# Connect a repository
Source: https://docs.infraista.com/en/developer-tools/code-security/connect-a-repository



Connecting a repository gives Infraista read access to its code and permission to report a status
check on commits and pull requests. Scans start from your Git provider's events, so nothing needs to
change in the repository.

**Who can do this:** owners and admins, or a role that can manage Code Security.

## Connect [#connect]

1. Open **Code Security** and select **Connect repository**.
2. **Repositories**: pick your Git connection (or connect GitHub, GitLab or Bitbucket here), then select
   one or more repositories. Repositories that are already scanned are marked.
3. **What to scan**: turn on the scanners you want. At least one must be on.
4. **When**: choose what's scanned.
   * **Scan on push**: each repository's default branch is always scanned. Add other branches or
     patterns, like `develop` or `release/*`.
   * **Pull requests**: scan every pull request and report the result on it. Only findings the pull
     request adds can fail the check.
   * **Nightly scan**: rescans the default branch every night at the time you choose (UTC), so
     advisories published after your last push still show up.
5. **Gate & alerts**: your organization's [policy](/en/developer-tools/code-security/policies) decides
   when the check fails. Optionally make it stricter for these repositories, and pick the notification
   channels for each alert.
6. Select **Connect and scan**.

The first scan of each repository starts right away. You can leave the page while it runs.

## Block merges when the gate fails [#block-merges-when-the-gate-fails]

Each scan reports the `infraista/security` status check. To stop risky changes from being merged, make
it a **required** status check in your repository's branch protection rules. The check name can be
changed in the repository's **Settings**; if you rename it, update branch protection too.

On GitHub, each scan also adds a check run named **Infraista Code Security**, which shows the scan's new
findings on their lines in the pull request's **Files** tab.

## Alerts [#alerts]

Pick notification channels for each event (the same channels Pipelines and Monitoring use):

| Event                                          | When                                                                                                             |
| ---------------------------------------------- | ---------------------------------------------------------------------------------------------------------------- |
| **Gate failed**                                | Any scan whose gate fails, on a branch or a pull request                                                         |
| **New Critical or High on the default branch** | A scan of the default branch finds new Critical or High findings                                                 |
| **Secret found**                               | Right away, whatever the gate says                                                                               |
| **Weekly digest**                              | Mondays 08:00 UTC: open findings, the week's new and fixed findings and scans, and anything past its fix-by date |

## Related [#related]

* [Scans and the gate](/en/developer-tools/code-security/scans-and-the-gate)
* [Policies](/en/developer-tools/code-security/policies)
* [Billing and retention](/en/developer-tools/code-security/billing-and-retention)