Connect GitHub

Before you start

You need the GitHub organisation owner admin rights described below, and in Trusterio the right to manage integrations (owners and admins have it). Anybody else sees the page read-only.

Connect it

1. Open Automation and choose Connect on the GitHub organisation owner card. (The link opens the dialog straight away.)
2. Give it a name under What to call it, and read What to grant: every permission and what it is for.
3. Press Add it and enter the credential. You land on the connection’s own page.

Trusterio connects a GitHub organisation. A personal account cannot be connected: members, two-factor and repositories are read through the organisation, and GitHub offers the organisation permissions only for one.

Create the token

1. Signed in as an organisation owner, create a fine-grained personal access token in GitHub. Choose the organisation as Resource owner, not your own account: only then are the organisation permissions offered. Give it all repositories or the ones in scope. If your organisation requires approval for tokens, approve it under the organisation’s settings.
2. Organisation permissions: Members: Read-only and Administration: Read-only. In GitHub’s newer screen, press Add permissions to find them.
3. Repository permissions: Metadata, Administration and Dependabot alerts, all Read-only.

A classic token would need the repo scope, which can write. Use a fine-grained one. A GitHub App is not supported.

In Trusterio

Fill in Organisation login, the name in your organisation’s GitHub address (acme-inc in github.com/acme-inc), and the Personal Access Token, and press Save credentials.

What it checks

• Branch protection on the default branch, required reviews, required status checks, rules that apply to admins too
• Two-factor authentication required in the organisation. This one needs the token’s owner to be an organisation owner; otherwise it says it cannot tell.
• Secret scanning and Dependabot switched on; no public repositories. On GitHub Free, private repositories have no branch protection, and secret scanning on them needs GitHub Secret Protection: those checks say so rather than fail.

After it is connected

• Press Sync now for the first reading. The Tests tab shows each check: what it should be, what was found, and what is affected.
• New connections are read by hand until you choose a schedule: in Monitoring, on the Collection tab, pick Every hour, Every 6 hours, Daily or Weekly.
• The page says when it was last read and its health; Sync History keeps every run.

A connection marked Beta on the Automation screen has not been tried on a real account yet: its permission list is our reading of the provider’s documentation. AWS, Azure, Google Cloud and Jira have been. If a permission is wrong, tell us.

Disconnect

On the connection’s page, choose Disconnect. Reading stops and its credentials are deleted; its history, checks and evidence stay. Then remove what you created at the provider:

• Revoke the token in GitHub.