Connectors GitHub
GitHub
GitHub is two connectors. GitHub reads one organisation on github.com, GitHub Enterprise Cloud or GitHub Enterprise Server. GitHub (Personal) reads the repositories one person owns. How the connect flow works is on How connectors work.
Who can do it
Connecting needs connections:manage (Manage connections), held by Owner, Admin and Fleet operator. Reading the connector needs connections:read.
Connect an organisation
- Go to Collection › Connectors and choose Connect on GitHub.
- Give the connection a Name, then sign in with one of two methods:
- Install the Oxelone app on GitHub. GitHub opens its own install screen. This method is offered once a global admin has registered the app.
- Fine-grained personal access token. Paste the token into the password field and name the Organisation beside it. The hint reads "Scoped to one organisation, which you name beside it."
- Optional: API base. It defaults to
https://api.github.com. The hint reads "GitHub Enterprise Server: https://HOSTNAME/api/v3. Data residency: https://api.SUBDOMAIN.ghe.com." A connection through Oxelone's app uses the address the app was installed against; bring your own token to reach a self-hosted host. - Optional: add Organisation owner's classic token, a classic personal access token with
read:audit_log. It unlocks Audit events on GitHub Enterprise Cloud. - Continue through Check and Rules, then choose Create connection.
On GitHub's side
- To install the app, GitHub's own steps are: open the install link, choose your personal account or an organisation you belong to, choose All repositories or selected ones, review the permissions and click the button. Organisation owners can install apps on their organisation. A member who cannot install can ask: GitHub tells the owner instead.
- To make a fine-grained token: profile picture › Settings › Developer settings › Personal access tokens › Fine-grained tokens › Generate new token. Under Resource owner, select the organisation. If the organisation must approve tokens, the token stays
pendinguntil an organisation administrator approves it.
Vendor documentation: https://docs.github.com/en/apps/using-github-apps/installing-a-github-app-from-a-third-party and https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens
What it reads
| Records | What you get |
|---|---|
| Members | People in the organisation, their role, and whether they use two-factor authentication. |
| Outside collaborators | People with repository access who are not members. |
| Teams | Teams, their visibility and their default repository permission. |
| Repositories | Every repository: visibility, archive state, default branch and its security settings. |
| Branch protection | The protection on each repository's default branch. |
| Rulesets | Organisation and repository rulesets, their enforcement and who may bypass them. |
| Secrets | Actions secrets by name and scope. Values are never read. |
| Workflows | Actions workflows and whether each is active. |
| Actions settings | Which actions may run and what a workflow token may do, for the organisation and each repository. |
| Dependabot alerts | Open Dependabot alerts across the organisation. |
| Code scanning alerts | Open code scanning alerts across the organisation. |
| Secret scanning alerts | Open secret scanning alerts and whether each secret is still valid. |
| Security configurations | Code security configurations and what each enables. |
| Organisation roles | Organisation roles and how many users and teams hold each. |
| Installed apps | GitHub Apps installed on the organisation and how much they may do. |
| Copilot seats | Who holds a Copilot seat and when they last used it. |
| Copilot policies | The organisation's Copilot settings: public-code suggestions, chat, CLI and seat management. |
| Copilot metrics | The latest 28-day usage report. |
| Copilot content exclusions | Paths Copilot is told not to read, per repository. |
| Audit events | The organisation's audit log, fetched forward from a cursor. |
| Deploy keys | Deploy keys on each repository and whether each may write. |
| Files | The files an inspection reads on each repository's default branch, by path and size, up to five hundred per repository. Contents are fetched for an inspection and never stored. |
Files kept are manifests and agent files: requirements.txt, package.json, pyproject.toml, Cargo.toml, go.mod, CLAUDE.md, AGENTS.md, SKILL.md, .cursorrules, and anything under .github/workflows/ or .claude/.
What it can do
Each action is something a policy can run on a matching record. All need write access on the matching GitHub permission.
| Action | Consequence | Reversible |
|---|---|---|
| Remove from organisation | They lose access to every repository and team in the organisation. | No |
| Remove outside collaborator | They lose access to every repository they were invited to. | No |
| Convert to outside collaborator | They leave every team and keep only the repositories they were given directly. | No |
| Remove Copilot seat | Their Copilot access ends at the end of the billing cycle. | Yes |
| Delete secret | Workflows that read this secret stop working; the value cannot be recovered. | No |
| Archive repository | The repository becomes read-only for everyone until it is unarchived. | Yes |
| Make repository private | The repository stops being visible outside the organisation. | Yes |
| Disable Actions | No workflow in this repository runs until Actions is enabled again. | Yes |
| Enable secret scanning and push protection | GitHub scans this repository for secrets and blocks pushes that contain one. | Yes |
| Dismiss Dependabot alert | The alert is closed as tolerable risk with a note naming Oxelone. | Yes |
| Delete deploy key | Anything that used this key to reach the repository loses access. | No |
| Block user | They cannot open issues, pull requests or comments in the organisation until unblocked. | Yes |
What it checks
Eleven posture checks and two inspections.
| Rule | Pack | Severity | Action offered |
|---|---|---|---|
| Member without two-factor authentication | Posture check | High | None |
| Public repository | Posture check | Medium | Make repository private |
| Default branch without protection | Posture check | Medium | None |
| Secret scanning or push protection off | Posture check | High | Enable secret scanning and push protection |
| Actions may run any third-party workflow | Posture check | Medium | None |
| Workflows get write access by default | Posture check | Medium | None |
| Copilot may suggest public code | Posture check | Medium | None |
| Copilot CLI enabled | Posture check | Low | None |
| Copilot seat unused for 90 days | Posture check | Low | Remove Copilot seat |
| Open critical Dependabot alert | Posture check | High | None |
| Organisation secret shared with every repository | Posture check | Low | None |
| Secret in a repository file | Inspection | High | None |
| Prompt injection in an agent definition | Inspection | High | None |
What it needs to be Readable
The app or token needs these GitHub permissions. Reads need read, actions need write.
- Organisation permissions: Members, Administration, Secrets, Custom organization roles, GitHub Copilot Business, Organization Copilot metrics, Copilot content exclusion, Blocking users.
- Repository permissions: Metadata, Administration, Secrets, Actions, Contents, Secret scanning alerts, Dependabot alerts, Code scanning alerts.
Some kinds depend on the plan:
- Code scanning alerts need GitHub Advanced Security.
- Audit events need GitHub Enterprise Cloud and the Organisation owner's classic token.
- The Copilot kinds need GitHub Copilot.
A kind your credential cannot reach shows Not readable with the reason on the Check step. See How connectors work.
Sync period
All four periods are offered. 15 min is withheld when the organisation has more than 50 repositories.
Connect your own repositories
GitHub (Personal) reads one person's repositories on github.com.
- Sign in with Install the Oxelone app on GitHub as yourself (hint: "When GitHub asks where to install, choose yourself rather than an organisation."), or a Fine-grained personal access token ("Scoped to you; the repositories it may read are chosen when the token is created.").
- It reads Repositories, Files, Dependabot alerts, Code scanning alerts and Secret scanning alerts.
- Actions: Archive repository, Make repository private, Disable Actions, Enable secret scanning and push protection, Dismiss Dependabot alert.
- Rules: Secret scanning or push protection off, Open critical Dependabot alert, and the two inspections.
When it goes wrong
| What you see | What it means |
|---|---|
| The GitHub app this platform is registered with cannot prove who installed it. | Oxelone's GitHub App is not yet set up to confirm who installed it, so the connection is refused. Connect with your own credential instead, or write to support@oxelone.com. |
| This organisation is too large for a 15-minute period. | More than 50 repositories. Pick a longer period. |
With the API
Not available with an API key.