Configure repository access using GitHub Enterprise Server permissions

Configure Qodo to show users only the repositories they can access in GitHub Enterprise Server. Users keep their existing Qodo sign-in method and link their GitHub account to apply repository permissions.

This configuration applies to Qodo multi-tenant, single-tenant, and on-premises deployments on GitHub Enterprise Server.

Qodo uses two separate GitHub apps for this configuration:

OAuth App: Links each user’s Qodo account to their GitHub Enterprise Server account.
Qodo-generated GitHub App: Connects Qodo to repositories and provides the permission information used to filter repository access.

The following sections explain how to configure both apps, link user accounts, verify repository permissions, and enable repository access filtering.

If your Qodo deployment already has a GitHub Enterprise Server integration, see Replacing an existing installation.

Prerequisites

Before you begin, confirm that:

You can sign in to your Qodo deployment.
Qodo can reach your GitHub Enterprise Server instance over HTTPS.
For on-premises deployments: Your Qodo deployment runs Helm chart version 7.20.0 or later.

Step 1: Create the OAuth App

Role: GitHub Enterprise Server administrator. Create an OAuth App so each user can link their GitHub Enterprise Server account to their Qodo account.

In GitHub Enterprise Server, open Settings.

Go to Developer settings > OAuth Apps.

Select New OAuth App.

Create the app under the appropriate account or organization.

Enter the following values, replacing the examples with your deployment URLs.

Field	Value
Application name	Qodo account linking
Homepage URL	`https://app.customer.example`
Authorization callback URL	`https://portal-api.customer.example/auth/v1/connect-account/callback`

The callback URL must use the publicly accessible Platform API URL. Do not use an internal Kubernetes service URL. This callback is for account linking and is different from the callback used for SSO.

Create the OAuth App.

Copy the Client ID and generate a Client secret.Follow these guidelines:

Share the Client secret through your organization’s approved secret manager. Do not send it in chat or tickets, include it in frontend configuration, or commit it to source control.
Use a separate OAuth App for each environment where appropriate.
Do not delete the OAuth App when replacing the GitHub App. The OAuth App handles account linking and is separate from the GitHub App used to connect repositories.

Step 2: Install the Qodo-generated GitHub App

Role: GitHub Enterprise Server organization or app administrator, working with a Qodo administrator. Create a GitHub App through Qodo. The app requests the permissions required for repository access filtering.

Go to Integrations and select Add installation.

Select GitHub Server and enter your GitHub Enterprise Server organization URL.

Follow the installation wizard. Qodo creates the GitHub App with the required permissions.

If the requested app name is already in use, choose a unique name.

Review the requested permissions and install the app on the repositories approved for Qodo access.

Confirm that the installation is active and repository synchronization succeeds.

The manifest includes the following read-only permissions:

Permission	Access	Purpose
`Repository: Metadata`	Read-only	Reads repository information.
`Repository: Administration`	Read-only	Reads collaborator and repository permission information.
`Organization: Members`	Read-only	Provides organization and team attribution.
`Organization: Administration`	Read-only	Provides organization base-permission attribution.

Retain all other permissions requested. These read-only permissions do not grant users GitHub administrator access.

Step 3: Configure Qodo

Role: Kubernetes or DevOps operator. Configure Qodo with the OAuth App credentials and the hostname of your GitHub Enterprise Server instance.

Create a Kubernetes Secret

Create a Secret containing the OAuth App Client secret:

kubectl -n <namespace> create secret generic qodo-platform-github-connect \
  --from-literal=DYNACONF_AUTH__GITHUB_CONNECT__CLIENT_SECRET='<your-github-oauth-client-secret>'

Replace <namespace> with your Qodo namespace and provide the Client secret generated when you created the OAuth App.The Secret name must be qodo-platform-github-connect, and its key must be DYNACONF_AUTH__GITHUB_CONNECT__CLIENT_SECRET.

Update the deployment configuration

Rules and guidelines:

Set filteringEnabled to false only when configuring repository access filtering for the first time. This allows Qodo to calculate and verify repository permissions before filtering repository visibility.
If filtering is already enabled, preserve the existing setting unless an approved change requires otherwise. Disabling filtering restores unfiltered repository access.
Preserve existing configuration values and apply changes through your normal Helm or GitOps deployment process. Do not patch running workloads manually. Replace the example hostname, Client ID, and URLs with the values for your deployment. The GitHub host value is the hostname only, without the scheme or path.

Add the following values to your deployment’s Helm values or configuration Overlay.

global:
  repositoryAccess:
    enabled: true
    filteringEnabled: false

platform:
  env:
    DYNACONF_GIT_INTEGRATION__GITHUB__HOST:
      value: github.customer.example
    DYNACONF_AUTH__GITHUB_CONNECT__CLIENT_ID:
      value: "REPLACE_WITH_OAUTH_APP_CLIENT_ID"
    DYNACONF_AUTH__GITHUB_CONNECT__CLIENT_SECRET:
      valueFrom:
        secretKeyRef:
          name: qodo-platform-github-connect
          key: DYNACONF_AUTH__GITHUB_CONNECT__CLIENT_SECRET
    DYNACONF_AUTH__GITHUB_CONNECT__CALLBACK_URL:
      value: "https://portal-api.customer.example/auth/v1/connect-account/callback"
    DYNACONF_APP__BASE_URL:
      value: "https://portal-api.customer.example"
    DYNACONF_AUTH__REDIRECT_URI__VALIDATION_ENABLED:
      value: "true"
    DYNACONF_AUTH__REDIRECT_URI__STRICT_MODE:
      value: "true"
    DYNACONF_AUTH__REDIRECT_URI__ALLOWED_DOMAINS:
      value: '["https://app.customer.example","https://portal-api.customer.example"]'

Step 4: Link a GitHub account

Role: Each Qodo user. Each user must link their GitHub Enterprise Server account so Qodo can associate their identity with the repository permissions provided by the GitHub App.

While repository access filtering is disabled, users must link their accounts manually. Qodo does not display the automatic account-linking prompt in this state.

In the bottom-left corner, open your profile menu.

Select Link your Git user account, then select GitHub.

Authorize the OAuth App on your GitHub Enterprise Server instance.

Return to Qodo and confirm that your GitHub username appears as linked.

Verify repository permissions

Before enabling filtering, confirm that the GitHub App installation is active and that repositories appear in Qodo as expected. To verify:

In the Qodo portal, check that the repositories installed through the GitHub App are visible.
If expected repositories are missing or permissions appear incorrect:
- Confirm the GitHub App installation is active and includes the required repositories.
- Check for pending permission approvals in the GitHub App settings in GitHub Enterprise Server.
- Confirm the GitHub App has all four required permissions listed above.
- If the issue persists after checking the installation, contact Qodo support to recalculate repository permissions.

Do not enable filtering until the expected repositories are visible.

Step 5: Enable repository access filtering

Role: Kubernetes or DevOps operator. Enable filtering only after repository permissions have been calculated and verified.

Update your deployment configuration:

global:
  repositoryAccess:
    enabled: true
    filteringEnabled: true

Deploy the change through your normal Helm or GitOps workflow, then hard-refresh the Qodo portal.

With filtering enabled, Qodo uses the linked user’s GitHub Enterprise Server permissions to determine which repositories are visible to that user.

Step 6: Verify the configuration

Test with users whose GitHub Enterprise Server repository access is known.

A repository the user can access in GitHub Enterprise Server should be visible to that user in Qodo.
A repository the user cannot access in GitHub Enterprise Server should be hidden from that user in Qodo.
An unlinked user with an active supported GitHub Enterprise Server installation is prompted to link their account.
A user who has already linked their account is not prompted to link it again.

Repository access filtering also applies to human administrators. Administrator status in Qodo does not bypass the configured repository access filtering. Qodo considers eligible installations on the configured GitHub Enterprise Server host. Qodo supports one GitHub Enterprise Server host for each deployment. Disconnecting a linked GitHub account removes the account link and its associated repository grants.

Replacing an existing installation

Use this procedure if GitHub Server is already configured in your Qodo deployment and you need to replace the existing GitHub App with one generated from Qodo’s updated manifest. Rules and guidelines:

Schedule a maintenance window before starting. Removing the existing installation interrupts Qodo reviews and webhooks until the replacement setup is complete.
Do not delete the OAuth App. It handles account linking and is separate from the GitHub App installation.
Do not reuse the old GitHub App configuration. Create a new installation through Qodo to apply the required permissions.

Replace the installation in this order:

Record the approved repository selection and any installation-specific settings that must be restored.

In the Qodo portal, go to Integrations and remove the existing GitHub Server installation.

Confirm the uninstall in GitHub Enterprise Server. If the app remains installed, ask the installation owner to uninstall it.

In the Qodo portal, go to Integrations, click Add installation and select GitHub Server.

Enter your GitHub Enterprise Server organization URL.

Follow the wizard to create a new GitHub App through Qodo. If the app name is already in use, choose a unique name.

Review the requested permissions and install the new app on the approved repositories.

Confirm that the new installation is active and repository synchronization succeeds.

Reapply any installation-specific settings you recorded earlier.

Create the OAuth App, as described in Create the OAuth App. An existing installation does not have one, because account linking is new.

Complete the Qodo configuration, account linking and permission verification, and filtering enablement steps as needed.

Troubleshooting

Expected repositories are hidden

Confirm that the user has linked their GitHub Enterprise Server account.
Verify that the repository is included in the GitHub App installation’s repository selection.
Check that the GitHub App has the required permissions and that any pending permission approvals have been completed.
Verify that repository permissions were calculated correctly before changing the filtering configuration.

Repository permissions are missing or incorrect

Check the GitHub App installation and its permissions, including any pending approvals. After correcting the installation or permissions, recalculate repository permissions before enabling or changing filtering.

A user is not prompted to link their account

Confirm that repository access filtering is enabled and that the user has not already linked their GitHub Enterprise Server account. Users who have already linked their account are not prompted again.

The avatar is empty or the administrator interface looks incorrect after disconnecting an account

Refresh the portal and sign in again. If the issue persists, contact Qodo support.

For multi-tenant deployments: see Install the GitHub Enterprise server (MT)
For single-tenant deployments: see Install the GitHub Enterprise server (ST)
For on-premises deployments: See Install the GitHub Enterprise Server integration (on-premises)

Core concepts

Onboard Qodo for admins

Git providers

Integrations

Pricing, deployment & support

Configure repository access using GitHub Enterprise Server permissions

Prerequisites

Step 1: Create the OAuth App

Step 2: Install the Qodo-generated GitHub App

Step 3: Configure Qodo

Step 4: Link a GitHub account

Verify repository permissions

Step 5: Enable repository access filtering

Step 6: Verify the configuration

Replacing an existing installation

Troubleshooting

​Prerequisites

​Step 1: Create the OAuth App

​Step 2: Install the Qodo-generated GitHub App

​Step 3: Configure Qodo

​Step 4: Link a GitHub account

​Verify repository permissions

​Step 5: Enable repository access filtering

​Step 6: Verify the configuration

​Replacing an existing installation

​Troubleshooting

​Related resources

Prerequisites

Step 1: Create the OAuth App

Step 2: Install the Qodo-generated GitHub App

Step 3: Configure Qodo

Step 4: Link a GitHub account

Verify repository permissions

Step 5: Enable repository access filtering

Step 6: Verify the configuration

Replacing an existing installation

Troubleshooting

Related resources