GitHub integration
GitHub access changes,
recorded and verifiable.
Governax records access changes from GitHub into a tamper-evident ledger: organisation membership, team and repository access, branch protection changes and code-security alerts. It connects through a GitHub App whose every permission is read-only, and appends each change to a per-entity, SHA-256 hash-chained record.
What lands in the ledger
What does Governax record from GitHub?
Organisation membership
Members added, removed and invited, and users blocked or unblocked.
Teams
Team membership changes, teams created, edited and deleted, and team access to repositories.
Repository access
Collaborators added and removed, permission changes, repositories made public or private, and deploy keys.
Repository lifecycle
Repositories created, deleted, archived, unarchived, renamed and transferred.
Guardrails
Branch protection rules and rulesets created, edited and deleted.
Code movement and reviews
Force-pushes, branch deletions, pull request merges, review approvals and dismissed reviews.
Code security
Secret scanning, code scanning and Dependabot alerts, and changes to security features.
Access tokens
Personal access token requests created, approved, denied and cancelled.
Not captured: Ordinary pushes, pull request opens, updates and comments, and cosmetic repository edits such as description or topic changes are not recorded. File contents, diffs and commit messages are never fetched or stored.
How does the GitHub connection work?
You install the Governax GitHub App on your organisation, which normally means being an organisation owner. You register nothing yourself. Choose all repositories or a selected list; with all repositories, a repository created later is covered automatically.
Governax confirms that the person installing actually controls the installation before saving anything, which prevents someone attaching your organisation to their own Governax entity. Events then arrive by webhook, typically within seconds.
No token is stored. Tokens are minted per operation from Governax's own app registration. Disconnecting uninstalls the app from your organisation, and events already recorded stay in the ledger.
The baseline snapshot on connect
When you connect, Governax walks the organisation's current members and records each one it has not seen before as an access.baseline_observed event. Where a member's role changed while Governax was not looking, it records access.role_changed with reconciled: true. GitHub sends no webhook when someone is promoted to organisation owner, so reconnecting is currently how that change is caught.
Scope
What Governax does not do
Governax is a system of record, not a control plane. It records GitHub access changes after they have happened; it does not grant, revoke or block anything.
It requests no write permission
Every repository and organisation permission is read-only. Governax cannot change your repositories, merge anything or alter settings.
It does not read your code
The Contents permission is used for push metadata only: which branch, whether it was a force-push, whether a branch was deleted.
It does not block changes
Events arrive after a change has taken effect in GitHub. Governax records changes; it cannot prevent one.
It does not guess emails
GitHub webhooks carry account logins, never email addresses, so Governax stores what GitHub sent. Filter GitHub activity by actor login.
How this helps with audits
When an auditor asks who had access in GitHub and when it changed, the answer is a filtered view of the ledger rather than a folder of screenshots. Approvals are recorded for access requests raised with /governax in Slack. Filters combine tool, event type, actor and a date range, and the date range matches when the change happened in GitHub, not when Governax recorded it.
Because a baseline snapshot is taken when you connect, the record starts from who already had access, not only from the changes that followed.
Every event is appended to the entity's SHA-256 hash chain, and database triggers reject every update and delete. Anyone given read access to the entity, an auditor included, can re-run verification, which recomputes every hash and checks every link.
Verification proves that what was recorded has not changed. It cannot prove that everything that happened was recorded. Governax records the evidence; it does not map it to controls, perform the audit or export reports.
Questions
GitHub integration FAQ
Does Governax need write access to GitHub?
No. Every repository and organisation permission the Governax GitHub App requests is read-only. Governax cannot change your repositories, merge anything or alter settings.
Does Governax read our source code?
No. The Contents permission is used for push metadata only: which branch was pushed to, whether it was a force-push, and whether a branch was deleted. File contents, diffs and commit messages are never fetched or stored.
Why do GitHub events have no email addresses?
GitHub webhooks carry account logins and never email addresses, so Governax stores what GitHub actually sent rather than guessing. Filter GitHub activity by actor login.
How are organisation owner promotions recorded?
GitHub emits no webhook when someone is promoted to organisation owner. The change is detected by comparing a fresh membership snapshot against history, which happens at connect and reconnect, so periodically reconnecting is currently the only way to catch it.
What does disconnecting GitHub do?
Disconnecting uninstalls the app from your organisation, which is a real uninstall rather than a local flag. Events already recorded remain in the ledger.
Other integrations
- SlackWorkspace membership, channels, external sharing and access requests
- OktaUsers, groups, app assignments and admin roles
- Google WorkspaceUsers, groups, admin roles and third-party app grants
- AWSIAM users, roles and policies, read from CloudTrail
- Microsoft Entra IDDirectory roles, group membership and app consent
- GitLabGroup and project membership, tokens and deploy keys
Connect GitHub and start the record.
Read the GitHub setup guide, compare plans, or start free with one entity.