GitHub app (Northstar)
The Northstar GitHub app provides a unified, streamlined way to onboard your GitHub repositories to Contrast Code (SAST and SCA), AI Triage, and SmartFix. Instead of manually configuring workflow files and secrets in each repository, the app handles discovery, authorization, and workflow deployment automatically — at any scale, from a single repo to an entire GitHub organization.
How it works
When you install the Contrast GitHub app, it connects your GitHub organization to Contrast and enables automated onboarding. The app:
Helps you select which repositories to onboard and which Contrast capabilities to enable.
Creates required API keys and credentials directly in GitHub and Contrast.
Once the workflow is in place, Contrast Code (SAST and SCA), AI Triage, and SmartFix run automatically as part of your existing CI/CD pipeline.
Before you begin
Before installing the app:
You must have permission in the target GitHub organization to approve app installation.
Your Contrast account must have Contrast Code or SmartFix enabled.
You must allow the SmartFix coding agent to create fix pull requests (PRs) in your repository. To enable this setting:
Go to your GitHub organization Settings.
Go to Actions > General > Workflow Permissions.
Select the Allow GitHub Actions option to create and approve pull requests.
Install the GitHub app
The integration is a two-step process that starts in Northstar, directs you to GitHub to authorize and configure the application, and then returns to Northstar to finalize the connection.
For Northstar, in the left navigation, select Administration > Integrations.
Select GitHub.
You will be redirected to GitHub. Review the requested permissions and select the repositories the app should have access to. You can choose All repositories or specific ones.
Select Install. You will be redirected back to Contrast to complete the setup.
Confirm the installation in Contrast to finalize the connection.
After confirmation, Contrast discovers all repositories in the connected organization and displays the total count along with primary language information. SAST, SCA, and AI Triage will run automatically upon creation of the workflow file.
Configure capabilities and select repositories
After installation, you can configure which capabilities to enable and which repositories to onboard.
Capability toggles
You can independently enable or disable the following capabilities per repository:
Capability | Description |
|---|---|
SAST | Static analysis of source code for security vulnerabilities |
SCA | Static software composition analysis for open-source dependency risks |
SmartFix | AI-assisted automated remediation of detected vulnerabilities |
AI Triage | Additional AI-powered context on findings to eliminate false positives and verify true positives |
Repository selection
You can choose which repositories to onboard using one of three modes:
All: Applies your configuration to every discovered repository
Specific repos: Search for and select individual repositories
Filter by language: Narrow the list to repositories using a particular primary language. If a repository uses multiple languages, it will appear as Composite, consistent with the Contrast platform convention.
Use the toggles next to each repository to enable or disable individual capabilities.
Choose a commit mode
Before running onboarding, select how the app should write the workflow file to each repository.
Mode | When to use | What happens |
|---|---|---|
Direct commit | Repositories with unprotected default branches | Commits |
Create pull request | Repositories with branch protection rules | Creates a contrast-security-setup branch and opens a pull request into the default branch |
Note
If a Contrast workflow file already exists in a repository, the app will prompt you to either Overwrite the existing file or Skip that repository.
Secret and variable management
During onboarding, Contrast automatically injects the required credentials as GitHub Actions Secrets. Secrets and environment variables are written at the organization level, so they are available to all onboarded repositories without being duplicated in each one. No manual secret configuration is required.
Manage onboarded repositories
After initial onboarding, you can manage your repositories from within Explorer and opening the repository details view.
From there, you can:
View the onboarding status of each repository
Enable or disable individual capabilities (SAST, SmartFix, etc.) per repository
The repository state in Contrast stays synchronized with the GitHub app. Any changes made through the GitHub app management interface are reflected in the Contrast web interface.
IP Address Restrictions
If you have IP address restrictions enabled for GitHub, you may need to add the Contrast IP addresses to your allow list. The IP addresses for Contrast can be found in our SaaS IP address list.
Also, add the following IP addresses to both your GitHub IP allowlist and your Contrast IP allowlist:
34.213.88.3044.226.9.8550.112.236.146