Contents

Connect

Code hosts

Akesis works with GitHub, GitLab.com and Bitbucket Cloud. Connect them in Integrations → Code hosts (admins). Every repository Akesis adds starts at suggest-only (T0).

GitHub

  1. Click Connect GitHub. GitHub asks where to install the Akesis by Valitura app and which repositories it may see.
  2. Choose Only select repositories and pick the ones you want, or All repositories.
  3. GitHub returns you to Akesis, which adds the repositories and starts syncing Dependabot alerts.

Adding or removing repositories later is done on GitHub, not in Akesis: open the app's installation (your organization's Settings → GitHub Apps, or your account's Settings → Applications for a personal account), click Configure, and change the repository selection. Akesis picks the change up within about 5 minutes, and syncs a newly added repository's alerts straight away. Add another GitHub account in Akesis is only for a different organization or user.

If the app is already installed (for example by a colleague), use Link an existing installation. GitHub confirms that you can access it before Akesis links it.

What the app may do: read Dependabot alerts, checks, commit statuses and metadata; read and write code and pull requests. It has no administration permission, so it can't change branch protection, rulesets or settings. Every change it makes arrives as a pull request.

GitLab.com

  1. In GitLab, create a group access token with the Maintainer role and the api scope.
  2. In Akesis, under GitLab, enter the group path and the token. Akesis checks the token by listing the group's projects (subgroups included), then adds them and registers its webhooks.
  3. GitLab has no Dependabot, so findings come from Snyk, and fix merge requests come from Snyk and Renovate. Find fix MR accounts lists the accounts behind recent Snyk and Renovate merge requests so you can trust them.

Merges are pinned to the commit Akesis checked, and Revert this fix opens a revert merge request. Self-managed GitLab isn't supported yet.

Bitbucket Cloud

  1. In Bitbucket, create a workspace access token with Repositories: Read & Write, Pull requests: Read & Write and Webhooks: Read & Write.
  2. In Akesis, under Bitbucket, enter the workspace ID and the token. Akesis checks it, adds the workspace's repositories and registers webhooks on each.
  3. Use Find fix PR accounts to pick the accounts Snyk and a self-hosted Renovate open pull requests as.

Bitbucket has no revert API, so Revert this fix builds the revert itself. It restores the files the fix changed to their state before the merge, on a branch named akesis/revert-pr-<number>, and opens a pull request for a person to merge. If any of those files changed after the merge, it refuses and names them rather than overwrite later work; revert the merge commit in Bitbucket then.

Renames and tokens

Renamed or moved repositories are followed automatically, keeping their findings, policy and history. Tokens you enter are stored encrypted and never shown again; you can replace a token or disconnect at any time, which deletes the token and keeps the history.