GitHub Recommendations

[Wood_ Jeremy]

Hello,

Our company is looking to integrate our GitHub repositories and are looking for an addon to accomplish this. We started with the free app but had several security concerns with the app listed below. So we are asking the community if anyone knows of an app they would recommend that addresses these concerns. 

1. Once enabled the default app becomes available on all projects within the company. We can limit the app by controlling what projects contain the custom field connected to the app. But ideally we would rather be able to select specific projects to have the addon. 
2. There is no option to disable smart commits, which means someone without access to a Jira project could potentially transition issues via commit messages in GitHub.
3. : Any user can create a branch from the Jira Development panel, even if they don’t have access to the corresponding GitHub repository or don’t exist in GitHub.
4. We want to link only certain repositories to specific Jira projects. The free Atlassian plugin links all repositories to all projects. Meaning anyone could get access to a repository they shouldn't be involved in.

Any recommendations/advice are appreciated. 

[Aron Gombas _Midori_]

@Wood_ Jeremy I am not very familiar with all the options out there, but the "most mature" app to integrate Git repos (including GitHub ones) to Jira is Git Integration.

I would definitely check this first, if it is a better fit than the free one.

[Diana_Architect_ZigiWave]

@Wood_ Jeremy , hi.  You’re running into several common limitations of the free GitHub for Jira app, especially around project-level controls and repository scoping. Unfortunately, the native app works at the organization level, which means you can’t granularly restrict which projects or repositories it applies to — and this leads to exactly the issues you listed:

• The app becomes available across all Jira projects once enabled

• Smart commits can’t be disabled per project

• Branch creation from the Jira Development panel isn’t permission-aware

• All connected repositories become visible to all linked Jira projects

For teams with stricter security requirements, the usual workaround is to create separate GitHub organizations or separate Jira instances, but that’s not ideal and often adds unnecessary overhead.

If you need more fine-grained control — such as linking only certain repositories to specific Jira projects, restricting branch creation, or ensuring only authorized users can trigger transitions — you’ll need a solution that supports project-level and repository-level scoping instead of a global configuration.

Some teams solve this with a dedicated integration layer rather than relying on the free app. One example (mentioned occasionally in the community) is ZigiOps, which allows you to control exactly which Jira projects sync with which GitHub repositories and avoids the permission-related issues you described. It’s not the only option, but it’s one that supports the level of control you're looking for. If you're interested in exploring it as an integration option, feel free to book a demo or start a free trial. 

Regards, D.

[Dr_ Ankita Mehta-OpsHub_ Inc]

Hi @Wood_ Jeremy

The native GitHub–Jira connector is great for quick setups but limited when it comes to governance and access control. A few things to think about before you pick an alternative:

• Repository-level control: Look for a solution that lets you explicitly choose which GitHub repos link to which Jira projects, not a blanket connection across the instance.
• Smart commit restrictions: Ensure you can disable or limit smart commits so only authorized users can transition issues.
• User mapping and permissions: The tool should validate users across both systems to prevent unauthorized commits or issue updates.
• Auditability: Check that all commits, pull requests, and issue transitions are fully traceable, with visibility into who did what and when.

In your case, you may want to explore OpsHub Integration Manager (OIM) -a no-code, plugin-free, bi-directional sync platform. It runs outside both systems, supports granular project-repo mapping, and preserves full context (attachments, comments, commit history) without relying on scripts. As an Atlassian Solution Partner, OpsHub helps teams integrate GitHub and Jira securely while maintaining data integrity and compliance. You might want to see the Atlassian Marketplace listing on GitHub Jira integration .

Hope it helps!:)

[Javier Pozuelo -Exalate-]

Hi @Wood_ Jeremy, I’m the Community Manager at Exalate.

Those are pretty common concerns with the built-in GitHub integration, it links everything to every project, you can have issues restricting smart commits, and controlling which repos connect to which Jira projects.

If you need a little bit more control, you’ll probably want a connector that lets you pick exactly which repos sync to which projects and doesn’t expose everything by default. Exalate is one option here: it only syncs what you explicitly configure, and you can keep each repo connected to just the Jira projects you choose, without the smart-commit side effects.

If you have any questions regarding Exalate, feel free to reach out to the Exalate community.

Good luck with the integration!