CheckRoostCheckRoost
Integrations

GitHub

Check the exact package versions your apps ship against published vulnerabilities, from their lockfiles.

A custom app’s risk is in its packages — the web framework and everything it pulls in. The exact version of each is written in the app’s lockfile, and connecting GitHub lets CheckRoost read it.

What it does in CheckRoost

  • Reads each repository’s lockfile: package-lock.json, pnpm-lock.yaml or composer.lock, at the root of the default branch. Only the packages that ship are kept; test runners, linters and other development tools are left out.
  • Checks those versions against OSV.dev, Google’s open vulnerability database, which gathers GitHub’s own advisories, npm’s, Packagist’s and others. Anything affected appears on the Vulnerabilities page and the linked monitor, with the release that fixes it.
  • Links repositories to monitors automatically when a SpinupWP site deploys from the repository, or when its website is exactly one monitor’s domain. Otherwise you choose on the GitHub integration page.
  • Reads hourly, and reads a repository’s lockfile again only after a push to it.

The repository is what will ship, not always what has

A repository shows the code; the server may still run an older build. Where an app also reports itself with @checkroost/next, that report — what is actually deployed — is used for its monitor instead.

Hooking it up

  1. Step 1. Create a fine-grained token

    GitHub→Settings→Developer settings→Fine-grained tokens→Generate new token. For an organization’s repositories, choose the organization as the resource owner.

  2. Step 2. Give it read access only

    Repository access: all repositories, or the ones to check. Permissions: Contents — Read-only and Metadata — Read-only. Nothing that writes. A classic token is refused: it can push to every repository you can.

  3. Step 3. Paste it into CheckRoost

    Settings→Integrations→GitHub. The page lists the repositories it can see, what each lockfile held, and which monitor each is linked to.

CheckRoost lists repositories and reads lockfiles. It never reads or keeps your code, and it sends nothing to GitHub but read requests.