Compliance Glossary for Confluence

How do I trace GitHub code to requirements?

Yes, by declaration rather than automatic capture. An administrator declares a code_reference node with the GitHub URL. They declare an implements link to the requirement node. Another administrator approves both. From the requirement, Forward impact shows the code. From the code, Reverse provenance shows the requirement. Git Connector itself only runs terminology checks.

Last verified against production v6 · 24 October 2026

At a glance

InputCurrent actionOutputBoundary
Approved GitHub repositoryConfigure Repository, Confluence space, and Allowed pathsReport-only terminology scan scopeThe connector does not create code nodes or requirement links.
Connector scanSelect Scan by requestRecent asynchronous jobs and Git terminology findingsAdd as draft creates a glossary draft, not a trace link.
GitHub file or commit URLDeclare trace node with type code_referenceCandidate code node with your referenceThe app does not fetch, capture, or hash the revision.
Code node and requirement nodeDeclare trace link with relation implements and an Evidence referenceCandidate trace linkCandidates are excluded from traversal.
Candidate node or linkAnother administrator selects Approve with a Review reasonGoverned node or linkFour-eyes: the declarer cannot approve it.
Approved start nodeChoose it in Start node, select Show trace graphCode and requirement hopsRequirement is upstream of code.
Missing endpoint or truncated graphReview Coverage blockersExplicit incomplete-coverage reasonPartial paths are not complete trace coverage.

How it works

  1. Open Terminology Baseline and scroll to Enterprise evidence workspace.
  2. Use Declare trace node: type code_reference, a title, the GitHub URL in External reference or URL, and a reason.
  3. Use Declare trace link: the code node as From node, the requirement as To node, relation implements.
  4. Ask another administrator to approve in Trace nodes awaiting approval and Trace links awaiting approval.
  5. In Trace graph, choose the requirement in Start node and select Show trace graph.
  6. Select Forward impact to see the code, or start from the code node and select Reverse provenance.
  7. Check Coverage blockers before relying on the result.

Example

A payment service contains authorizePayment at a fixed commit. An administrator declares a code_reference node with the commit permalink and an implements link to the authorization requirement. A second administrator approves both. Forward impact from the requirement now lists the code hop.

What this does not mean

Production runs a report-only GitHub connector, with scans by request. Backend code that maps GitHub revisions into trace evidence exists, but nothing in production calls it. The code node stores the URL you entered, not a hashed revision. Only approved or imported links qualify as governed evidence.

Related questions

Next step

Declare code nodes with exact commit permalinks and have a second administrator approve them before relying on the trace.

View on Atlassian Marketplace
Verification basis: production v6 code, tests, manifest, and operations guidance. Verified 24 October 2026.