Integrations · Source control
The Aspian GitHub App scans your repos, applies the baseline, and acts as a deployment protection rule so production waits for an approval.
Control levels
1Observe
We watch, record and flag.
Webhooks and the audit log: every merge, review and deployment, scored against the baseline pack.
2GateRecommended
The tool waits for an approval.
A custom deployment protection rule on your production environment. The job waits until the change is approved.
3Hold
Only Aspian holds the credentials.
OIDC environments: the production credential is issued only to Aspian’s deploy job for an approved change.
Set it up
- 1Install the Aspian GitHub App on your organisation, all repos or chosen ones.
- 2See the scan: baseline score, unreviewed merges and unapproved deploys from the last 90 days.
- 3Add the Aspian rule to your production environment, starting in Evaluate.
Limits worth knowing
- GitHub’s custom deployment protection rules are in public preview, and on Free, Pro and Team they only apply to public repos. On private repos we gate at the deploy target instead.
See what shipped without approval in your last 90 days.
Install the GitHub App and the scan arrives in minutes: every repo scored, every unreviewed merge and unapproved deploy named. Nothing is blocked until you choose.
Ship like a startup. Prove it like a bank.