Skip to main content
A connector gives Bentra access to the Git provider that holds your workflows. Only GitHub is supported today. Add connectors under Settings → Connectors, and click one to see its details, rotate its credentials, test it, move it and change who it’s shared with.

​
Who owns and uses a connector

Every connector is owned by a workspace. That workspace’s team manages it, whoever added it. When you add one, Owned by defaults to the workspace you’re in; if you belong to several, pick the team it’s for. The person who added it is shown as Added by, which gives them no extra rights. A workflow can use a connector its own workspace owns, or one shared with it. A connector can be shared with selected workspaces or every workspace. Shared workspaces can use it but not change it. Members can’t add connectors to the default workspace, so it doesn’t fill up with personal connectors, and the connectors it owns are managed by owners and admins. If someone leaves a workspace, they stop managing its connectors and the rest of the team carries on. When you move a connector, the old workspace stays shared while its workflows still use it. You can’t stop sharing a connector with a workspace, or delete it, while workflows there still use it. The connector page lists them under Used by; switch them to another connector first. A workspace that owns a connector used by other workspaces can’t be deleted until you move the connector. Bentra uses a connector to:
  • list repositories and branches/tags when you create a workflow
  • read .bento/workflow/workflow.yml, .bento/form/form.yml and the README
  • hand a token to a runner so it can clone the repository; a runner only gets it for a run its pool is executing
  • commit form edits made in Bentra to a branch and open a pull request
Install the app on the repositories your workflows use, not on the whole organization. Bentra and its runners only ever use installation tokens, which expire after an hour. If you don’t edit forms from Bentra, Contents: Read and no pull request access are enough.

​
Personal access token

Use a fine-grained token limited to the same repositories, with the permissions in the table above. A classic token with repo scope works but grants access to every repository the user can see. The token acts as its owner, so prefer a dedicated machine user. Runners receive the token itself to clone, which is another reason to prefer the GitHub App.

​
Storage

Connector credentials are encrypted with your organization’s own data key before they are stored.