Integrations · GitHub
Landing source-level fixes in your repo, PR by PR.
Sigil scans your repo, writes remediation, opens a real pull request against your own commit history — the same shape as how it works, and the same source-fix model the rest of the site asserts. Criterion-cited, EN 301 549 mapped, audit-grade — no overlay, no audit-only mode.
Worked example · WCAG 2.2 SC 1.1.1
One finding. One fix. One PR.
A real diff from the Sigil scanner running against the in-repo sample-theme fixture — paired with the axe-core diagnostic the rule produced and the criterion / EN-clause mapping the PR’s commit message cites. Repro on tests/unit/sigil/fixtures/sample-theme.
Merged receipt · example
- Branch
sigil/fix-image-alt-page-html- Pull request
#142· “Add alt text topage.htmlimagery (axe: image-alt · WCAG 1.1.1 · EN 9.1.1.1)”- Commit
a14f8c…· merged today- Evidence hash
- A SHA-256 evidence hash is recorded against the fix at merge time.
This card is a shape, not a real PR — the GitHub integration pages real repositories when installed. The art is what Sigil produces against your repo: branch + PR + commit + an evidence hash recorded at the merge boundary.
OAuth scopes · exactly what we ask for
Four scopes. Every one of them has a job.
Sigil requests a narrow set of GitHub OAuth scopes, and it requests them at install time — never at runtime, never lazily. Below is the full list, what each scope is used for, and what it is explicitly not used for.
repowe use it for
Read and write code, open pull requests, push branches against the repos you grant.we don’t use it for
Used for: nothing else. Never for repo deletion, transfer, or admin actions.write:repo_hookwe use it for
Register the per-customer Sigil webhook that drives the fix engine.we don’t use it for
Used for: nothing else. Never for global org hooks.read:repo_hookwe use it for
Receive webhook delivery events from GitHub.we don’t use it for
Used for: nothing else. Never for cross-repo data.Statuses: writewe use it for
Commit status checks on each [axe-core rule id] the PR remediates.we don’t use it for
Used for: nothing else. Never for PR review approval state.
Minimum permissions
We never ask for admin:org, user:email, or delete_repo. Our install flow is read-and-write code on the repos you grant, webhooks for the fix engine, status checks on each PR — and nothing else.
Revoke any time: GitHub → Settings → Applications → Sigil.
GitHub Marketplace-style
Sigil on GitHub.
Custom audit-grade PRs land in your repo against your own commit history — not a dashboard-only observation, not a passive scan report. The GitHub integration is the source-fix model, embodied as a pull request on your branch with your review queue.
Audit-grade WCAG 2.2 + EN 301 549 fixes, surfaced as pull requests against your own branch and your own review queue.
Not on GitHub direct?
If you need the same audit-grade model,
without a GitHub-direct install, the early-access intake is the right door.
The GitHub integration is one path into Sigil — it is not the only path. Teams without a GitHub-hosted repo, or teams that want a private scoping before an install, start at early access.