Skip to content

Quickstart

Get Repohelm connected to your first repository and receive your first fix pull request in under five minutes.

Prerequisites

Step 1: Install the GitHub App

From your Repohelm dashboard, click Connect repository. You will be redirected to GitHub to install the Repohelm GitHub App.

Permissions requested:
  - Read: Contents (manifest files only)
  - Read: Metadata
  - Write: Pull requests

Authorize the app. You will return to your Repohelm dashboard automatically.

Step 2: Select repositories to monitor

Choose which repositories Repohelm should watch. On the Free plan, you can connect up to 5 repositories. All ecosystems in each repo are included.

Step 3: Review the default policy

Repohelm ships a default policy for new connections. It is stored as .repohelm.yaml in your organization root. You can customize it or start with the defaults.

version: "2"
policy:
  severity_threshold: CRITICAL
  auto_merge:
    enabled: false
  licenses:
    warn: [LGPL-2.1, GPL-3.0]

Step 4: Trigger your first scan

Scans run automatically on push events and on a daily schedule. To trigger a manual scan immediately:

From your dashboard: Repositories > Select repo > Scan now

The first scan indexes your full dependency graph. Subsequent scans are incremental.

Step 5: Merge your first fix PR

Within minutes of a completed scan, Repohelm will open pull requests for each policy violation found. Each PR includes:

  • The exact version bump with diff
  • CVE reference and CVSS score
  • Reachability analysis: whether the vulnerable path is actually callable
  • Auto-merge eligibility status

Review the PR in GitHub and merge. That's it.

Next steps