GitHub
Connect GitHub: authentication, permissions, what Noru collects, and troubleshooting.
- Authentication
- GitHub App
- Categories
- Repository, Security
- Sync cadence
- Daily by default (hourly, weekly, or monthly on request)
- Requested access
Metadata: ReadAdministration (repository): ReadPull requests: ReadIssues: ReadActions: ReadCode scanning alerts: ReadSecret scanning alerts: ReadDependabot alerts: ReadRepository security advisories: ReadMembers: ReadAdministration (organization): ReadSelf-hosted runners: ReadProjects: Read
Noru connects to GitHub as a GitHub App installed on your organization. You choose which repositories the installation covers, and Noru mints a short-lived installation token for each sync. The App never requests the Contents permission, so it cannot read source code.
What Noru collects
| Evidence type | Evidence | Read from |
|---|---|---|
| Repository | GitHub Repository, one per repository | Repository details |
| Policy | GitHub Access Control (collaborators and teams); GitHub Repository Settings (default branch protection) | Collaborators, teams, branch rules |
| Scan result | GitHub Security Scanning, only when alerts exist | Code scanning and Dependabot alerts |
| Configuration | GitHub Security Configuration | Whether secret scanning is on or off |
| Procedure | Workflow Automation; Pull Request Workflow | Workflow runs, pull requests |
| Log | Issue Tracking | Issues |
Each repository becomes an asset with the external id github:repo: plus its
full name. Collaborator emails become personnel identities in the
people directory. Findings cover
Dependabot and code scanning alerts plus derived checks: public repositories
(medium), repositories without CI/CD workflows (low), unprotected default
branches (high). Evidence maps to IAM, asset, secure lifecycle, change,
vulnerability, and configuration management controls.
What Noru does not collect
- File contents. The App does not request Contents and no contents call is made.
- Branches. Listing them needs Contents, so it is skipped deliberately.
- Secret or variable values, and the contents of secret-scanning alerts. Only the on or off status of secret scanning is stored.
- Organization membership. No organization-level calls are made.
The App also requests permissions the sync never uses: Secret scanning alerts, Repository security advisories, and the organization-level Members, Administration, Self-hosted runners, and Projects. You are granting more than Noru reads.
Before you connect
- Owner permission on the GitHub organization, or an installation approval from an owner.
- A decision on which repositories to include. You can pick all or a subset on GitHub's install screen.
- Popups allowed for the Noru app origin.
- Admin or editor role in Noru.
Connect
The GitHub user token used for that verification is not persisted. The resulting integration is named "GitHub - Noru Collector" and syncs daily, regardless of what you typed in Integration name and Sync frequency; rename it and change the frequency from the detail drawer afterwards.
After connecting
The first sync reads every repository the installation covers; changing the selection on GitHub is picked up on the next sync. Findings land in Findings and assets in Assets. If the App is uninstalled, the next sync marks the source Disconnected with "GitHub App installation not found. The app may have been uninstalled from the organization."
Permissions in detail
| Permission | Why Noru needs it | What it could technically allow |
|---|---|---|
| Metadata: Read | Repository list and details | Read repository metadata for every covered repository |
| Administration (repository): Read | Collaborators, teams, branch rules | Read repository settings and access lists |
| Pull requests: Read | Pull request workflow evidence | Read all pull requests, including descriptions |
| Issues: Read | Issue tracking evidence | Read all issues and comments |
| Actions: Read | Workflow runs | Read workflow run history and logs metadata |
| Code scanning alerts: Read | Security scanning evidence and findings | Read every code scanning alert |
| Dependabot alerts: Read | Security scanning evidence and findings | Read every Dependabot alert |
| Secret scanning alerts: Read | Not used by the sync | Read secret scanning alert contents |
| Repository security advisories: Read | Not used by the sync | Read draft advisories |
| Members, Administration (organization), Self-hosted runners, Projects: Read | Not used by the sync | Read organization members, settings, runners, and projects |
Collaborator emails are resolved through the users endpoint with the installation token, which returns only what each user has made public.
Troubleshooting
- "Popup blocked. Please allow popups for this site." Allow popups and retry.
- "Installation window closed. Please try again if the installation did not complete." The popup closed before GitHub confirmed the installation.
- "GitHub installation is already connected to another organization" means this installation id belongs to a different Noru organization; install the App on a separate GitHub organization or delete the other connection.
- "You do not have access to this GitHub installation" means the signed-in GitHub user cannot see the installation; sign in as an organization owner.
- "No repositories available for sync. Please check your GitHub App installation." The installation covers zero repositories.
Related
Last updated on