# Source Control Configuration

Sonatype Lifecycle can connect to your Source Control Management (SCM) system with an access token to scan your projects during the development phase. The access token can be set at the Root Organization level. This page provides the configuration steps for SCM.

**Note**  
The [Configuring Base URL](https://help.sonatype.com/en/configuring-base-url.html "Configuring Base URL") must be configured for Source Control Features to function.

**Note**  
For Sonatype IQ Server High Availability (HA) deployments, the SCM source-control directory must be configured on shared storage that is accessible by all HA nodes.  
For more information, see [IQ Server High Availability Installation](https://help.sonatype.com/en/iq-server-high-availability-installation.html#iq-server-high-availability-installation).

### Configuration Checklist

Follow the steps below to connect your SCM system to _Sonatype Lifecycle_.

01. Create SCM Access Token  
02. Configure base URL in IQ Server  
03. Navigate to Source Control at the Root Organization  
04. Select Source Control Management System  
05. [Add your SCM Access Token (created in step 1)](https://help.sonatype.com/en/iq-server-configuration.html "IQ Server Configuration") to enable Lifecycle features  
06. Enter the **Default Branch**  
07. Toggle Use SSH for Git Operations  
08. Toggle **Automated Pull requests**  
    - We recommend disabling it when used with Easy SCM Onboarding  
09. Toggle **Pull Request Commenting**  
    - Recommended for all repositories.  
10. Toggle Source Control Evaluations  
    - Recommended for all repositories.  
11. Select **Automated Commit Feedback**  
    - If you are importing a large number of applications, this may cause you to hit SCM rate limits. In such scenarios, we recommend disabling _Automatic Commit Feedback_, during the import. You can enable this after the import, for all the repositories.  
12. Optional: Create separate access tokens for IQ Server Organizations using different SCM Systems  
13. Optional: Configure additional SCM Features

## SCM Feature Configuration

The table below shows where the SCM feature is configured.

| Feature | **Configuration** |
| --- | --- |
| [Automatic Pull Requests](https://help.sonatype.com/en/automated-pull-requests.html "Automated remediation") | Configured at the Organization or Application level.<br>- Inherited by default (disabled by default at the root organization) |
| [SSH Operations](https://help.sonatype.com/en/iq-server-configuration.html "IQ Server Configuration") | Configured at the Organization or Application level.<br>- Inherited by default (disabled by default at the root organization) |
| [Pull Request Commenting](https://help.sonatype.com/en/pull-request-commenting.html "Pull Request Commenting") | Configured at the Organization or Application level.<br>- Inherited by default (enabled by default at the root organization) |
| [Pull Request Line Commenting](https://help.sonatype.com/en/pull-request-commenting.html "Pull Request Commenting") | Enabled with Pull Request Commenting. |
| [Source Control Evaluations](https://help.sonatype.com/en/iq-server-configuration.html "IQ Server Configuration") | Configured at the Organization or Application level.<br>- Inherited by default (enabled by default at the root organization) |
| [Automated Commit Feedback](https://help.sonatype.com/en/automated-commit-feedback.html "Automated Commit Feedback") | Configured in SCM Provider.<br>Configured at the Organization or Application level.<br>- Inherited by default (enabled by default at the root organization) |
| [Automatic SCM Configuration](https://help.sonatype.com/en/automatic-source-control.html "Automatic Source Control") | Configured on the page accessed through Settings Menu. |
| [Easy SCM Onboarding](https://help.sonatype.com/en/easy-scm-onboarding.html "Easy SCM Onboarding") | Application import feature.<br>Requires SCM Access token configured. |
| [Bitbucket Code Insights](https://help.sonatype.com/en/bitbucket-code-insights.html "Bitbucket Code Insights") | Configured with Pull Request Commenting |
| [Automatic Role Assignment](https://help.sonatype.com/en/source-control-rest-api.html "Source Control REST API") | Configured at the organization level using the [Source Control REST API](https://help.sonatype.com/en/source-control-rest-api.html "Source Control REST API") |

## Create Access Token

Select your SCM provider below for information on creating an access token and configuring your SCM System for use with Sonatype Lifecycle.

### Required Token Permissions

| Feature | [Azure DevOps](https://help.sonatype.com/en/azure-devops-configuration.html "Azure DevOps Configuration") | [Bitbucket Cloud](https://help.sonatype.com/en/bitbucket-cloud-configuration.html "Bitbucket Cloud Configuration") | [Bitbucket Server](https://help.sonatype.com/en/bitbucket-configuration.html "Bitbucket Data Center Configuration") | [GitHub](https://help.sonatype.com/en/github-configuration.html "GitHub Configuration") | [GitLab](https://help.sonatype.com/en/gitlab-configuration.html "GitLab Configuration") |
| --- | --- | --- | --- | --- | --- |
| [Automated Commit Feedback](https://help.sonatype.com/en/automated-commit-feedback.html "Automated Commit Feedback") | **Code: Read & Write** | **Read** under **Repositories** | **Read** under **Repositories** | **repo:status** | **api** |
| [Automated Pull Requests](https://help.sonatype.com/en/automated-pull-requests.html "Automated remediation") | **Code: Read & Write** | **Write** under **Pull Requests** | **Write** under **Repositories** | **repo** | **api + write_repository** |
| [Pull Request Commenting](https://help.sonatype.com/en/pull-request-commenting.html "Pull Request Commenting") | **Code: Read & Write** |  | **Write** under **Repositories** | **repo** | **api** |
| [Pull Request Line Commenting](https://help.sonatype.com/en/pull-request-commenting.html "Pull Request Commenting") |  | **Write** under **Repositories** | **repo** | **api** |
| [Bitbucket Code Insights](https://help.sonatype.com/en/bitbucket-code-insights.html "Bitbucket Code Insights") | **Write** under **Repositories** | N/A | N/A |
| [Automatic Role Assignment](https://help.sonatype.com/en/source-control-rest-api.html#automatic-role-assignment) |  |  |  | **user:email**<br>**read:user** |  |

**Supported SCM Authentication**  
For enhanced security and following industry best practices, basic authentication (username and password) is either deprecated or not recommended for most Source Control Management (SCM) providers. We recommend using secure alternatives such as Personal Access Tokens (PATs), OAuth, or SSH keys for authenticating with your SCM systems.

### Dealing with SCM API rate limits

When an SCM system's API interacts with Nexus IQ, the SCM system enforces some form of limitation on the volume and frequency of interaction with their APIs; GitHub appears to be the most restrictive. GitHub limits API requests to 5000 per hour per user and specifies at least a one-second delay between requests. As the number of applications that IQ Server manages increases, the workload demanded of the SCM API also increases. This translates to a delay between, for example, the time the workload is initially processed and the time before a comment is added to a pull request.

Since the SCM system API limitations are per user, organizations with hundreds or thousands of repositories should create multiple users/access tokens and use different tokens for different sub-organizations in IQ Server. This allows IQ Server to perform more work in parallel with the SCM system. The additional tokens must be for distinct SCM users — multiple tokens for the same user will not help since the API rate limits apply at the user level and not the token level. A reasonable starting point would be one user/token for every 500 repositories.

### Troubleshooting

**Special Characters in Repository Names**  
Sonatype has special character restrictions on repository names for security reasons. The special characters that are restricted include:

/ : \ ~ & % ; @ ' " ? < \> \| # $ \* } { , + \] \[  
The repository names cannot start with an underscore ( \_ ), start or end with a period (.), or be a system reserved name.  
Some SCM providers do not have similar restrictions and allow special characters in repository names. This could lead to errors during onboarding the applications from the SCM system such as the example below:

```  
SourceControl repositoryUrl is invalid: Invalid project URL. Project URL cannot contain any of the characters: ;$!*&|()[]<>.  
```