Connecting GitHub lets FixControl open a Pull Request with an agent's patch after that patch has been approved (the Run fix → verify → approve → PR flow). FixControl never pushes to your default branch and never merges: the Pull Request is where your own review and CI take over.
Before you start
- You are an admin of your FixControl organization.
- You can install GitHub Apps on the GitHub account or organization that owns the repositories (or a GitHub owner can approve the install for you).
- You know which repositories FixControl should be able to reach.
Connect GitHub
- Open Settings → Channels → Code & patch delivery → GitHub.
- Click Connect GitHub. You get three options.
- Pick one and follow the steps below.
| Install on GitHub | Use a device code | Personal Access Token | |
|---|---|---|---|
| Recommended for | Almost everyone | Headless setups, or when you can't sign in to FixControl in this browser | When the other two are not possible |
| PR attribution | The FixControl bot | Your GitHub user | Your GitHub user |
| Token lifetime | Short-lived, rotated automatically | Until you revoke it on GitHub | Until you revoke it |
| Repository access | Only the repositories you select | Whatever your GitHub user can reach | Whatever the token can reach |
Option 1: Install on GitHub (recommended)
- Choose Install on GitHub and click Continue on GitHub.
- On GitHub, pick the account or organization and select the repositories FixControl may access.
- Confirm. You return to FixControl and the connection shows as connected.
FixControl's GitHub App is registered and maintained by FixControl. You don't create an app, a private key or a webhook secret yourself.
Option 2: Use a device code
- Choose Use a device code and click Get a device code.
- Open the GitHub link shown on screen, paste the User code and approve.
- The FixControl page picks up the approval automatically.
Option 3: Personal Access Token (advanced)
- On GitHub, create a classic token with the scopes
repo,workflowandread:user. - Choose Advanced: paste a Personal Access Token, paste it, optionally add your GitHub username, and click Save token.
Pull Requests then appear under the account that owns the token. If that person leaves or the token expires, delivery stops until someone connects again.
Link a repository to a project
A connection alone does not tell FixControl where a project's code lives. Add the repository as a codebase of the project (see Codebases), so agents can read it and patches know where to go.
How delivery works
- A Pull Request opens only after the patch is approved. By default, applying an approved patch is a separate, deliberate click.
- Auto-delivery is a per-project choice, off by default. In the project, open Connections, edit the GitHub connection, open More options and switch on Auto-deliver code — open a PR on this repo after the patch is approved. This requires the repository to be linked as a GitHub codebase.
- FixControl never merges. It opens the Pull Request on a new branch; merging is your team's decision.
- Merged or closed state comes back to FixControl through GitHub's Pull Request events, which FixControl's GitHub App receives. If that state looks stale, open the patch and click Check: FixControl asks GitHub what the Pull Request's state really is.
When something goes wrong
| What you see | What to do |
|---|---|
| The connection shows Reconnect required | The installation was removed or a token was revoked. Connect again from Settings → Channels → Code & patch delivery → GitHub. |
| A patch fails to open a Pull Request for one repository | That repository is probably not selected in the GitHub App installation. Add it on GitHub under the app's repository access, then retry. |
| A Pull Request was merged but FixControl still shows it open | Click Check on the patch. |
FAQ
Can I use more than one option at once? Yes. FixControl uses the App installation first, then a device-code connection, then a Personal Access Token. Some actions, such as answering a GitHub environment review for a deployment gate, need a credential tied to a person; a bot installation cannot act as a reviewer.
Which repositories can FixControl touch? With the App: only the repositories you selected during installation. With a device code or token: whatever that GitHub user or token can reach. FixControl only writes to repositories linked as a codebase.
Can I rotate the webhook secret? No. The webhook secret belongs to FixControl's GitHub App and is managed by FixControl. There is nothing for you to rotate.
Are tokens logged? No. Credentials are stored encrypted. Audit events record the installation and the GitHub username, never tokens.
Related: Git providers (GitLab, Bitbucket) · Codebases · Delivery