GitHub · GitLab · Azure DevOps
Keep your inventory in sync.
Import dependency changes on every push. Review on Testing; publish from Published.
01Repository sync
Connect your repository
Install the SourceTrust GitHub App, or connect GitLab or Azure DevOps with an access token. Pick a repository and choose which branches to watch. Manual file upload is disabled for connected projects so inventory always matches the linked repo.
Sync behavior
Connect one repository per project, on GitHub, GitLab, or Azure DevOps. When someone pushes to a watched branch, SourceTrust fetches the lockfile, imports new and updated dependencies automatically, and marks them needs review. There is no separate preview or apply step.
Auto-discovered lockfiles
Repo sync discovers lockfiles recursively across the repository, monorepo subdirectories included: npm (package-lock.json), pnpm (pnpm-lock.yaml), Yarn (yarn.lock), Bun (bun.lock), Go (go.mod), and more. CycloneDX SBOMs upload manually or via an explicit lockfile path.
web/package-lock.jsonapi/uv.lockservices/go.sum
Push to main → new packages appear in your review queue within minutes.
02Review
Review before you release.
Each connected project watches two branches by default. The Published branch inventory is what you publish to buyers. The Testing branch is a separate inventory for reviewing changes before they reach production.
developTestingmainPublishedDependency review comments
Pull requests and merge requests can receive informational comments comparing base and head lockfiles. Inventory changes only happen on pushes to watched branches, not on every review comment.
Pull request or merge request comments list dependency changes with deep links to each review, and never block a merge
#482web/package-lock.jsoncharting-lib 1.4.2
charting-lib 2.0.0
03Automation
Publish on merge.
When enabled, publish on merge refreshes your page after the review gates pass.
When approved Testing work merges into Published, reviewed packages copy across automatically. Optional publish-on-merge can push a new attestation snapshot when the merge completes.
Auto-approve safe defaults
Safe license with verified text: approve without waking a human.
#482sourcetrust.app/acme/platform
publish on merge
charting-lib2.0.0MITStart with the files you already have.
Free to import and review. No credit card needed.
Review licenses and obligations before merging.
SourceTrust · bot