gate, and posts a Check Run + sticky comment within ~2 minutes.
- Merge box shows the Check Run verdict (PROMOTE / HOLD). The sticky comment carries the finding breakdown so reviewers can act inline.