HomeFeaturesPricingDocumentationContactDOWNLOAD

GitHub and Jira

Connect GitHub for deploy and PR signals, and link SiteCMD findings to tickets in GitHub Issues or Jira.

GitHub and Jira are two integrations in one category because they overlap. GitHub gives you both repository signals (deploys, workflow runs, open PRs) and an issue tracker. Jira is purely a destination for tickets. SiteCMD treats them as a pair: the source of deploy data plus the destination for findings.

Ticket mirroring and repository signals are both part of the complete free local workbench.

GitHub

GitHub connects two ways; both end up in the same place.

Setup via the Deploys page (OAuth device flow)

  1. Open Deploys from the sidebar and click Connect on the GitHub card.
  2. SiteCMD shows a short device code and points you at GitHub’s device authorization page.
  3. Sign in to GitHub if you aren’t already, enter the code, and approve. SiteCMD picks up the token within a few seconds.
  4. Back in SiteCMD, pick the repository this project corresponds to from the list.

SiteCMD doesn’t ship with an embedded client secret (desktop apps can’t keep one safe), so the device flow is the right OAuth pattern for it.

Setup via Settings (personal access token)

  1. Create a GitHub personal access token with repository read access at github.com/settings/tokens. Name it something obvious like “SiteCMD”.
  2. In SiteCMD, Settings → Integrations → GitHub.
  3. Enter the repository as a slug in owner/repository format (e.g. vercel/next.js).
  4. Paste the token and save.

Either way, the token stays in your OS keychain, never in the SiteCMD database. If the token expires or gets revoked, the integration shows an error state and you reconnect the same way.

What it pulls

  • Workflow runs. Recent CI runs (success, failure, in-progress) for the repo.
  • Deployments. Recent deploys, environments, statuses. Used for “this issue appeared right after deploy abc123” correlation.
  • Open PRs. Currently open pull requests.
  • Latest release. The newest release tag if the repo uses GitHub Releases.

Where it shows up

  • Deploys page. Recent deploys and CI activity with timing.
  • Activity timeline. Each deploy, workflow failure, and release becomes an event in the project’s unified timeline.
  • Issues page. A scan finding that appeared after a specific deploy gets correlated to that deploy directly.

Jira

Jira connects via API token plus your Jira site URL.

Setup

  1. Sign in to Atlassian’s account page.
  2. Click Create API token. Name it something obvious like “SiteCMD”.
  3. Copy the token.
  4. In SiteCMD, Settings → Integrations → Jira.
  5. Enter:
    • Your Jira site URL (e.g. your-company.atlassian.net)
    • The email for your Atlassian account
    • The API token you just copied
    • The project key (e.g. PROJ) and issue type SiteCMD should use for new tickets
  6. Save.

What Jira does (and doesn’t) do

Jira is a ticket destination, not a data source. SiteCMD doesn’t read your existing Jira tickets, doesn’t pull velocity data, doesn’t surface other team activity. The integration is one-way: SiteCMD → Jira.

Ticket mirroring

SiteCMD can mirror a scan finding into your tracker as a ticket. A mirrored ticket carries:

  • The finding title, prefixed [SiteCMD] so mirrored tickets are easy to spot
  • Labels for the severity and category (plus a sitecmd label), on both GitHub and Jira
  • The finding’s description and fix details as the body
  • The page or file the finding points at

The resolution loop

Mirroring is two-way at the resolution end, and the scan stays the source of truth in both directions:

  • When a linked finding passes on a rescan, SiteCMD resolves the finding and closes the linked GitHub or Jira ticket with a comment saying the check now passes.
  • When you close the ticket by hand, SiteCMD does not mark the finding fixed. The next scan does that, when it confirms the underlying check passes. Closing a ticket is a project-management action; fixed is something the scan verifies.

Why mirroring is per-finding, not automatic

We deliberately don’t auto-mirror every finding into your tracker. Scan findings get noisy, especially on the first scan of a real site. The intended workflow is: triage in SiteCMD, mirror the ones you’ve decided to actually work on, leave the rest in SiteCMD.

Disconnecting

Disconnecting GitHub removes the stored token from your keychain. To revoke on GitHub’s side too: for a device-flow connection, Settings → Applications → Authorized OAuth Apps; for a personal access token, delete it at github.com/settings/tokens.

Disconnecting Jira removes the stored API token from your keychain. To revoke the token entirely, delete it from your Atlassian account’s API tokens page.

Privacy

All GitHub and Jira requests go from your machine to their APIs directly. No SiteCMD server in between. SiteCMD stores deploy and workflow events locally for correlation; it doesn’t mirror your repo contents, your PR diffs, or unrelated tickets.

A mirrored ticket sends the finding title, severity, category, and fix details. It doesn’t send your scan history, your other findings, or anything about your other projects.