GitHub Integration
Corridor integrates with GitHub to provide automated PR reviews on every pull request. Connect your repositories to get security analysis before code merges.What you get
- Automated PR reviews: Every pull request analyzed for security vulnerabilities
- Inline comments: Findings posted directly on the affected code lines
- Status checks: Optionally block merges until security review passes
- Finding tracking: Issues persist and track through remediation
Connecting GitHub
Install the GitHub App
Navigate to project settings
In the Corridor dashboard, go to your project and click Settings → GitHub.
Required permissions
The Corridor GitHub App requests:| Permission | Access | Purpose |
|---|---|---|
| Code | Read | Analyze code in pull requests |
| Metadata | Read | Repository information |
| Pull requests | Read/Write | Post review comments |
| Checks | Read/Write | Update status checks |
Corridor only reads code during PR review. We analyze the diff, not your entire codebase, and don’t store source code beyond what’s needed for review.
How PR reviews work
When a pull request is opened or updated:- GitHub sends a webhook to Corridor
- Corridor fetches and analyzes the changed files
- Security review is generated with findings
- Review is posted to the PR
- Status check is updated
Review timing
Reviews typically complete within 1-2 minutes. Large PRs or high-volume periods may take longer.Status checks
Block merges until Corridor approves:Enable status checks
- Go to Project Settings → GitHub
- Toggle on Status Checks
- In GitHub, go to Settings → Branches → Branch protection rules
- Edit (or create) a rule for your main branch
- Enable “Require status checks to pass”
- Select “Corridor Security Review”
Check states
| State | Meaning |
|---|---|
| Pending | Review in progress |
| Success | No blocking issues found |
| Failure | Security issues require attention |
Configuring severity threshold
By default, status checks fail on High or Critical findings. You can adjust this in project settings:- Strict: Fail on Medium and above
- Standard: Fail on High and above (default)
- Relaxed: Fail only on Critical
Review settings
Configure PR review behavior:| Setting | Description |
|---|---|
| Review all PRs | Review every pull request |
| Skip draft PRs | Don’t review until PR is ready for review |
| Branch filter | Only review PRs targeting specific branches |
OAuth authentication
Users can sign in to Corridor with their GitHub account:- Click Sign in with GitHub
- Authorize Corridor to access your GitHub identity
- Your Corridor account links to your GitHub profile
Troubleshooting
Reviews not appearing
- Verify the GitHub App is installed on the repository
- Check that PR reviews are enabled in project settings
- Look at webhook deliveries in GitHub for errors:
- Go to your GitHub organization settings
- Click Developer settings → GitHub Apps
- Find Corridor and click Configure
- Check Recent deliveries for failures
Status checks stuck pending
- Check webhook delivery succeeded
- Verify your team has available PR review credits
- Large PRs take longer—wait a few minutes
- Check the Corridor dashboard for processing status
Permission errors
- Re-install the GitHub App with correct repository access
- Ensure the repository is selected in GitHub App configuration
- Verify your GitHub user has write access to the repo
Webhook delivery failures
- Go to GitHub App settings
- Check Recent deliveries
- Look for HTTP errors (4xx, 5xx)
- If persistent, contact support@corridor.dev