GitHub

GitHub Actions

The GitHub Actions scraper creates configuration items from GitHub Actions workflows. Specify the owner, repository, and branch to scrape.

github-actions.yaml
apiVersion: configs.flanksource.com/v1
kind: ScrapeConfig
metadata:
  name: github-actions-scraper
spec:
  githubActions:
    - owner: flanksource
      repository: config-db
      connection: connection://default/github-pat
      branch: main

By default the last 7 days of workflow runs are fetched. Change that with the scrapers.githubactions.maxAge system property.

Field	Description	Scheme	Required
owner	GitHub repository owner	string	true
repository	GitHub repository name	string	true
personalAccessToken	Personal access token for authentication	EnvVar
connection	Connection name used to populate personalAccessToken	string
workflows	Workflows to scrape. When empty, all workflows are scraped	[]string
status	Only return workflow runs with this check run status or conclusion e.g. success, in_progress	string
actor	Only return workflow runs for this user. Use the login of the user who created the push associated with the run	string
branch	Only return workflow runs associated with this branch	string

GitHub Repository

The GitHub Repository scraper creates GitHub::Repository config items and optionally fetches security alerts (Dependabot, code scanning, secret scanning) and OpenSSF Scorecard data as analyses.

github.yaml
apiVersion: configs.flanksource.com/v1
kind: ScrapeConfig
metadata:
  name: github
spec:
  schedule: '@every 6h'
  github:
    - security: true
      openssf: true
      permissions:
        enabled: true
      repositories:
        - owner: flanksource
          repo: duty
      # rulesets needs organization Administration write access; settings and
      # apps need Administration read access; members needs Members read access.
      organizations:
        - name: flanksource
          settings: true
          rulesets: false
          apps: true
          members: true

Field	Description	Scheme	Required
repositories	List of repositories to scrape	[]GitHubRepository	true
organizations	Organizations to scrape for settings, installed apps and membership	[]GitHubOrganization
personalAccessToken	Personal access token for authentication	[]EnvVar
connection	Connection name for GitHub credential	string
security	Enable Dependabot, code scanning, and secret scanning alerts	bool
openssf	Enable OpenSSF Scorecard data	bool
permissions	Collect repository collaborator and team access	Permissions
commits	Collect commit metadata from each repository's default branch	Commits
securityFilters	Filters for security alerts	SecurityFilters

GitHubRepository

Field	Description	Scheme	Required
owner	GitHub repository owner	string	true
repo	Exact repository name or comma-separated collections.MatchItems patterns. Pattern selectors skip archived repositories.	string	true
topics	Filter repositories by GitHub topic. A repository is included when at least one positive pattern matches; negated patterns take precedence. If all patterns are negated, a repository is included when none of its topics match an exclusion	MatchExpressions

GitHubOrganization

Repository owners are always attached to their organization, but only organizations listed here are scraped beyond their name.

Field	Description	Scheme	Required
name	Organization login e.g. acme	string	true
settings	Collect organization security and policy settings: 2FA requirement, default repository permission, member repository and page creation policy, Advanced Security / Dependabot / secret scanning defaults, Actions permissions, custom organization roles and code security configurations	bool
rulesets	Collect organization repository rulesets	bool
apps	Collect installed GitHub App installations	bool
members	Collect organization members and their organization role, teams, team membership and team to repository grants	bool

Required token scopes

settings and apps require organization administration read access, rulesets requires organization administration write access (even though the API operation is read-only), and members requires organization members read access.

Permissions

Field	Description	Scheme
enabled	Map effective collaborators and repository teams to external users, groups, roles, and config access records	bool

Commits

Field	Description	Scheme
enabled	Enable commit collection	bool
maxAge	Only collect commits newer than this duration. Defaults to 30d	string

Repository selectors

Use repository selectors when you want one GitHub scraper to discover multiple repositories for the same owner. The repo field supports exact names, * wildcards, comma-separated patterns, and ! exclusions from collections.MatchItems.

The following example discovers matching repositories for flanksource, mixes selector and exact entries, and deduplicates overlapping matches per GitHub scraper config.

github-repo-selectors.yaml
apiVersion: configs.flanksource.com/v1
kind: ScrapeConfig
metadata:
  name: github-repo-selectors
spec:
  schedule: '@every 6h'
  github:
    - repositories:
        # Repo selectors use collections.MatchItems syntax and are resolved
        # against all visible, non-archived repositories for the owner.
        - owner: flanksource
          repo: config-db,mission-control
        # Overlapping selectors are deduped per GitHub scraper config.
        - owner: flanksource
          repo: '*control'
        # Topic filters use MatchItems syntax and further restrict repo matches.
        # Negated topic matches take precedence over positive matches.
        - owner: flanksource
          repo: '*'
          topics:
            - kubernetes
            - '!deprecated'
        # Exact repositories can be mixed with selectors.
        - owner: flanksource
          repo: duty

SecurityFilters

Field	Description	Scheme
severity	Filter alerts by severity (e.g. critical, high)	[]string
state	Filter alerts by state (e.g. open, fixed)	[]string
maxAge	Only include alerts newer than this duration (e.g. 7d, 24h)	string