GitHub

Connect GitHub repositories to Safeguard. The permissions each token needs, which token types work, and step-by-step setup for GitHub.com and GitHub Enterprise Server.

What it does

The GitHub card connects Safeguard to repositories on GitHub.com, GitHub Enterprise Cloud or your own GitHub Enterprise Server. Safeguard lists the repositories a token can see, and each repository you select (at a branch or tag) becomes a project that Safeguard clones and scans for an SBOM and findings. With write access, Safeguard can also open fix and upgrade pull requests, comment on pull requests and set a commit status for the quality gate. Find the card under Integrations on the Project/Product tab.

Public vs private

	Public	Private
What you enter	One or more public repository URLs, like `https://github.com/user/repo`	Where GitHub runs, and a personal access token
Credential needed	None	A personal access token
What you can scan	The public repositories you add by URL	Every repository the token can read

Supported auth methods

Method	Use it when	Notes
Fine-grained personal access token	Recommended default	Scoped to one owner and to the repositories you pick, with read-only permissions unless you want fix pull requests
Personal access token (classic)	Your organization blocks fine-grained tokens, or you use GitHub Enterprise Server without them	Broader than needed: the `repo` scope grants read and write to every private repository you can access
None (Public tab)	Public repositories only	Nothing to create

A GitHub App installation and "Sign in with GitHub" (OAuth) are not available. The dialog takes a personal access token only.

Permissions required

For scanning, Safeguard only reads. It writes to GitHub only for the optional features marked below, and only when you use them.

Fine-grained personal access token

Repository permissions:

Permission	Required?	What Safeguard uses it for
Metadata: Read-only	Required	Listing your repositories, reading repository details and tags. GitHub adds it to every fine-grained token
Contents: Read-only	Required	Listing branches, reading files, and cloning the repository for the scan
Contents: Read and write	Optional	Fix and upgrade pull requests: creating the branch and committing the changed files. Also merging a pull request from Safeguard
Pull requests: Read and write	Optional	Opening fix pull requests, requesting reviewers and adding labels, reading changed files, and posting pull request reviews and comments
Commit statuses: Read and write	Optional	The Quality gate commit status (`safeguard/code-analysis`) on pull requests

Least privilege: Metadata (Read-only) and Contents (Read-only), with Repository access set to Only select repositories.

Personal access token (classic)

Scope	Required?	What Safeguard uses it for
`repo`	Required for private repositories	Listing, reading and cloning private repositories. GitHub has no read-only classic scope for private repositories, so this also covers fix pull requests, comments and commit statuses
`public_repo`	Alternative to `repo`	Enough when the token only needs public repositories (for example, to open fix pull requests on them)
`read:org`, `admin:repo_hook`, `write:repo_hook`, `workflow`	Not needed	Safeguard does not list organizations or create webhooks, and fix pull requests do not edit workflow files

Least privilege: use a fine-grained token instead. A classic token always reaches every repository you can access.

Token types

Token type	Works?	Notes
Fine-grained personal access token	Yes (recommended)	Pick the organization that owns the repositories as Resource owner. If the organization requires approval, the token stays pending and can only read public resources until an owner approves it
Personal access token (classic)	Yes	For an organization that uses SAML single sign-on, authorize the token for that organization (Configure SSO, then Authorize) or GitHub refuses it
GitHub App or OAuth app	Not available yet
GitHub Actions `GITHUB_TOKEN`	No	It exists only inside a workflow run
A token for a machine user or service account	Yes	A fine-grained or classic token of a dedicated GitHub account works the same way. Give that account read access to the repositories

Expiry: choose an expiry such as 90 days. When the token expires, scans and repository listing fail until you paste a new one in the connection.

What we never need: admin or organization scopes, webhook scopes, Actions, Secrets, Administration, deleting repositories, or write access of any kind when you only scan.

Step-by-step setup

Create the credential in GitHub

Fine-grained token:

Select your profile picture, then Settings > Developer settings > Personal access tokens > Fine-grained tokens.
Click Generate new token, enter a Token name and choose an Expiration.
Under Resource owner, choose the account or organization that owns the repositories. If the organization requires approval, add a justification.
Under Repository access, choose Only select repositories and pick the repositories, or choose all repositories of that owner.
Under Permissions, set Contents to Read-only (Metadata is added automatically). Add the optional write permissions from the table above only if you want fix pull requests or the quality gate.
Click Generate token and copy it. GitHub shows it only once.

Classic token:

Select your profile picture, then Settings > Developer settings > Personal access tokens > Tokens (classic).
Select Generate new token, then Generate new token (classic).
Enter a Note, choose an Expiration, and select the repo scope (or public_repo for public repositories only).
Click Generate token and copy it.
If the repositories belong to an organization with SAML single sign-on, go back to Personal access tokens, click Configure SSO next to the token, and click Authorize next to the organization.

On GitHub Enterprise Server the same pages are on your server, under your profile's Settings > Developer settings.

Or with the GitHub CLI

GitHub has no CLI command that creates a personal access token. Create it in the web pages above, then check what it can see:

# Who the token belongs to
GH_TOKEN=<token> gh api user --jq .login
# A classic token's scopes (the X-OAuth-Scopes header; fine-grained tokens have none)
GH_TOKEN=<token> gh api -i user | grep -i '^x-oauth-scopes'
# The repositories it can list, as Safeguard lists them
GH_TOKEN=<token> gh api "user/repos?visibility=all&per_page=100" --jq '.[].full_name'
# GitHub Enterprise Server: add --hostname github.example.com to each command

Connect it in Safeguard

Open Integrations and choose the Project/Product tab.
Click Connect on the GitHub card.
For public repositories, stay on Public, enter a Name, paste each URL under Enter a public URL and click Add. Then click Next.
For private repositories, choose Private and enter a Name (and an optional Description).
Under Where does GitHub run?, keep GitHub.com (this includes GitHub Enterprise Cloud), or choose GitHub Enterprise Server and enter its Server URL, such as https://github.example.com. For GitHub Enterprise Cloud with data residency (an address under ghe.com), keep GitHub.com, click Edit and enter your address.
Paste the token into Access Token and click Check. "Access token validated successfully" means GitHub accepted it.
Click Next, select the repositories and the branch or tag of each, and finish with the Connect button. Its menu offers Connect: Fast scan (quicker), Connect: Deep scan (full) and Connect: Progressive scan (fast now, full depth after).

A GitHub Enterprise Server must be reachable from the internet over a public address. Safeguard does not send a token to private or internal addresses.

Webhooks and triggers

This integration has no webhooks to set up. Each selected repository is scanned when you connect it. To rescan new commits, set a schedule under Integrations > Scheduled, or choose Rescan from the connection's menu under Project Configurations.

What we read and store

Read: your login and repository list, repository details, branches and tags, and the contents of each selected repository at the chosen branch or tag. For pull request features, the pull request, its changed files and its comments.
Stored: the connection's settings, the repositories you selected, the SBOM and findings of each scan, and the token, which is encrypted at rest with a per-workspace key and never shown again after you save it.
Not stored: source code. The scanner makes a shallow clone into a temporary folder and deletes it when the scan ends.
No customer data from this integration is sent to third-party LLMs.

Troubleshooting

Message you see	Cause	Fix
`Invalid or expired access token`	GitHub refused the token: it is mistyped, expired or revoked, a fine-grained token is still pending approval, or a classic token is not authorized for the organization's SAML single sign-on	Create a new token, ask an organization owner to approve it, or authorize it with Configure SSO
`Failed to validate access token`	Safeguard could not reach GitHub, often a GitHub Enterprise Server address that is wrong or not reachable from the internet	Check the Server URL and that the server is reachable from outside your network
`Enter Server URL.`	GitHub Enterprise Server is chosen but no address is entered	Enter the server address, or choose GitHub.com
`This server address isn't allowed: ...`	The server address is private, internal or contains a user name and password	Use the server's public https address
`Invalid repository URL`	A URL on the Public tab is not a public GitHub repository, or the repository is private	Copy the URL from the repository page, or connect it on the Private tab
`No credentials configured for GITHUB. Please provide a personal access token to create PRs. ...`	A fix pull request was requested on a public connection	Connect the repository on the Private tab with a token that has write access
`git clone failed: ...` (on a scan)	The token lost access to the repository, or the branch or tag no longer exists	Check the token's repository access and expiry, then update the connection

Rotation and disconnect

Rotate: create a new token with the same permissions. Under Project Configurations on the Project/Product tab, open the connection's menu, choose Update, paste the new token into Access Token, click Check, and click Save Changes. Then delete the old token in GitHub (Settings > Developer settings > Personal access tokens).
Disconnect: choose Delete from the connection's menu under Project Configurations and confirm Delete configuration. Then delete the token in GitHub.

Vendor references

Managing your personal access tokens, checked 2026-10-16.
Permissions required for fine-grained personal access tokens, checked 2026-10-16.
Scopes for OAuth apps, checked 2026-10-16.
Authorizing a personal access token for use with single sign-on, checked 2026-10-16.
Getting started with the REST API (GitHub Enterprise Server), checked 2026-10-16.
gh auth token, checked 2026-10-16.

GitHub

On this page