Skip to main content
Install githits-scan to scan a repository from your terminal or CI. On macOS and Linux, use Homebrew. On Windows, download a prebuilt binary or install with Cargo. You can also use prebuilt binaries or Cargo on macOS and Linux. For CI, use a pinned version. Scan is Alpha. These pages cover version 0.3.0.

​
Install with Homebrew

On macOS or Linux, install Homebrew if you don’t already have it, then run:
Homebrew provides prebuilt packages for macOS 15 on Apple Silicon and Linux x86_64/ARM64. If a prebuilt package isn’t available for your system, including Intel Macs, Homebrew builds Scan from source and installs the required build dependencies.

​
Prebuilt binaries

  1. Download your archive and SHA256SUMS from the same v0.3.0 GitHub release.
  2. Check the archive’s checksum using the commands below.
  3. Extract the archive and put githits-scan (or githits-scan.exe) in a directory on PATH.
Run the checksum command in the directory containing both downloads:
On Linux and macOS, confirm that your archive is marked OK. On Windows, compare the hash with the matching archive entry in SHA256SUMS. Extract the archive after the checksum matches. The binaries are built on Ubuntu 24.04, macOS 15, and Windows Server 2025. Older systems are not tested.

​
Install with Cargo

You need Rust 1.99 or newer. Install the latest published version from crates.io:
For a reproducible installation, pin the version:

​
Check the installation

After installing, run:
For the pinned 0.3.0 release, the expected output is githits-scan 0.3.0. From your repository root, preview the package files Scan would upload:
This step stays local and needs no token. Review the selection and the upload privacy guidance before running an online analysis.

​
Set up authentication

Sign in or create an account at app.githits.com. Create an API token in Settings → Tokens, then set GITHITS_API_TOKEN in the shell that will run Scan. In Bash, read the token without putting it in shell history. Keep shell tracing (set -x) disabled:
Online commands read the token from GITHITS_API_TOKEN. Scan does not run credential commands or read the githits CLI’s stored login. In CI, inject the variable from your secret store. See API authentication for account and token guidance, and Scan in CI for a workflow. Local detect and offline replay need no token. Next, generate an SBOM, audit dependencies, or report licenses.

​
Uninstall

For a Homebrew installation:
For a Cargo installation:
For an extracted binary, remove the executable you put on PATH. Scan has no daemon or installed background service. Uninstalling leaves generated reports and repository configuration in place. Remove those separately if you no longer need them. Unset GITHITS_API_TOKEN in your shell or CI configuration, and revoke unused tokens in token settings.