> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.
# GitHub
> Connect GitHub to Iru Compliance with a personal access token to collect repository inventory, branch protection, organization membership, and audit logs.
### About GitHub
The **GitHub** connector reads repository metadata, branch protection, team membership, organization settings, audit logs, and related security configuration from your **GitHub organization**. That data appears in Iru Compliance as artifacts you can map to actions and controls. The integration is **read-only**. Iru does not open pull requests, change settings, or modify repositories beyond what the GitHub API allows for the scopes you grant.
### How It Works
Iru calls the GitHub REST API using a **personal access token (PAT)** sent as a **Bearer** token:
```http theme={null}
Authorization: Bearer github_pat_XXXX
```
**Fine-grained PATs** (recommended) let you scope repositories and permissions narrowly. **Classic PATs** work but are broader and harder to least-privilege.
If your organization enforces **SAML SSO**, you must **authorize** the PAT for the organization after you create it, or API calls for org-level data will fail.
| Detail | Value |
| ------------------ | --------------------------------------------------------------------------------------------------------- |
| **Category** | Developer tools / source control |
| **Authentication** | Bearer token (fine-grained or classic PAT) |
| **GitHub plan** | Compatible with GitHub Free, Team, or Enterprise (subject to GitHub’s own API and audit-log availability) |
Official references: [Managing personal access tokens](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens), [REST authentication](https://docs.github.com/en/rest/authentication/authenticating-to-the-rest-api), and [Rate limits](https://docs.github.com/en/rest/using-the-rest-api/rate-limits-for-the-rest-api).
### Prerequisites
* GitHub access as a member (or owner) of the organization you want Iru to read.
* **Owner** access on that organization if you need audit logs and org-wide security settings (depending on what your compliance program expects).
* A PAT with **read** permissions aligned to the tables below (fine-grained PAT shown).
**Minimum fine-grained PAT permissions (typical)**
| Area | Permissions |
| ---------------- | ------------------------------------------------------------------- |
| **Repository** | **Contents** (read), **Metadata** (read), **Administration** (read) |
| **Organization** | **Members** (read), **Administration** (read) |
Adjust upward only if your controls require additional read scopes.
### Connect GitHub to Iru
#### Create a fine-grained personal access token
Sign in to GitHub. Select your profile picture → **Settings** → **Developer settings** → **Personal access tokens** → **Fine-grained tokens**.
Select **Generate new token**.
Set a clear **name** (for example **Iru Compliance**) and an **expiration** (fine-grained PATs can run up to **366 days** - set a reminder to rotate early). Under **Resource owner**, choose your **organization** when you need organization-level data. Under **Repository access**, choose **All repositories** or only what compliance covers.
Under **Permissions**, enable at least the repository and organization **read** permissions listed under **Prerequisites** above.
Generate the token and copy it immediately. It is shown once.
If your org uses **SAML SSO**, open **Settings** → **Developer settings** → **Personal access tokens**, find the token, select **Configure SSO**, and **Authorize** it for your organization.
#### Complete the connector in Iru
In Iru Compliance, on the left navigation bar, expand **Compliance** and select **Sources**.
Find **GitHub** (use **Category** or **Search by name or description**). On that card, turn on the **toggle**. A new tab opens the connector wizard.
When you see the bearer token step, paste your PAT into the **Token** field and submit.
Click **Submit Bearer Token**. When the connection succeeds, the wizard shows **Connection Configured**.
Close the **Iru is requesting access to external services** browser tab, then return to **Compliance** → **Sources** and confirm the **GitHub** card is **Active**.
### Troubleshooting
Check **pop-up blocker** settings for the Iru site and try again.
Confirm the PAT was copied in full, has not expired, and was not revoked.
For org-wide reads, the PAT’s **resource owner** must be the organization - not only your personal account. Create a new PAT if needed.
Authorize the PAT for SAML SSO (see **Create a fine-grained personal access token**).
Regenerate the PAT with the repository and organization permissions your controls require.
Authenticated REST requests share GitHub’s rate limits (see GitHub’s docs). Iru batches work within those limits; sustained spikes can delay sync.
### Considerations
Prefer **fine-grained PATs** with the smallest repository set and read scopes that still satisfy your controls.
Rotate PATs before expiry and update the connector so evidence collection does not stall.
Iru reads metadata and configuration exposed by the APIs you allow - it does not bypass GitHub permissions your org enforces.
### Related Articles
Browse and manage every Compliance source.
Frameworks, actions, and **Artifacts**.
How Endpoint, Compliance, and Identity fit together.
Upload, review, and organize evidence from sources and actions.