What it does #
The Norma GitHub App is installed from GitHub, on the repositories you choose. Installing it does three things:
- Creates your Norma account. The GitHub identity you install with is the identity you sign in with — the same one the Continue with GitHub button uses on the sign-in page. You never end up with two accounts.
- Imports the repositories you selected, so they start appearing in Norma without you configuring anything.
- Turns on pull request checks for those repositories. From then on, opening a pull request gets you a Norma comment listing the issues your changes introduced. See Pull request checks.
You land on the Free tier with the standard Free quotas.
When you’d use it #
Use the GitHub App when you want Norma to follow your work rather than the other way round — you review pull requests on GitHub, and you’d rather see quality feedback there than remember to launch a scan in the portal.
It’s also the shortest possible way in: if you’ve never used Norma, installing the app is signing up.
How to install it #
- Open the Norma GitHub App page on GitHub and click Install.
- Choose the account or organisation to install on. Installing on an organisation may need an owner’s approval — GitHub will offer to send the request.
- Choose which repositories Norma can see:
- All repositories — every repo on the account, including ones you create later.
- Only select repositories — pick them individually. Recommended for tighter control.
- Review the permissions (below) and confirm.
- GitHub asks you to authorise Norma one more time. This step is what identifies you, so complete it — one click if you’re already signed in to GitHub.
- You land in Norma with your repositories importing.
What Norma asks for #
The app requests three permissions and nothing more:
| Permission | Why |
|---|---|
| Contents: read | Clone the repository so it can be analysed. |
| Metadata: read | Required by GitHub for every app. |
| Pull requests: write | Post and remove Norma’s own results comment on your pull requests. |
Norma cannot push commits, open pull requests, change your code, or read repositories you didn’t select. “Pull requests: write” lets Norma write a comment — not code.
Public and private repositories use the same flow and the same permission screen. There is no separate setup for private repos.
If you already have a Norma account #
The installation is linked to the organisation you already have. Nothing is duplicated: no second account, no second organisation. Selected repositories you hadn’t imported yet get imported; ones you had are reused as they are.
If you skip the authorisation step #
If you cancel at step 5, the app is installed on GitHub but Norma doesn’t yet know who you are, so it stays inactive — no checks run and no comments are posted. To finish, open the app’s setup page from github.com → Settings → Applications → Installed GitHub Apps → Norma → Configure and complete the authorisation. Provisioning then proceeds exactly as above.
Pull requests opened while the installation was inactive are not checked retroactively. Only pull requests opened or updated after you finish setup get a check.
Changing which repositories Norma can see #
- Go to github.com → Settings → Applications → Installed GitHub Apps.
- Click Configure next to Norma.
- Add or remove repositories under Repository access, then save.
Repositories you add are imported into your organisation automatically. Repositories you remove stop being checked; the scans and issues Norma already has for them are kept.
Uninstalling or suspending the app #
Uninstall or suspend from the same Configure page on GitHub. Norma immediately stops cloning those repositories, stops checking pull requests, and stops commenting.
Your account and data are kept. Uninstalling the app is not the same as deleting your account — your organisation, repositories, scan history and issues all remain. To remove the account itself, see Delete account.
Limits & notes #
- Repository import quota still applies. If you select more repositories than your quota allows, the ones that fit are imported and the rest are skipped — the install and the sign-up never fail because of quota. Import the remainder later from the portal once you have room. See Tiers and quotas.
- Which repositories fit isn’t predictable when you’re over quota, so if you care which ones get imported first, select those.
- Organisation approval can arrive late, and from someone else. If an owner approves your request days later, the Norma account is created for whoever completes the authorisation step — which may be the approver, not you.
- Accounts don’t merge across sign-in methods. An email/password Norma account and a GitHub account with the same address are two separate accounts. Install with the GitHub identity you want to keep using.
- Paid GitHub Marketplace plans aren’t part of this. The app maps to the Free tier; upgrades happen in Norma.
- A repository whose import failed isn’t checked. Its pull requests are ignored rather than queued. Fix the import in the portal first.
Related #
- Pull request checks — what the app posts on your pull requests, and how to read it.
- Connect GitHub — connecting GitHub from inside Norma instead, if you already have an account.
- Sign up — the other ways to create a Norma account.
- Tiers and quotas — what the Free tier includes.
