How YATFA works in your repositories
YATFA reaches your code through a GitHub App you install on the repositories you choose. It writes branches, commits, pull requests and comments — nothing else — and you can revoke it in one click.
Give the reports page any date window #482
Openyatfa wants to merge intomainfromreports-window
Which permission each step used
Hover an event on the left.
ContentsRead and write
Pull requestsRead and write
Commit statuses · ActionsRead-only
Metadata · Issues · othersRead-only
✓Pushed a branch and commits
✓Opened a pull request
✓Wrote review and QA comments
✓Read the check results
Every permission, exactly as GitHub shows it
Two write permissions, both about code changes. The rest is read-only. Nothing at the account or organisation level.
Repository permissions requested at install time. Account and organisation permissions: none.
What it can’t reach
Repositories you didn’t chooseIt’s installed only on the ones you pick
Your infrastructureIt reaches code — not servers or networks
Your cloud accountsNo account- or organisation-level permissions
Your CI secretsNot among the permissions it asks for
You never paste a repository credential into YATFA.
Choose the repositories. Take them back any time.
1Choose repositories
2Approve on GitHub
Install YATFA on 2 repositoriesContents and pull requests: read and write. Everything else: read-only.Install
3What YATFA can see
Revoke access
A red main becomes a ticket
When main goes red, the fix is filed with the failing checks attached. When the build is green again, the ticket closes itself — nobody has to remember to tidy up.
09:12main is red3 checks failing after this morning’s merges
09:13Ticket filedThe failing checks and the merges that moved them, attached
10:41Fixed, reviewed, checkedThe usual path — no shortcut because it’s urgent
10:58Green — ticket closed itselfNo one had to remember
Explore more
Code reviewThe verdict you see on every pull request — and what happens when it says no.How review works →
Trust & securityThe data flow, step by step — checked against the running system.Read the trust page →
Self-host runnersKeep the agents that touch your code on machines you own.Isolation, step by step →