Add opt-out signals to a repository

If your images live in a Git repository, you can scan them for the opt-out field and open one reviewable request that swaps files missing the field for marked copies: a pull request on GitHub or a merge request on GitLab. This does not prevent copying or guarantee that AI systems will honor the field.

1. Connect your repository provider

On the dashboard, open Connectors, choose GitHub or GitLab, and connect the account that can access the repository. GitHub uses a GitHub App installation: choose only the repositories you want to expose. The alpha currently supports repositories owned by the personal GitHub account that installs the App; organization-owned repositories are not supported yet. The App asks for Contents read/write, Pull requests write, and GitHub’s baseline Metadata read at installation because the same installation supports both scanning and the Raise PR action. NoAI Shield narrows each short-lived token to one repository: scan tokens are read-only, and write permission is included only after you click Raise PR. The App does not request email or private-profile permission.

GitLab initially asks only for read_repository and does not request your GitLab profile, name, or email. GitLab does not offer a per-project selector for its repository OAuth scopes: the read scope, and the separately requested write_repository scope, apply to every project the connected account can access. NoAI Shield nevertheless reads or writes only the repository URL you explicitly submit and never scans automatically. Disconnecting from the connector page or Account → Connected services removes the saved connection.

Public repositories can be scanned without connecting. Private scans require the matching provider connection with read access; opening a review request requires write access to that repository.

2. Scan

Open Scan repository, select GitHub or GitLab, paste the repository link, and scan. Supported images within the scan limits are checked for the machine-readable opt-out field. Results show Signal present or No signal found.

Each paid account can start up to 10 repository scans per day. A separate service-wide emergency ceiling of 250 repository scans per day can temporarily pause new scans for everyone. That ceiling protects launch infrastructure and is not an additional per-user allowance. The images checked in repository and website workflows also count toward the account’s 50,000 actual image checks per month.

3. Open the pull or merge request

When a scan finds images without the field, a provider-aware panel appears above the results. It offers a pull request for GitHub or a merge request for GitLab. The first time you choose the GitLab action, a separate authorization asks for account-wide repository write access; GitLab does not provide a per-project selector for that scope. NoAI Shield does not request GitLab’s broad API or profile scopes and uses the write credential only for the repository and action you explicitly submit. After you approve the provider’s required write permission and click the action, the server:

1. downloads the flagged images,
2. runs each through the standard image-marking pipeline,
3. commits the marked copies to a new noai-shield/mark-images-* branch (re-encoded files are renamed to match their real format), and
4. opens one pull or merge request against the default branch.

No review request or file replacement runs on its own: the request exists only because you clicked, and your team reviews and merges it like any other change. Large sets are capped per run (the panel reports what was left out); merge and run again to cover the rest.

Notes

• The pull- or merge-request body lists every file swapped and links back to the dashboard.
• Re-encodes are handled: a hero.webp that comes back as PNG lands as hero.png with the old file removed in the same commit.
• Without GitHub App credentials configured (keyless development), the GitHub flow runs end to end with provider writes simulated and clearly labeled as a sandbox run.