Skip to main content
Instalog integrates with GitHub as a GitHub App. One install per organization, then pick which repositories Instalog can see.

​
Installing

Visit github.com/apps/instalog and click Install. Pick either All repositories or Only select repositories, and choose the repos. The same page is where you change the repository list later. Installation does not auto add new repositories. To enable Instalog on a new repo, edit the app installation.

​
Permissions requested

PermissionWhy
Code (read)Read the diff and surrounding files for context.
Pull requests (read and write)Read PR metadata and post review comments.
Checks (write)Create the instalog/review check.
Metadata (read)Required by GitHub for any app.
Members (read, org only)Map review activity to team members in the dashboard.
Contents (read)Fetch instalog-ai.yaml and .semgrep/ files.
We do not request write access to code, branch protection, secrets, or actions.

​
Webhook events Instalog subscribes to

  • pull_request (opened, synchronize, ready_for_review, labeled, unlabeled)
  • pull_request_review_comment (to read reactions on Instalog comments)
  • installation (added, removed, suspended)
  • installation_repositories (added, removed)

​
Branch protection

To gate merges on Instalog, add instalog/review to required status checks.
  1. Repo Settings → Branches → Branch protection rules → Edit on the rule for your default branch.
  2. Under Require status checks to pass before merging, search for instalog/review and enable it.
  3. Save.
The check reports:
  • success if no blocking findings remain.
  • failure if a finding matches a category in rules.block_on.
  • neutral if Instalog skipped the PR (filtered, no relevant files, etc).
neutral does not block merges, even when the check is required.

​
Comment behavior

Instalog posts:
  • One top level summary comment on the PR, with the count of findings, drop rate, and a link to the dashboard.
  • Zero to N inline comments, capped by max_suggestions_per_file and the global PR cap.
When you push new commits, Instalog edits the summary in place and marks superseded inline comments as outdated. Outdated comments are collapsed by GitHub but not deleted, so reviewers can see history.

​
Comment format

integrations.github.comment_format controls verbosity:
  • concise (one or two sentences plus rule citation)
  • detailed (full explanation plus suggested fix in a code block)
Default is detailed. Switch to concise if your team prefers terse feedback.

​
integrations.github schema

integrations:
  github:
    comment_format: detailed          # concise | detailed
    auto_approve_minor: false         # automatically approve PRs with no findings
    require_human_review: false       # require a human approval even if Instalog approves
    suppress_summary: false           # skip the top level summary comment
    show_drop_summary: false          # add a footer listing dropped findings with reasons
FieldDefaultDescription
comment_formatdetailedVerbosity of inline comments.
auto_approve_minorfalseWhen true, Instalog approves PRs that produce zero findings after filtering. The approval comes from the Instalog GitHub App account.
require_human_reviewfalseBlock merges until a human approves, even if auto_approve_minor is on.
suppress_summaryfalseSkip the summary comment. Inline comments still post.
show_drop_summaryfalseAppend a footer to the summary listing every finding that was dropped, with reason.

​
Removing Instalog

Uninstall from the GitHub App page. The check stops appearing on new PRs immediately. Existing comments are not deleted, since they belong to the Instalog bot user. Stored embeddings and review history are retained for 90 days for billing reconciliation, then deleted. Email [email protected] for immediate deletion.

​
GitHub Enterprise Server

Instalog supports GitHub Enterprise Server 3.10 and above. Contact [email protected] for the on prem installer.

​
Troubleshooting

Instalog stopped reviewing PRs: check the Checks tab on a recent PR. The instalog/review check status will say skipped with a reason, or failure with details. If the check is missing entirely, the app may have been uninstalled or suspended. Reviews are arriving but no inline comments appear: confirm max_suggestions_per_file and confidence_threshold. The summary comment will say how many findings were dropped vs posted. Comments are duplicated on push: check trigger_on_updates. If it is true (default), reviews rerun on every push. Old comments should be marked outdated automatically. If they are not, file an issue.