Connect GitHub
A fine-grained token with read access to the repositories that hold your scripts, and what a manifest adds.
Scripts, Apps Script projects and SQL that live in a repository are automations too. A repository connection reads the code and, when there is one, a manifest that describes it.
The token
Create a fine-grained personal access token in GitHub (Settings → Developer settings → Fine-grained tokens) with Contents: read on the repositories that hold the scripts, and nothing else. One token per repository is the tidiest; the shell gives each its own variable.
In the workspace, choose GitHub repository, enter owner/name, paste the token, and say what runs there (apps_script, python or bigquery). The repository's name names the system.
What a scan finds
Without a manifest, the collector scans the code for the CRM fields it names. Every edge it finds is a claim: it is marked inferred, lands in a review queue rather than the confirmed graph, and is drawn dashed in the structure until someone confirms it. Precision comes from the vocabulary: a name is only emitted if the graph already knows that property exists on that object, so a scan for email does not produce an edge in every file that mentions the word.
Confirm or reject inferred edges from the command line:
tanglemap review --tenant <workspace id> tanglemap review --tenant <workspace id> --confirm 12 14 --reject 13
What a manifest adds
An automation.yaml at the root of the repository is the highest-fidelity input there is, because nothing is inferred. It names each automation, its trigger, and the fields it reads and writes. A manifest with a lint block can be checked against the code it describes, so a write added in code without a manifest entry fails in CI instead of quietly disappearing from the graph; an automation without one ingests as parsed, one rung of confidence below declared. The repository ships an example, examples/automation.yaml.
Keeping it current
Repositories are re-collected daily. Hosted, a push re-collects at once: connecting a repository mints a webhook secret, and a GitHub webhook pointed at the workspace's hook address with that secret does the rest.