Skip to main content
In this recipe, you configure Custodian to review pull requests in one upstream GitHub repository for evidence-supported effects on one downstream repository. The job posts its findings as a source-control review. For this first setup, you use Review only so Custodian does not change downstream code.

​
Before you start

You need:
  • An Account Admin role in Sidecar
  • Permission to install or configure GitHub apps for the relevant organizations
  • One upstream GitHub repository that receives changes
  • One different downstream GitHub repository that may depend on those changes
  • The standard Sidecar Data GitHub app connected to the downstream repository
  • The Custodian GitHub app installed with access to the upstream repository
Both repositories must use github.com.

​
Configure the GitHub integrations

1

Connect the downstream repository

In Sidecar, select Integrations → GitHub.If the standard Sidecar Data GitHub app is not connected, click Link Sidecar Data and grant it access to the downstream repository.
2

Install Custodian for the upstream repository

On the same GitHub integration page, find Custodian and click Manage access in GitHub.Install or configure the Custodian GitHub app with access to the upstream repository. If GitHub shows an approval request, ask an organization administrator to approve it.Return to Sidecar and confirm that the Custodian installation lists the upstream repository as accessible.

​
Subscribe the upstream repository

1

Open Custodian settings

Select Agents → Custodian, then click Settings.
2

Bind the upstream repository

Under Scope → Subscribed repositories, find the upstream repository and click Bind.You can use Bind all accessible when every accessible repository should be available as a Custodian upstream.Confirm that the repository shows as bound and accessible.

​
Duplicate the Custodian template

1

Open the preset catalog

Return to the Custodian page and click From preset.
2

View the template

Find Review changes for downstream impacts and click View template.The template is read-only and never runs directly.
3

Create an operational copy

Click Duplicate. Sidecar creates an inactive custom copy and opens its configuration page.
Immutable Custodian downstream-impact review template with Duplicate button

Duplicate the immutable template to create a configurable Custodian job.

​
Configure the review job

1

Name the job

Use a name that identifies the repository relationship, such as API changes → analytics impact review.Add a description that helps Account Admins recognize the job in the Console.
2

Review the instructions

Keep the default instructions for the first job. Add only constraints specific to this upstream and downstream relationship.
3

Select upstream and downstream

Under Scope, select:
  • Upstream repository — the repository you bound to Custodian
  • Downstream repository — the different repository connected through the standard Sidecar GitHub integration
Save the scope.
4

Choose review behavior

Under Review behavior, select Review only.Leave Suppress no-findings comments off for the first test. This lets you confirm that the workflow ran even when it finds no downstream impact.After validating the workflow, you can choose Draft PR when a safe fix is verified.
5

Check readiness

Confirm that the readiness panel marks the upstream and downstream repositories ready.Knowledge Store and Context Garage checks are informational. They do not block activation.
6

Activate the job

Switch the job to Active.Sidecar allows only one active Custodian downstream-impact job for a given upstream repository. If activation fails, pause the existing job or choose another upstream.

​
Test the workflow

1

Open or update an upstream pull request

Create a safe test pull request in the upstream repository, or push a new commit to an existing test pull request.Custodian starts from the GitHub pull-request webhook. This job does not have Run now.
2

Follow the run

Open Agents → Console and select the Custodian run. Review the evidence, findings, and delivery status.
3

Review the GitHub result

Return to the upstream pull request and find the Custodian review comment.With Review only, Custodian does not change downstream code. If you later enable draft remediation, review any downstream draft pull request before merging.

​
Maintain the job

  • Pause the job before changing a repository binding.
  • Restore GitHub app access if readiness reports an inaccessible repository.
  • Use Retry when the same pull-request snapshot should run again.
  • Use Run again when the upstream head or downstream base branch has moved.