Skip to main content

​
About GitHub

The GitHub connector reads repository metadata, branch protection, team membership, organization settings, audit logs, and related security configuration from your GitHub organization. That data appears in Iru Compliance as artifacts you can map to actions and controls. The integration is read-only. Iru does not open pull requests, change settings, or modify repositories beyond what the GitHub API allows for the scopes you grant.

​
How It Works

Iru calls the GitHub REST API using a personal access token (PAT) sent as a Bearer token:
Fine-grained PATs (recommended) let you scope repositories and permissions narrowly. Classic PATs work but are broader and harder to least-privilege. If your organization enforces SAML SSO, you must authorize the PAT for the organization after you create it, or API calls for org-level data will fail. Official references: Managing personal access tokens, REST authentication, and Rate limits.

​
Prerequisites

  • GitHub access as a member (or owner) of the organization you want Iru to read.
  • Owner access on that organization if you need audit logs and org-wide security settings (depending on what your compliance program expects).
  • A PAT with read permissions aligned to the tables below (fine-grained PAT shown).
Minimum fine-grained PAT permissions (typical) Adjust upward only if your controls require additional read scopes.

​
Connect GitHub to Iru

​
Create a fine-grained personal access token

1

Open Developer settings

Sign in to GitHub. Select your profile picture → Settings → Developer settings → Personal access tokens → Fine-grained tokens.
2

Create a new token

Select Generate new token.
3

Set name, expiration, and resource scope

Set a clear name (for example Iru Compliance) and an expiration (fine-grained PATs can run up to 366 days - set a reminder to rotate early). Under Resource owner, choose your organization when you need organization-level data. Under Repository access, choose All repositories or only what compliance covers.
4

Set repository and organization permissions

Under Permissions, enable at least the repository and organization read permissions listed under Prerequisites above.
5

Generate and copy the token

Generate the token and copy it immediately. It is shown once.
6

Authorize for SAML SSO (if required)

If your org uses SAML SSO, open Settings → Developer settings → Personal access tokens, find the token, select Configure SSO, and Authorize it for your organization.

​
Complete the connector in Iru

1

Open Sources

In Iru Compliance, on the left navigation bar, expand Compliance and select Sources.
Left navigation: Compliance expanded, Sources selected
2

Turn on GitHub

Find GitHub (use Category or Search by name or description). On that card, turn on the toggle. A new tab opens the connector wizard.
3

Paste the personal access token

When you see the bearer token step, paste your PAT into the Token field and submit.
4

Finish the connection

Click Submit Bearer Token. When the connection succeeds, the wizard shows Connection Configured.
5

Confirm the source is Active

Close the Iru is requesting access to external services browser tab, then return to Compliance → Sources and confirm the GitHub card is Active.

​
Troubleshooting

Check pop-up blocker settings for the Iru site and try again.
Confirm the PAT was copied in full, has not expired, and was not revoked.
For org-wide reads, the PAT’s resource owner must be the organization - not only your personal account. Create a new PAT if needed.
Authorize the PAT for SAML SSO (see Create a fine-grained personal access token).
Regenerate the PAT with the repository and organization permissions your controls require.
Authenticated REST requests share GitHub’s rate limits (see GitHub’s docs). Iru batches work within those limits; sustained spikes can delay sync.

​
Considerations

Prefer fine-grained PATs with the smallest…

Prefer fine-grained PATs with the smallest repository set and read scopes that still satisfy your controls.

Rotate PATs before expiry and update the connector…

Rotate PATs before expiry and update the connector so evidence collection does not stall.

Iru reads metadata and configuration exposed by the…

Iru reads metadata and configuration exposed by the APIs you allow - it does not bypass GitHub permissions your org enforces.

Sources Management

Browse and manage every Compliance source.

Getting Started With Compliance

Frameworks, actions, and Artifacts.

Iru Overview

How Endpoint, Compliance, and Identity fit together.

Artifacts Management

Upload, review, and organize evidence from sources and actions.