> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usetrident.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# GitHub Integration: Automated Remediation Pull Requests

> Connect Trident to GitHub to receive automated draft pull requests for cloud security findings and AI agent vulnerability fixes.

The Trident GitHub integration closes the gap between a security finding and an engineering fix. When Trident identifies a remediable issue — an over-permissive IAM policy, a Kubernetes RBAC misconfiguration, a Terraform drift, or a code-level agent vulnerability — it opens a draft pull request in the repository you designate, complete with a description of the finding, the proposed change, and a direct link back to the finding in the Trident dashboard. Your team reviews and merges on their own schedule; Trident never touches your main branch.

## Install the Trident GitHub App

<Steps>
  <Step title="Open the GitHub integration settings">
    In the [Trident dashboard](https://app.usetrident.dev), navigate to **Settings → Integrations → GitHub** and click **Install App**.
  </Step>

  <Step title="Authorize the Trident GitHub App">
    GitHub will redirect you to the App authorization screen. Select whether to grant access to your entire organization or to specific repositories, then click **Install & Authorize**.
  </Step>

  <Step title="Select target repositories">
    Back in the Trident dashboard, choose which repositories Trident is allowed to open PRs in. You can select one repository per project or multiple repositories for a monorepo setup.
  </Step>

  <Step title="Save and confirm">
    Click **Save**. A green status indicator on the integration card confirms the connection is active. Trident will now open draft PRs in the selected repositories when remediable findings are detected.
  </Step>
</Steps>

## What Trident creates PRs for

Once the GitHub App is installed, Trident automatically opens draft pull requests for the following finding types:

| Finding type                | Example change                                                          |
| --------------------------- | ----------------------------------------------------------------------- |
| **IAM policy fixes**        | Remove wildcard `*` actions from an over-permissive AWS policy          |
| **Terraform changes**       | Add encryption or restrict public access on an S3 bucket resource       |
| **Kubernetes RBAC patches** | Scope a `ClusterRole` to namespace-level permissions                    |
| **Agent code fixes**        | Apply a system-prompt hardening patch suggested by Sentinel's Fix Agent |

## Pull request format

Every PR Trident opens follows the same structure:

* **Draft status** — PRs always open as drafts so they do not trigger auto-merge rules or required-review workflows until your team is ready.
* **Finding summary** — The PR description includes the finding name, severity, affected resource, and the reasoning behind the proposed change.
* **Proposed diff** — The change is scoped to the minimum edit needed to resolve the finding.
* **Dashboard link** — A direct link back to the finding in Trident so reviewers have full context before merging.

## Required permissions

The Trident GitHub App requests the following permissions:

| Permission      | Level | Reason                                           |
| --------------- | ----- | ------------------------------------------------ |
| `pull_requests` | Write | Create and update draft PRs                      |
| `contents`      | Read  | Read repository files to generate accurate diffs |

Trident does **not** request `push` access to your default branch. It cannot force-push, merge pull requests, or modify branch protection rules.

<Warning>
  PRs opened by Trident are always drafts. Trident never force-pushes to any branch, merges a pull request, or bypasses branch protection rules. A human must review and merge every change.
</Warning>