GitHub Integration
Connect GitHub to measure cost per PR, track AI vs manual code, and attribute AI spend to shipped work.
Install the GitHub App
CostLens uses a GitHub App — no OAuth tokens, no manual webhook setup.
- Go to Settings → GitHub or complete onboarding
- Click Install GitHub App — redirects to GitHub
- Select your organization and grant access to repos
- GitHub redirects back — CostLens stores your
installationIdand fetches available repos - Select which repos to track (limited by plan)
No OAuth tokens stored. Auth uses GitHub App installation tokens that rotate automatically.
What Gets Tracked
| Event | Data Captured |
|---|---|
| PR opened | Branch, author, linked AI session + cost |
| PR merged | Cycle time, files changed, additions/deletions |
| Review submitted | Reviewer, state (approved/changes requested), review rounds |
| Commits pushed | Commit count per PR, used for throughput metrics |
AI Detection
CostLens automatically detects AI-assisted PRs by matching active coding sessions to PR branches. When a developer has a tracked AI session on the same branch as an opened PR, the cost is attributed.
You can manually override detection using the AI/Manual toggle on any PR in the dashboard.
Cost Per PR
The key metric: how much AI spend went into shipping each pull request.
Cost per PR = total AI session spend attributed to that branch
Cycle time = time from PR opened → merged
First review = time from PR opened → first review
Permissions
The CostLens GitHub App requests:
- Pull requests — read (track PRs and reviews)
- Contents — read (commit metadata only, not file contents)
- Metadata — read (repo names, branches)
Webhook events subscribed:
pull_request— opened, closed, synchronizepull_request_review— submittedpull_request_review_comment— created
No write permissions. All webhook deliveries are signed with HMAC-SHA256 and verified server-side.
Backfill
On first install, CostLens backfills recent PR history using installation tokens (parallelized, batches of 5 repos):
- Free plan — last 14 days
- Pro plan — last 90 days
- Business plan — last 180 days
A daily cron re-syncs all connected users to catch any missed webhook events.