GitHub Sensor

What it ingests

Repository activity — issues, pull requests, commits, and code-review activity — across a single organization or an explicit list of repositories.

Credential

The GitHub sensor references a github_token credential by id. Create one with a Personal Access Token that has read access to the org/repos you want to ingest:

• Classic PAT — repo scope (or public_repo for public repos only).
• Fine-grained PAT — read-only access to Contents, Issues, Pull requests, and Metadata on the target repositories. A missing permission surfaces as a 403 naming the permission that's absent.

curl -sS -X POST https://your-corveil-host/api/credentials \
  -H "Authorization: Bearer <admin>" -H "Content-Type: application/json" \
  -d '{"type":"github_token","name":"acme-github-ro","secret":"ghp_..."}'

Copy the returned credential id.

Config fields

Key	Required	Notes
org	one of org / repos	Organization login, e.g. radiusmethod.
repos	one of org / repos	Comma-separated owner/name list, e.g. acme/api, acme/web.

Provide either an organization or an explicit repo list (or both).

Provider-side setup

1. Create the PAT at GitHub → Settings → Developer settings → Personal access tokens.
2. Grant it read access to the org or repositories above.
3. If the org enforces SSO, authorize the token for the org.

Wire-up

POST /api/sensors

{
  "sensor_type": "github",
  "name": "Acme GitHub",
  "config": { "org": "acme" },
  "credentials": { "token": "<github_token credential id>" }
}

To scope to specific repos instead:

{
  "sensor_type": "github",
  "name": "Acme API + Web",
  "config": { "repos": "acme/api, acme/web" },
  "credentials": { "token": "<github_token credential id>" }
}

Verify

Use Test connection on the sensor (or watch the first poll). A healthy sensor reports events flowing; a credential problem surfaces as an auth failure with the missing scope/permission named.