Connect GitHub

The Workspace reads your GitHub organization (or personal account) with an access token. With it, Leavory maps repositories, branches, technologies, packages and their vulnerabilities, and commit history, on the same screens as Azure DevOps.

Leavory only reads. Every call is a read: no write permission is needed, and Leavory doesn’t change code, workflows or permissions.

Azure DevOps, GitHub or both

A tenant can connect Azure DevOps, GitHub or both. Everything lands in the same Code & Pipelines screens, the same dashboard and the same vulnerability view, whatever platform each team uses. To connect Azure DevOps, see Connect Azure DevOps.

Token permissions

Use a fine-grained personal access token with these settings:

Setting	Value
Resource owner	The organization Leavory will read (or your user, for a personal account)
Repository access	All repositories (or Only select repositories, to limit what Leavory sees)

And only these permissions, all set to Read-only:

Permission (as shown on GitHub)	What Leavory reads with it
Repository → Metadata	The organization and its repositories (always on, read-only)
Repository → Contents	Files (Dockerfile, package manifests), branches and commits
Repository → Actions	Workflows and their runs
Repository → Administration	Branch protection rules
Organization → Members	Teams and their members, for the access inventory

Classic token

A classic token also works, with the repo and read:org scopes. Prefer the fine-grained token: it is limited to one organization and to read access.

Organization approval

Some organizations require an owner to approve fine-grained tokens. If the token stays Pending, ask an owner of the organization to approve it under Settings → Personal access tokens → Pending requests.

Create the token

1. On GitHub, click your avatar (top right) → Settings → Developer settings → Personal access tokens → Fine-grained tokens.

2. Click Generate new token and fill in:

   Field	Value
   Token name	leavory-workspace
   Resource owner	the organization Leavory will read
   Expiration	whatever your company policy allows. Note the date so you can rotate it in time
   Repository access	All repositories
   Permissions	the permissions above, all set to Read-only

3. Click Generate token and copy the token right away. GitHub doesn’t show the value again.

Which user should create the token

The token sees only what the user who created it can see. Repositories that user can’t access are left out of Leavory.

Ideally, use a dedicated machine user that is a member of the organization with read access to the repositories Leavory should map. That way the inventory doesn’t depend on one person’s account, and access doesn’t change when someone switches teams or leaves the company.

Set it up in the Workspace

1. In the Workspace, open Settings → GitHub tab.

2. Fill in Organization or user (the name in github.com/<organization>) and Access token.

3. Click Test connection. Leavory tests each permission and shows the result:

   Check	Permission tested
   Owner (organization or user)	Metadata (Read)
   Repositories	Repository access + Metadata (Read)
   Repository contents	Contents (Read)
   Actions workflows and runs	Actions (Read)
   Branch protection	Administration (Read)
   Teams and members	Members (Read), for organizations only

4. With every check passing, click Save. Leavory detects whether the name is an organization or a user and shows it in the GitHub card next to the form.

The test doesn’t save anything. With a token already saved, leaving the field blank tests the saved one.

Discovery starts on its own and repeats on the repository interval of Settings → Discovery (every 60 minutes by default). To run it now, open Code & Pipelines → Projects, click Discover repositories and pipelines and pick GitHub.

Test messages

Message	What to do
Missing permission: <permission>	Edit the token on GitHub and set the permission shown to Read-only
The access token was rejected (invalid, expired, or revoked)	Wrong, expired or revoked token. Create a new one
"<name>" was not found on GitHub	Check the organization or user name
Token accepted, but it cannot see any repository of <name>	The token’s resource owner or repository access doesn’t cover this organization, or the token is still pending approval
GitHub returned an error (HTTP 403): rate limit exceeded, try again later	The token used up its hourly GitHub quota. Try again later
Could not reach GitHub from Leavory	Temporary network failure. Try again in a few minutes

Rotate the token

Fine-grained tokens expire. Before the expiration date:

1. On GitHub, open the token and click Regenerate token (or create a new one with the same permissions).
2. In Settings → GitHub, paste the new token, click Test connection and then Save.
3. Delete the old token on GitHub, if it wasn’t regenerated.

To stop reading the organization, click Disconnect in Settings → GitHub and delete the token on GitHub.