Sources

The Sources page gathers everything that feeds the project’s stack: GitHub and GitLab repositories, container images, imported SBOM and manifest files, watched websites, the device and cloud inventory (GLPI, Intune, AWS, Azure, Wazuh, Jamf Pro) and manual entry. Scanner reports are listed too, with a link to their view: they add nothing to the stack.

The screen is under Monitoring › Sources, just below Stack (address /sources). The Sources button in the Stack page header also leads there. It shows the sources of the active project; without an active project, it shows “Choose a project to see its stack sources.”

The page is an overview:

• at the top, the title Stack sources, with the project name, and the View the stack (N components) link;
• Stack breakdown: the total number of components, and a bar showing each source’s share (manual entry, websites, files, GitHub, GitLab, inventory);
• Automatic sources: one card per source (GitHub repositories, GitLab repositories, Containers, SBOM and manifest files, Websites, Device and cloud inventory). Each card shows the tool’s logo (GitHub, GitLab, GLPI, Intune…) and its status (not connected, watched or pending repositories, applications, websites, configured connectors) and the number of components it added. A click opens the source’s page (/sources/github, /sources/gitlab, /sources/conteneurs, /sources/fichiers, /sources/sites, /sources/inventaire), with a ‹ Sources link to go back;
• Other ways to feed the stack: Manual entry, which opens the Stack page’s add window, and Scanner reports.

Each source only touches what it added

A GitHub or GitLab repository, an imported application, a watched website or a connector updates and removes its own components, and nothing else. Items entered by hand are never changed by an automatic source. On the Stack page, a small badge shows where an item comes from: GitHub, GitLab, Container, SBOM, Manifest, Website, or GLPI and Intune for the connectors.

GitHub repositories

The GitHub connector reads your repositories’ dependencies from their lockfiles and manifests, and keeps them up to date on every push to the default branch. It only asks for read permissions: Contents and Metadata.

Connecting GitHub

1. In the GitHub repositories section, click Connect GitHub. GitHub opens and offers to install the TechWatchAlert app on your account or organisation.

2. On GitHub, choose Only select repositories and tick only the repositories to watch, then confirm.

3. Back in TechWatchAlert, the installation is linked to the project. The authorised repositories appear in the account card, Pending: nothing is read until you enable a repository.

If you are not an owner of the GitHub organisation, GitHub sends an installation request to its owners; once the request is approved, start the connection again from the Sources page. Connect another GitHub account adds a second installation (another account or organisation).

An account card shows how many repositories are watched (“2 / 5 repositories watched”) and offers:

• Choose repositories on GitHub: add or remove authorised repositories, on GitHub’s side;
• Refresh: re-read the list of authorised repositories;
• Disconnect (see Stop watching a repository, disconnect).

Access to every repository

If the installation grants access to every repository of the account, a banner says so: “TechWatchAlert has access to every repository of this account. For security, limit access to the repositories you want to watch.” The Restrict on GitHub button opens the installation settings, where you choose Only select repositories.

Watching a repository

Each authorised repository has a Watch this repository switch. Turning it on analyses its default branch; the repository goes through Analysing…, then Watched, or Error if reading failed. A message confirms how many components were added to the stack. Once watched, the repository row shows the number of components and files read, and the date of the last read; Re-read runs an analysis straight away. A private repository is marked Private repository.

What is read:

• the lockfiles and manifests recognised by the file import (package-lock.json, pnpm-lock.yaml, yarn.lock, poetry.lock, requirements.txt, go.mod, composer.lock, pom.xml, Gemfile.lock, Cargo.lock…) and CycloneDX or SPDX SBOMs (bom.json, sbom.json, *.cdx.json, *.spdx.json…), anywhere in the repository;
• in addition, the dependency graph GitHub keeps for the repository (its SBOM): what GitHub resolved itself, notably through automatic submission (Maven, Gradle, NuGet, pip). Only exact versions are kept; a disabled graph blocks nothing;
• except in folders that do not describe the application: node_modules, vendor, dist, build, Python virtual environments, tests (test, tests, __tests__, fixtures, testdata), examples (examples, samples) and docs;
• in the same folder, the lockfile is preferred to the manifest: package-lock.json rather than package.json, composer.lock rather than composer.json;
• 50 files at most per repository, 1 MB each at most; extra files are skipped, the shallowest being kept first.

Hovering an item’s GitHub badge on the Stack page shows the file it comes from (for example api/poetry.lock).

Updates

• Every push to the default branch that touches a dependency file triggers a new read of the repository.
• A scheduled pass, every 15 minutes, handles pending reads; a daily safety net re-reads every watched repository, in case a push was missed.
• If GitHub webhooks are not configured on the instance, the section says so: repositories are then only re-read once a day.

On every read, components that have left the repository’s files leave the stack, new ones enter it; an upgrade replaces the old row. Vulnerabilities already published on new components are caught up in alerts, as for an import.

If the installation is suspended or removed on GitHub’s side, the card says so (“The installation is suspended or was removed on GitHub: nothing is read any more.”).

Stop watching a repository, disconnect

• Stop watching (the switch, turned off): the repository is no longer read. The confirmation offers Also remove its components from the stack; without that box, its components stay in the stack, frozen.
• Disconnect removes the installation from the project: TechWatchAlert stops reading these repositories. The confirmation offers Also remove from the stack the components that came from these repositories.
• To also remove access on GitHub’s side, uninstall the app from Choose repositories on GitHub.

Manual entries are never touched.

Plan

Each watched repository counts as one SBOM application in the plan, like an imported file: with the instance’s default settings, 1 on Free, 5 on Team, unlimited on Pro and Business. A repository’s re-reads do not count towards daily imports. See Plan and billing.

GitLab repositories

The GitLab connector reads your GitLab projects’ dependencies, on gitlab.com or on your own instance, with the same rules as GitHub. It is read-only (read_api and read_repository scopes) and installs no webhook: each watched repository is checked every 15 minutes, and only re-read if its latest commit changed.

Connecting GitLab

1. Open Sources › GitLab repositories.

2. Choose gitlab.com, or Self-hosted instance. For a self-hosted instance, its administrator first creates an OAuth application (Admin › Applications, or Preferences › Applications) with the Redirect URI shown in the form, the read_api and read_repository scopes, and Confidential ticked. Then enter the Instance address (https://), the Application ID and the Secret.

3. Click Connect GitLab, then authorize the application on GitLab.

4. Back in TechWatchAlert, the projects you can access (Reporter role or higher) appear as Pending: nothing is read until you enable a repository.

Why do all projects arrive pending?

GitLab does not let you choose projects at authorization time. TechWatchAlert therefore lists them all, but reads none until you turn on Watch this repository.

Connect another account or instance adds a second connection. A connection’s card shows the account, the instance and the number of watched repositories, and offers:

• Authorizations on GitLab: the GitLab page where the authorization can be revoked;
• Refresh: re-read the list of accessible projects (a new project arrives pending);
• Disconnect.

Watching a repository, Re-read, stopping and the plan work as for GitHub: each watched repository counts as one SBOM application. If the authorization was revoked or expired, the card says so (“The GitLab authorization was revoked or expired: nothing is read any more.”): reconnect GitLab.

Disconnect makes TechWatchAlert forget the connection and its tokens. To also remove the authorization on GitLab’s side, open Authorizations on GitLab.

Containers

The Containers source adds the base system packages of your Docker images to the stack: apt packages (Debian, Ubuntu), apk (Alpine) and rpm (Red Hat, Rocky, Alma, Fedora). These are the components dependency files don’t show: OpenSSL, glibc, curl… It is read-only.

Watching an image

In Sources › Containers, enter an image reference (nginx:1.27, ghcr.io/acme/api:prod) then Watch image. The layers are downloaded and read: the row goes through Analysing…, then Watched. It shows the system (“Debian GNU/Linux 12 (bookworm)”), the number of packages and components, and the last read date.

Public images (Docker Hub, GHCR, Quay…) are read without credentials. For a private image, add the registry under Private registries: its address (ghcr.io, registry.gitlab.com, harbor.company.com), a username and a read-only token (GHCR: read:packages; GitLab: read_registry; Harbor: robot account with “pull”; Docker Hub: read-only access token). The token is encrypted and never shown again.

Connecting a Kubernetes cluster

1. Under Kubernetes clusters, name the cluster (for example prod-eu), then Generate manifest.

2. Download techwatchalert.yaml. It contains the cluster token, which will not be shown again.

3. Apply it with a cluster administrator account: kubectl apply -f techwatchalert.yaml. It creates a service account that can only list pods, and a job that sends the image list every hour. Nothing else leaves the cluster.

4. On the first push, running images appear as Pending, with the namespaces they run in. Nothing is downloaded until you turn on Watch this image.

An image that no longer runs in the cluster is marked No longer running and is no longer read. Disconnecting a cluster revokes its token: also remove the job with kubectl delete namespace techwatchalert.

Updates

Every 6 hours, each watched image compares its tag’s digest: it is only re-read if a new version was published under the same tag (nginx:1.27, latest…). Re-read forces a read. Packages that disappear leave the stack, new ones join it.

Debian and Alpine

Debian and Alpine security advisories are not imported yet. The packages of these images are listed, and their CVEs come from the NVD, which ignores fixes backported by the distribution. An alert on a package of a Debian or Alpine image may therefore already be fixed: check it before acting on it. Ubuntu, Red Hat, Rocky, Alma and SUSE images are compared with their distribution’s advisories.

Each watched image counts as one SBOM application in the plan. Pending images don’t count.

SBOM and manifest files

One file per application: the application name, entered at import (the file name by default), groups its components. The section lists the imported applications, with their number of components and the date of the last import.

• Import a file opens the import window (CycloneDX SBOM or manifest), described in Imports, connectors and scans.
• New version reopens the same window, under the application’s name: the file replaces the previous version.
• Remove removes the application, after confirmation: its components leave the stack and its slot in the plan is freed. Manual entries are not touched.

In the import window, the Replace this application’s previous version: what is no longer in the file leaves the stack. box is ticked by default. Unticked, the import only adds.

Applications kept by a GitHub or GitLab repository are managed from the repository’s page (GitHub repositories or GitLab repositories).

Websites

The project’s public sites, scanned every 3 hours: detected technologies, HTTP code, HTTPS certificate. Auto-follow adds the detected technologies to the stack. This section takes over the former URLs page, whose address (/urls) now leads here. Everything is described in Monitored URLs.

Device and cloud inventory

The software actually installed on your workstations and servers, re-read every night by the GLPI, Microsoft Intune, AWS (Systems Manager), Azure (Change Tracking & Inventory), Wazuh (Syscollector) and Jamf Pro connectors. This section replaces the former Inventory section of the project’s Integrations page. Setup, sync and removal are described in Imports, connectors and scans.

When removing a connector, the confirmation offers Also remove from the stack what this connector added. Without that box, the items stay in the stack, frozen: nothing updates them any more.

Manual entry

A product or a vendor, and its version, added by hand. The Add by hand button opens the Stack page’s add window (see Stack › Adding an item by hand). No automatic source changes these items.

Scanner reports

Trivy, Grype, Nessus, Greenbone, Qualys, InsightVM: their results are matched against the project’s alerts, they add nothing to the stack. The Import a scan report button opens the Stack › Scans view (see Scanner reports).

Who can do what

Action	User	Analyst	Admin	Owner
View the Sources page	✓	✓	✓	✓
Import a file, new version, remove an application		✓	✓	✓
Add or delete a site, turn on auto-follow		✓	✓	✓
Connect GitHub or GitLab, watch a repository, disconnect			✓	✓
Watch an image, connect a cluster, manage registries			✓	✓
Configure, sync, remove an inventory connector			✓	✓

Without project administration rights, the GitHub section shows “Only project administrators can connect GitHub.” Importing a file needs the Import (SBOM / batch) right; removing an application also needs the Remove from stack right.

FAQ

Where did the Stack page’s “Detect from a URL” and “Import a file” buttons go? They are replaced by the Stack page’s Sources button, which leads here. For a site, add it under Websites; for a file, use Import a file under SBOM and manifest files. Adding by hand stays on the Stack page.

Does TechWatchAlert read all my repositories as soon as I connect? No. Authorised repositories arrive Pending and nothing is read until you turn on Watch this repository. Also limit access to the repositories you need (Only select repositories).

Can an external tool know when the stack changes? Yes, on the Pro and Business plans: an Inventory webhook receives the inventory.changed event on every change made by GitHub, GitLab, a connector or an import (see Project webhooks).

StackVersions, thresholds, criticality and tags.

Imports, connectors and scansFile import, GLPI, Intune, scanner reports.

Monitored URLsWebsites watched every 3 hours.

Populating your stackCompare the ways to fill the stack.