GitHub Permissions
The permissions required to successfully connect the GitHub adapter depend on the authentication method you use. In addition, some permissions are required only for fetching specific asset types.
Permissions for Authenticating with an Authorization Token
For all asset types except for Secrets, Alerts/Incidents, and Application Settings
Roles:
- The Security Manager role is required to fetch Aggregated Security Findings
Repository Permissions:
- Administration - Read-only
- Codespaces metadata - Read-only
- Commit statuses - Read-only
- Contents - Read-only
- Metadata - Read-only
- Pull requests - Read-only
Account permissions:
- Email addresses - Read-only
- Gists - Read-only
- Profile - Read-only
For Fetching Secrets
Repository Permissions:
- Codespaces secrets - Read-only
- Secrets - Read-only
Account permissions:
- GPG keys - Read-only
- Git SSH keys - Read-only
- SSH signing keys - Read-only
For Fetching Alerts/Incidents
Repository AND Account permissions:
- Code scanning - Read-only
- Secret scanning - Read-only
For Fetching Application Settings and Licenses
The 'Plan - Read-only' Account permission is required.
Permissions for Authenticating with a GitHub App
Grant the GitHub App only the permissions you need. All read permissions are set to Read-only. Metadata is mandatory for every GitHub App.
Always Required
These permissions are required to fetch users, organizations, and repositories.
| Scope | Permission | Access | Used For |
|---|---|---|---|
| Repository | Metadata | Read-only | Repositories, tags, contributors, and collaborators |
| Organization | Members | Read-only | Members and roles, teams, outside collaborators, and SAML/SCIM identities |
| Organization | Administration | Read-only | Installed apps (Extensions) |
| Organization | Personal access tokens | Read-only | Personal access tokens as Secrets. Not required if you turn off this setting. |
| Organization | Plan | Read-only | Organization plan for Licenses |
Required Only When an Advanced Setting Is Enabled
| Advanced Setting | Scope | Permission | Access |
|---|---|---|---|
| Fetch code and secret scanning alerts | Repository | Code scanning alerts | Read-only |
| Repository | Secret scanning alerts | Read-only | |
| Repository | Contents | Read-only (CodeQL databases) | |
| Fetch repository vulnerabilities | Repository | Dependabot alerts | Read-only |
| Fetch repository commits, last login per user, SBOM, or default branches | Repository | Contents | Read-only |
| Fetch branch rules | Repository | Administration | Read-only (branch protection) |
| Fetch repository runners | Repository | Administration | Read-only |
| Fetch user repository SSH keys | Repository | Administration | Read-only (deploy keys) |
| Fetch repository workflows | Repository | Actions | Read-only |
| Fetch Issues | Repository | Issues | Read-only |
| Fetch Projects V2 | Organization | Projects | Read-only |
| Repository | Issues and Pull requests | Read-only (to read project item content) | |
| Copilot license (SaaS Management) | Organization | GitHub Copilot Business | Read-only (together with Organization Administration - Read-only) |
Required for Enforcement Actions
These permissions require write access and are needed only if you use the actions.
| Enforcement Action | Scope | Permission | Access |
|---|---|---|---|
| GitHub - Create Issue and GitHub - Update Issue | Repository | Issues | Read and write |
| GitHub - Add issues to projects | Organization | Projects | Read and write |
Account permissions apply only to user-to-server tokens, so they are not required for a GitHub App. Set all other permissions that are not listed here to No access.
Updated 4 days ago