How cix gets your code

cix needs to read your repository before it can index it, and there are three ways to arrange that. Only the first involves installing anything on GitHub.

Pick one per repository. You can use different paths for different repos on the same account, and you can move a repo from one to another later.

The three paths

Path	What it needs	Reindexes when	Team can share it
GitHub App	The cix App authorized on your account or org	You push	Yes
Private index	Nothing beyond being signed in	You run `cix index --push`	No
One-off token	A GitHub credential you supply at run time	You run the command again	No

Recommended — the GitHub App, if the repository is on GitHub and you can authorize it. It is the only path that reindexes on its own and the only one your teammates can read from.

GitHub App

You authorize the cix App once and choose which repositories it may see. After that, pushing is the whole workflow: cix notices the push and reindexes, so the index tracks the branch without you running anything.

This is the path the rest of the docs assume unless they say otherwise.

Full walkthrough: Connect GitHub. Managing which repos it can see: GitHub App permissions.

Private index

If you can't install the App — an org that won't approve it, a repository that isn't on GitHub at all, a client's code you'd rather not connect — you can build the index locally and upload it as your own private index:

shell

$ cix index --push

cix reads the tracked files in your working tree, sends them to be parsed, and the resulting index is yours privately. No App installation is involved, and git is only ever read — your remotes, branches, commits and tags are untouched.

This changes where cix reads your code from, not whether it is sent: the contents reach the cix cloud either way. See What leaves your machine.

The trade-off is that nothing reindexes on its own. Run cix index --push again when you want the index to catch up, and add --full to rebuild from scratch rather than from what changed.

Note — a private index is yours alone. Sharing a repo's index with teammates needs the App installed by someone who owns the repository.

Full walkthrough: Index without GitHub.

One-off token

For a repository no cix App installation covers, you can hand cix a GitHub credential for a single run:

shell

$ cix index --github-token

The flag takes no value. cix reads the token from your environment or prompts for it with hidden input, uses it once to clone, and never stores it — so it stays out of your shell history and out of the process list.

Which one should I use?

Your own repo, on GitHub, you can authorize apps — GitHub App.
Work repo, org hasn't approved the App yet — private index now, App later when approval lands. Moving over is just authorizing the App.
Not on GitHub, or not going onto GitHub — private index.
A repo you need indexed once, not continuously — one-off token.

Already covered by a teammate

If someone who owns the repository has the App installed, their index already covers it and you read from theirs — there is nothing for you to index or push. cix init tells you when this is the case.

Next: Connect GitHub, or Index without GitHub.