Codeac repository static analysis integration – defining test workspace permission boundaries

Answer to the Core Questions

1. Can a test integration use a read‑only repository token that does not grant secret scanning or alert‑routing permissions? Yes. A GitHub Personal Access Token (PAT) with the repo:read scope (or the equivalent minimal scope for the target VCS) allows Codeac to fetch code but prevents it from creating or updating issues, alerts, or policy data in the workspace.

2. Does provisioning such a token automatically route findings to production channels or enforce production policies? No. Alert routing and policy enforcement are governed by the workspace configuration, not the token scope. If the integration points to the production workspace, findings will still appear in the production alert channels and will be subject to production policies, even with a read‑only token.

3. Is there a configurable option to disable data retention for test scans so that test findings are not stored in the production database? The token level cannot disable persistence. Data retention is a workspace setting. By creating a dedicated test workspace and disabling “store findings” or setting a short retention period, you can keep test results from being persisted in the production data store.

Why the Token Alone Isn’t Enough

• Token scopes control read/write access to the repository, not how findings are handled by Codeac.
• Alert routing, policy evaluation, and storage are all configured at the workspace level.
• Using a read‑only token in the production workspace will still route findings to the production alert channels if the workspace’s routing rules allow it.

Practical Steps to Isolate Test Scans

1. Create a Dedicated Test Workspace
   In Codeac’s admin console, add a new workspace named, for example, test-scans. Keep its alert channels and policy settings minimal or disabled.
2. Generate a Read‑Only PAT
   On GitHub (or your VCS), create a PAT with the repo:read scope. Do not add any security_events, issues, or other write scopes.
3. Configure the Integration
   In the test workspace, set up the repository integration and paste the read‑only PAT. Ensure the integration points explicitly to the test-scans workspace.
4. Adjust Data‑Retention Settings
   Navigate to the workspace’s Data Retention section. Toggle Store Findings to Off or set a short retention period (e.g., 7 days) so that test results are not persisted long‑term.
5. Verify Isolation
   Open a pull request in the repository, wait for Codeac to run the scan, and confirm that:
   • Findings appear only in the test workspace’s dashboard.
   • No alerts are sent to production Slack, email, or other channels.
   • Audit logs show only read operations performed by the PAT.

Missing Diagnostic Detail

To fine‑tune the isolation, could you confirm whether the production workspace currently routes alerts to any shared channels that might inadvertently receive test findings if misconfigured? Knowing the exact routing rules will help verify that the test workspace remains fully isolated.