When enabled, SOBS will automatically fetch lockfiles (requirements.txt,
package-lock.json, go.sum, etc.) from each app's GitHub repository
to build a richer library inventory for CVE scanning.
How repo URLs are configured: Each app registered in SOBS has a
Repository URL field (set via the Release Registry or the CI helper
--repo-url arg). SOBS uses the global GitHub token from
AI Settings → GitHub token
to access all configured repositories — a single personal access token or GitHub App
installation token with
contents:read scope is sufficient.
Required GitHub token scope:
contents:read — read access to repository file contents (lockfiles).
No write access or issue access is needed for dependency enrichment.
Set the token in
AI Settings.
Limits GitHub lockfile fetch work per scan. Higher values increase coverage but can make scans slower.