Skip to content
FencerFencerDocs

Generic Git Integration

Overview

Section titled “Overview”

The generic Git integration lets you connect any Git-compatible repository to Fencer for code scanning. Use it for Git servers that are not directly supported through a dedicated integration, including:

  • Self-hosted Git servers (Gitea, Gogs, cgit, Forgejo)
  • AWS CodeCommit
  • Any server accessible via HTTPS or SSH clone URLs

Fencer clones the repository using the credentials you provide and runs all configured code scanners against it. Scans can be triggered manually or run on a schedule.

Prerequisites

Section titled “Prerequisites”
  • An active Fencer organization with a valid subscription.
  • The Administrator role in your Fencer organization.
  • A clone URL for your repository (HTTPS or SSH).
  • Credentials to clone the repository (SSH key, access token, or username/password), unless the repository is public.

How it works

Section titled “How it works”

Fencer stores the connection credentials you provide (encrypted at rest) and uses them to clone the repository when a scan is triggered. Scheduled scans clone a fresh copy of the repository at the default branch, run all enabled code scanners, and report results.

There are four authentication methods:

  • None — For public repositories that require no authentication.
  • SSH Key — Fencer uses your private key to clone via SSH (e.g., git@git.example.com:org/repo.git). Keys with passphrases are supported. Both OpenSSH and PEM formats are accepted.
  • Access Token — Fencer embeds the token in the HTTPS clone URL as https://oauth2:{token}@git.example.com/org/repo.git. Works with personal access tokens, deploy tokens, and machine user tokens.
  • Basic Auth — Fencer embeds the username and password in the HTTPS clone URL. Use this when your server requires HTTP basic authentication.

Usage / Configuration

Section titled “Usage / Configuration”

Connecting a Git Repository

Section titled “Connecting a Git Repository”
  1. Go to Admin > Integrations.
  2. Under Available Integrations, click the Git (Code) card, then click Continue.
  3. Fill in the connection form:
    • Connection Name: A display name for this connection (e.g., “Internal Git Server” or “CodeCommit”).
    • Authentication Method: Choose the method that matches your server’s requirements.
    • Provide the credentials for your chosen method (see below).
    • Repository Clone URL: The URL used to clone the repository. For SSH, use the SSH URL (e.g., git@git.example.com:org/repo.git). For HTTPS, use the HTTPS URL (e.g., https://git.example.com/org/repo.git).
    • Repository Web URL: The URL where the repository can be browsed in a web interface. Fencer uses this to generate links to files when vulnerabilities are found.
    • Repository Name: A display name, typically in org/repo format.
    • Default Branch: The branch Fencer scans by default (e.g., main or master).
  4. Click Connect. Fencer creates the connection and the repository, and triggers an initial code scan.

Authentication Methods

Section titled “Authentication Methods”

SSH Key

Section titled “SSH Key”
  1. Select SSH Key as the authentication method.
  2. Paste your SSH private key into the SSH Private Key field. Both OpenSSH format (-----BEGIN OPENSSH PRIVATE KEY-----) and PEM format (-----BEGIN RSA PRIVATE KEY-----) are accepted.
  3. If your key is encrypted with a passphrase, enter it in the SSH Key Passphrase field.
  4. Use an SSH clone URL (e.g., git@git.example.com:org/repo.git).

Access Token

Section titled “Access Token”
  1. Select Access Token as the authentication method.
  2. Paste the token into the Access Token field.
  3. Use an HTTPS clone URL (e.g., https://git.example.com/org/repo.git).

This works with:

  • Gitea / Forgejo: Create a personal access token under Settings > Applications with read:repository scope.
  • AWS CodeCommit: Use an HTTPS Git credential generated in IAM under your IAM user’s security credentials (select Basic Auth (username & password) instead of Access Token for CodeCommit).

Basic Auth

Section titled “Basic Auth”
  1. Select Basic Auth (username & password) as the authentication method.
  2. Enter the Username and Password.
  3. Use an HTTPS clone URL.

None (Public Repositories)

Section titled “None (Public Repositories)”
  1. Select None (Public Repository) as the authentication method.
  2. Use the public HTTPS clone URL.

Adding More Repositories

Section titled “Adding More Repositories”

A single Git connection can hold multiple repositories that share the same credentials. To add additional repositories:

  1. Go to Admin > Integrations and click Edit on your Git connection.
  2. Click Add repositories and fill in the Repository Clone URL, Repository Web URL, Repository Name, and Default Branch.
  3. Click Add repository. Fencer triggers an initial scan on the new repository.

If your repositories use different credentials (e.g., different deploy keys for each repo), create a separate Git connection for each set of credentials.

Editing a Repository

Section titled “Editing a Repository”
  1. From the Git connection edit page, find the repository under Connected repositories.
  2. Click Edit repository to update the clone URL, web URL, name, or default branch, then click Save.

Suspending and Resuming Scans

Section titled “Suspending and Resuming Scans”
  1. From the Git connection edit page, find the repository.
  2. Click Suspend. Fencer stops scheduling scans for this repository.
  3. Click Resume to start scanning it again.

Removing a Repository

Section titled “Removing a Repository”
  1. From the Git connection edit page, find the repository.
  2. Click Remove repository and confirm with Remove. Fencer stops scanning the repository and soft-deletes it; existing scan results are preserved.

Updating Connection Credentials

Section titled “Updating Connection Credentials”
  1. Go to Admin > Integrations and click Edit on your Git connection.
  2. Update the connection name, authentication method, or credentials as needed. Leave credential fields blank to keep the existing values.
  3. Click Save changes.

Triggering a Manual Scan

Section titled “Triggering a Manual Scan”
  1. Go to Posture > Code and open the repository.
  2. Click Run scan.
  3. Fencer clones the repository at the branch you are viewing (the default branch unless you picked another) and runs all enabled code scanners.

Disconnecting

Section titled “Disconnecting”
  1. Go to Admin > Integrations and find your Git connection.
  2. Click Remove on the connection and confirm with Remove.
  3. Fencer clears stored credentials and soft-deletes all associated repositories.

Examples

Section titled “Examples”

Connecting a Gitea server with an SSH key

Section titled “Connecting a Gitea server with an SSH key”
  1. On your Gitea instance, generate a deploy key for the repository under Settings > Deploy Keys.
  2. In Fencer, go to Admin > Integrations, click the Git (Code) card, and click Continue.
  3. Set Connection Name to “Gitea - Internal”.
  4. Select SSH Key and paste the deploy key’s private key.
  5. Set Repository Clone URL to git@gitea.example.com:myorg/myrepo.git.
  6. Set Repository Web URL to https://gitea.example.com/myorg/myrepo.
  7. Set Repository Name to myorg/myrepo and Default Branch to main.
  8. Click Connect. Fencer connects and starts the initial scan.

Connecting an AWS CodeCommit repository

Section titled “Connecting an AWS CodeCommit repository”
  1. In the AWS IAM console, go to your IAM user’s Security Credentials tab.
  2. Under HTTPS Git credentials for AWS CodeCommit, click Generate credentials.
  3. Note the username and password.
  4. In Fencer, go to Admin > Integrations, click the Git (Code) card, and click Continue.
  5. Set Connection Name to “AWS CodeCommit”.
  6. Select Basic Auth (username & password) and enter the IAM-generated username and password.
  7. Set Repository Clone URL to the CodeCommit HTTPS URL (e.g., https://git-codecommit.us-east-1.amazonaws.com/v1/repos/my-repo).
  8. Set Repository Web URL to the CodeCommit console URL, and fill in Repository Name and Default Branch.
  9. Click Connect.

Troubleshooting

Section titled “Troubleshooting”
  • Clone fails with “Permission denied (publickey)”: Verify the SSH private key matches a deploy key or SSH key registered on the Git server. Ensure the clone URL uses the SSH format (git@host:org/repo.git), not HTTPS.
  • Clone fails with “SSL certificate problem”: If your Git server uses a self-signed certificate, this is not currently supported. Use SSH key authentication instead.
  • Clone fails with “repository not found”: Double-check the clone URL. For SSH, ensure the path is correct (some servers use git@host:org/repo.git, others use git@host:/org/repo.git).
  • Clone fails with “Authentication failed”: Verify the token, username/password, or SSH key is correct. Ensure the credentials have read access to the repository.
  • SSH key passphrase error: Ensure the passphrase is correct. Fencer normalizes key formats internally — both OpenSSH and PEM formats are supported.
Section titled “Related pages”