Install the App at the organization level, grant it only the repositories that need gating, and drop a manifest in each participating repo. After that, a pull request that touches a watched path starts a check on its own.
Two controls do different jobs: repository access decides where the App can receive events; the manifest decides what the check tests. Keep both minimal.
1. Install the App
- Open the app page on GitHub, choose the organization, and grant access only to the repositories that need the integration.
- Return to /settings/integrations and confirm that the installation appears for the intended organization.
- Repository access controls where the app can receive events; the repository manifest controls what the check should test.
Grant access per repository rather than org-wide — installation scope is a security decision, not a convenience. Return to /settings/integrations and confirm the installation appears for the intended organization before configuring manifests.
2. Add the manifest
- Add `.doesitdefend.yml` at the repository root. Start with the minimal manifest below, then replace the example endpoint and watched path with values for your repository.
- target: endpoint: https://preview.example.com/chat template: simple_json system_prompt: prompts/system.md watch: - config/rag.yaml
- Open a test pull request that changes a watched path and confirm that GitHub records the check in the pull request's Checks tab. Runtime depends on the target and selected scenarios.
- In the Checks tab, read the verdict together with its finding details. A passing check covers the configured target and watched artifacts; it is not a certificate for the whole application.
Start from the minimal .doesitdefend.yml and replace the example endpoint and watched paths with your own. Open a test pull request that changes a watched path, confirm GitHub records the check, and read the verdict together with its finding details — a passing check covers the configured target and watched areas, nothing more.