Getting started
On this page
Install the GitHub App on the repositories you choose. Stackat scans them straight away; there is nothing else to set up.
1. Install one of the apps#
Pick the app that fits your policy:
- Stackpaw opens issues and, when you ask for them, pull requests. Install Stackpaw.
- Stackpaw Audit opens issues only. It can read your code but never change it, for teams whose change policy forbids a bot pushing branches. Install Stackpaw Audit.
On GitHub's install screen choose All repositories or Only select repositories. You can change that choice at any time in your organisation's settings (Settings → GitHub Apps → Configure); Stackat picks the change up on its next scan.
If you plan to keep organisation-wide settings in your
.githubrepository, include that repository when you select repositories. Stackat can only read files in repositories the app was given. See Where the file lives.
An organisation that installs both apps is scanned once, through Stackpaw.
2. The first hour#
| When | What happens |
|---|---|
| Right after installing | GitHub sends you to a welcome page. Your organisation gets its 14-day trial. |
| Within 15 minutes | The first scan of every repository the app can see. It reads YAML, Terraform and HCL files only. |
| Within the hour | The first issues, one per tool behind its latest release, labelled stackat. |
| Any time | Sign in to the dashboard with GitHub. Until the first scan finishes, Overview shows a getting-started checklist. |
An issue is opened once Stackat has read every release between your version and the latest. For a tool many releases behind, that can take a little longer than the first scan; Stackat checks again every 15 minutes until it is complete.
No issues after the first scan? Then every tool Stackat recognised is on its latest release. That is good news, not a fault. If you expected issues, see Troubleshooting.
3. The trial and the free plan#
Every new organisation gets 14 days of everything: every repository, pull requests and audit evidence. No card is needed and nothing is billed automatically.
When the trial ends without a price agreed for Team, Stackat carries on for free:
- one repository is scanned;
- issues only: no pull requests, and
/stackpaw pranswers that pull requests come with Team; - no audit evidence: the tab shows how many issues are recorded, not the issues themselves.
Open issues in the other repositories stay as they are. The details are on Plans and billing.
4. Choose the free repository#
On the dashboard, open Settings and find the Plan box.
- During the trial the choice is called Repository to keep after the trial; on the free plan it is Repository the free plan scans.
- Only an administrator of all the repositories Stackat can read (usually an organisation owner) can choose. Everyone else sees which one it is.
- Archived repositories are not offered: Stackat does not scan them.
- After a change, it can be changed again 30 days later. The box says on which date.
- If nobody chooses, Stackat picks the repository with the most tools when the trial ends, and keeps it.
When the free repository is chosen on the free plan, a scan of it starts at once, so the dashboard does not wait for the next daily scan.
Next steps#
- Read How issues work to understand verdicts and risk.
- Turn on pull requests with
auto_pr: true, or ask for one with/stackpaw pr. - Connect Slack for urgent security fixes and the weekly digest.
- Narrow what Stackat reads, add a cooldown or your registry mirrors in .stackat.yml.